1/******************************************************************************
2 *
3 *  Copyright (C) 2004-2012 Broadcom Corporation
4 *
5 *  Licensed under the Apache License, Version 2.0 (the "License");
6 *  you may not use this file except in compliance with the License.
7 *  You may obtain a copy of the License at:
8 *
9 *  http://www.apache.org/licenses/LICENSE-2.0
10 *
11 *  Unless required by applicable law or agreed to in writing, software
12 *  distributed under the License is distributed on an "AS IS" BASIS,
13 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 *  See the License for the specific language governing permissions and
15 *  limitations under the License.
16 *
17 ******************************************************************************/
18
19/******************************************************************************
20 *
21 *  This file contains action functions for advanced audio/video main state
22 *  machine.
23 *
24 ******************************************************************************/
25
26#include "bt_target.h"
27#if defined(BTA_AV_INCLUDED) && (BTA_AV_INCLUDED == TRUE)
28
29#include <string.h>
30#include "bta_av_api.h"
31#include "bta_av_int.h"
32#include "avdt_api.h"
33#include "utl.h"
34#include "l2c_api.h"
35#include "osi/include/list.h"
36#if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
37#include "bta_ar_api.h"
38#endif
39
40#define LOG_TAG "bt_bta_av"
41#include "osi/include/log.h"
42
43/*****************************************************************************
44**  Constants
45*****************************************************************************/
46/* the timer in milliseconds to wait for open req after setconfig for incoming connections */
47#ifndef BTA_AV_SIG_TIME_VAL
48#define BTA_AV_SIG_TIME_VAL 8000
49#endif
50
51/* In millisec to wait for signalling from SNK when it is initiated from SNK.   */
52/* If not, we will start signalling from SRC.                                   */
53#ifndef BTA_AV_ACP_SIG_TIME_VAL
54#define BTA_AV_ACP_SIG_TIME_VAL 2000
55#endif
56
57static void bta_av_acp_sig_timer_cback (TIMER_LIST_ENT *p_tle);
58
59/*******************************************************************************
60**
61** Function         bta_av_get_rcb_by_shdl
62**
63** Description      find the RCB associated with the given SCB handle.
64**
65** Returns          tBTA_AV_RCB
66**
67*******************************************************************************/
68tBTA_AV_RCB * bta_av_get_rcb_by_shdl(UINT8 shdl)
69{
70    tBTA_AV_RCB *p_rcb = NULL;
71    int         i;
72
73    for (i=0; i<BTA_AV_NUM_RCB; i++)
74    {
75        if (bta_av_cb.rcb[i].shdl == shdl && bta_av_cb.rcb[i].handle != BTA_AV_RC_HANDLE_NONE)
76        {
77            p_rcb = &bta_av_cb.rcb[i];
78            break;
79        }
80    }
81    return p_rcb;
82}
83#define BTA_AV_STS_NO_RSP       0xFF    /* a number not used by tAVRC_STS */
84
85/*******************************************************************************
86**
87** Function         bta_av_del_rc
88**
89** Description      delete the given AVRC handle.
90**
91** Returns          void
92**
93*******************************************************************************/
94void bta_av_del_rc(tBTA_AV_RCB *p_rcb)
95{
96    tBTA_AV_SCB  *p_scb;
97    UINT8        rc_handle;      /* connected AVRCP handle */
98
99    p_scb = NULL;
100    if(p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
101    {
102        if(p_rcb->shdl)
103        {
104            /* Validate array index*/
105            if ((p_rcb->shdl - 1) < BTA_AV_NUM_STRS)
106            {
107                p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
108            }
109            if(p_scb)
110            {
111                APPL_TRACE_DEBUG("bta_av_del_rc shdl:%d, srch:%d rc_handle:%d", p_rcb->shdl,
112                                  p_scb->rc_handle, p_rcb->handle);
113                if(p_scb->rc_handle == p_rcb->handle)
114                    p_scb->rc_handle = BTA_AV_RC_HANDLE_NONE;
115                /* just in case the RC timer is active
116                if(bta_av_cb.features & BTA_AV_FEAT_RCCT && p_scb->chnl == BTA_AV_CHNL_AUDIO) */
117                    bta_sys_stop_timer(&p_scb->timer);
118            }
119        }
120
121        APPL_TRACE_EVENT("bta_av_del_rc  handle: %d status=0x%x, rc_acp_handle:%d, idx:%d",
122            p_rcb->handle, p_rcb->status, bta_av_cb.rc_acp_handle, bta_av_cb.rc_acp_idx);
123        rc_handle = p_rcb->handle;
124        if(!(p_rcb->status & BTA_AV_RC_CONN_MASK) ||
125            ((p_rcb->status & BTA_AV_RC_ROLE_MASK) == BTA_AV_RC_ROLE_INT) )
126        {
127            p_rcb->status = 0;
128            p_rcb->handle = BTA_AV_RC_HANDLE_NONE;
129            p_rcb->shdl = 0;
130            p_rcb->lidx = 0;
131        }
132        /* else ACP && connected. do not clear the handle yet */
133        AVRC_Close(rc_handle);
134        if (rc_handle == bta_av_cb.rc_acp_handle)
135            bta_av_cb.rc_acp_handle = BTA_AV_RC_HANDLE_NONE;
136        APPL_TRACE_EVENT("end del_rc handle: %d status=0x%x, rc_acp_handle:%d, lidx:%d",
137            p_rcb->handle, p_rcb->status, bta_av_cb.rc_acp_handle, p_rcb->lidx);
138    }
139}
140
141
142/*******************************************************************************
143**
144** Function         bta_av_close_all_rc
145**
146** Description      close the all AVRC handle.
147**
148** Returns          void
149**
150*******************************************************************************/
151static void bta_av_close_all_rc(tBTA_AV_CB *p_cb)
152{
153    int i;
154
155    for(i=0; i<BTA_AV_NUM_RCB; i++)
156    {
157        if ((p_cb->disabling == TRUE) || (bta_av_cb.rcb[i].shdl != 0))
158            bta_av_del_rc(&bta_av_cb.rcb[i]);
159    }
160}
161
162/*******************************************************************************
163**
164** Function         bta_av_del_sdp_rec
165**
166** Description      delete the given SDP record handle.
167**
168** Returns          void
169**
170*******************************************************************************/
171static void bta_av_del_sdp_rec(UINT32 *p_sdp_handle)
172{
173    if(*p_sdp_handle != 0)
174    {
175        SDP_DeleteRecord(*p_sdp_handle);
176        *p_sdp_handle = 0;
177    }
178}
179
180/*******************************************************************************
181**
182** Function         bta_av_avrc_sdp_cback
183**
184** Description      AVRCP service discovery callback.
185**
186** Returns          void
187**
188*******************************************************************************/
189static void bta_av_avrc_sdp_cback(UINT16 status)
190{
191    BT_HDR *p_msg;
192    UNUSED(status);
193
194    if ((p_msg = (BT_HDR *) GKI_getbuf(sizeof(BT_HDR))) != NULL)
195    {
196        p_msg->event = BTA_AV_SDP_AVRC_DISC_EVT;
197        bta_sys_sendmsg(p_msg);
198    }
199}
200
201/*******************************************************************************
202**
203** Function         bta_av_rc_ctrl_cback
204**
205** Description      AVRCP control callback.
206**
207** Returns          void
208**
209*******************************************************************************/
210static void bta_av_rc_ctrl_cback(UINT8 handle, UINT8 event, UINT16 result, BD_ADDR peer_addr)
211{
212    tBTA_AV_RC_CONN_CHG *p_msg;
213    UINT16 msg_event = 0;
214    UNUSED(result);
215
216#if (defined(BTA_AV_MIN_DEBUG_TRACES) && BTA_AV_MIN_DEBUG_TRACES == TRUE)
217    APPL_TRACE_EVENT("rc_ctrl handle: %d event=0x%x", handle, event);
218#else
219    APPL_TRACE_EVENT("bta_av_rc_ctrl_cback handle: %d event=0x%x", handle, event);
220#endif
221    if (event == AVRC_OPEN_IND_EVT)
222    {
223        /* save handle of opened connection
224        bta_av_cb.rc_handle = handle;*/
225
226        msg_event = BTA_AV_AVRC_OPEN_EVT;
227    }
228    else if (event == AVRC_CLOSE_IND_EVT)
229    {
230        msg_event = BTA_AV_AVRC_CLOSE_EVT;
231    }
232
233    if (msg_event)
234    {
235        if ((p_msg = (tBTA_AV_RC_CONN_CHG *) GKI_getbuf(sizeof(tBTA_AV_RC_CONN_CHG))) != NULL)
236        {
237            p_msg->hdr.event = msg_event;
238            p_msg->handle    = handle;
239            if(peer_addr)
240                bdcpy(p_msg->peer_addr, peer_addr);
241            bta_sys_sendmsg(p_msg);
242        }
243    }
244}
245
246/*******************************************************************************
247**
248** Function         bta_av_rc_msg_cback
249**
250** Description      AVRCP message callback.
251**
252** Returns          void
253**
254*******************************************************************************/
255static void bta_av_rc_msg_cback(UINT8 handle, UINT8 label, UINT8 opcode, tAVRC_MSG *p_msg)
256{
257    UINT8           *p_data_src = NULL;
258    UINT16          data_len = 0;
259
260    APPL_TRACE_DEBUG("%s handle: %u opcode=0x%x", __func__, handle, opcode);
261
262    /* Determine the size of the buffer we need */
263    if (opcode == AVRC_OP_VENDOR && p_msg->vendor.p_vendor_data != NULL) {
264        p_data_src = p_msg->vendor.p_vendor_data;
265        data_len = (UINT16) p_msg->vendor.vendor_len;
266    } else if (opcode == AVRC_OP_PASS_THRU && p_msg->pass.p_pass_data != NULL) {
267        p_data_src = p_msg->pass.p_pass_data;
268        data_len = (UINT16) p_msg->pass.pass_len;
269    }
270
271    /* Create a copy of the message */
272    tBTA_AV_RC_MSG *p_buf =
273        (tBTA_AV_RC_MSG *)GKI_getbuf((UINT16)(sizeof(tBTA_AV_RC_MSG) + data_len));
274    if (p_buf != NULL) {
275        p_buf->hdr.event = BTA_AV_AVRC_MSG_EVT;
276        p_buf->handle = handle;
277        p_buf->label = label;
278        p_buf->opcode = opcode;
279        memcpy(&p_buf->msg, p_msg, sizeof(tAVRC_MSG));
280        /* Copy the data payload, and set the pointer to it */
281        if (p_data_src != NULL) {
282            UINT8 *p_data_dst = (UINT8 *)(p_buf + 1);
283            memcpy(p_data_dst, p_data_src, data_len);
284            if (opcode == AVRC_OP_VENDOR)
285                p_buf->msg.vendor.p_vendor_data = p_data_dst;
286            else if (opcode == AVRC_OP_PASS_THRU)
287                p_buf->msg.pass.p_pass_data = p_data_dst;
288        }
289        bta_sys_sendmsg(p_buf);
290    }
291}
292
293/*******************************************************************************
294**
295** Function         bta_av_rc_create
296**
297** Description      alloc RCB and call AVRC_Open
298**
299** Returns          the created rc handle
300**
301*******************************************************************************/
302UINT8 bta_av_rc_create(tBTA_AV_CB *p_cb, UINT8 role, UINT8 shdl, UINT8 lidx)
303{
304    tAVRC_CONN_CB ccb;
305    BD_ADDR_PTR   bda = (BD_ADDR_PTR)bd_addr_any;
306    UINT8         status = BTA_AV_RC_ROLE_ACP;
307    tBTA_AV_SCB  *p_scb = p_cb->p_scb[shdl - 1];
308    int i;
309    UINT8   rc_handle;
310    tBTA_AV_RCB *p_rcb;
311
312    if(role == AVCT_INT)
313    {
314        bda = p_scb->peer_addr;
315        status = BTA_AV_RC_ROLE_INT;
316    }
317    else
318    {
319        if ((p_rcb = bta_av_get_rcb_by_shdl(shdl)) != NULL )
320        {
321            APPL_TRACE_ERROR("bta_av_rc_create ACP handle exist for shdl:%d", shdl);
322            return p_rcb->handle;
323        }
324    }
325
326    ccb.p_ctrl_cback = bta_av_rc_ctrl_cback;
327    ccb.p_msg_cback = bta_av_rc_msg_cback;
328    ccb.company_id = p_bta_av_cfg->company_id;
329    ccb.conn = role;
330    /* note: BTA_AV_FEAT_RCTG = AVRC_CT_TARGET, BTA_AV_FEAT_RCCT = AVRC_CT_CONTROL */
331    ccb.control = p_cb->features & (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_RCCT | AVRC_CT_PASSIVE);
332
333
334    if (AVRC_Open(&rc_handle, &ccb, bda) != AVRC_SUCCESS)
335        return BTA_AV_RC_HANDLE_NONE;
336
337    i = rc_handle;
338    p_rcb = &p_cb->rcb[i];
339
340    if (p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
341    {
342        APPL_TRACE_ERROR("bta_av_rc_create found duplicated handle:%d", rc_handle);
343    }
344
345    p_rcb->handle = rc_handle;
346    p_rcb->status = status;
347    p_rcb->shdl = shdl;
348    p_rcb->lidx = lidx;
349    p_rcb->peer_features = 0;
350    if(lidx == (BTA_AV_NUM_LINKS + 1))
351    {
352        /* this LIDX is reserved for the AVRCP ACP connection */
353        p_cb->rc_acp_handle = p_rcb->handle;
354        p_cb->rc_acp_idx = (i + 1);
355        APPL_TRACE_DEBUG("rc_acp_handle:%d idx:%d", p_cb->rc_acp_handle, p_cb->rc_acp_idx);
356    }
357    APPL_TRACE_DEBUG("create %d, role: %d, shdl:%d, rc_handle:%d, lidx:%d, status:0x%x",
358        i, role, shdl, p_rcb->handle, lidx, p_rcb->status);
359
360    return rc_handle;
361}
362
363/*******************************************************************************
364**
365** Function         bta_av_valid_group_navi_msg
366**
367** Description      Check if it is Group Navigation Msg for Metadata
368**
369** Returns          BTA_AV_RSP_ACCEPT or BTA_AV_RSP_NOT_IMPL.
370**
371*******************************************************************************/
372static tBTA_AV_CODE bta_av_group_navi_supported(UINT8 len, UINT8 *p_data, BOOLEAN is_inquiry)
373{
374    tBTA_AV_CODE ret=BTA_AV_RSP_NOT_IMPL;
375    UINT8 *p_ptr = p_data;
376    UINT16 u16;
377    UINT32 u32;
378
379    if (p_bta_av_cfg->avrc_group && len == BTA_GROUP_NAVI_MSG_OP_DATA_LEN)
380    {
381        BTA_AV_BE_STREAM_TO_CO_ID(u32, p_ptr);
382        BE_STREAM_TO_UINT16(u16, p_ptr);
383
384        if (u32 == AVRC_CO_METADATA)
385        {
386            if (is_inquiry)
387            {
388                if (u16 <= AVRC_PDU_PREV_GROUP)
389                    ret = BTA_AV_RSP_IMPL_STBL;
390            }
391            else
392            {
393                if (u16 <= AVRC_PDU_PREV_GROUP)
394                    ret = BTA_AV_RSP_ACCEPT;
395                else
396                    ret = BTA_AV_RSP_REJ;
397            }
398        }
399    }
400
401    return ret;
402}
403
404/*******************************************************************************
405**
406** Function         bta_av_op_supported
407**
408** Description      Check if remote control operation is supported.
409**
410** Returns          BTA_AV_RSP_ACCEPT of supported, BTA_AV_RSP_NOT_IMPL if not.
411**
412*******************************************************************************/
413static tBTA_AV_CODE bta_av_op_supported(tBTA_AV_RC rc_id, BOOLEAN is_inquiry)
414{
415    tBTA_AV_CODE ret_code = BTA_AV_RSP_NOT_IMPL;
416
417    if (p_bta_av_rc_id)
418    {
419        if (is_inquiry)
420        {
421            if (p_bta_av_rc_id[rc_id >> 4] & (1 << (rc_id & 0x0F)))
422            {
423                ret_code = BTA_AV_RSP_IMPL_STBL;
424            }
425        }
426        else
427        {
428            if (p_bta_av_rc_id[rc_id >> 4] & (1 << (rc_id & 0x0F)))
429            {
430                ret_code = BTA_AV_RSP_ACCEPT;
431            }
432            else if ((p_bta_av_cfg->rc_pass_rsp == BTA_AV_RSP_INTERIM) && p_bta_av_rc_id_ac)
433            {
434                if (p_bta_av_rc_id_ac[rc_id >> 4] & (1 << (rc_id & 0x0F)))
435                {
436                    ret_code = BTA_AV_RSP_INTERIM;
437                }
438            }
439        }
440
441    }
442    return ret_code;
443}
444
445/*******************************************************************************
446**
447** Function         bta_av_find_lcb
448**
449** Description      Given BD_addr, find the associated LCB.
450**
451** Returns          NULL, if not found.
452**
453*******************************************************************************/
454tBTA_AV_LCB * bta_av_find_lcb(BD_ADDR addr, UINT8 op)
455{
456    tBTA_AV_CB   *p_cb = &bta_av_cb;
457    int     xx;
458    UINT8   mask;
459    tBTA_AV_LCB *p_lcb = NULL;
460
461    for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
462    {
463        mask = 1 << xx; /* the used mask for this lcb */
464        if((mask & p_cb->conn_lcb) && 0 ==( bdcmp(p_cb->lcb[xx].addr, addr)))
465        {
466            p_lcb = &p_cb->lcb[xx];
467            if(op == BTA_AV_LCB_FREE)
468            {
469                p_cb->conn_lcb &= ~mask; /* clear the connect mask */
470                APPL_TRACE_DEBUG("conn_lcb: 0x%x", p_cb->conn_lcb);
471            }
472            break;
473        }
474    }
475    return p_lcb;
476}
477
478/*******************************************************************************
479**
480** Function         bta_av_rc_opened
481**
482** Description      Set AVRCP state to opened.
483**
484** Returns          void
485**
486*******************************************************************************/
487void bta_av_rc_opened(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
488{
489    tBTA_AV_RC_OPEN rc_open;
490    tBTA_AV_SCB     *p_scb;
491    int         i;
492    UINT8       shdl = 0;
493    tBTA_AV_LCB *p_lcb;
494    tBTA_AV_RCB *p_rcb;
495    UINT8       tmp;
496    UINT8       disc = 0;
497
498    /* find the SCB & stop the timer */
499    for(i=0; i<BTA_AV_NUM_STRS; i++)
500    {
501        p_scb = p_cb->p_scb[i];
502        if(p_scb && bdcmp(p_scb->peer_addr, p_data->rc_conn_chg.peer_addr) == 0)
503        {
504            p_scb->rc_handle = p_data->rc_conn_chg.handle;
505            APPL_TRACE_DEBUG("bta_av_rc_opened shdl:%d, srch %d", i + 1, p_scb->rc_handle);
506            shdl = i+1;
507            LOG_INFO("%s allow incoming AVRCP connections:%d", __func__, p_scb->use_rc);
508            bta_sys_stop_timer(&p_scb->timer);
509            disc = p_scb->hndl;
510            break;
511        }
512    }
513
514    i = p_data->rc_conn_chg.handle;
515    if (p_cb->rcb[i].handle == BTA_AV_RC_HANDLE_NONE)
516    {
517        APPL_TRACE_ERROR("not a valid handle:%d any more", i);
518        return;
519    }
520
521
522    if (p_cb->rcb[i].lidx == (BTA_AV_NUM_LINKS + 1) && shdl != 0)
523    {
524        /* rc is opened on the RC only ACP channel, but is for a specific
525         * SCB -> need to switch RCBs */
526        p_rcb = bta_av_get_rcb_by_shdl(shdl);
527        if (p_rcb)
528        {
529            p_rcb->shdl = p_cb->rcb[i].shdl;
530            tmp         = p_rcb->lidx;
531            p_rcb->lidx = p_cb->rcb[i].lidx;
532            p_cb->rcb[i].lidx = tmp;
533            p_cb->rc_acp_handle = p_rcb->handle;
534            p_cb->rc_acp_idx = (p_rcb - p_cb->rcb) + 1;
535            APPL_TRACE_DEBUG("switching RCB rc_acp_handle:%d idx:%d",
536                               p_cb->rc_acp_handle, p_cb->rc_acp_idx);
537        }
538    }
539
540    p_cb->rcb[i].shdl = shdl;
541    rc_open.rc_handle = i;
542    APPL_TRACE_ERROR("bta_av_rc_opened rcb[%d] shdl:%d lidx:%d/%d",
543            i, shdl, p_cb->rcb[i].lidx, p_cb->lcb[BTA_AV_NUM_LINKS].lidx);
544    p_cb->rcb[i].status |= BTA_AV_RC_CONN_MASK;
545
546    if(!shdl && 0 == p_cb->lcb[BTA_AV_NUM_LINKS].lidx)
547    {
548        /* no associated SCB -> connected to an RC only device
549         * update the index to the extra LCB */
550        p_lcb = &p_cb->lcb[BTA_AV_NUM_LINKS];
551        bdcpy(p_lcb->addr, p_data->rc_conn_chg.peer_addr);
552        APPL_TRACE_DEBUG("rc_only bd_addr:%02x-%02x-%02x-%02x-%02x-%02x",
553                      p_lcb->addr[0], p_lcb->addr[1],
554                      p_lcb->addr[2], p_lcb->addr[3],
555                      p_lcb->addr[4], p_lcb->addr[5]);
556        p_lcb->lidx = BTA_AV_NUM_LINKS + 1;
557            p_cb->rcb[i].lidx = p_lcb->lidx;
558        p_lcb->conn_msk = 1;
559        APPL_TRACE_ERROR("rcb[%d].lidx=%d, lcb.conn_msk=x%x",
560            i, p_cb->rcb[i].lidx, p_lcb->conn_msk);
561        disc = p_data->rc_conn_chg.handle|BTA_AV_CHNL_MSK;
562    }
563
564    bdcpy(rc_open.peer_addr, p_data->rc_conn_chg.peer_addr);
565    rc_open.peer_features = p_cb->rcb[i].peer_features;
566    rc_open.status = BTA_AV_SUCCESS;
567    APPL_TRACE_DEBUG("local features:x%x peer_features:x%x", p_cb->features,
568                      rc_open.peer_features);
569    if(rc_open.peer_features == 0)
570    {
571        /* we have not done SDP on peer RC capabilities.
572         * peer must have initiated the RC connection */
573        rc_open.peer_features = BTA_AV_FEAT_RCCT;
574        bta_av_rc_disc(disc);
575    }
576    (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
577
578}
579
580
581/*******************************************************************************
582**
583** Function         bta_av_rc_remote_cmd
584**
585** Description      Send an AVRCP remote control command.
586**
587** Returns          void
588**
589*******************************************************************************/
590void bta_av_rc_remote_cmd(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
591{
592    tBTA_AV_RCB    *p_rcb;
593    if (p_cb->features & BTA_AV_FEAT_RCCT)
594    {
595        if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
596        {
597            p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
598            if(p_rcb->status & BTA_AV_RC_CONN_MASK)
599            {
600                AVRC_PassCmd(p_rcb->handle, p_data->api_remote_cmd.label,
601                     &p_data->api_remote_cmd.msg);
602            }
603        }
604    }
605}
606
607/*******************************************************************************
608**
609** Function         bta_av_rc_vendor_cmd
610**
611** Description      Send an AVRCP vendor specific command.
612**
613** Returns          void
614**
615*******************************************************************************/
616void bta_av_rc_vendor_cmd(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
617{
618    tBTA_AV_RCB    *p_rcb;
619    if ( (p_cb->features & (BTA_AV_FEAT_RCCT | BTA_AV_FEAT_VENDOR)) ==
620         (BTA_AV_FEAT_RCCT | BTA_AV_FEAT_VENDOR))
621    {
622        if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
623        {
624            p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
625            AVRC_VendorCmd(p_rcb->handle, p_data->api_vendor.label, &p_data->api_vendor.msg);
626        }
627    }
628}
629
630/*******************************************************************************
631**
632** Function         bta_av_rc_vendor_rsp
633**
634** Description      Send an AVRCP vendor specific response.
635**
636** Returns          void
637**
638*******************************************************************************/
639void bta_av_rc_vendor_rsp(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
640{
641    tBTA_AV_RCB    *p_rcb;
642    if ( (p_cb->features & (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_VENDOR)) ==
643         (BTA_AV_FEAT_RCTG | BTA_AV_FEAT_VENDOR))
644    {
645        if(p_data->hdr.layer_specific < BTA_AV_NUM_RCB)
646        {
647            p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
648            AVRC_VendorRsp(p_rcb->handle, p_data->api_vendor.label, &p_data->api_vendor.msg);
649        }
650    }
651}
652
653/*******************************************************************************
654**
655** Function         bta_av_rc_meta_rsp
656**
657** Description      Send an AVRCP metadata/advanced control command/response.
658**
659** Returns          void
660**
661*******************************************************************************/
662void bta_av_rc_meta_rsp(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
663{
664    tBTA_AV_RCB *p_rcb;
665    BOOLEAN         do_free = TRUE;
666
667    if ((p_cb->features & BTA_AV_FEAT_METADATA) && (p_data->hdr.layer_specific < BTA_AV_NUM_RCB))
668    {
669        if ((p_data->api_meta_rsp.is_rsp && (p_cb->features & BTA_AV_FEAT_RCTG)) ||
670            (!p_data->api_meta_rsp.is_rsp && (p_cb->features & BTA_AV_FEAT_RCCT)) )
671        {
672            p_rcb = &p_cb->rcb[p_data->hdr.layer_specific];
673            if (p_rcb->handle != BTA_AV_RC_HANDLE_NONE) {
674                AVRC_MsgReq(p_rcb->handle, p_data->api_meta_rsp.label,
675                            p_data->api_meta_rsp.rsp_code,
676                            p_data->api_meta_rsp.p_pkt);
677                do_free = FALSE;
678            }
679        }
680    }
681
682    if (do_free)
683        GKI_freebuf (p_data->api_meta_rsp.p_pkt);
684}
685
686/*******************************************************************************
687**
688** Function         bta_av_rc_free_rsp
689**
690** Description      free an AVRCP metadata command buffer.
691**
692** Returns          void
693**
694*******************************************************************************/
695void bta_av_rc_free_rsp (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
696{
697    UNUSED(p_cb);
698
699    GKI_freebuf (p_data->api_meta_rsp.p_pkt);
700}
701
702/*******************************************************************************
703**
704** Function         bta_av_rc_meta_req
705**
706** Description      Send an AVRCP metadata command.
707**
708** Returns          void
709**
710*******************************************************************************/
711void bta_av_rc_free_msg (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
712{
713    UNUSED(p_cb);
714    UNUSED(p_data);
715}
716
717
718
719/*******************************************************************************
720**
721** Function         bta_av_chk_notif_evt_id
722**
723** Description      make sure the requested player id is valid.
724**
725** Returns          BTA_AV_STS_NO_RSP, if no error
726**
727*******************************************************************************/
728static tAVRC_STS bta_av_chk_notif_evt_id(tAVRC_MSG_VENDOR *p_vendor)
729{
730    tAVRC_STS   status = BTA_AV_STS_NO_RSP;
731    UINT8       xx;
732    UINT16      u16;
733    UINT8       *p = p_vendor->p_vendor_data + 2;
734
735    BE_STREAM_TO_UINT16 (u16, p);
736    /* double check the fixed length */
737    if ((u16 != 5) || (p_vendor->vendor_len != 9))
738    {
739        status = AVRC_STS_INTERNAL_ERR;
740    }
741    else
742    {
743        /* make sure the player_id is valid */
744        for (xx=0; xx<p_bta_av_cfg->num_evt_ids; xx++)
745        {
746            if (*p == p_bta_av_cfg->p_meta_evt_ids[xx])
747            {
748                break;
749            }
750        }
751        if (xx == p_bta_av_cfg->num_evt_ids)
752        {
753            status = AVRC_STS_BAD_PARAM;
754        }
755    }
756
757    return status;
758}
759
760/*******************************************************************************
761**
762** Function         bta_av_proc_meta_cmd
763**
764** Description      Process an AVRCP metadata command from the peer.
765**
766** Returns          TRUE to respond immediately
767**
768*******************************************************************************/
769tBTA_AV_EVT bta_av_proc_meta_cmd(tAVRC_RESPONSE  *p_rc_rsp, tBTA_AV_RC_MSG *p_msg, UINT8 *p_ctype)
770{
771    tBTA_AV_EVT evt = BTA_AV_META_MSG_EVT;
772    UINT8       u8, pdu, *p;
773    UINT16      u16;
774    tAVRC_MSG_VENDOR    *p_vendor = &p_msg->msg.vendor;
775
776#if (AVRC_METADATA_INCLUDED == TRUE)
777
778    pdu = *(p_vendor->p_vendor_data);
779    p_rc_rsp->pdu = pdu;
780    *p_ctype = AVRC_RSP_REJ;
781    /* Metadata messages only use PANEL sub-unit type */
782    if (p_vendor->hdr.subunit_type != AVRC_SUB_PANEL)
783    {
784        APPL_TRACE_DEBUG("SUBUNIT must be PANEL");
785        /* reject it */
786        evt=0;
787        p_vendor->hdr.ctype = BTA_AV_RSP_NOT_IMPL;
788        AVRC_VendorRsp(p_msg->handle, p_msg->label, &p_msg->msg.vendor);
789    }
790    else if (!AVRC_IsValidAvcType(pdu, p_vendor->hdr.ctype) )
791    {
792        APPL_TRACE_DEBUG("Invalid pdu/ctype: 0x%x, %d", pdu, p_vendor->hdr.ctype);
793        /* reject invalid message without reporting to app */
794        evt = 0;
795        p_rc_rsp->rsp.status = AVRC_STS_BAD_CMD;
796    }
797    else
798    {
799        switch (pdu)
800        {
801        case AVRC_PDU_GET_CAPABILITIES:
802            /* process GetCapabilities command without reporting the event to app */
803            evt = 0;
804            u8 = *(p_vendor->p_vendor_data + 4);
805            p = p_vendor->p_vendor_data + 2;
806            p_rc_rsp->get_caps.capability_id = u8;
807            BE_STREAM_TO_UINT16 (u16, p);
808            if ((u16 != 1) || (p_vendor->vendor_len != 5))
809            {
810                p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;
811            }
812            else
813            {
814                p_rc_rsp->get_caps.status = AVRC_STS_NO_ERROR;
815                if (u8 == AVRC_CAP_COMPANY_ID)
816                {
817                    *p_ctype = AVRC_RSP_IMPL_STBL;
818                    p_rc_rsp->get_caps.count = p_bta_av_cfg->num_co_ids;
819                    memcpy(p_rc_rsp->get_caps.param.company_id, p_bta_av_cfg->p_meta_co_ids,
820                           (p_bta_av_cfg->num_co_ids << 2));
821                }
822                else if (u8 == AVRC_CAP_EVENTS_SUPPORTED)
823                {
824                    *p_ctype = AVRC_RSP_IMPL_STBL;
825                    p_rc_rsp->get_caps.count = p_bta_av_cfg->num_evt_ids;
826                    memcpy(p_rc_rsp->get_caps.param.event_id, p_bta_av_cfg->p_meta_evt_ids,
827                           p_bta_av_cfg->num_evt_ids);
828                }
829                else
830                {
831                    APPL_TRACE_DEBUG("Invalid capability ID: 0x%x", u8);
832                    /* reject - unknown capability ID */
833                    p_rc_rsp->get_caps.status = AVRC_STS_BAD_PARAM;
834                }
835            }
836            break;
837
838
839        case AVRC_PDU_REGISTER_NOTIFICATION:
840            /* make sure the event_id is implemented */
841            p_rc_rsp->rsp.status = bta_av_chk_notif_evt_id (p_vendor);
842            if (p_rc_rsp->rsp.status != BTA_AV_STS_NO_RSP)
843                evt = 0;
844            break;
845
846        }
847    }
848#else
849    APPL_TRACE_DEBUG("AVRCP 1.3 Metadata not supporteed. Reject command.");
850    /* reject invalid message without reporting to app */
851    evt = 0;
852    p_rc_rsp->rsp.status = AVRC_STS_BAD_CMD;
853#endif
854
855    return evt;
856}
857
858
859/*******************************************************************************
860**
861** Function         bta_av_rc_msg
862**
863** Description      Process an AVRCP message from the peer.
864**
865** Returns          void
866**
867*******************************************************************************/
868void bta_av_rc_msg(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
869{
870    tBTA_AV_EVT evt = 0;
871    tBTA_AV     av;
872    BT_HDR      *p_pkt = NULL;
873    tAVRC_MSG_VENDOR    *p_vendor = &p_data->rc_msg.msg.vendor;
874    BOOLEAN is_inquiry = ((p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_SPEC_INQ) || p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_GEN_INQ);
875#if (AVRC_METADATA_INCLUDED == TRUE)
876    UINT8       ctype = 0;
877    tAVRC_RESPONSE  rc_rsp;
878
879    rc_rsp.rsp.status = BTA_AV_STS_NO_RSP;
880#endif
881
882    if (p_data->rc_msg.opcode == AVRC_OP_PASS_THRU)
883    {
884    /* if this is a pass thru command */
885        if ((p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_CTRL) ||
886            (p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_SPEC_INQ) ||
887            (p_data->rc_msg.msg.hdr.ctype == AVRC_CMD_GEN_INQ)
888            )
889        {
890        /* check if operation is supported */
891            if (p_data->rc_msg.msg.pass.op_id == AVRC_ID_VENDOR)
892            {
893                p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_NOT_IMPL;
894#if (AVRC_METADATA_INCLUDED == TRUE)
895                if (p_cb->features & BTA_AV_FEAT_METADATA)
896                    p_data->rc_msg.msg.hdr.ctype =
897                        bta_av_group_navi_supported(p_data->rc_msg.msg.pass.pass_len,
898                        p_data->rc_msg.msg.pass.p_pass_data, is_inquiry);
899#endif
900            }
901            else
902            {
903                p_data->rc_msg.msg.hdr.ctype = bta_av_op_supported(p_data->rc_msg.msg.pass.op_id, is_inquiry);
904            }
905
906            APPL_TRACE_DEBUG("ctype %d",p_data->rc_msg.msg.hdr.ctype)
907
908            /* send response */
909            if (p_data->rc_msg.msg.hdr.ctype != BTA_AV_RSP_INTERIM)
910                AVRC_PassRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.pass);
911
912            /* set up for callback if supported */
913            if (p_data->rc_msg.msg.hdr.ctype == BTA_AV_RSP_ACCEPT || p_data->rc_msg.msg.hdr.ctype == BTA_AV_RSP_INTERIM)
914            {
915                evt = BTA_AV_REMOTE_CMD_EVT;
916                av.remote_cmd.rc_id = p_data->rc_msg.msg.pass.op_id;
917                av.remote_cmd.key_state = p_data->rc_msg.msg.pass.state;
918                av.remote_cmd.p_data = p_data->rc_msg.msg.pass.p_pass_data;
919                av.remote_cmd.len = p_data->rc_msg.msg.pass.pass_len;
920                memcpy(&av.remote_cmd.hdr, &p_data->rc_msg.msg.hdr, sizeof (tAVRC_HDR));
921                av.remote_cmd.label = p_data->rc_msg.label;
922            }
923        }
924        /* else if this is a pass thru response */
925        else if (p_data->rc_msg.msg.hdr.ctype >= AVRC_RSP_ACCEPT)
926        {
927            /* set up for callback */
928            evt = BTA_AV_REMOTE_RSP_EVT;
929            av.remote_rsp.rc_id = p_data->rc_msg.msg.pass.op_id;
930            av.remote_rsp.key_state = p_data->rc_msg.msg.pass.state;
931            av.remote_rsp.rsp_code = p_data->rc_msg.msg.hdr.ctype;
932            av.remote_rsp.label = p_data->rc_msg.label;
933        }
934        /* must be a bad ctype -> reject*/
935        else
936        {
937            p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_REJ;
938            AVRC_PassRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.pass);
939        }
940    }
941    /* else if this is a vendor specific command or response */
942    else if (p_data->rc_msg.opcode == AVRC_OP_VENDOR)
943    {
944        /* set up for callback */
945        av.vendor_cmd.code = p_data->rc_msg.msg.hdr.ctype;
946        av.vendor_cmd.company_id = p_vendor->company_id;
947        av.vendor_cmd.label = p_data->rc_msg.label;
948        av.vendor_cmd.p_data = p_vendor->p_vendor_data;
949        av.vendor_cmd.len = p_vendor->vendor_len;
950
951        /* if configured to support vendor specific and it's a command */
952        if ((p_cb->features & BTA_AV_FEAT_VENDOR)  &&
953            p_data->rc_msg.msg.hdr.ctype <= AVRC_CMD_GEN_INQ)
954        {
955#if (AVRC_METADATA_INCLUDED == TRUE)
956            if ((p_cb->features & BTA_AV_FEAT_METADATA) &&
957               (p_vendor->company_id == AVRC_CO_METADATA))
958            {
959                av.meta_msg.p_msg = &p_data->rc_msg.msg;
960                evt = bta_av_proc_meta_cmd (&rc_rsp, &p_data->rc_msg, &ctype);
961            }
962            else
963#endif
964                evt = BTA_AV_VENDOR_CMD_EVT;
965        }
966        /* else if configured to support vendor specific and it's a response */
967        else if ((p_cb->features & BTA_AV_FEAT_VENDOR) &&
968                 p_data->rc_msg.msg.hdr.ctype >= AVRC_RSP_ACCEPT)
969        {
970#if (AVRC_METADATA_INCLUDED == TRUE)
971            if ((p_cb->features & BTA_AV_FEAT_METADATA) &&
972               (p_vendor->company_id == AVRC_CO_METADATA))
973            {
974                av.meta_msg.p_msg = &p_data->rc_msg.msg;
975                evt = BTA_AV_META_MSG_EVT;
976            }
977            else
978#endif
979                evt = BTA_AV_VENDOR_RSP_EVT;
980
981        }
982        /* else if not configured to support vendor specific and it's a command */
983        else if (!(p_cb->features & BTA_AV_FEAT_VENDOR)  &&
984            p_data->rc_msg.msg.hdr.ctype <= AVRC_CMD_GEN_INQ)
985        {
986           if(p_data->rc_msg.msg.vendor.p_vendor_data[0] == AVRC_PDU_INVALID)
987           {
988           /* reject it */
989              p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_REJ;
990              p_data->rc_msg.msg.vendor.p_vendor_data[4] = AVRC_STS_BAD_CMD;
991           }
992           else
993              p_data->rc_msg.msg.hdr.ctype = BTA_AV_RSP_NOT_IMPL;
994           AVRC_VendorRsp(p_data->rc_msg.handle, p_data->rc_msg.label, &p_data->rc_msg.msg.vendor);
995        }
996    }
997#if (AVRC_METADATA_INCLUDED == TRUE)
998    if (evt == 0 && rc_rsp.rsp.status != BTA_AV_STS_NO_RSP)
999    {
1000        if (!p_pkt)
1001        {
1002            rc_rsp.rsp.opcode = p_data->rc_msg.opcode;
1003            AVRC_BldResponse (0, &rc_rsp, &p_pkt);
1004        }
1005        if (p_pkt)
1006            AVRC_MsgReq (p_data->rc_msg.handle, p_data->rc_msg.label, ctype, p_pkt);
1007    }
1008#endif
1009
1010    /* call callback */
1011    if (evt != 0)
1012    {
1013        av.remote_cmd.rc_handle = p_data->rc_msg.handle;
1014        (*p_cb->p_cback)(evt, &av);
1015    }
1016}
1017
1018/*******************************************************************************
1019**
1020** Function         bta_av_rc_close
1021**
1022** Description      close the specified AVRC handle.
1023**
1024** Returns          void
1025**
1026*******************************************************************************/
1027void bta_av_rc_close (tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
1028{
1029    UINT16 handle = p_data->hdr.layer_specific;
1030    tBTA_AV_SCB  *p_scb;
1031    tBTA_AV_RCB *p_rcb;
1032
1033    if(handle < BTA_AV_NUM_RCB)
1034    {
1035        p_rcb = &p_cb->rcb[handle];
1036
1037        APPL_TRACE_DEBUG("bta_av_rc_close handle: %d, status=0x%x", p_rcb->handle, p_rcb->status);
1038        if(p_rcb->handle != BTA_AV_RC_HANDLE_NONE)
1039        {
1040            if(p_rcb->shdl)
1041            {
1042                p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
1043                if(p_scb)
1044                {
1045                    /* just in case the RC timer is active
1046                    if(bta_av_cb.features & BTA_AV_FEAT_RCCT &&
1047                       p_scb->chnl == BTA_AV_CHNL_AUDIO) */
1048                        bta_sys_stop_timer(&p_scb->timer);
1049                }
1050            }
1051
1052            AVRC_Close(p_rcb->handle);
1053        }
1054    }
1055}
1056
1057/*******************************************************************************
1058**
1059** Function         bta_av_get_shdl
1060**
1061** Returns          The index to p_scb[]
1062**
1063*******************************************************************************/
1064static UINT8 bta_av_get_shdl(tBTA_AV_SCB *p_scb)
1065{
1066    int     i;
1067    UINT8   shdl = 0;
1068    /* find the SCB & stop the timer */
1069    for(i=0; i<BTA_AV_NUM_STRS; i++)
1070    {
1071        if(p_scb == bta_av_cb.p_scb[i])
1072        {
1073            shdl = i+1;
1074            break;
1075        }
1076    }
1077    return shdl;
1078}
1079
1080/*******************************************************************************
1081**
1082** Function         bta_av_stream_chg
1083**
1084** Description      audio streaming status changed.
1085**
1086** Returns          void
1087**
1088*******************************************************************************/
1089void bta_av_stream_chg(tBTA_AV_SCB *p_scb, BOOLEAN started)
1090{
1091    UINT8   started_msk;
1092    int     i;
1093    UINT8   *p_streams;
1094    BOOLEAN no_streams = FALSE;
1095    tBTA_AV_SCB *p_scbi;
1096
1097    started_msk = BTA_AV_HNDL_TO_MSK(p_scb->hdi);
1098    APPL_TRACE_DEBUG ("bta_av_stream_chg started:%d started_msk:x%x chnl:x%x", started,
1099                                                  started_msk, p_scb->chnl);
1100    if (BTA_AV_CHNL_AUDIO == p_scb->chnl)
1101        p_streams = &bta_av_cb.audio_streams;
1102    else
1103        p_streams = &bta_av_cb.video_streams;
1104
1105    if (started)
1106    {
1107        /* Let L2CAP know this channel is processed with high priority */
1108        L2CA_SetAclPriority(p_scb->peer_addr, L2CAP_PRIORITY_HIGH);
1109        (*p_streams) |= started_msk;
1110    }
1111    else
1112    {
1113        (*p_streams) &= ~started_msk;
1114    }
1115
1116    if (!started)
1117    {
1118        i=0;
1119        if (BTA_AV_CHNL_AUDIO == p_scb->chnl)
1120        {
1121            if (bta_av_cb.video_streams == 0)
1122                no_streams = TRUE;
1123        }
1124        else
1125        {
1126            no_streams = TRUE;
1127            if ( bta_av_cb.audio_streams )
1128            {
1129                for (; i<BTA_AV_NUM_STRS; i++)
1130                {
1131                    p_scbi = bta_av_cb.p_scb[i];
1132                    /* scb is used and started */
1133                    if ( p_scbi && (bta_av_cb.audio_streams & BTA_AV_HNDL_TO_MSK(i))
1134                        && bdcmp(p_scbi->peer_addr, p_scb->peer_addr) == 0)
1135                    {
1136                        no_streams = FALSE;
1137                        break;
1138                    }
1139                }
1140
1141            }
1142        }
1143
1144        APPL_TRACE_DEBUG ("no_streams:%d i:%d, audio_streams:x%x, video_streams:x%x", no_streams, i,
1145                           bta_av_cb.audio_streams, bta_av_cb.video_streams);
1146        if (no_streams)
1147        {
1148            /* Let L2CAP know this channel is processed with low priority */
1149            L2CA_SetAclPriority(p_scb->peer_addr, L2CAP_PRIORITY_NORMAL);
1150        }
1151    }
1152}
1153
1154
1155/*******************************************************************************
1156**
1157** Function         bta_av_conn_chg
1158**
1159** Description      connetion status changed.
1160**                  Open an AVRCP acceptor channel, if new conn.
1161**
1162** Returns          void
1163**
1164*******************************************************************************/
1165void bta_av_conn_chg(tBTA_AV_DATA *p_data)
1166{
1167    tBTA_AV_CB   *p_cb = &bta_av_cb;
1168    tBTA_AV_SCB     *p_scb = NULL;
1169    tBTA_AV_SCB     *p_scbi;
1170    UINT8   mask;
1171    UINT8   conn_msk;
1172    UINT8   old_msk;
1173    int i;
1174    int index = (p_data->hdr.layer_specific & BTA_AV_HNDL_MSK) - 1;
1175    tBTA_AV_LCB *p_lcb;
1176    tBTA_AV_LCB *p_lcb_rc;
1177    tBTA_AV_RCB *p_rcb, *p_rcb2;
1178    BOOLEAN     chk_restore = FALSE;
1179
1180    /* Validate array index*/
1181    if (index < BTA_AV_NUM_STRS)
1182    {
1183        p_scb = p_cb->p_scb[index];
1184    }
1185    mask = BTA_AV_HNDL_TO_MSK(index);
1186    p_lcb = bta_av_find_lcb(p_data->conn_chg.peer_addr, BTA_AV_LCB_FIND);
1187    conn_msk = 1 << (index + 1);
1188    if(p_data->conn_chg.is_up)
1189    {
1190        /* set the conned mask for this channel */
1191        if(p_scb)
1192        {
1193            if(p_lcb)
1194            {
1195                p_lcb->conn_msk |= conn_msk;
1196                for (i=0; i<BTA_AV_NUM_RCB; i++)
1197                {
1198                    if (bta_av_cb.rcb[i].lidx == p_lcb->lidx)
1199                    {
1200                        bta_av_cb.rcb[i].shdl = index + 1;
1201                        APPL_TRACE_DEBUG("conn_chg up[%d]: %d, status=0x%x, shdl:%d, lidx:%d", i,
1202                                          bta_av_cb.rcb[i].handle, bta_av_cb.rcb[i].status,
1203                                          bta_av_cb.rcb[i].shdl, bta_av_cb.rcb[i].lidx);
1204                        break;
1205                    }
1206                }
1207            }
1208            if (p_scb->chnl == BTA_AV_CHNL_AUDIO)
1209            {
1210                old_msk = p_cb->conn_audio;
1211                p_cb->conn_audio |= mask;
1212            }
1213            else
1214            {
1215                old_msk = p_cb->conn_video;
1216                p_cb->conn_video |= mask;
1217            }
1218
1219            if ((old_msk & mask) == 0)
1220            {
1221                /* increase the audio open count, if not set yet */
1222                bta_av_cb.audio_open_cnt++;
1223            }
1224
1225
1226            APPL_TRACE_DEBUG("rc_acp_handle:%d rc_acp_idx:%d", p_cb->rc_acp_handle, p_cb->rc_acp_idx);
1227            /* check if the AVRCP ACP channel is already connected */
1228            if(p_lcb && p_cb->rc_acp_handle != BTA_AV_RC_HANDLE_NONE && p_cb->rc_acp_idx)
1229            {
1230                p_lcb_rc = &p_cb->lcb[BTA_AV_NUM_LINKS];
1231                APPL_TRACE_DEBUG("rc_acp is connected && conn_chg on same addr p_lcb_rc->conn_msk:x%x",
1232                                  p_lcb_rc->conn_msk);
1233                /* check if the RC is connected to the scb addr */
1234                APPL_TRACE_DEBUG ("p_lcb_rc->addr: %02x:%02x:%02x:%02x:%02x:%02x",
1235                       p_lcb_rc->addr[0], p_lcb_rc->addr[1], p_lcb_rc->addr[2], p_lcb_rc->addr[3],
1236                       p_lcb_rc->addr[4], p_lcb_rc->addr[5]);
1237                APPL_TRACE_DEBUG ("conn_chg.peer_addr: %02x:%02x:%02x:%02x:%02x:%02x",
1238                       p_data->conn_chg.peer_addr[0], p_data->conn_chg.peer_addr[1],
1239                       p_data->conn_chg.peer_addr[2],
1240                       p_data->conn_chg.peer_addr[3], p_data->conn_chg.peer_addr[4],
1241                       p_data->conn_chg.peer_addr[5]);
1242                if (p_lcb_rc->conn_msk && bdcmp(p_lcb_rc->addr, p_data->conn_chg.peer_addr) == 0)
1243                {
1244                    /* AVRCP is already connected.
1245                     * need to update the association betwen SCB and RCB */
1246                    p_lcb_rc->conn_msk = 0; /* indicate RC ONLY is not connected */
1247                    p_lcb_rc->lidx = 0;
1248                    p_scb->rc_handle = p_cb->rc_acp_handle;
1249                    p_rcb = &p_cb->rcb[p_cb->rc_acp_idx - 1];
1250                    p_rcb->shdl = bta_av_get_shdl(p_scb);
1251                    APPL_TRACE_DEBUG("update rc_acp shdl:%d/%d srch:%d", index + 1, p_rcb->shdl,
1252                                      p_scb->rc_handle );
1253
1254                    p_rcb2 = bta_av_get_rcb_by_shdl(p_rcb->shdl);
1255                    if (p_rcb2)
1256                    {
1257                        /* found the RCB that was created to associated with this SCB */
1258                        p_cb->rc_acp_handle = p_rcb2->handle;
1259                        p_cb->rc_acp_idx = (p_rcb2 - p_cb->rcb) + 1;
1260                        APPL_TRACE_DEBUG("new rc_acp_handle:%d, idx:%d", p_cb->rc_acp_handle,
1261                                           p_cb->rc_acp_idx);
1262                        p_rcb2->lidx = (BTA_AV_NUM_LINKS + 1);
1263                        APPL_TRACE_DEBUG("rc2 handle:%d lidx:%d/%d",p_rcb2->handle, p_rcb2->lidx,
1264                                          p_cb->lcb[p_rcb2->lidx-1].lidx);
1265                    }
1266                    p_rcb->lidx = p_lcb->lidx;
1267                    APPL_TRACE_DEBUG("rc handle:%d lidx:%d/%d",p_rcb->handle, p_rcb->lidx,
1268                                      p_cb->lcb[p_rcb->lidx-1].lidx);
1269                }
1270            }
1271        }
1272    }
1273    else
1274    {
1275        if ((p_cb->conn_audio & mask) && bta_av_cb.audio_open_cnt)
1276        {
1277            /* this channel is still marked as open. decrease the count */
1278            bta_av_cb.audio_open_cnt--;
1279        }
1280
1281        /* clear the conned mask for this channel */
1282        p_cb->conn_audio &= ~mask;
1283        p_cb->conn_video &= ~mask;
1284        if(p_scb)
1285        {
1286            /* the stream is closed.
1287             * clear the peer address, so it would not mess up the AVRCP for the next round of operation */
1288            bdcpy(p_scb->peer_addr, bd_addr_null);
1289            if(p_scb->chnl == BTA_AV_CHNL_AUDIO)
1290            {
1291                if(p_lcb)
1292                {
1293                    p_lcb->conn_msk &= ~conn_msk;
1294                }
1295                /* audio channel is down. make sure the INT channel is down */
1296                /* just in case the RC timer is active
1297                if(p_cb->features & BTA_AV_FEAT_RCCT) */
1298                {
1299                    bta_sys_stop_timer(&p_scb->timer);
1300                }
1301                /* one audio channel goes down. check if we need to restore high priority */
1302                chk_restore = TRUE;
1303            }
1304        }
1305
1306        APPL_TRACE_DEBUG("bta_av_conn_chg shdl:%d", index + 1);
1307        for (i=0; i<BTA_AV_NUM_RCB; i++)
1308        {
1309            APPL_TRACE_DEBUG("conn_chg dn[%d]: %d, status=0x%x, shdl:%d, lidx:%d", i,
1310                              bta_av_cb.rcb[i].handle, bta_av_cb.rcb[i].status,
1311                              bta_av_cb.rcb[i].shdl, bta_av_cb.rcb[i].lidx);
1312            if(bta_av_cb.rcb[i].shdl == index + 1)
1313            {
1314                bta_av_del_rc(&bta_av_cb.rcb[i]);
1315                break;
1316            }
1317        }
1318
1319        if(p_cb->conn_audio == 0 && p_cb->conn_video == 0)
1320        {
1321            /* if both channels are not connected,
1322             * close all RC channels */
1323            bta_av_close_all_rc(p_cb);
1324        }
1325
1326        /* if the AVRCP is no longer listening, create the listening channel */
1327        if (bta_av_cb.rc_acp_handle == BTA_AV_RC_HANDLE_NONE && bta_av_cb.features & BTA_AV_FEAT_RCTG)
1328            bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
1329    }
1330
1331    APPL_TRACE_DEBUG("bta_av_conn_chg audio:%x video:%x up:%d conn_msk:0x%x chk_restore:%d audio_open_cnt:%d",
1332        p_cb->conn_audio, p_cb->conn_video, p_data->conn_chg.is_up, conn_msk, chk_restore, p_cb->audio_open_cnt);
1333
1334    if (chk_restore)
1335    {
1336        if (p_cb->audio_open_cnt == 1)
1337        {
1338            /* one audio channel goes down and there's one audio channel remains open.
1339             * restore the switch role in default link policy */
1340            bta_sys_set_default_policy(BTA_ID_AV, HCI_ENABLE_MASTER_SLAVE_SWITCH);
1341            /* allow role switch, if this is the last connection */
1342            bta_av_restore_switch();
1343        }
1344        if (p_cb->audio_open_cnt)
1345        {
1346            /* adjust flush timeout settings to longer period */
1347            for (i=0; i<BTA_AV_NUM_STRS; i++)
1348            {
1349                p_scbi = bta_av_cb.p_scb[i];
1350                if (p_scbi && p_scbi->chnl == BTA_AV_CHNL_AUDIO && p_scbi->co_started)
1351                {
1352                    /* may need to update the flush timeout of this already started stream */
1353                    if (p_scbi->co_started != bta_av_cb.audio_open_cnt)
1354                    {
1355                        p_scbi->co_started = bta_av_cb.audio_open_cnt;
1356                        L2CA_SetFlushTimeout(p_scbi->peer_addr, p_bta_av_cfg->p_audio_flush_to[p_scbi->co_started - 1] );
1357                    }
1358                }
1359            }
1360        }
1361    }
1362}
1363
1364/*******************************************************************************
1365**
1366** Function         bta_av_disable
1367**
1368** Description      disable AV.
1369**
1370** Returns          void
1371**
1372*******************************************************************************/
1373void bta_av_disable(tBTA_AV_CB *p_cb, tBTA_AV_DATA *p_data)
1374{
1375    BT_HDR  hdr;
1376    UINT16  xx;
1377    UNUSED(p_data);
1378
1379    p_cb->disabling = TRUE;
1380
1381    bta_av_close_all_rc(p_cb);
1382
1383    utl_freebuf((void **) &p_cb->p_disc_db);
1384
1385    /* disable audio/video - de-register all channels,
1386     * expect BTA_AV_DEREG_COMP_EVT when deregister is complete */
1387    for(xx=0; xx<BTA_AV_NUM_STRS; xx++)
1388    {
1389        hdr.layer_specific = xx + 1;
1390        bta_av_api_deregister((tBTA_AV_DATA *)&hdr);
1391    }
1392}
1393
1394/*******************************************************************************
1395**
1396** Function         bta_av_api_disconnect
1397**
1398** Description      .
1399**
1400** Returns          void
1401**
1402*******************************************************************************/
1403void bta_av_api_disconnect(tBTA_AV_DATA *p_data)
1404{
1405    AVDT_DisconnectReq(p_data->api_discnt.bd_addr, bta_av_conn_cback);
1406    bta_sys_stop_timer(&bta_av_cb.sig_tmr);
1407}
1408
1409/*******************************************************************************
1410**
1411** Function         bta_av_sig_chg
1412**
1413** Description      process AVDT signal channel up/down.
1414**
1415** Returns          void
1416**
1417*******************************************************************************/
1418void bta_av_sig_chg(tBTA_AV_DATA *p_data)
1419{
1420    UINT16 event = p_data->str_msg.hdr.layer_specific;
1421    tBTA_AV_CB   *p_cb = &bta_av_cb;
1422    int     xx;
1423    UINT8   mask;
1424    tBTA_AV_LCB *p_lcb = NULL;
1425
1426    APPL_TRACE_DEBUG("bta_av_sig_chg event: %d", event);
1427    if(event == AVDT_CONNECT_IND_EVT)
1428    {
1429        p_lcb = bta_av_find_lcb(p_data->str_msg.bd_addr, BTA_AV_LCB_FIND);
1430        if(!p_lcb)
1431        {
1432            /* if the address does not have an LCB yet, alloc one */
1433            for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
1434            {
1435                mask = 1 << xx;
1436                APPL_TRACE_DEBUG("conn_lcb: 0x%x", p_cb->conn_lcb);
1437
1438                /* look for a p_lcb with its p_scb registered */
1439                if((!(mask & p_cb->conn_lcb)) && (p_cb->p_scb[xx] != NULL))
1440                {
1441                    p_lcb = &p_cb->lcb[xx];
1442                    p_lcb->lidx = xx + 1;
1443                    bdcpy(p_lcb->addr, p_data->str_msg.bd_addr);
1444                    p_lcb->conn_msk = 0; /* clear the connect mask */
1445                    /* start listening when the signal channel is open */
1446                    if (p_cb->features & BTA_AV_FEAT_RCTG)
1447                    {
1448                        bta_av_rc_create(p_cb, AVCT_ACP, 0, p_lcb->lidx);
1449                    }
1450                    /* this entry is not used yet. */
1451                    p_cb->conn_lcb |= mask;     /* mark it as used */
1452                    APPL_TRACE_DEBUG("start sig timer %d", p_data->hdr.offset);
1453                    if (p_data->hdr.offset == AVDT_ACP)
1454                    {
1455                        APPL_TRACE_DEBUG("Incoming L2CAP acquired, set state as incoming", NULL);
1456                        bdcpy(p_cb->p_scb[xx]->peer_addr, p_data->str_msg.bd_addr);
1457                        p_cb->p_scb[xx]->use_rc = TRUE;     /* allowing RC for incoming connection */
1458                        bta_av_ssm_execute(p_cb->p_scb[xx], BTA_AV_ACP_CONNECT_EVT, p_data);
1459
1460                        /* The Pending Event should be sent as soon as the L2CAP signalling channel
1461                         * is set up, which is NOW. Earlier this was done only after
1462                         * BTA_AV_SIG_TIME_VAL milliseconds.
1463                         * The following function shall send the event and start the recurring timer
1464                         */
1465                        bta_av_sig_timer(NULL);
1466
1467                        /* Possible collision : need to avoid outgoing processing while the timer is running */
1468                        p_cb->p_scb[xx]->coll_mask = BTA_AV_COLL_INC_TMR;
1469
1470                        p_cb->acp_sig_tmr.param = (UINT32)xx;
1471                        p_cb->acp_sig_tmr.p_cback = (TIMER_CBACK*)&bta_av_acp_sig_timer_cback;
1472                        bta_sys_start_timer(&p_cb->acp_sig_tmr, 0, BTA_AV_ACP_SIG_TIME_VAL);
1473                    }
1474                    break;
1475                }
1476            }
1477
1478            /* check if we found something */
1479            if (xx == BTA_AV_NUM_LINKS)
1480            {
1481                /* We do not have scb for this avdt connection.     */
1482                /* Silently close the connection.                   */
1483                APPL_TRACE_ERROR("av scb not available for avdt connection");
1484                AVDT_DisconnectReq (p_data->str_msg.bd_addr, NULL);
1485                return;
1486            }
1487        }
1488    }
1489#if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
1490    else if (event == BTA_AR_AVDT_CONN_EVT)
1491    {
1492        bta_sys_stop_timer(&bta_av_cb.sig_tmr);
1493    }
1494#endif
1495    else
1496    {
1497        /* disconnected. */
1498        p_lcb = bta_av_find_lcb(p_data->str_msg.bd_addr, BTA_AV_LCB_FREE);
1499        if(p_lcb && p_lcb->conn_msk)
1500        {
1501            APPL_TRACE_DEBUG("conn_msk: 0x%x", p_lcb->conn_msk);
1502            /* clean up ssm  */
1503            for(xx=0; xx < BTA_AV_NUM_STRS; xx++)
1504            {
1505                mask = 1 << (xx + 1);
1506                if ((mask & p_lcb->conn_msk) && (p_cb->p_scb[xx]) &&
1507                    (bdcmp(p_cb->p_scb[xx]->peer_addr, p_data->str_msg.bd_addr) == 0))
1508                {
1509                    bta_av_ssm_execute(p_cb->p_scb[xx], BTA_AV_AVDT_DISCONNECT_EVT, NULL);
1510                }
1511            }
1512        }
1513    }
1514    APPL_TRACE_DEBUG("conn_lcb: 0x%x", p_cb->conn_lcb);
1515}
1516
1517/*******************************************************************************
1518**
1519** Function         bta_av_sig_timer
1520**
1521** Description      process the signal channel timer. This timer is started
1522**                  when the AVDTP signal channel is connected. If no profile
1523**                  is connected, the timer goes off every BTA_AV_SIG_TIME_VAL
1524**
1525** Returns          void
1526**
1527*******************************************************************************/
1528void bta_av_sig_timer(tBTA_AV_DATA *p_data)
1529{
1530    tBTA_AV_CB   *p_cb = &bta_av_cb;
1531    int     xx;
1532    UINT8   mask;
1533    tBTA_AV_LCB *p_lcb = NULL;
1534    tBTA_AV_PEND pend;
1535    UNUSED(p_data);
1536
1537    APPL_TRACE_DEBUG("bta_av_sig_timer");
1538    for(xx=0; xx<BTA_AV_NUM_LINKS; xx++)
1539    {
1540        mask = 1 << xx;
1541        if(mask & p_cb->conn_lcb)
1542        {
1543            /* this entry is used. check if it is connected */
1544            p_lcb = &p_cb->lcb[xx];
1545            if(!p_lcb->conn_msk)
1546            {
1547                bta_sys_start_timer(&p_cb->sig_tmr, BTA_AV_SIG_TIMER_EVT, BTA_AV_SIG_TIME_VAL);
1548                bdcpy(pend.bd_addr, p_lcb->addr);
1549                (*p_cb->p_cback)(BTA_AV_PENDING_EVT, (tBTA_AV *) &pend);
1550            }
1551        }
1552    }
1553}
1554
1555/*******************************************************************************
1556**
1557** Function         bta_av_acp_sig_timer_cback
1558**
1559** Description      Process the timeout when SRC is accepting connection
1560**                  and SNK did not start signalling.
1561**
1562** Returns          void
1563**
1564*******************************************************************************/
1565static void bta_av_acp_sig_timer_cback (TIMER_LIST_ENT *p_tle)
1566{
1567    UINT8   inx = (UINT8)p_tle->param;
1568    tBTA_AV_CB  *p_cb = &bta_av_cb;
1569    tBTA_AV_SCB *p_scb = NULL;
1570    tBTA_AV_API_OPEN  *p_buf;
1571    if (inx < BTA_AV_NUM_STRS)
1572    {
1573        p_scb = p_cb->p_scb[inx];
1574    }
1575    if (p_scb)
1576    {
1577        APPL_TRACE_DEBUG("bta_av_acp_sig_timer_cback, coll_mask = 0x%02X", p_scb->coll_mask);
1578
1579        if (p_scb->coll_mask & BTA_AV_COLL_INC_TMR)
1580        {
1581            p_scb->coll_mask &= ~BTA_AV_COLL_INC_TMR;
1582
1583            if (bta_av_is_scb_opening(p_scb))
1584            {
1585                if (p_scb->p_disc_db)
1586                {
1587                    /* We are still doing SDP. Run the timer again. */
1588                    p_scb->coll_mask |= BTA_AV_COLL_INC_TMR;
1589
1590                    p_cb->acp_sig_tmr.param = (UINT32)inx;
1591                    p_cb->acp_sig_tmr.p_cback = (TIMER_CBACK *)&bta_av_acp_sig_timer_cback;
1592                    bta_sys_start_timer(&p_cb->acp_sig_tmr, 0, BTA_AV_ACP_SIG_TIME_VAL);
1593                }
1594                else
1595                {
1596                    /* SNK did not start signalling, resume signalling process. */
1597                    bta_av_discover_req (p_scb, NULL);
1598                }
1599            }
1600            else if (bta_av_is_scb_incoming(p_scb))
1601            {
1602                /* Stay in incoming state if SNK does not start signalling */
1603
1604                /* API open was called right after SNK opened L2C connection. */
1605                if (p_scb->coll_mask & BTA_AV_COLL_API_CALLED)
1606                {
1607                    p_scb->coll_mask &= ~BTA_AV_COLL_API_CALLED;
1608
1609                    /* BTA_AV_API_OPEN_EVT */
1610                    if ((p_buf = (tBTA_AV_API_OPEN *) GKI_getbuf(sizeof(tBTA_AV_API_OPEN))) != NULL)
1611                    {
1612                        memcpy(p_buf, &(p_scb->open_api), sizeof(tBTA_AV_API_OPEN));
1613                        bta_sys_sendmsg(p_buf);
1614                    }
1615                }
1616            }
1617        }
1618    }
1619}
1620
1621/*******************************************************************************
1622**
1623** Function         bta_av_check_peer_features
1624**
1625** Description      check supported features on the peer device from the SDP record
1626**                  and return the feature mask
1627**
1628** Returns          tBTA_AV_FEAT peer device feature mask
1629**
1630*******************************************************************************/
1631tBTA_AV_FEAT bta_av_check_peer_features (UINT16 service_uuid)
1632{
1633    tBTA_AV_FEAT peer_features = 0;
1634    tBTA_AV_CB   *p_cb = &bta_av_cb;
1635    tSDP_DISC_REC       *p_rec = NULL;
1636    tSDP_DISC_ATTR      *p_attr;
1637    UINT16              peer_rc_version=0;
1638    UINT16              categories = 0;
1639
1640    APPL_TRACE_DEBUG("bta_av_check_peer_features service_uuid:x%x", service_uuid);
1641    /* loop through all records we found */
1642    while (TRUE)
1643    {
1644        /* get next record; if none found, we're done */
1645        if ((p_rec = SDP_FindServiceInDb(p_cb->p_disc_db, service_uuid, p_rec)) == NULL)
1646        {
1647            break;
1648        }
1649
1650        if (( SDP_FindAttributeInRec(p_rec, ATTR_ID_SERVICE_CLASS_ID_LIST)) != NULL)
1651        {
1652            /* find peer features */
1653            if (SDP_FindServiceInDb(p_cb->p_disc_db, UUID_SERVCLASS_AV_REMOTE_CONTROL, NULL))
1654            {
1655                peer_features |= BTA_AV_FEAT_RCCT;
1656            }
1657            if (SDP_FindServiceInDb(p_cb->p_disc_db, UUID_SERVCLASS_AV_REM_CTRL_TARGET, NULL))
1658            {
1659                peer_features |= BTA_AV_FEAT_RCTG;
1660            }
1661        }
1662
1663        if (( SDP_FindAttributeInRec(p_rec, ATTR_ID_BT_PROFILE_DESC_LIST)) != NULL)
1664        {
1665            /* get profile version (if failure, version parameter is not updated) */
1666            SDP_FindProfileVersionInRec(p_rec, UUID_SERVCLASS_AV_REMOTE_CONTROL, &peer_rc_version);
1667            APPL_TRACE_DEBUG("peer_rc_version 0x%x", peer_rc_version);
1668
1669            if (peer_rc_version >= AVRC_REV_1_3)
1670                peer_features |= (BTA_AV_FEAT_VENDOR | BTA_AV_FEAT_METADATA);
1671
1672            if (peer_rc_version >= AVRC_REV_1_4)
1673            {
1674                peer_features |= (BTA_AV_FEAT_ADV_CTRL);
1675                /* get supported categories */
1676                if ((p_attr = SDP_FindAttributeInRec(p_rec,
1677                                ATTR_ID_SUPPORTED_FEATURES)) != NULL)
1678                {
1679                    categories = p_attr->attr_value.v.u16;
1680                    if (categories & AVRC_SUPF_CT_BROWSE)
1681                        peer_features |= (BTA_AV_FEAT_BROWSE);
1682                }
1683            }
1684        }
1685    }
1686    APPL_TRACE_DEBUG("peer_features:x%x", peer_features);
1687    return peer_features;
1688}
1689
1690/*******************************************************************************
1691**
1692** Function         bta_av_rc_disc_done
1693**
1694** Description      Handle AVRCP service discovery results.  If matching
1695**                  service found, open AVRCP connection.
1696**
1697** Returns          void
1698**
1699*******************************************************************************/
1700void bta_av_rc_disc_done(tBTA_AV_DATA *p_data)
1701{
1702    tBTA_AV_CB   *p_cb = &bta_av_cb;
1703    tBTA_AV_SCB  *p_scb = NULL;
1704    tBTA_AV_LCB  *p_lcb;
1705    tBTA_AV_RC_OPEN rc_open;
1706    tBTA_AV_RC_FEAT rc_feat;
1707    UINT8               rc_handle;
1708    tBTA_AV_FEAT        peer_features;  /* peer features mask */
1709    UNUSED(p_data);
1710
1711    APPL_TRACE_DEBUG("bta_av_rc_disc_done disc:x%x", p_cb->disc);
1712    if (!p_cb->disc)
1713    {
1714        return;
1715    }
1716
1717    if ((p_cb->disc & BTA_AV_CHNL_MSK) == BTA_AV_CHNL_MSK)
1718    {
1719        /* this is the rc handle/index to tBTA_AV_RCB */
1720        rc_handle = p_cb->disc & (~BTA_AV_CHNL_MSK);
1721    }
1722    else
1723    {
1724        /* Validate array index*/
1725        if (((p_cb->disc & BTA_AV_HNDL_MSK) - 1) < BTA_AV_NUM_STRS)
1726        {
1727            p_scb = p_cb->p_scb[(p_cb->disc & BTA_AV_HNDL_MSK) - 1];
1728        }
1729        if (p_scb)
1730            rc_handle = p_scb->rc_handle;
1731        else
1732        {
1733            p_cb->disc = 0;
1734            return;
1735        }
1736    }
1737
1738    APPL_TRACE_DEBUG("rc_handle %d", rc_handle);
1739    /* check peer version and whether support CT and TG role */
1740    peer_features = bta_av_check_peer_features (UUID_SERVCLASS_AV_REMOTE_CONTROL);
1741    if ((p_cb->features & BTA_AV_FEAT_ADV_CTRL) && ((peer_features&BTA_AV_FEAT_ADV_CTRL) == 0))
1742    {
1743        /* if we support advance control and peer does not, check their support on TG role
1744         * some implementation uses 1.3 on CT ans 1.4 on TG */
1745        peer_features |= bta_av_check_peer_features (UUID_SERVCLASS_AV_REM_CTRL_TARGET);
1746    }
1747
1748    p_cb->disc = 0;
1749    utl_freebuf((void **) &p_cb->p_disc_db);
1750
1751    APPL_TRACE_DEBUG("peer_features 0x%x, features 0x%x", peer_features, p_cb->features);
1752
1753    /* if we have no rc connection */
1754    if (rc_handle == BTA_AV_RC_HANDLE_NONE)
1755    {
1756        if (p_scb)
1757        {
1758            /* if peer remote control service matches ours and USE_RC is TRUE */
1759            if ((((p_cb->features & BTA_AV_FEAT_RCCT) && (peer_features & BTA_AV_FEAT_RCTG)) ||
1760                 ((p_cb->features & BTA_AV_FEAT_RCTG) && (peer_features & BTA_AV_FEAT_RCCT))) )
1761            {
1762                p_lcb = bta_av_find_lcb(p_scb->peer_addr, BTA_AV_LCB_FIND);
1763                if(p_lcb)
1764                {
1765                    rc_handle = bta_av_rc_create(p_cb, AVCT_INT, (UINT8)(p_scb->hdi + 1), p_lcb->lidx);
1766                    p_cb->rcb[rc_handle].peer_features = peer_features;
1767                }
1768#if (BT_USE_TRACES == TRUE || BT_TRACE_APPL == TRUE)
1769                else
1770                {
1771                    APPL_TRACE_ERROR("can not find LCB!!");
1772                }
1773#endif
1774            }
1775            else if(p_scb->use_rc)
1776            {
1777                /* can not find AVRC on peer device. report failure */
1778                p_scb->use_rc = FALSE;
1779                bdcpy(rc_open.peer_addr, p_scb->peer_addr);
1780                rc_open.peer_features = 0;
1781                rc_open.status = BTA_AV_FAIL_SDP;
1782                (*p_cb->p_cback)(BTA_AV_RC_OPEN_EVT, (tBTA_AV *) &rc_open);
1783            }
1784        }
1785    }
1786    else
1787    {
1788        p_cb->rcb[rc_handle].peer_features = peer_features;
1789        rc_feat.rc_handle =  rc_handle;
1790        rc_feat.peer_features = peer_features;
1791        (*p_cb->p_cback)(BTA_AV_RC_FEAT_EVT, (tBTA_AV *) &rc_feat);
1792    }
1793}
1794
1795/*******************************************************************************
1796**
1797** Function         bta_av_rc_closed
1798**
1799** Description      Set AVRCP state to closed.
1800**
1801** Returns          void
1802**
1803*******************************************************************************/
1804void bta_av_rc_closed(tBTA_AV_DATA *p_data)
1805{
1806    tBTA_AV_CB   *p_cb = &bta_av_cb;
1807    tBTA_AV_RC_CLOSE rc_close;
1808    tBTA_AV_RC_CONN_CHG *p_msg = (tBTA_AV_RC_CONN_CHG *)p_data;
1809    tBTA_AV_RCB    *p_rcb;
1810    tBTA_AV_SCB    *p_scb;
1811    int i;
1812    BOOLEAN conn = FALSE;
1813    tBTA_AV_LCB *p_lcb;
1814
1815    rc_close.rc_handle = BTA_AV_RC_HANDLE_NONE;
1816    p_scb = NULL;
1817    APPL_TRACE_DEBUG("bta_av_rc_closed rc_handle:%d", p_msg->handle);
1818    for(i=0; i<BTA_AV_NUM_RCB; i++)
1819    {
1820        p_rcb = &p_cb->rcb[i];
1821        APPL_TRACE_DEBUG("bta_av_rc_closed rcb[%d] rc_handle:%d, status=0x%x", i, p_rcb->handle, p_rcb->status);
1822        if(p_rcb->handle == p_msg->handle)
1823        {
1824            rc_close.rc_handle = i;
1825            p_rcb->status &= ~BTA_AV_RC_CONN_MASK;
1826            p_rcb->peer_features = 0;
1827            APPL_TRACE_DEBUG("       shdl:%d, lidx:%d", p_rcb->shdl, p_rcb->lidx);
1828            if(p_rcb->shdl)
1829            {
1830                if ((p_rcb->shdl - 1) < BTA_AV_NUM_STRS)
1831                {
1832                    p_scb = bta_av_cb.p_scb[p_rcb->shdl - 1];
1833                }
1834                if(p_scb)
1835                {
1836                    bdcpy(rc_close.peer_addr, p_scb->peer_addr);
1837                    if(p_scb->rc_handle == p_rcb->handle)
1838                        p_scb->rc_handle = BTA_AV_RC_HANDLE_NONE;
1839                    APPL_TRACE_DEBUG("shdl:%d, srch:%d", p_rcb->shdl, p_scb->rc_handle);
1840                }
1841                p_rcb->shdl = 0;
1842            }
1843            else if(p_rcb->lidx == (BTA_AV_NUM_LINKS + 1) )
1844            {
1845                /* if the RCB uses the extra LCB, use the addr for event and clean it */
1846                p_lcb = &p_cb->lcb[BTA_AV_NUM_LINKS];
1847                bdcpy(rc_close.peer_addr, p_msg->peer_addr);
1848                APPL_TRACE_DEBUG("rc_only closed bd_addr:%02x-%02x-%02x-%02x-%02x-%02x",
1849                              p_msg->peer_addr[0], p_msg->peer_addr[1],
1850                              p_msg->peer_addr[2], p_msg->peer_addr[3],
1851                              p_msg->peer_addr[4], p_msg->peer_addr[5]);
1852                p_lcb->conn_msk = 0;
1853                p_lcb->lidx = 0;
1854            }
1855            p_rcb->lidx = 0;
1856
1857            if((p_rcb->status & BTA_AV_RC_ROLE_MASK) == BTA_AV_RC_ROLE_INT)
1858            {
1859                /* AVCT CCB is deallocated */
1860                p_rcb->handle = BTA_AV_RC_HANDLE_NONE;
1861                p_rcb->status = 0;
1862            }
1863            else
1864            {
1865                /* AVCT CCB is still there. dealloc */
1866                bta_av_del_rc(p_rcb);
1867
1868                /* if the AVRCP is no longer listening, create the listening channel */
1869                if (bta_av_cb.rc_acp_handle == BTA_AV_RC_HANDLE_NONE && bta_av_cb.features & BTA_AV_FEAT_RCTG)
1870                    bta_av_rc_create(&bta_av_cb, AVCT_ACP, 0, BTA_AV_NUM_LINKS + 1);
1871            }
1872        }
1873        else if((p_rcb->handle != BTA_AV_RC_HANDLE_NONE) && (p_rcb->status & BTA_AV_RC_CONN_MASK))
1874        {
1875            /* at least one channel is still connected */
1876            conn = TRUE;
1877        }
1878    }
1879
1880    if(!conn)
1881    {
1882        /* no AVRC channels are connected, go back to INIT state */
1883        bta_av_sm_execute(p_cb, BTA_AV_AVRC_NONE_EVT, NULL);
1884    }
1885
1886    if (rc_close.rc_handle == BTA_AV_RC_HANDLE_NONE)
1887    {
1888        rc_close.rc_handle = p_msg->handle;
1889        bdcpy(rc_close.peer_addr, p_msg->peer_addr);
1890    }
1891    (*p_cb->p_cback)(BTA_AV_RC_CLOSE_EVT, (tBTA_AV *) &rc_close);
1892}
1893
1894/*******************************************************************************
1895**
1896** Function         bta_av_rc_disc
1897**
1898** Description      start AVRC SDP discovery.
1899**
1900** Returns          void
1901**
1902*******************************************************************************/
1903void bta_av_rc_disc(UINT8 disc)
1904{
1905    tBTA_AV_CB   *p_cb = &bta_av_cb;
1906    tAVRC_SDP_DB_PARAMS db_params;
1907      UINT16              attr_list[] = {ATTR_ID_SERVICE_CLASS_ID_LIST,
1908                                       ATTR_ID_BT_PROFILE_DESC_LIST,
1909                                       ATTR_ID_SUPPORTED_FEATURES};
1910    UINT8       hdi;
1911    tBTA_AV_SCB *p_scb;
1912    UINT8       *p_addr = NULL;
1913    UINT8       rc_handle;
1914
1915    APPL_TRACE_DEBUG("bta_av_rc_disc 0x%x, %d", disc, bta_av_cb.disc);
1916    if ((bta_av_cb.disc != 0) || (disc == 0))
1917        return;
1918
1919    if ((disc & BTA_AV_CHNL_MSK) == BTA_AV_CHNL_MSK)
1920    {
1921        /* this is the rc handle/index to tBTA_AV_RCB */
1922        rc_handle = disc & (~BTA_AV_CHNL_MSK);
1923        if (p_cb->rcb[rc_handle].lidx)
1924        {
1925            p_addr = p_cb->lcb[p_cb->rcb[rc_handle].lidx-1].addr;
1926        }
1927    }
1928    else
1929    {
1930        hdi = (disc & BTA_AV_HNDL_MSK) - 1;
1931        p_scb = p_cb->p_scb[hdi];
1932
1933        if (p_scb)
1934        {
1935            APPL_TRACE_DEBUG("rc_handle %d", p_scb->rc_handle);
1936            p_addr = p_scb->peer_addr;
1937        }
1938    }
1939
1940    if (p_addr)
1941    {
1942        /* allocate discovery database */
1943        if (p_cb->p_disc_db == NULL)
1944        {
1945            p_cb->p_disc_db = (tSDP_DISCOVERY_DB *) GKI_getbuf(BTA_AV_DISC_BUF_SIZE);
1946        }
1947
1948        if (p_cb->p_disc_db)
1949        {
1950            /* set up parameters */
1951            db_params.db_len = BTA_AV_DISC_BUF_SIZE;
1952            db_params.num_attr = 3;
1953            db_params.p_db = p_cb->p_disc_db;
1954            db_params.p_attrs = attr_list;
1955
1956            /* searching for UUID_SERVCLASS_AV_REMOTE_CONTROL gets both TG and CT */
1957            if (AVRC_FindService(UUID_SERVCLASS_AV_REMOTE_CONTROL, p_addr, &db_params,
1958                            bta_av_avrc_sdp_cback) == AVRC_SUCCESS)
1959            {
1960                p_cb->disc = disc;
1961                APPL_TRACE_DEBUG("disc %d", p_cb->disc);
1962            }
1963        }
1964    }
1965}
1966
1967/*******************************************************************************
1968**
1969** Function         bta_av_dereg_comp
1970**
1971** Description      deregister complete. free the stream control block.
1972**
1973** Returns          void
1974**
1975*******************************************************************************/
1976void bta_av_dereg_comp(tBTA_AV_DATA *p_data)
1977{
1978    tBTA_AV_CB   *p_cb = &bta_av_cb;
1979    tBTA_AV_SCB  *p_scb;
1980    tBTA_UTL_COD    cod;
1981    UINT8   mask;
1982    BT_HDR  *p_buf;
1983
1984    /* find the stream control block */
1985    p_scb = bta_av_hndl_to_scb(p_data->hdr.layer_specific);
1986
1987    if(p_scb)
1988    {
1989        APPL_TRACE_DEBUG("deregistered %d(h%d)", p_scb->chnl, p_scb->hndl);
1990        mask = BTA_AV_HNDL_TO_MSK(p_scb->hdi);
1991        if(p_scb->chnl == BTA_AV_CHNL_AUDIO)
1992        {
1993            p_cb->reg_audio  &= ~mask;
1994            if ((p_cb->conn_audio & mask) && bta_av_cb.audio_open_cnt)
1995            {
1996                /* this channel is still marked as open. decrease the count */
1997                bta_av_cb.audio_open_cnt--;
1998            }
1999            p_cb->conn_audio &= ~mask;
2000
2001            if (p_scb->q_tag == BTA_AV_Q_TAG_STREAM && p_scb->a2d_list) {
2002                /* make sure no buffers are in a2d_list */
2003                while (!list_is_empty(p_scb->a2d_list)) {
2004                    p_buf = (BT_HDR*)list_front(p_scb->a2d_list);
2005                    list_remove(p_scb->a2d_list, p_buf);
2006                    GKI_freebuf(p_buf);
2007                }
2008            }
2009
2010            /* remove the A2DP SDP record, if no more audio stream is left */
2011            if(!p_cb->reg_audio)
2012            {
2013#if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
2014                bta_ar_dereg_avrc (UUID_SERVCLASS_AV_REMOTE_CONTROL, BTA_ID_AV);
2015#endif
2016                bta_av_del_sdp_rec(&p_cb->sdp_a2d_handle);
2017                bta_sys_remove_uuid(UUID_SERVCLASS_AUDIO_SOURCE);
2018
2019#if (BTA_AV_SINK_INCLUDED == TRUE)
2020                bta_av_del_sdp_rec(&p_cb->sdp_a2d_snk_handle);
2021                bta_sys_remove_uuid(UUID_SERVCLASS_AUDIO_SINK);
2022#endif
2023            }
2024        }
2025        else
2026        {
2027            p_cb->reg_video  &= ~mask;
2028            /* make sure that this channel is not connected */
2029            p_cb->conn_video &= ~mask;
2030            /* remove the VDP SDP record, (only one video stream at most) */
2031            bta_av_del_sdp_rec(&p_cb->sdp_vdp_handle);
2032            bta_sys_remove_uuid(UUID_SERVCLASS_VIDEO_SOURCE);
2033        }
2034
2035        /* make sure that the timer is not active */
2036        bta_sys_stop_timer(&p_scb->timer);
2037        utl_freebuf((void **)&p_cb->p_scb[p_scb->hdi]);
2038    }
2039
2040    APPL_TRACE_DEBUG("audio 0x%x, video: 0x%x, disable:%d",
2041        p_cb->reg_audio, p_cb->reg_video, p_cb->disabling);
2042    /* if no stream control block is active */
2043    if((p_cb->reg_audio + p_cb->reg_video) == 0)
2044    {
2045#if( defined BTA_AR_INCLUDED ) && (BTA_AR_INCLUDED == TRUE)
2046        /* deregister from AVDT */
2047        bta_ar_dereg_avdt(BTA_ID_AV);
2048
2049        /* deregister from AVCT */
2050        bta_ar_dereg_avrc (UUID_SERVCLASS_AV_REM_CTRL_TARGET, BTA_ID_AV);
2051        bta_ar_dereg_avct(BTA_ID_AV);
2052#endif
2053
2054        if(p_cb->disabling)
2055        {
2056            p_cb->disabling     = FALSE;
2057            bta_av_cb.features  = 0;
2058        }
2059
2060        /* Clear the Capturing service class bit */
2061        cod.service = BTM_COD_SERVICE_CAPTURING;
2062        utl_set_device_class(&cod, BTA_UTL_CLR_COD_SERVICE_CLASS);
2063    }
2064}
2065#endif /* BTA_AV_INCLUDED */
2066