avdt_scb_act.c revision 83e2c342e8b40009f3509425722d309c0b8189b9
1/******************************************************************************
2 *
3 *  Copyright (C) 2002-2012 Broadcom Corporation
4 *
5 *  Licensed under the Apache License, Version 2.0 (the "License");
6 *  you may not use this file except in compliance with the License.
7 *  You may obtain a copy of the License at:
8 *
9 *  http://www.apache.org/licenses/LICENSE-2.0
10 *
11 *  Unless required by applicable law or agreed to in writing, software
12 *  distributed under the License is distributed on an "AS IS" BASIS,
13 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 *  See the License for the specific language governing permissions and
15 *  limitations under the License.
16 *
17 ******************************************************************************/
18
19/******************************************************************************
20 *
21 *  This module contains the action functions associated with the stream
22 *  control block state machine.
23 *
24 ******************************************************************************/
25
26#include <string.h>
27#include "bt_types.h"
28#include "bt_target.h"
29#include "bt_utils.h"
30#include "avdt_api.h"
31#include "avdtc_api.h"
32#include "avdt_int.h"
33#include "gki.h"
34#include "btu.h"
35
36/* This table is used to lookup the callback event that matches a particular
37** state machine API request event.  Note that state machine API request
38** events are at the beginning of the event list starting at zero, thus
39** allowing for this table.
40*/
41const UINT8 avdt_scb_cback_evt[] = {
42    0,                          /* API_REMOVE_EVT (no event) */
43    AVDT_WRITE_CFM_EVT,         /* API_WRITE_REQ_EVT */
44    0,                          /* API_GETCONFIG_REQ_EVT (no event) */
45    0,                          /* API_DELAY_RPT_REQ_EVT (no event) */
46    AVDT_OPEN_CFM_EVT,          /* API_SETCONFIG_REQ_EVT */
47    AVDT_OPEN_CFM_EVT,          /* API_OPEN_REQ_EVT */
48    AVDT_CLOSE_CFM_EVT,         /* API_CLOSE_REQ_EVT */
49    AVDT_RECONFIG_CFM_EVT,      /* API_RECONFIG_REQ_EVT */
50    AVDT_SECURITY_CFM_EVT,      /* API_SECURITY_REQ_EVT */
51    0                           /* API_ABORT_REQ_EVT (no event) */
52};
53
54/* This table is used to look up the callback event based on the signaling
55** role when the stream is closed.
56*/
57const UINT8 avdt_scb_role_evt[] = {
58    AVDT_CLOSE_IND_EVT,         /* AVDT_CLOSE_ACP */
59    AVDT_CLOSE_CFM_EVT,         /* AVDT_CLOSE_INT */
60    AVDT_CLOSE_IND_EVT,         /* AVDT_OPEN_ACP */
61    AVDT_OPEN_CFM_EVT           /* AVDT_OPEN_INT */
62};
63
64/*******************************************************************************
65**
66** Function         avdt_scb_gen_ssrc
67**
68** Description      This function generates a SSRC number unique to the stream.
69**
70** Returns          SSRC value.
71**
72*******************************************************************************/
73UINT32 avdt_scb_gen_ssrc(tAVDT_SCB *p_scb)
74{
75    /* combine the value of the media type and codec type of the SCB */
76    return ((UINT32)(p_scb->cs.cfg.codec_info[1] | p_scb->cs.cfg.codec_info[2]));
77}
78
79/*******************************************************************************
80**
81** Function         avdt_scb_hdl_abort_cmd
82**
83** Description      This function sends the SCB an AVDT_SCB_API_ABORT_RSP_EVT
84**                  to initiate sending of an abort response message.
85**
86** Returns          Nothing.
87**
88*******************************************************************************/
89void avdt_scb_hdl_abort_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
90{
91    p_scb->role = AVDT_CLOSE_ACP;
92    avdt_scb_event(p_scb, AVDT_SCB_API_ABORT_RSP_EVT, p_data);
93}
94
95/*******************************************************************************
96**
97** Function         avdt_scb_hdl_abort_rsp
98**
99** Description      This function is an empty function; it serves as a
100**                  placeholder for a conformance API action function.
101**
102** Returns          Nothing.
103**
104*******************************************************************************/
105void avdt_scb_hdl_abort_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
106{
107    UNUSED(p_scb);
108    UNUSED(p_data);
109    return;
110}
111
112/*******************************************************************************
113**
114** Function         avdt_scb_hdl_close_cmd
115**
116** Description      This function sends the SCB an AVDT_SCB_API_CLOSE_RSP_EVT
117**                  to initiate sending of a close response message.
118**
119** Returns          Nothing.
120**
121*******************************************************************************/
122void avdt_scb_hdl_close_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
123{
124    p_scb->role = AVDT_CLOSE_ACP;
125    avdt_scb_event(p_scb, AVDT_SCB_API_CLOSE_RSP_EVT, p_data);
126}
127
128/*******************************************************************************
129**
130** Function         avdt_scb_hdl_close_rsp
131**
132** Description      This function sets the close_code variable to the error
133**                  code returned in the close response.
134**
135** Returns          Nothing.
136**
137*******************************************************************************/
138void avdt_scb_hdl_close_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
139{
140    p_scb->close_code = p_data->msg.hdr.err_code;
141}
142
143/*******************************************************************************
144**
145** Function         avdt_scb_hdl_getconfig_cmd
146**
147** Description      This function retrieves the configuration parameters of
148**                  the SCB and sends the SCB an AVDT_SCB_API_GETCONFIG_RSP_EVT
149**                  to initiate sending of a get configuration response message.
150**
151** Returns          Nothing.
152**
153*******************************************************************************/
154void avdt_scb_hdl_getconfig_cmd(tAVDT_SCB *p_scb,tAVDT_SCB_EVT *p_data)
155{
156    p_data->msg.svccap.p_cfg = &p_scb->curr_cfg;
157
158    avdt_scb_event(p_scb, AVDT_SCB_API_GETCONFIG_RSP_EVT, p_data);
159}
160
161/*******************************************************************************
162**
163** Function         avdt_scb_hdl_getconfig_rsp
164**
165** Description      This function is an empty function; it serves as a
166**                  placeholder for a conformance API action function.
167**
168** Returns          Nothing.
169**
170*******************************************************************************/
171void avdt_scb_hdl_getconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
172{
173    UNUSED(p_scb);
174    UNUSED(p_data);
175    return;
176}
177
178/*******************************************************************************
179**
180** Function         avdt_scb_hdl_open_cmd
181**
182** Description      This function sends the SCB an AVDT_SCB_API_OPEN_RSP_EVT
183**                  to initiate sending of an open response message.
184**
185** Returns          Nothing.
186**
187*******************************************************************************/
188void avdt_scb_hdl_open_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
189{
190    avdt_scb_event(p_scb, AVDT_SCB_API_OPEN_RSP_EVT, p_data);
191}
192
193/*******************************************************************************
194**
195** Function         avdt_scb_hdl_open_rej
196**
197** Description      This function calls the application callback function
198**                  indicating the open request has failed.  It initializes
199**                  certain SCB variables and sends a AVDT_CCB_UL_CLOSE_EVT
200**                  to the CCB.
201**
202** Returns          Nothing.
203**
204*******************************************************************************/
205void avdt_scb_hdl_open_rej(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
206{
207    /* do exactly same as setconfig reject */
208    avdt_scb_hdl_setconfig_rej(p_scb, p_data);
209}
210
211/*******************************************************************************
212**
213** Function         avdt_scb_hdl_open_rsp
214**
215** Description      This function calls avdt_ad_open_req() to initiate
216**                  connection of the transport channel for this stream.
217**
218** Returns          Nothing.
219**
220*******************************************************************************/
221void avdt_scb_hdl_open_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
222{
223    UNUSED(p_data);
224
225    /* initiate opening of trans channels for this SEID */
226    p_scb->role = AVDT_OPEN_INT;
227    avdt_ad_open_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, AVDT_INT);
228
229    /* start tc connect timer */
230    btu_start_timer(&p_scb->timer_entry, BTU_TTYPE_AVDT_SCB_TC, AVDT_SCB_TC_CONN_TOUT);
231}
232
233/*******************************************************************************
234**
235** Function         avdt_scb_hdl_pkt_no_frag
236**
237** Description
238**
239** Returns          Nothing.
240**
241*******************************************************************************/
242void avdt_scb_hdl_pkt_no_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
243{
244    UINT8   *p, *p_start;
245    UINT8   o_v, o_p, o_x, o_cc;
246    UINT8   m_pt;
247    UINT8   marker;
248    UINT16  seq;
249    UINT32  time_stamp;
250    UINT16  offset;
251    UINT16  ex_len;
252    UINT8   pad_len = 0;
253
254    p = p_start = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
255
256    /* parse media packet header */
257    AVDT_MSG_PRS_OCTET1(p, o_v, o_p, o_x, o_cc);
258    AVDT_MSG_PRS_M_PT(p, m_pt, marker);
259    BE_STREAM_TO_UINT16(seq, p);
260    BE_STREAM_TO_UINT32(time_stamp, p);
261    p += 4;
262
263    UNUSED(o_v);
264
265    /* skip over any csrc's in packet */
266    p += o_cc * 4;
267
268    /* check for and skip over extension header */
269    if (o_x)
270    {
271        p += 2;
272        BE_STREAM_TO_UINT16(ex_len, p);
273        p += ex_len * 4;
274    }
275
276    /* save our new offset */
277    offset = (UINT16) (p - p_start);
278
279    /* adjust length for any padding at end of packet */
280    if (o_p)
281    {
282        /* padding length in last byte of packet */
283        pad_len =  *(p_start + p_data->p_pkt->len);
284    }
285
286    /* do sanity check */
287    if ((offset > p_data->p_pkt->len) || ((pad_len + offset) > p_data->p_pkt->len))
288    {
289        AVDT_TRACE_WARNING("Got bad media packet");
290        GKI_freebuf(p_data->p_pkt);
291    }
292    /* adjust offset and length and send it up */
293    else
294    {
295        p_data->p_pkt->len -= (offset + pad_len);
296        p_data->p_pkt->offset += offset;
297
298        if (p_scb->cs.p_data_cback != NULL)
299        {
300            /* report sequence number */
301            p_data->p_pkt->layer_specific = seq;
302            (*p_scb->cs.p_data_cback)(avdt_scb_to_hdl(p_scb), p_data->p_pkt,
303                time_stamp, (UINT8)(m_pt | (marker<<7)));
304        }
305        else
306        {
307#if AVDT_MULTIPLEXING == TRUE
308            if ((p_scb->cs.p_media_cback != NULL)
309             && (p_scb->p_media_buf != NULL)
310             && (p_scb->media_buf_len > p_data->p_pkt->len))
311            {
312                /* media buffer enough length is assigned by application. Lets use it*/
313                memcpy(p_scb->p_media_buf,(UINT8*)(p_data->p_pkt + 1) + p_data->p_pkt->offset,
314                    p_data->p_pkt->len);
315                (*p_scb->cs.p_media_cback)(avdt_scb_to_hdl(p_scb),p_scb->p_media_buf,
316                    p_scb->media_buf_len,time_stamp,seq,m_pt,marker);
317            }
318#endif
319            GKI_freebuf(p_data->p_pkt);
320        }
321    }
322}
323
324#if AVDT_REPORTING == TRUE
325/*******************************************************************************
326**
327** Function         avdt_scb_hdl_report
328**
329** Description
330**
331** Returns          Nothing.
332**
333*******************************************************************************/
334UINT8 * avdt_scb_hdl_report(tAVDT_SCB *p_scb, UINT8 *p, UINT16 len)
335{
336    UINT16  result = AVDT_SUCCESS;
337    UINT8   *p_start = p;
338    UINT32  ssrc;
339    UINT8   o_v, o_p, o_cc;
340    AVDT_REPORT_TYPE    pt;
341    tAVDT_REPORT_DATA   report, *p_rpt;
342
343    AVDT_TRACE_DEBUG( "avdt_scb_hdl_report");
344    if(p_scb->cs.p_report_cback)
345    {
346        p_rpt = &report;
347        /* parse report packet header */
348        AVDT_MSG_PRS_RPT_OCTET1(p, o_v, o_p, o_cc);
349        pt = *p++;
350        p += 2;
351        BE_STREAM_TO_UINT32(ssrc, p);
352
353        UNUSED(o_p);
354        UNUSED(o_v);
355
356        switch(pt)
357        {
358        case AVDT_RTCP_PT_SR:   /* the packet type - SR (Sender Report) */
359            BE_STREAM_TO_UINT32(report.sr.ntp_sec, p);
360            BE_STREAM_TO_UINT32(report.sr.ntp_frac, p);
361            BE_STREAM_TO_UINT32(report.sr.rtp_time, p);
362            BE_STREAM_TO_UINT32(report.sr.pkt_count, p);
363            BE_STREAM_TO_UINT32(report.sr.octet_count, p);
364            break;
365
366        case AVDT_RTCP_PT_RR:   /* the packet type - RR (Receiver Report) */
367            report.rr.frag_lost = *p;
368            BE_STREAM_TO_UINT32(report.rr.packet_lost, p);
369            report.rr.packet_lost &= 0xFFFFFF;
370            BE_STREAM_TO_UINT32(report.rr.seq_num_rcvd, p);
371            BE_STREAM_TO_UINT32(report.rr.jitter, p);
372            BE_STREAM_TO_UINT32(report.rr.lsr, p);
373            BE_STREAM_TO_UINT32(report.rr.dlsr, p);
374            break;
375
376        case AVDT_RTCP_PT_SDES: /* the packet type - SDES (Source Description) */
377            if(*p == AVDT_RTCP_SDES_CNAME)
378            {
379                p_rpt = (tAVDT_REPORT_DATA *)(p+2);
380            }
381            else
382            {
383                AVDT_TRACE_WARNING( " - SDES SSRC=0x%08x sc=%d %d len=%d %s",
384                    ssrc, o_cc, *p, *(p+1), p+2);
385                result = AVDT_BUSY;
386            }
387            break;
388
389        default:
390            AVDT_TRACE_ERROR( "Bad Report pkt - packet type: %d", pt);
391            result = AVDT_BAD_PARAMS;
392        }
393
394        if(result == AVDT_SUCCESS)
395            (*p_scb->cs.p_report_cback)(avdt_scb_to_hdl(p_scb), pt, p_rpt);
396
397    }
398    p_start += len;
399    return p_start;
400}
401#endif
402
403#if AVDT_MULTIPLEXING == TRUE
404/*******************************************************************************
405**
406** Function         avdt_scb_hdl_pkt_frag
407**
408** Description
409**
410** Returns          Nothing.
411**
412*******************************************************************************/
413void avdt_scb_hdl_pkt_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
414{
415    /* Fields of Adaptation Layer Header */
416    UINT8   al_tsid,al_frag,al_lcode;
417    UINT16  al_len;
418    /* media header fields */
419    UINT8   o_v, o_p, o_x, o_cc;
420    UINT8   m_pt;
421    UINT8   marker;
422    UINT16  seq;
423    UINT32  time_stamp;
424    UINT32  ssrc;
425    UINT16  ex_len;
426    UINT8   pad_len;
427    /* other variables */
428    UINT8   *p; /* current pointer */
429    UINT8   *p_end; /* end of all packet */
430    UINT8   *p_payload; /* pointer to media fragment payload in the buffer */
431    UINT32  payload_len; /* payload length */
432    UINT16  frag_len; /* fragment length */
433
434    p = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
435    p_end = p + p_data->p_pkt->len;
436    /* parse all fragments */
437    while(p < p_end)
438    {
439        if (p_end - p < 4) /* length check. maximum length of AL header = 4 */
440        {
441            AVDT_TRACE_WARNING("p_end: 0x%x - p:0x%x < 4", p_end, p);
442            break;
443        }
444
445        /* parse first byte */
446        al_tsid = (*p)>>3;
447        al_frag = ( (*p) >> 2 ) & 0x01;
448        al_lcode = (*p++) & AVDT_ALH_LCODE_MASK;
449
450        /* in case of TSID=00000, a second AL header byte, before the length field,
451        ** is expected and contains the actual TSID, aligned with MSB */
452        if(al_tsid == 0)
453            al_tsid = *p++;
454
455        /* get remaining media length on base of lcode */
456        switch(al_lcode)
457        {
458        case AVDT_ALH_LCODE_NONE:  /* No length field present. Take length from l2cap */
459            al_len = (UINT16)(p_end - p);
460            break;
461        case AVDT_ALH_LCODE_16BIT:  /* 16 bit length field */
462            BE_STREAM_TO_UINT16(al_len, p);
463            break;
464        case AVDT_ALH_LCODE_9BITM0:  /* 9 bit length field, MSB = 0, 8 LSBs in 1 octet following */
465            al_len = *p++;
466            break;
467        default:    /* 9 bit length field, MSB = 1, 8 LSBs in 1 octet following */
468            al_len =(UINT16)*p++ + 0x100;
469        }
470
471        /* max fragment length */
472        frag_len = (UINT16)(p_end - p);
473        /* if it isn't last fragment */
474        if(frag_len >= al_len)
475            frag_len = al_len;
476
477        /* check TSID corresponds to config */
478        if (al_tsid != p_scb->curr_cfg.mux_tsid_media)
479        {
480#if AVDT_REPORTING == TRUE
481            if((p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT) &&
482                (al_tsid == p_scb->curr_cfg.mux_tsid_report))
483            {
484                /* parse reporting packet */
485                p = avdt_scb_hdl_report(p_scb, p, frag_len);
486                continue;
487            }
488            else
489#endif
490            {
491                AVDT_TRACE_WARNING("bad tsid: %d, mux_tsid_media:%d", al_tsid, p_scb->curr_cfg.mux_tsid_media);
492                break;
493            }
494        }
495        /* check are buffer for assembling and related callback set */
496        else if ((p_scb->p_media_buf == NULL) || (p_scb->cs.p_media_cback == NULL))
497        {
498            AVDT_TRACE_WARNING("NULL p_media_buf or p_media_cback");
499            break;
500        }
501
502
503        /* it is media fragment beginning */
504        if(!al_frag) /* is it first fragment of original media packet */
505        {
506            AVDT_TRACE_DEBUG("al:%d media:%d",
507                al_len, p_scb->media_buf_len);
508
509            p_scb->frag_off = 0;
510            p_scb->frag_org_len = al_len; /* total length of original media packet */
511            /* length check: minimum length of media header is 12 */
512            if (p_scb->frag_org_len < 12)
513            {
514                AVDT_TRACE_WARNING("bad al_len: %d(<12)", al_len);
515                break;
516            }
517            /* check that data fit into buffer */
518            if (al_len > p_scb->media_buf_len)
519            {
520                AVDT_TRACE_WARNING("bad al_len: %d(>%d)", al_len, p_scb->media_buf_len);
521                break;
522            }
523            /* make sure it is the last fragment in l2cap packet */
524            if (p + al_len < p_end)
525            {
526                AVDT_TRACE_WARNING("bad al_len: %d(>%d)", al_len, p_scb->media_buf_len);
527                break;
528            }
529        }
530        else
531        {
532            AVDT_TRACE_DEBUG("al:%d media:%d frag_org_len:%d frag_off:%d",
533                al_len, p_scb->media_buf_len, p_scb->frag_org_len, p_scb->frag_off);
534
535            /* check that remaining length from AL header equals to original len - length of already received fragments */
536            if(al_len != p_scb->frag_org_len - p_scb->frag_off)
537            {
538                AVDT_TRACE_WARNING("al_len:%d != (frag_org_len:%d - frag_off:%d) %d",
539                    al_len, p_scb->frag_org_len, p_scb->frag_off,
540                    (p_scb->frag_org_len- p_scb->frag_off));
541                break;
542            }
543
544            /* do sanity check */
545            if (p_scb->frag_off == 0)
546            {
547                AVDT_TRACE_WARNING("frag_off=0");
548                break;
549            }
550        }
551        /* do common sanity check */
552        if((p_scb->frag_org_len <= p_scb->frag_off) || (p_scb->frag_org_len >= p_scb->media_buf_len))
553        {
554            AVDT_TRACE_WARNING("common sanity frag_off:%d frag_org_len:%d media_buf_len:%d",
555                p_scb->frag_off, p_scb->frag_org_len, p_scb->media_buf_len);
556            break;
557        }
558
559        AVDT_TRACE_DEBUG("Received fragment org_len=%d off=%d al_len=%d frag_len=%d",
560            p_scb->frag_org_len, p_scb->frag_off, al_len, frag_len);
561
562        /* copy fragment into buffer */
563        memcpy(p_scb->p_media_buf + p_scb->frag_off, p, frag_len);
564        p_scb->frag_off += frag_len;
565        /* move to the next fragment */
566        p += frag_len;
567        /* if it is last fragment in original media packet then process total media pocket */
568        if(p_scb->frag_off == p_scb->frag_org_len)
569        {
570            p_payload = p_scb->p_media_buf;
571
572            /* media header */
573            AVDT_MSG_PRS_OCTET1(p_payload, o_v, o_p, o_x, o_cc);
574            AVDT_MSG_PRS_M_PT(p_payload, m_pt, marker);
575            BE_STREAM_TO_UINT16(seq, p_payload);
576            BE_STREAM_TO_UINT32(time_stamp, p_payload);
577            BE_STREAM_TO_UINT32(ssrc, p_payload);
578
579            UNUSED(o_v);
580            UNUSED(ssrc);
581
582            /* skip over any csrc's in packet */
583            p_payload += o_cc * 4;
584
585            /* check for and skip over extension header */
586            if (o_x)
587            {
588                if(p_scb->p_media_buf + p_scb->frag_off - p_payload < 4)
589                {
590                    AVDT_TRACE_WARNING("length check frag_off:%d p_media_buf:%d p_payload:%d",
591                        p_scb->frag_off, p_scb->p_media_buf, p_payload);
592                    break;/* length check */
593                }
594                p_payload += 2;
595                BE_STREAM_TO_UINT16(ex_len, p_payload);
596                p_payload += ex_len * 4;
597            }
598
599            if(p_payload >= p_scb->p_media_buf + p_scb->frag_off)
600            {
601                AVDT_TRACE_WARNING("length check2 frag_off:%d p_media_buf:%d p_payload:%d",
602                    p_scb->frag_off, p_scb->p_media_buf, p_payload);
603                break;/* length check */
604            }
605
606            /* adjust length for any padding at end of packet */
607            if (o_p)
608            {
609                /* padding length in last byte of packet */
610                pad_len =  *(p_scb->p_media_buf + p_scb->frag_off - 1);
611            }
612            else
613                pad_len =  0;
614            /* payload length */
615            payload_len = (UINT32)(p_scb->p_media_buf + p_scb->frag_off - pad_len - p_payload);
616
617            AVDT_TRACE_DEBUG("Received last fragment header=%d len=%d",
618                p_payload - p_scb->p_media_buf,payload_len);
619
620            /* send total media packet up */
621            if (p_scb->cs.p_media_cback != NULL)
622            {
623                (*p_scb->cs.p_media_cback)(avdt_scb_to_hdl(p_scb), p_payload,
624                                           payload_len, time_stamp, seq, m_pt, marker);
625            }
626        }
627    } /* while(p < p_end) */
628
629    if(p < p_end)
630    {
631        AVDT_TRACE_WARNING("*** Got bad media packet");
632    }
633    GKI_freebuf(p_data->p_pkt);
634}
635#endif
636
637/*******************************************************************************
638**
639** Function         avdt_scb_hdl_pkt
640**
641** Description
642**
643** Returns          Nothing.
644**
645*******************************************************************************/
646void avdt_scb_hdl_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
647{
648#if AVDT_REPORTING == TRUE
649    UINT8 *p;
650#endif
651
652#if AVDT_MULTIPLEXING == TRUE
653    /* select right function in dependance of is fragmentation supported or not */
654    if( 0 != (p_scb->curr_cfg.psc_mask & AVDT_PSC_MUX))
655    {
656        avdt_scb_hdl_pkt_frag(p_scb, p_data);
657    }
658    else
659#endif
660#if AVDT_REPORTING == TRUE
661    if(p_data->p_pkt->layer_specific == AVDT_CHAN_REPORT)
662    {
663        p = (UINT8 *)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
664        avdt_scb_hdl_report(p_scb, p, p_data->p_pkt->len);
665        GKI_freebuf(p_data->p_pkt);
666    }
667    else
668#endif
669        avdt_scb_hdl_pkt_no_frag(p_scb, p_data);
670}
671
672/*******************************************************************************
673**
674** Function         avdt_scb_drop_pkt
675**
676** Description      Drop an incoming media packet.  This function is called if
677**                  a media packet is received in any state besides streaming.
678**
679** Returns          Nothing.
680**
681*******************************************************************************/
682void avdt_scb_drop_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
683{
684    UNUSED(p_scb);
685
686    GKI_freebuf(p_data->p_pkt);
687    AVDT_TRACE_ERROR(" avdt_scb_drop_pkt Dropped incoming media packet");
688}
689
690/*******************************************************************************
691**
692** Function         avdt_scb_hdl_reconfig_cmd
693**
694** Description      This function calls the application callback function
695**                  with a reconfiguration indication.
696**
697** Returns          Nothing.
698**
699*******************************************************************************/
700void avdt_scb_hdl_reconfig_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
701{
702    /* if command not supported */
703    if (p_scb->cs.nsc_mask & AVDT_NSC_RECONFIG)
704    {
705        /* send reject */
706        p_data->msg.hdr.err_code = AVDT_ERR_NSC;
707        p_data->msg.hdr.err_param = 0;
708        avdt_scb_event(p_scb, AVDT_SCB_API_RECONFIG_RSP_EVT, p_data);
709    }
710    else
711    {
712        /* store requested configuration */
713        memcpy(&p_scb->req_cfg, p_data->msg.reconfig_cmd.p_cfg, sizeof(tAVDT_CFG));
714
715        /* call application callback */
716        (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
717                                  NULL,
718                                  AVDT_RECONFIG_IND_EVT,
719                                  (tAVDT_CTRL *) &p_data->msg.reconfig_cmd);
720    }
721}
722
723/*******************************************************************************
724**
725** Function         avdt_scb_hdl_reconfig_rsp
726**
727** Description      This function calls the application callback function
728**                  with a reconfiguration confirm.
729**
730** Returns          Nothing.
731**
732*******************************************************************************/
733void avdt_scb_hdl_reconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
734{
735    if (p_data->msg.hdr.err_code == 0)
736    {
737        /* store new configuration */
738        if (p_scb->req_cfg.num_codec > 0)
739        {
740            p_scb->curr_cfg.num_codec = p_scb->req_cfg.num_codec;
741            memcpy(p_scb->curr_cfg.codec_info, p_scb->req_cfg.codec_info, AVDT_CODEC_SIZE);
742        }
743        if (p_scb->req_cfg.num_protect > 0)
744        {
745            p_scb->curr_cfg.num_protect = p_scb->req_cfg.num_protect;
746            memcpy(p_scb->curr_cfg.protect_info, p_scb->req_cfg.protect_info, AVDT_PROTECT_SIZE);
747        }
748    }
749
750    p_data->msg.svccap.p_cfg = &p_scb->curr_cfg;
751
752    /* call application callback */
753    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
754                              NULL,
755                              AVDT_RECONFIG_CFM_EVT,
756                              (tAVDT_CTRL *) &p_data->msg.svccap);
757}
758
759/*******************************************************************************
760**
761** Function         avdt_scb_hdl_security_cmd
762**
763** Description      This function calls the application callback with a
764**                  security indication.
765**
766** Returns          Nothing.
767**
768*******************************************************************************/
769void avdt_scb_hdl_security_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
770{
771    /* if command not supported */
772    if (p_scb->cs.nsc_mask & AVDT_NSC_SECURITY)
773    {
774        /* send reject */
775        p_data->msg.hdr.err_code = AVDT_ERR_NSC;
776        avdt_scb_event(p_scb, AVDT_SCB_API_SECURITY_RSP_EVT, p_data);
777    }
778    else
779    {
780        /* call application callback */
781        (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
782                                  NULL,
783                                  AVDT_SECURITY_IND_EVT,
784                                  (tAVDT_CTRL *) &p_data->msg.security_cmd);
785    }
786}
787
788/*******************************************************************************
789**
790** Function         avdt_scb_hdl_security_rsp
791**
792** Description      This function calls the application callback with a
793**                  security confirm.
794**
795** Returns          Nothing.
796**
797*******************************************************************************/
798void avdt_scb_hdl_security_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
799{
800    /* call application callback */
801    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
802                              NULL,
803                              AVDT_SECURITY_CFM_EVT,
804                              (tAVDT_CTRL *) &p_data->msg.security_cmd);
805}
806
807/*******************************************************************************
808**
809** Function         avdt_scb_hdl_setconfig_cmd
810**
811** Description      This function marks the SCB as in use and copies the
812**                  configuration and peer SEID to the SCB.  It then calls
813**                  the application callback with a configuration indication.
814**
815** Returns          Nothing.
816**
817*******************************************************************************/
818void avdt_scb_hdl_setconfig_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
819{
820    tAVDT_CFG *p_cfg;
821
822    if (!p_scb->in_use)
823    {
824        p_cfg = p_data->msg.config_cmd.p_cfg;
825        if(p_scb->cs.cfg.codec_info[AVDT_CODEC_TYPE_INDEX] == p_cfg->codec_info[AVDT_CODEC_TYPE_INDEX])
826        {
827            /* set sep as in use */
828            p_scb->in_use = TRUE;
829
830            /* copy info to scb */
831            p_scb->p_ccb = avdt_ccb_by_idx(p_data->msg.config_cmd.hdr.ccb_idx);
832            p_scb->peer_seid = p_data->msg.config_cmd.int_seid;
833            memcpy(&p_scb->req_cfg, p_cfg, sizeof(tAVDT_CFG));
834            /* call app callback */
835            (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), /* handle of scb- which is same as sep handle of bta_av_cb.p_scb*/
836                                      p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
837                                      AVDT_CONFIG_IND_EVT,
838                                      (tAVDT_CTRL *) &p_data->msg.config_cmd);
839        }
840        else
841        {
842            p_data->msg.hdr.err_code = AVDT_ERR_UNSUP_CFG;
843            p_data->msg.hdr.err_param = 0;
844            avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
845                              p_data->msg.hdr.sig_id, &p_data->msg);
846        }
847    }
848    else
849    {
850        avdt_scb_rej_in_use(p_scb, p_data);
851    }
852}
853
854/*******************************************************************************
855**
856** Function         avdt_scb_hdl_setconfig_rej
857**
858** Description      This function marks the SCB as not in use and calls the
859**                  application callback with an open confirm indicating failure.
860**
861** Returns          Nothing.
862**
863*******************************************************************************/
864void avdt_scb_hdl_setconfig_rej(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
865{
866    /* clear scb variables */
867    avdt_scb_clr_vars(p_scb, p_data);
868
869    /* tell ccb we're done with signaling channel */
870    avdt_ccb_event(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx), AVDT_CCB_UL_CLOSE_EVT, NULL);
871
872    /* call application callback */
873    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
874                              NULL,
875                              AVDT_OPEN_CFM_EVT,
876                              (tAVDT_CTRL *) &p_data->msg.hdr);
877}
878
879/*******************************************************************************
880**
881** Function         avdt_scb_hdl_setconfig_rsp
882**
883** Description      This function sends the SCB an AVDT_SCB_API_OPEN_REQ_EVT
884**                  to initiate sending of an open command message.
885**
886** Returns          Nothing.
887**
888*******************************************************************************/
889void avdt_scb_hdl_setconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
890{
891    tAVDT_EVT_HDR   single;
892    UNUSED(p_data);
893
894    if (p_scb->p_ccb != NULL)
895    {
896        /* save configuration */
897        memcpy(&p_scb->curr_cfg, &p_scb->req_cfg, sizeof(tAVDT_CFG));
898
899        /* initiate open */
900        single.seid = p_scb->peer_seid;
901        avdt_scb_event(p_scb, AVDT_SCB_API_OPEN_REQ_EVT, (tAVDT_SCB_EVT *) &single);
902    }
903}
904
905/*******************************************************************************
906**
907** Function         avdt_scb_hdl_start_cmd
908**
909** Description      This function calls the application callback with a
910**                  start indication.
911**
912** Returns          Nothing.
913**
914*******************************************************************************/
915void avdt_scb_hdl_start_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
916{
917    UNUSED(p_data);
918
919    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
920                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
921                              AVDT_START_IND_EVT,
922                              NULL);
923}
924
925/*******************************************************************************
926**
927** Function         avdt_scb_hdl_start_rsp
928**
929** Description      This function calls the application callback with a
930**                  start confirm.
931**
932** Returns          Nothing.
933**
934*******************************************************************************/
935void avdt_scb_hdl_start_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
936{
937    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
938                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
939                              AVDT_START_CFM_EVT,
940                              (tAVDT_CTRL *) &p_data->msg.hdr);
941}
942
943/*******************************************************************************
944**
945** Function         avdt_scb_hdl_suspend_cmd
946**
947** Description      This function calls the application callback with a suspend
948**                  indication.
949**
950** Returns          Nothing.
951**
952*******************************************************************************/
953void avdt_scb_hdl_suspend_cmd(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
954{
955    UNUSED(p_data);
956
957    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
958                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
959                              AVDT_SUSPEND_IND_EVT,
960                              NULL);
961}
962
963/*******************************************************************************
964**
965** Function         avdt_scb_hdl_suspend_rsp
966**
967** Description      This function calls the application callback with a suspend
968**                  confirm.
969**
970** Returns          Nothing.
971**
972*******************************************************************************/
973void avdt_scb_hdl_suspend_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
974{
975    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
976                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
977                              AVDT_SUSPEND_CFM_EVT,
978                              (tAVDT_CTRL *) &p_data->msg.hdr);
979}
980
981/*******************************************************************************
982**
983** Function         avdt_scb_hdl_tc_close
984**
985** Description      This function is called when the transport channel is
986**                  closed.  It marks the SCB as not in use and
987**                  initializes certain SCB parameters.  It then sends
988**                  an AVDT_CCB_UL_CLOSE_EVT to the CCB if the SCB
989**                  initiated the close.  It then checks to see if the SCB
990**                  is to be removed.  If it is it deallocates the SCB.  Finally,
991**                  it calls the application callback with a close indication.
992**
993** Returns          Nothing.
994**
995*******************************************************************************/
996void avdt_scb_hdl_tc_close(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
997{
998    UINT8               hdl = avdt_scb_to_hdl(p_scb);
999    tAVDT_CTRL_CBACK    *p_ctrl_cback = p_scb->cs.p_ctrl_cback;
1000    tAVDT_CTRL          avdt_ctrl;
1001    UINT8               event;
1002    tAVDT_CCB           *p_ccb = p_scb->p_ccb;
1003    BD_ADDR remote_addr;
1004
1005
1006    memcpy (remote_addr, p_ccb->peer_addr, BD_ADDR_LEN);
1007
1008    /* set up hdr */
1009    avdt_ctrl.hdr.err_code = p_scb->close_code;
1010
1011    /* clear sep variables */
1012    avdt_scb_clr_vars(p_scb, p_data);
1013    p_scb->media_seq = 0;
1014    p_scb->cong = FALSE;
1015
1016    /* free pkt we're holding, if any */
1017    if (p_scb->p_pkt != NULL)
1018    {
1019        GKI_freebuf(p_scb->p_pkt);
1020        p_scb->p_pkt = NULL;
1021    }
1022
1023    /* stop transport channel timer */
1024    btu_stop_timer(&p_scb->timer_entry);
1025
1026    if ((p_scb->role == AVDT_CLOSE_INT) || (p_scb->role == AVDT_OPEN_INT))
1027    {
1028        /* tell ccb we're done with signaling channel */
1029        avdt_ccb_event(p_ccb, AVDT_CCB_UL_CLOSE_EVT, NULL);
1030    }
1031    event = (p_scb->role == AVDT_CLOSE_INT) ? AVDT_CLOSE_CFM_EVT : AVDT_CLOSE_IND_EVT;
1032    p_scb->role = AVDT_CLOSE_ACP;
1033
1034    if (p_scb->remove)
1035    {
1036        avdt_scb_dealloc(p_scb, NULL);
1037    }
1038
1039    /* call app callback */
1040    (*p_ctrl_cback)(hdl, remote_addr, event, &avdt_ctrl);
1041}
1042
1043/*******************************************************************************
1044**
1045** Function         avdt_scb_snd_delay_rpt_req
1046**
1047** Description      This function calls the application callback with a delay
1048**                  report.
1049**
1050** Returns          Nothing.
1051**
1052*******************************************************************************/
1053void avdt_scb_snd_delay_rpt_req (tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1054{
1055    avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_DELAY_RPT, (tAVDT_MSG *) &p_data->apidelay);
1056}
1057
1058/*******************************************************************************
1059**
1060** Function         avdt_scb_hdl_delay_rpt_cmd
1061**
1062** Description      This function calls the application callback with a delay
1063**                  report.
1064**
1065** Returns          Nothing.
1066**
1067*******************************************************************************/
1068void avdt_scb_hdl_delay_rpt_cmd (tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1069{
1070    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
1071                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
1072                              AVDT_DELAY_REPORT_EVT,
1073                              (tAVDT_CTRL *) &p_data->msg.hdr);
1074
1075    if (p_scb->p_ccb)
1076        avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_DELAY_RPT, &p_data->msg);
1077    else
1078        avdt_scb_rej_not_in_use(p_scb, p_data);
1079}
1080
1081/*******************************************************************************
1082**
1083** Function         avdt_scb_hdl_delay_rpt_rsp
1084**
1085** Description      This function calls the application callback with a delay
1086**                  report.
1087**
1088** Returns          Nothing.
1089**
1090*******************************************************************************/
1091void avdt_scb_hdl_delay_rpt_rsp (tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1092{
1093    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
1094                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
1095                              AVDT_DELAY_REPORT_CFM_EVT,
1096                              (tAVDT_CTRL *) &p_data->msg.hdr);
1097}
1098
1099#if AVDT_REPORTING == TRUE
1100/*******************************************************************************
1101**
1102** Function         avdt_scb_hdl_tc_close_sto
1103**
1104** Description      This function is called when a channel is closed in OPEN
1105**                  state.  Check the channel type and process accordingly.
1106**
1107** Returns          Nothing.
1108**
1109*******************************************************************************/
1110void avdt_scb_hdl_tc_close_sto(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1111{
1112    tAVDT_CTRL          avdt_ctrl;
1113    /* AVDT_CHAN_SIG does not visit this action */
1114    if(p_data && p_data->close.type != AVDT_CHAN_MEDIA)
1115    {
1116        /* it's reporting or recovery channel,
1117         * the channel close in open state means the peer does not support it */
1118        if(p_data->close.old_tc_state == AVDT_AD_ST_OPEN)
1119        {
1120            avdt_ctrl.hdr.err_code = 0;
1121            avdt_ctrl.hdr.err_param = 0;
1122            /* call app callback */
1123            (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
1124                                      p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
1125                                      AVDT_REPORT_DISCONN_EVT, &avdt_ctrl);
1126        }
1127    }
1128    else
1129    {
1130        /* must be in OPEN state. need to go back to idle */
1131        avdt_scb_event(p_scb, AVDT_SCB_MSG_ABORT_RSP_EVT, NULL);
1132        avdt_scb_hdl_tc_close(p_scb, p_data);
1133    }
1134}
1135#endif
1136
1137/*******************************************************************************
1138**
1139** Function         avdt_scb_hdl_tc_open
1140**
1141** Description      This function is called when the transport channel is
1142**                  opened while in the opening state.  It calls the
1143**                  application callback with an open indication or open
1144**                  confirm depending on who initiated the open procedure.
1145**
1146** Returns          Nothing.
1147**
1148*******************************************************************************/
1149void avdt_scb_hdl_tc_open(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1150{
1151    UINT8   event;
1152#if AVDT_REPORTING == TRUE
1153    UINT8   role;
1154#endif
1155
1156    /* stop transport channel connect timer */
1157    btu_stop_timer(&p_scb->timer_entry);
1158
1159    event = (p_scb->role == AVDT_OPEN_INT) ? AVDT_OPEN_CFM_EVT : AVDT_OPEN_IND_EVT;
1160    p_data->open.hdr.err_code = 0;
1161
1162    AVDT_TRACE_DEBUG("psc_mask: cfg: 0x%x, req:0x%x, cur: 0x%x",
1163        p_scb->cs.cfg.psc_mask, p_scb->req_cfg.psc_mask, p_scb->curr_cfg.psc_mask);
1164#if AVDT_REPORTING == TRUE
1165    if(p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT)
1166    {
1167        /* open the reporting channel, if both devices support it */
1168        role = (p_scb->role == AVDT_OPEN_INT) ? AVDT_INT : AVDT_ACP;
1169        avdt_ad_open_req(AVDT_CHAN_REPORT, p_scb->p_ccb, p_scb, role);
1170    }
1171#endif
1172
1173    /* call app callback */
1174    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
1175                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
1176                              event,
1177                              (tAVDT_CTRL *) &p_data->open);
1178}
1179
1180#if AVDT_REPORTING == TRUE
1181/*******************************************************************************
1182**
1183** Function         avdt_scb_hdl_tc_open_sto
1184**
1185** Description      This function is called when the transport channel is
1186**                  opened while in the opening state.  It calls the
1187**                  application callback with an open indication or open
1188**                  confirm depending on who initiated the open procedure.
1189**
1190** Returns          Nothing.
1191**
1192*******************************************************************************/
1193void avdt_scb_hdl_tc_open_sto(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1194{
1195    tAVDT_CTRL          avdt_ctrl;
1196    /* open reporting channel here, when it is implemented */
1197
1198    /* call app callback */
1199    if(p_data->open.hdr.err_code == AVDT_CHAN_REPORT)
1200    {
1201        avdt_ctrl.hdr.err_code = 0;
1202        avdt_ctrl.hdr.err_param = 1;
1203        (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
1204                              p_scb->p_ccb ? p_scb->p_ccb->peer_addr : NULL,
1205                              AVDT_REPORT_CONN_EVT, &avdt_ctrl);
1206    }
1207}
1208#endif
1209
1210/*******************************************************************************
1211**
1212** Function         avdt_scb_hdl_write_req_no_frag
1213**
1214** Description      This function frees the media packet currently stored in
1215**                  the SCB, if any.  Then it builds a new media packet from
1216**                  with the passed in buffer and stores it in the SCB.
1217**
1218** Returns          Nothing.
1219**
1220*******************************************************************************/
1221void avdt_scb_hdl_write_req_no_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1222{
1223    UINT8   *p;
1224    UINT32  ssrc;
1225
1226    /* free packet we're holding, if any; to be replaced with new */
1227    if (p_scb->p_pkt != NULL)
1228    {
1229        GKI_freebuf(p_scb->p_pkt);
1230
1231        /* this shouldn't be happening */
1232        AVDT_TRACE_WARNING("Dropped media packet; congested");
1233    }
1234
1235    /* build a media packet */
1236    /* Add RTP header if required */
1237    if ( !(p_data->apiwrite.opt & AVDT_DATA_OPT_NO_RTP) )
1238    {
1239        ssrc = avdt_scb_gen_ssrc(p_scb);
1240
1241        p_data->apiwrite.p_buf->len += AVDT_MEDIA_HDR_SIZE;
1242        p_data->apiwrite.p_buf->offset -= AVDT_MEDIA_HDR_SIZE;
1243        p_scb->media_seq++;
1244        p = (UINT8 *)(p_data->apiwrite.p_buf + 1) + p_data->apiwrite.p_buf->offset;
1245
1246        UINT8_TO_BE_STREAM(p, AVDT_MEDIA_OCTET1);
1247        UINT8_TO_BE_STREAM(p, p_data->apiwrite.m_pt);
1248        UINT16_TO_BE_STREAM(p, p_scb->media_seq);
1249        UINT32_TO_BE_STREAM(p, p_data->apiwrite.time_stamp);
1250        UINT32_TO_BE_STREAM(p, ssrc);
1251    }
1252
1253    /* store it */
1254    p_scb->p_pkt = p_data->apiwrite.p_buf;
1255}
1256
1257#if AVDT_MULTIPLEXING == TRUE
1258/*******************************************************************************
1259**
1260** Function         avdt_scb_hdl_write_req_frag
1261**
1262** Description      This function builds a new fragments of media packet from
1263**                  the passed in buffers and stores them in the SCB.
1264**
1265** Returns          Nothing.
1266**
1267*******************************************************************************/
1268void avdt_scb_hdl_write_req_frag(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1269{
1270    UINT8   *p;
1271    UINT32  ssrc;
1272    BT_HDR  *p_frag;
1273
1274    /* free fragments we're holding, if any; it shouldn't happen */
1275    if (!GKI_queue_is_empty(&p_scb->frag_q))
1276    {
1277        while((p_frag = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
1278            GKI_freebuf(p_frag);
1279
1280        /* this shouldn't be happening */
1281        AVDT_TRACE_WARNING("*** Dropped media packet; congested");
1282    }
1283
1284    /* build a media fragments */
1285    p_scb->frag_off = p_data->apiwrite.data_len;
1286    p_scb->p_next_frag = p_data->apiwrite.p_data;
1287
1288    ssrc = avdt_scb_gen_ssrc(p_scb);
1289
1290    /* get first packet */
1291    p_frag = (BT_HDR*)GKI_getfirst (&p_data->apiwrite.frag_q);
1292    /* posit on Adaptation Layer header */
1293    p_frag->len += AVDT_AL_HDR_SIZE + AVDT_MEDIA_HDR_SIZE;
1294    p_frag->offset -= AVDT_AL_HDR_SIZE + AVDT_MEDIA_HDR_SIZE;
1295    p = (UINT8 *)(p_frag + 1) + p_frag->offset;
1296
1297    /* Adaptation Layer header */
1298    /* TSID, no-fragment bit and coding of length(in 2 length octets following) */
1299    *p++ = (p_scb->curr_cfg.mux_tsid_media<<3) | AVDT_ALH_LCODE_16BIT;
1300
1301    /* length of all remaining transport packet */
1302    UINT16_TO_BE_STREAM(p, p_frag->layer_specific+AVDT_MEDIA_HDR_SIZE );
1303    /* media header */
1304    UINT8_TO_BE_STREAM(p, AVDT_MEDIA_OCTET1);
1305    UINT8_TO_BE_STREAM(p, p_data->apiwrite.m_pt);
1306    UINT16_TO_BE_STREAM(p, p_scb->media_seq);
1307    UINT32_TO_BE_STREAM(p, p_data->apiwrite.time_stamp);
1308    UINT32_TO_BE_STREAM(p, ssrc);
1309    p_scb->media_seq++;
1310
1311    while((p_frag = (BT_HDR*)GKI_getnext (p_frag)) != NULL)
1312    {
1313        /* posit on Adaptation Layer header */
1314        p_frag->len += AVDT_AL_HDR_SIZE;
1315        p_frag->offset -= AVDT_AL_HDR_SIZE;
1316        p = (UINT8 *)(p_frag + 1) + p_frag->offset;
1317        /* Adaptation Layer header */
1318        /* TSID, fragment bit and coding of length(in 2 length octets following) */
1319        *p++ = (p_scb->curr_cfg.mux_tsid_media<<3) | (AVDT_ALH_FRAG_MASK|AVDT_ALH_LCODE_16BIT);
1320
1321        /* length of all remaining transport packet */
1322        UINT16_TO_BE_STREAM(p, p_frag->layer_specific );
1323    }
1324
1325    /* store it */
1326    p_scb->frag_q = p_data->apiwrite.frag_q;
1327}
1328#endif
1329
1330
1331/*******************************************************************************
1332**
1333** Function         avdt_scb_hdl_write_req
1334**
1335** Description      This function calls one of the two versions of building functions
1336**                  for case with and without fragmentation
1337**
1338** Returns          Nothing.
1339**
1340*******************************************************************************/
1341void avdt_scb_hdl_write_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1342{
1343#if AVDT_MULTIPLEXING == TRUE
1344    if (GKI_queue_is_empty(&p_data->apiwrite.frag_q))
1345#endif
1346        avdt_scb_hdl_write_req_no_frag(p_scb, p_data);
1347#if AVDT_MULTIPLEXING == TRUE
1348    else
1349        avdt_scb_hdl_write_req_frag(p_scb, p_data);
1350#endif
1351}
1352
1353/*******************************************************************************
1354**
1355** Function         avdt_scb_snd_abort_req
1356**
1357** Description      This function sends an abort command message.
1358**
1359** Returns          Nothing.
1360**
1361*******************************************************************************/
1362void avdt_scb_snd_abort_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1363{
1364    tAVDT_EVT_HDR   hdr;
1365    UNUSED(p_data);
1366
1367    if (p_scb->p_ccb != NULL)
1368    {
1369        p_scb->role = AVDT_CLOSE_INT;
1370
1371        hdr.seid = p_scb->peer_seid;
1372
1373        avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_ABORT, (tAVDT_MSG *) &hdr);
1374    }
1375}
1376
1377/*******************************************************************************
1378**
1379** Function         avdt_scb_snd_abort_rsp
1380**
1381** Description      This function sends an abort response message.
1382**
1383** Returns          Nothing.
1384**
1385*******************************************************************************/
1386void avdt_scb_snd_abort_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1387{
1388    UNUSED(p_scb);
1389
1390    avdt_msg_send_rsp(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx), AVDT_SIG_ABORT,
1391                      &p_data->msg);
1392}
1393
1394/*******************************************************************************
1395**
1396** Function         avdt_scb_snd_close_req
1397**
1398** Description      This function sends a close command message.
1399**
1400** Returns          Nothing.
1401**
1402*******************************************************************************/
1403void avdt_scb_snd_close_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1404{
1405    tAVDT_EVT_HDR   hdr;
1406    UNUSED(p_data);
1407
1408    p_scb->role = AVDT_CLOSE_INT;
1409
1410    hdr.seid = p_scb->peer_seid;
1411
1412    avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_CLOSE, (tAVDT_MSG *) &hdr);
1413}
1414
1415/*******************************************************************************
1416**
1417** Function         avdt_scb_snd_stream_close
1418**
1419** Description      This function sends a close command message.
1420**
1421** Returns          Nothing.
1422**
1423*******************************************************************************/
1424void avdt_scb_snd_stream_close(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1425{
1426#if AVDT_MULTIPLEXING == TRUE
1427    BT_HDR          *p_frag;
1428
1429    AVDT_TRACE_WARNING("avdt_scb_snd_stream_close c:%d, off:%d",
1430        GKI_queue_length(&p_scb->frag_q), p_scb->frag_off);
1431    /* clean fragments queue */
1432    while((p_frag = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
1433         GKI_freebuf(p_frag);
1434    p_scb->frag_off = 0;
1435#endif
1436    if (p_scb->p_pkt)
1437    {
1438        GKI_freebuf(p_scb->p_pkt);
1439        p_scb->p_pkt = NULL;
1440    }
1441
1442#if 0
1443    if(p_scb->cong)
1444        p_scb->cong = FALSE;
1445
1446    /* p_scb->curr_cfg.mux_tsid_media == 0 */
1447#endif
1448    avdt_scb_snd_close_req(p_scb, p_data);
1449}
1450
1451/*******************************************************************************
1452**
1453** Function         avdt_scb_snd_close_rsp
1454**
1455** Description      This function sends a close response message.
1456**
1457** Returns          Nothing.
1458**
1459*******************************************************************************/
1460void avdt_scb_snd_close_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1461{
1462    avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_CLOSE, &p_data->msg);
1463}
1464
1465/*******************************************************************************
1466**
1467** Function         avdt_scb_snd_getconfig_req
1468**
1469** Description      This function sends a get configuration command message.
1470**
1471** Returns          Nothing.
1472**
1473*******************************************************************************/
1474void avdt_scb_snd_getconfig_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1475{
1476    tAVDT_EVT_HDR   hdr;
1477    UNUSED(p_data);
1478
1479    hdr.seid = p_scb->peer_seid;
1480
1481    avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_GETCONFIG, (tAVDT_MSG *) &hdr);
1482}
1483
1484/*******************************************************************************
1485**
1486** Function         avdt_scb_snd_getconfig_rsp
1487**
1488** Description      This function sends a get configuration response message.
1489**
1490** Returns          Nothing.
1491**
1492*******************************************************************************/
1493void avdt_scb_snd_getconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1494{
1495    avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_GETCONFIG, &p_data->msg);
1496}
1497
1498/*******************************************************************************
1499**
1500** Function         avdt_scb_snd_open_req
1501**
1502** Description      This function sends an open command message.
1503**
1504** Returns          Nothing.
1505**
1506*******************************************************************************/
1507void avdt_scb_snd_open_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1508{
1509    tAVDT_EVT_HDR   hdr;
1510    UNUSED(p_data);
1511
1512    hdr.seid = p_scb->peer_seid;
1513
1514    avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_OPEN, (tAVDT_MSG *) &hdr);
1515}
1516
1517/*******************************************************************************
1518**
1519** Function         avdt_scb_snd_open_rsp
1520**
1521** Description      This function sends an open response message.  It also
1522**                  calls avdt_ad_open_req() to accept a transport channel
1523**                  connection.
1524**
1525** Returns          Nothing.
1526**
1527*******************************************************************************/
1528void avdt_scb_snd_open_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1529{
1530    /* notify adaption that we're waiting for transport channel open */
1531    p_scb->role = AVDT_OPEN_ACP;
1532    avdt_ad_open_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, AVDT_ACP);
1533
1534    /* send response */
1535    avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_OPEN, &p_data->msg);
1536
1537    /* start tc connect timer */
1538    btu_start_timer(&p_scb->timer_entry, BTU_TTYPE_AVDT_SCB_TC, AVDT_SCB_TC_CONN_TOUT);
1539}
1540
1541/*******************************************************************************
1542**
1543** Function         avdt_scb_snd_reconfig_req
1544**
1545** Description      This function stores the configuration parameters in the
1546**                  SCB and sends a reconfiguration command message.
1547**
1548** Returns          Nothing.
1549**
1550*******************************************************************************/
1551void avdt_scb_snd_reconfig_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1552{
1553    memcpy(&p_scb->req_cfg, p_data->msg.config_cmd.p_cfg, sizeof(tAVDT_CFG));
1554    p_data->msg.hdr.seid = p_scb->peer_seid;
1555    avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_RECONFIG, &p_data->msg);
1556}
1557
1558/*******************************************************************************
1559**
1560** Function         avdt_scb_snd_reconfig_rsp
1561**
1562** Description      This function stores the configuration parameters in the
1563**                  SCB and sends a reconfiguration response message.
1564**
1565** Returns          Nothing.
1566**
1567*******************************************************************************/
1568void avdt_scb_snd_reconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1569{
1570    if (p_data->msg.hdr.err_code == 0)
1571    {
1572        /* store new configuration */
1573        if (p_scb->req_cfg.num_codec > 0)
1574        {
1575            p_scb->curr_cfg.num_codec = p_scb->req_cfg.num_codec;
1576            memcpy(p_scb->curr_cfg.codec_info, p_scb->req_cfg.codec_info, AVDT_CODEC_SIZE);
1577        }
1578        if (p_scb->req_cfg.num_protect > 0)
1579        {
1580            p_scb->curr_cfg.num_protect = p_scb->req_cfg.num_protect;
1581            memcpy(p_scb->curr_cfg.protect_info, p_scb->req_cfg.protect_info, AVDT_PROTECT_SIZE);
1582        }
1583
1584        /* send response */
1585        avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_RECONFIG, &p_data->msg);
1586    }
1587    else
1588    {
1589        /* send reject */
1590        avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_RECONFIG, &p_data->msg);
1591    }
1592}
1593
1594/*******************************************************************************
1595**
1596** Function         avdt_scb_snd_security_req
1597**
1598** Description      This function sends a security command message.
1599**
1600** Returns          Nothing.
1601**
1602*******************************************************************************/
1603void avdt_scb_snd_security_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1604{
1605    p_data->msg.hdr.seid = p_scb->peer_seid;
1606    avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_SECURITY, &p_data->msg);
1607}
1608
1609/*******************************************************************************
1610**
1611** Function         avdt_scb_snd_security_rsp
1612**
1613** Description      This function sends a security response message.
1614**
1615** Returns          Nothing.
1616**
1617*******************************************************************************/
1618void avdt_scb_snd_security_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1619{
1620    if (p_data->msg.hdr.err_code == 0)
1621    {
1622        avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_SECURITY, &p_data->msg);
1623    }
1624    else
1625    {
1626        avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_SECURITY, &p_data->msg);
1627    }
1628}
1629
1630/*******************************************************************************
1631**
1632** Function         avdt_scb_snd_setconfig_rej
1633**
1634** Description      This function marks the SCB as not in use and sends a
1635**                  set configuration reject message.
1636**
1637** Returns          Nothing.
1638**
1639*******************************************************************************/
1640void avdt_scb_snd_setconfig_rej(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1641{
1642    if (p_scb->p_ccb != NULL)
1643    {
1644        avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_SETCONFIG, &p_data->msg);
1645
1646        /* clear scb variables */
1647        avdt_scb_clr_vars(p_scb, p_data);
1648    }
1649}
1650
1651/*******************************************************************************
1652**
1653** Function         avdt_scb_snd_setconfig_req
1654**
1655** Description      This function marks the SCB as in use and copies the
1656**                  configuration parameters to the SCB.  Then the function
1657**                  sends a set configuration command message and initiates
1658**                  opening of the signaling channel.
1659**
1660** Returns          Nothing.
1661**
1662*******************************************************************************/
1663void avdt_scb_snd_setconfig_req(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1664{
1665    tAVDT_CFG *p_req, *p_cfg;
1666
1667    /* copy API parameters to scb, set scb as in use */
1668    p_scb->in_use = TRUE;
1669    p_scb->p_ccb = avdt_ccb_by_idx(p_data->msg.config_cmd.hdr.ccb_idx);
1670    p_scb->peer_seid = p_data->msg.config_cmd.hdr.seid;
1671    p_req = p_data->msg.config_cmd.p_cfg;
1672    p_cfg = &p_scb->cs.cfg;
1673#if AVDT_MULTIPLEXING == TRUE
1674    p_req->mux_tsid_media = p_cfg->mux_tsid_media;
1675    p_req->mux_tcid_media = p_cfg->mux_tcid_media;
1676    if(p_req->psc_mask & AVDT_PSC_REPORT)
1677    {
1678        p_req->mux_tsid_report = p_cfg->mux_tsid_report;
1679        p_req->mux_tcid_report = p_cfg->mux_tcid_report;
1680    }
1681#endif
1682    memcpy(&p_scb->req_cfg, p_data->msg.config_cmd.p_cfg, sizeof(tAVDT_CFG));
1683
1684    avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_SETCONFIG, &p_data->msg);
1685
1686    /* tell ccb to open channel */
1687    avdt_ccb_event(p_scb->p_ccb, AVDT_CCB_UL_OPEN_EVT, NULL);
1688}
1689
1690/*******************************************************************************
1691**
1692** Function         avdt_scb_snd_setconfig_rsp
1693**
1694** Description      This function copies the requested configuration into the
1695**                  current configuration and sends a set configuration
1696**                  response message.
1697**
1698** Returns          Nothing.
1699**
1700*******************************************************************************/
1701void avdt_scb_snd_setconfig_rsp(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1702{
1703    if (p_scb->p_ccb != NULL)
1704    {
1705        memcpy(&p_scb->curr_cfg, &p_scb->req_cfg, sizeof(tAVDT_CFG));
1706
1707        avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_SETCONFIG, &p_data->msg);
1708    }
1709}
1710
1711/*******************************************************************************
1712**
1713** Function         avdt_scb_snd_tc_close
1714**
1715** Description      This function calls avdt_ad_close_req() to close the
1716**                  transport channel for this SCB.
1717**
1718** Returns          Nothing.
1719**
1720*******************************************************************************/
1721void avdt_scb_snd_tc_close(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1722{
1723    UNUSED(p_data);
1724
1725#if AVDT_REPORTING == TRUE
1726    if(p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT)
1727        avdt_ad_close_req(AVDT_CHAN_REPORT, p_scb->p_ccb, p_scb);
1728#endif
1729    avdt_ad_close_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb);
1730}
1731
1732/*******************************************************************************
1733**
1734** Function         avdt_scb_cb_err
1735**
1736** Description      This function calls the application callback function
1737**                  indicating an error.
1738**
1739** Returns          Nothing.
1740**
1741*******************************************************************************/
1742void avdt_scb_cb_err(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1743{
1744    tAVDT_CTRL          avdt_ctrl;
1745    UNUSED(p_data);
1746
1747    /* set error code and parameter */
1748    avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
1749    avdt_ctrl.hdr.err_param = 0;
1750
1751    /* call callback, using lookup table to get callback event */
1752    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb),
1753                              NULL,
1754                              avdt_scb_cback_evt[p_scb->curr_evt],
1755                              &avdt_ctrl);
1756}
1757
1758/*******************************************************************************
1759**
1760** Function         avdt_scb_cong_state
1761**
1762** Description      This function sets the congestion state of the SCB media
1763**                  transport channel.
1764**
1765** Returns          Nothing.
1766**
1767*******************************************************************************/
1768void avdt_scb_cong_state(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1769{
1770    p_scb->cong = p_data->llcong;
1771}
1772
1773/*******************************************************************************
1774**
1775** Function         avdt_scb_rej_state
1776**
1777** Description      This function sends a reject message to the peer indicating
1778**                  incorrect state for the received command message.
1779**
1780** Returns          Nothing.
1781**
1782*******************************************************************************/
1783void avdt_scb_rej_state(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1784{
1785    UNUSED(p_scb);
1786
1787    p_data->msg.hdr.err_code = AVDT_ERR_BAD_STATE;
1788    p_data->msg.hdr.err_param = 0;
1789    avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
1790                      p_data->msg.hdr.sig_id, &p_data->msg);
1791}
1792
1793/*******************************************************************************
1794**
1795** Function         avdt_scb_rej_in_use
1796**
1797** Description      This function sends a reject message to the peer indicating
1798**                  the stream is in use.
1799**
1800** Returns          Nothing.
1801**
1802*******************************************************************************/
1803void avdt_scb_rej_in_use(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1804{
1805    UNUSED(p_scb);
1806
1807    p_data->msg.hdr.err_code = AVDT_ERR_IN_USE;
1808    p_data->msg.hdr.err_param = 0;
1809    avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
1810                      p_data->msg.hdr.sig_id, &p_data->msg);
1811}
1812
1813/*******************************************************************************
1814**
1815** Function         avdt_scb_rej_not_in_use
1816**
1817** Description      This function sends a reject message to the peer indicating
1818**                  the stream is in use.
1819**
1820** Returns          Nothing.
1821**
1822*******************************************************************************/
1823void avdt_scb_rej_not_in_use(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1824{
1825    UNUSED(p_scb);
1826
1827    p_data->msg.hdr.err_code = AVDT_ERR_NOT_IN_USE;
1828    p_data->msg.hdr.err_param = 0;
1829    avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
1830                      p_data->msg.hdr.sig_id, &p_data->msg);
1831}
1832
1833/*******************************************************************************
1834**
1835** Function         avdt_scb_set_remove
1836**
1837** Description      This function marks an SCB to be removed.
1838**
1839** Returns          Nothing.
1840**
1841*******************************************************************************/
1842void avdt_scb_set_remove(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1843{
1844    UNUSED(p_data);
1845
1846    p_scb->remove = TRUE;
1847}
1848
1849/*******************************************************************************
1850**
1851** Function         avdt_scb_free_pkt
1852**
1853** Description      This function frees the media packet passed in.
1854**
1855** Returns          Nothing.
1856**
1857*******************************************************************************/
1858void avdt_scb_free_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1859{
1860    tAVDT_CTRL      avdt_ctrl;
1861#if AVDT_MULTIPLEXING == TRUE
1862    BT_HDR          *p_frag;
1863#endif
1864
1865    /* set error code and parameter */
1866    avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
1867    avdt_ctrl.hdr.err_param = 0;
1868
1869    /* p_buf can be NULL in case using of fragments queue frag_q */
1870    if(p_data->apiwrite.p_buf)
1871        GKI_freebuf(p_data->apiwrite.p_buf);
1872
1873#if AVDT_MULTIPLEXING == TRUE
1874    /* clean fragments queue */
1875    while((p_frag = (BT_HDR*)GKI_dequeue (&p_data->apiwrite.frag_q)) != NULL)
1876         GKI_freebuf(p_frag);
1877#endif
1878
1879    AVDT_TRACE_WARNING("Dropped media packet");
1880
1881    /* we need to call callback to keep data flow going */
1882    (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT,
1883                              &avdt_ctrl);
1884}
1885
1886/*******************************************************************************
1887**
1888** Function         avdt_scb_clr_pkt
1889**
1890** Description      This function frees the media packet stored in the SCB.
1891**
1892** Returns          Nothing.
1893**
1894*******************************************************************************/
1895void avdt_scb_clr_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1896{
1897    tAVDT_CTRL      avdt_ctrl;
1898    tAVDT_CCB       *p_ccb;
1899    UINT8           tcid;
1900    UINT16          lcid;
1901#if AVDT_MULTIPLEXING == TRUE
1902    BT_HDR          *p_frag;
1903#endif
1904    UNUSED(p_data);
1905
1906    /* set error code and parameter */
1907    avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
1908    avdt_ctrl.hdr.err_param = 0;
1909    /* flush the media data queued at L2CAP */
1910    if((p_ccb = p_scb->p_ccb) != NULL)
1911    {
1912        /* get tcid from type, scb */
1913        tcid = avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb);
1914
1915        lcid = avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_ccb)][tcid].lcid;
1916        L2CA_FlushChannel (lcid, L2CAP_FLUSH_CHANS_ALL);
1917    }
1918
1919    if (p_scb->p_pkt != NULL)
1920    {
1921        GKI_freebuf(p_scb->p_pkt);
1922        p_scb->p_pkt = NULL;
1923
1924        AVDT_TRACE_DEBUG("Dropped stored media packet");
1925
1926        /* we need to call callback to keep data flow going */
1927        (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT,
1928                                  &avdt_ctrl);
1929    }
1930#if AVDT_MULTIPLEXING == TRUE
1931    else if(!GKI_queue_is_empty (&p_scb->frag_q))
1932    {
1933        AVDT_TRACE_DEBUG("Dropped fragments queue");
1934        /* clean fragments queue */
1935        while((p_frag = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
1936             GKI_freebuf(p_frag);
1937
1938        p_scb->frag_off = 0;
1939
1940        /* we need to call callback to keep data flow going */
1941        (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT,
1942                                  &avdt_ctrl);
1943    }
1944#endif
1945}
1946
1947
1948/*******************************************************************************
1949**
1950** Function         avdt_scb_chk_snd_pkt
1951**
1952** Description      This function checks if the SCB is congested, and if not
1953**                  congested it sends a stored media packet, if any.  After it
1954**                  sends the packet it calls the application callback function
1955**                  with a write confirm.
1956**
1957** Returns          Nothing.
1958**
1959*******************************************************************************/
1960void avdt_scb_chk_snd_pkt(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
1961{
1962    tAVDT_CTRL      avdt_ctrl;
1963    BT_HDR          *p_pkt;
1964#if AVDT_MULTIPLEXING == TRUE
1965    BOOLEAN         sent = FALSE;
1966    UINT8   res = AVDT_AD_SUCCESS;
1967    tAVDT_SCB_EVT data;
1968#endif
1969    UNUSED(p_data);
1970
1971    avdt_ctrl.hdr.err_code = 0;
1972
1973    if (!p_scb->cong)
1974    {
1975        if (p_scb->p_pkt != NULL)
1976        {
1977            p_pkt = p_scb->p_pkt;
1978            p_scb->p_pkt = NULL;
1979            avdt_ad_write_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, p_pkt);
1980
1981            (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT, &avdt_ctrl);
1982        }
1983#if AVDT_MULTIPLEXING == TRUE
1984        else
1985        {
1986#if 0
1987            AVDT_TRACE_DEBUG("num_q=%d",
1988                L2CA_FlushChannel(avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_scb->p_ccb)][avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb)].lcid),
1989                                  L2CAP_FLUSH_CHANS_GET);
1990#endif
1991            while((p_pkt = (BT_HDR*)GKI_dequeue (&p_scb->frag_q)) != NULL)
1992            {
1993                sent = TRUE;
1994                AVDT_TRACE_DEBUG("Send fragment len=%d",p_pkt->len);
1995                /* fragments queue contains fragment to send */
1996                res = avdt_ad_write_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, p_pkt);
1997                if(AVDT_AD_CONGESTED == res)
1998                {
1999                    p_scb->cong = TRUE;
2000                    AVDT_TRACE_DEBUG("avdt/l2c congested!!");
2001                    break;/* exit loop if channel became congested */
2002            }
2003            }
2004            AVDT_TRACE_DEBUG("res=%d left=%d",res, p_scb->frag_off);
2005
2006            if(p_scb->frag_off)
2007            {
2008                if(AVDT_AD_SUCCESS == res || GKI_queue_is_empty (&p_scb->frag_q))
2009                {
2010                    /* all buffers were sent to L2CAP, compose more to queue */
2011                    avdt_scb_queue_frags(p_scb, &p_scb->p_next_frag, &p_scb->frag_off, &p_scb->frag_q);
2012                    if(!GKI_queue_is_empty (&p_scb->frag_q))
2013                    {
2014                        data.llcong = p_scb->cong;
2015                        avdt_scb_event(p_scb, AVDT_SCB_TC_CONG_EVT, &data);
2016                    }
2017                }
2018            }
2019
2020            /* Send event AVDT_WRITE_CFM_EVT if it was last fragment */
2021            else if (sent && GKI_queue_is_empty (&p_scb->frag_q))
2022            {
2023                (*p_scb->cs.p_ctrl_cback)(avdt_scb_to_hdl(p_scb), NULL, AVDT_WRITE_CFM_EVT, &avdt_ctrl);
2024            }
2025        }
2026#endif
2027    }
2028}
2029
2030/*******************************************************************************
2031**
2032** Function         avdt_scb_tc_timer
2033**
2034** Description      This function is called to start a timer when the peer
2035**                  initiates closing of the stream.  The timer verifies that
2036**                  the peer disconnects the transport channel.
2037**
2038** Returns          Nothing.
2039**
2040*******************************************************************************/
2041void avdt_scb_tc_timer(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
2042{
2043    UNUSED(p_data);
2044
2045    btu_start_timer(&p_scb->timer_entry, BTU_TTYPE_AVDT_SCB_TC, AVDT_SCB_TC_DISC_TOUT);
2046}
2047
2048/*******************************************************************************
2049**
2050** Function         avdt_scb_clr_vars
2051**
2052** Description      This function initializes certain SCB variables.
2053**
2054** Returns          Nothing.
2055**
2056*******************************************************************************/
2057void avdt_scb_clr_vars(tAVDT_SCB *p_scb, tAVDT_SCB_EVT *p_data)
2058{
2059    UNUSED(p_data);
2060
2061    if ((p_scb->cs.tsep == AVDT_TSEP_SNK) && (!p_scb->sink_activated))
2062    {
2063        p_scb->in_use = TRUE;
2064    }
2065    else
2066    {
2067        p_scb->in_use = FALSE;
2068    }
2069    p_scb->p_ccb = NULL;
2070    p_scb->peer_seid = 0;
2071}
2072
2073#if AVDT_MULTIPLEXING == TRUE
2074/*******************************************************************************
2075**
2076** Function         avdt_scb_queue_frags
2077**
2078** Description      This function breaks media payload into fragments
2079**                  and put the fragments in the given queue.
2080**
2081** Returns          Nothing.
2082**
2083*******************************************************************************/
2084void avdt_scb_queue_frags(tAVDT_SCB *p_scb, UINT8 **pp_data, UINT32 *p_data_len, BUFFER_Q *pq)
2085{
2086    UINT16  lcid;
2087    UINT16  num_frag;
2088    UINT16  mtu_used;
2089    UINT8   *p;
2090    BOOLEAN al_hdr = FALSE;
2091    UINT8   tcid;
2092    tAVDT_TC_TBL    *p_tbl;
2093    UINT16          buf_size;
2094    UINT16          offset = AVDT_MEDIA_OFFSET + AVDT_AL_HDR_SIZE;
2095    UINT16          cont_offset = offset - AVDT_MEDIA_HDR_SIZE;
2096    BT_HDR          *p_frag;
2097
2098    tcid = avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb);
2099    lcid = avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_scb->p_ccb)][tcid].lcid;
2100
2101    if( p_scb->frag_off != 0)
2102    {
2103        /* continuing process is usually triggered by un-congest event.
2104         * the number of buffers at L2CAP is very small (if not 0).
2105         * we do not need to L2CA_FlushChannel() */
2106        offset = cont_offset;
2107        al_hdr = TRUE;
2108        num_frag = AVDT_MAX_FRAG_COUNT;
2109    }
2110    else
2111    {
2112        num_frag = L2CA_FlushChannel(lcid, L2CAP_FLUSH_CHANS_GET);
2113        AVDT_TRACE_DEBUG("num_q=%d lcid=%d", num_frag, lcid);
2114        if(num_frag >= AVDT_MAX_FRAG_COUNT)
2115        {
2116            num_frag = 0;
2117        }
2118        else
2119        {
2120            num_frag = AVDT_MAX_FRAG_COUNT - num_frag;
2121        }
2122    }
2123
2124    /* look up transport channel table entry to get peer mtu */
2125    p_tbl = avdt_ad_tc_tbl_by_type(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb);
2126    buf_size = p_tbl->peer_mtu + BT_HDR_SIZE;
2127    AVDT_TRACE_DEBUG("peer_mtu: %d, buf_size: %d num_frag=%d",
2128        p_tbl->peer_mtu, buf_size, num_frag);
2129
2130    if(buf_size > AVDT_DATA_POOL_SIZE)
2131        buf_size = AVDT_DATA_POOL_SIZE;
2132
2133    mtu_used = buf_size - BT_HDR_SIZE;
2134
2135    while(*p_data_len && num_frag)
2136    {
2137        /* allocate buffer for fragment */
2138        if(NULL == (p_frag = (BT_HDR*)GKI_getbuf(buf_size)))
2139        {
2140            AVDT_TRACE_WARNING("avdt_scb_queue_frags len=%d(out of GKI buffers)",*p_data_len);
2141            break;
2142        }
2143        /* fill fragment by chunk of media payload */
2144        p_frag->layer_specific = *p_data_len;/* length of all remaining transport packet */
2145        p_frag->offset = offset;
2146        /* adjust packet offset for continuing packets */
2147        offset = cont_offset;
2148
2149        p_frag->len = mtu_used - p_frag->offset;
2150        if(p_frag->len > *p_data_len)
2151            p_frag->len = *p_data_len;
2152        memcpy((UINT8*)(p_frag+1) + p_frag->offset, *pp_data, p_frag->len);
2153        *pp_data += p_frag->len;
2154        *p_data_len -= p_frag->len;
2155        AVDT_TRACE_DEBUG("Prepared fragment len=%d", p_frag->len);
2156
2157        if(al_hdr)
2158        {
2159            /* Adaptation Layer header */
2160            p_frag->len += AVDT_AL_HDR_SIZE;
2161            p_frag->offset -= AVDT_AL_HDR_SIZE;
2162            p = (UINT8 *)(p_frag + 1) + p_frag->offset;
2163            /* TSID, fragment bit and coding of length(in 2 length octets following) */
2164            *p++ = (p_scb->curr_cfg.mux_tsid_media<<3) | (AVDT_ALH_FRAG_MASK|AVDT_ALH_LCODE_16BIT);
2165
2166            /* length of all remaining transport packet */
2167            UINT16_TO_BE_STREAM(p, p_frag->layer_specific );
2168        }
2169        /* put fragment into gueue */
2170        GKI_enqueue(pq, p_frag);
2171        num_frag--;
2172    }
2173}
2174#endif
2175
2176