1 /******************************************************************************
2  *
3  *  Copyright 2002-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /******************************************************************************
20  *
21  *  This module contains the action functions associated with the stream
22  *  control block state machine.
23  *
24  ******************************************************************************/
25 
26 #define LOG_TAG "bluetooth"
27 
28 #include <string.h>
29 #include "a2dp_codec_api.h"
30 #include "avdt_api.h"
31 #include "avdt_int.h"
32 #include "avdtc_api.h"
33 #include "bt_common.h"
34 #include "bt_target.h"
35 #include "bt_types.h"
36 #include "bt_utils.h"
37 #include "btu.h"
38 #include "osi/include/log.h"
39 #include "osi/include/osi.h"
40 
41 /* This table is used to lookup the callback event that matches a particular
42  * state machine API request event.  Note that state machine API request
43  * events are at the beginning of the event list starting at zero, thus
44  * allowing for this table.
45  */
46 const uint8_t avdt_scb_cback_evt[] = {
47     0,                     /* API_REMOVE_EVT (no event) */
48     AVDT_WRITE_CFM_EVT,    /* API_WRITE_REQ_EVT */
49     0,                     /* API_GETCONFIG_REQ_EVT (no event) */
50     0,                     /* API_DELAY_RPT_REQ_EVT (no event) */
51     AVDT_OPEN_CFM_EVT,     /* API_SETCONFIG_REQ_EVT */
52     AVDT_OPEN_CFM_EVT,     /* API_OPEN_REQ_EVT */
53     AVDT_CLOSE_CFM_EVT,    /* API_CLOSE_REQ_EVT */
54     AVDT_RECONFIG_CFM_EVT, /* API_RECONFIG_REQ_EVT */
55     AVDT_SECURITY_CFM_EVT, /* API_SECURITY_REQ_EVT */
56     0                      /* API_ABORT_REQ_EVT (no event) */
57 };
58 
59 /*******************************************************************************
60  *
61  * Function         avdt_scb_gen_ssrc
62  *
63  * Description      This function generates a SSRC number unique to the stream.
64  *
65  * Returns          SSRC value.
66  *
67  ******************************************************************************/
avdt_scb_gen_ssrc(AvdtpScb * p_scb)68 uint32_t avdt_scb_gen_ssrc(AvdtpScb* p_scb) {
69   /* combine the value of the media type and codec type of the SCB */
70   return ((uint32_t)(p_scb->stream_config.cfg.codec_info[1] |
71                      p_scb->stream_config.cfg.codec_info[2]));
72 }
73 
74 /*******************************************************************************
75  *
76  * Function         avdt_scb_hdl_abort_cmd
77  *
78  * Description      This function sends the SCB an AVDT_SCB_API_ABORT_RSP_EVT
79  *                  to initiate sending of an abort response message.
80  *
81  * Returns          Nothing.
82  *
83  ******************************************************************************/
avdt_scb_hdl_abort_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)84 void avdt_scb_hdl_abort_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
85   p_scb->role = AVDT_CLOSE_ACP;
86   avdt_scb_event(p_scb, AVDT_SCB_API_ABORT_RSP_EVT, p_data);
87 }
88 
89 /*******************************************************************************
90  *
91  * Function         avdt_scb_hdl_abort_rsp
92  *
93  * Description      This function is an empty function; it serves as a
94  *                  placeholder for a conformance API action function.
95  *
96  * Returns          Nothing.
97  *
98  ******************************************************************************/
avdt_scb_hdl_abort_rsp(UNUSED_ATTR AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)99 void avdt_scb_hdl_abort_rsp(UNUSED_ATTR AvdtpScb* p_scb,
100                             UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
101   return;
102 }
103 
104 /*******************************************************************************
105  *
106  * Function         avdt_scb_hdl_close_cmd
107  *
108  * Description      This function sends the SCB an AVDT_SCB_API_CLOSE_RSP_EVT
109  *                  to initiate sending of a close response message.
110  *
111  * Returns          Nothing.
112  *
113  ******************************************************************************/
avdt_scb_hdl_close_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)114 void avdt_scb_hdl_close_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
115   p_scb->role = AVDT_CLOSE_ACP;
116   avdt_scb_event(p_scb, AVDT_SCB_API_CLOSE_RSP_EVT, p_data);
117 }
118 
119 /*******************************************************************************
120  *
121  * Function         avdt_scb_hdl_close_rsp
122  *
123  * Description      This function sets the close_code variable to the error
124  *                  code returned in the close response.
125  *
126  * Returns          Nothing.
127  *
128  ******************************************************************************/
avdt_scb_hdl_close_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)129 void avdt_scb_hdl_close_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
130   p_scb->close_code = p_data->msg.hdr.err_code;
131 }
132 
133 /*******************************************************************************
134  *
135  * Function         avdt_scb_hdl_getconfig_cmd
136  *
137  * Description      This function retrieves the configuration parameters of
138  *                  the SCB and sends the SCB an AVDT_SCB_API_GETCONFIG_RSP_EVT
139  *                  to initiate sending of a get configuration response message.
140  *
141  * Returns          Nothing.
142  *
143  ******************************************************************************/
avdt_scb_hdl_getconfig_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)144 void avdt_scb_hdl_getconfig_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
145   p_data->msg.svccap.p_cfg = &p_scb->curr_cfg;
146 
147   avdt_scb_event(p_scb, AVDT_SCB_API_GETCONFIG_RSP_EVT, p_data);
148 }
149 
150 /*******************************************************************************
151  *
152  * Function         avdt_scb_hdl_getconfig_rsp
153  *
154  * Description      This function is an empty function; it serves as a
155  *                  placeholder for a conformance API action function.
156  *
157  * Returns          Nothing.
158  *
159  ******************************************************************************/
avdt_scb_hdl_getconfig_rsp(UNUSED_ATTR AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)160 void avdt_scb_hdl_getconfig_rsp(UNUSED_ATTR AvdtpScb* p_scb,
161                                 UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
162   return;
163 }
164 
165 /*******************************************************************************
166  *
167  * Function         avdt_scb_hdl_open_cmd
168  *
169  * Description      This function sends the SCB an AVDT_SCB_API_OPEN_RSP_EVT
170  *                  to initiate sending of an open response message.
171  *
172  * Returns          Nothing.
173  *
174  ******************************************************************************/
avdt_scb_hdl_open_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)175 void avdt_scb_hdl_open_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
176   avdt_scb_event(p_scb, AVDT_SCB_API_OPEN_RSP_EVT, p_data);
177 }
178 
179 /*******************************************************************************
180  *
181  * Function         avdt_scb_hdl_open_rej
182  *
183  * Description      This function calls the application callback function
184  *                  indicating the open request has failed.  It initializes
185  *                  certain SCB variables and sends a AVDT_CCB_UL_CLOSE_EVT
186  *                  to the CCB.
187  *
188  * Returns          Nothing.
189  *
190  ******************************************************************************/
avdt_scb_hdl_open_rej(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)191 void avdt_scb_hdl_open_rej(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
192   /* do exactly same as setconfig reject */
193   avdt_scb_hdl_setconfig_rej(p_scb, p_data);
194 }
195 
196 /*******************************************************************************
197  *
198  * Function         avdt_scb_hdl_open_rsp
199  *
200  * Description      This function calls avdt_ad_open_req() to initiate
201  *                  connection of the transport channel for this stream.
202  *
203  * Returns          Nothing.
204  *
205  ******************************************************************************/
avdt_scb_hdl_open_rsp(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)206 void avdt_scb_hdl_open_rsp(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
207   /* initiate opening of trans channels for this SEID */
208   p_scb->role = AVDT_OPEN_INT;
209   avdt_ad_open_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, AVDT_INT);
210 
211   /* start tc connect timer */
212   alarm_set_on_mloop(p_scb->transport_channel_timer,
213                      AVDT_SCB_TC_CONN_TIMEOUT_MS,
214                      avdt_scb_transport_channel_timer_timeout, p_scb);
215 }
216 
217 /*******************************************************************************
218  *
219  * Function         avdt_scb_hdl_pkt_no_frag
220  *
221  * Description
222  *
223  * Returns          Nothing.
224  *
225  ******************************************************************************/
avdt_scb_hdl_pkt_no_frag(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)226 void avdt_scb_hdl_pkt_no_frag(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
227   uint8_t *p, *p_start;
228   uint8_t o_v, o_p, o_x, o_cc;
229   uint8_t m_pt;
230   uint8_t marker;
231   uint16_t seq;
232   uint32_t time_stamp;
233   uint16_t offset;
234   uint16_t ex_len;
235   uint8_t pad_len = 0;
236   uint16_t len = p_data->p_pkt->len;
237 
238   p = p_start = (uint8_t*)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
239 
240   /* parse media packet header */
241   offset = 12;
242   // AVDT_MSG_PRS_OCTET1(1) + AVDT_MSG_PRS_M_PT(1) + UINT16(2) + UINT32(4) + 4
243   if (offset > len) goto length_error;
244   AVDT_MSG_PRS_OCTET1(p, o_v, o_p, o_x, o_cc);
245   AVDT_MSG_PRS_M_PT(p, m_pt, marker);
246   BE_STREAM_TO_UINT16(seq, p);
247   BE_STREAM_TO_UINT32(time_stamp, p);
248   p += 4;
249 
250   /* skip over any csrc's in packet */
251   offset += o_cc * 4;
252   p += o_cc * 4;
253 
254   /* check for and skip over extension header */
255   if (o_x) {
256     offset += 4;
257     if (offset > len) goto length_error;
258     p += 2;
259     BE_STREAM_TO_UINT16(ex_len, p);
260     offset += ex_len * 4;
261     p += ex_len * 4;
262   }
263 
264   /* adjust length for any padding at end of packet */
265   if (o_p) {
266     /* padding length in last byte of packet */
267     pad_len = *(p_start + p_data->p_pkt->len);
268   }
269 
270   /* do sanity check */
271   if ((offset > p_data->p_pkt->len) ||
272       ((pad_len + offset) > p_data->p_pkt->len)) {
273     AVDT_TRACE_WARNING("Got bad media packet");
274     osi_free_and_reset((void**)&p_data->p_pkt);
275   }
276   /* adjust offset and length and send it up */
277   else {
278     p_data->p_pkt->len -= (offset + pad_len);
279     p_data->p_pkt->offset += offset;
280 
281     if (p_scb->stream_config.p_sink_data_cback != NULL) {
282       /* report sequence number */
283       p_data->p_pkt->layer_specific = seq;
284       (*p_scb->stream_config.p_sink_data_cback)(
285           avdt_scb_to_hdl(p_scb), p_data->p_pkt, time_stamp,
286           (uint8_t)(m_pt | (marker << 7)));
287     } else {
288       osi_free_and_reset((void**)&p_data->p_pkt);
289     }
290   }
291   return;
292 length_error:
293   android_errorWriteLog(0x534e4554, "111450156");
294   AVDT_TRACE_WARNING("%s: hdl packet length %d too short: must be at least %d",
295                      __func__, len, offset);
296   osi_free_and_reset((void**)&p_data->p_pkt);
297 }
298 
299 /*******************************************************************************
300  *
301  * Function         avdt_scb_hdl_report
302  *
303  * Description
304  *
305  * Returns          Nothing.
306  *
307  ******************************************************************************/
avdt_scb_hdl_report(AvdtpScb * p_scb,uint8_t * p,uint16_t len)308 uint8_t* avdt_scb_hdl_report(AvdtpScb* p_scb, uint8_t* p, uint16_t len) {
309   uint16_t result = AVDT_SUCCESS;
310   uint8_t* p_start = p;
311   uint32_t ssrc;
312   uint8_t o_v, o_p, o_cc;
313   uint16_t min_len = 0;
314   AVDT_REPORT_TYPE pt;
315   tAVDT_REPORT_DATA report;
316 
317   AVDT_TRACE_DEBUG("%s", __func__);
318   if (p_scb->stream_config.p_report_cback) {
319     /* parse report packet header */
320     min_len += 8;
321     if (min_len > len) {
322       android_errorWriteLog(0x534e4554, "111450156");
323       AVDT_TRACE_WARNING(
324           "%s: hdl packet length %d too short: must be at least %d", __func__,
325           len, min_len);
326       goto avdt_scb_hdl_report_exit;
327     }
328     AVDT_MSG_PRS_RPT_OCTET1(p, o_v, o_p, o_cc);
329     pt = *p++;
330     p += 2;
331     BE_STREAM_TO_UINT32(ssrc, p);
332 
333     switch (pt) {
334       case AVDT_RTCP_PT_SR: /* the packet type - SR (Sender Report) */
335         min_len += 20;
336         if (min_len > len) {
337           android_errorWriteLog(0x534e4554, "111450156");
338           AVDT_TRACE_WARNING(
339               "%s: hdl packet length %d too short: must be at least %d",
340               __func__, len, min_len);
341           goto avdt_scb_hdl_report_exit;
342         }
343         BE_STREAM_TO_UINT32(report.sr.ntp_sec, p);
344         BE_STREAM_TO_UINT32(report.sr.ntp_frac, p);
345         BE_STREAM_TO_UINT32(report.sr.rtp_time, p);
346         BE_STREAM_TO_UINT32(report.sr.pkt_count, p);
347         BE_STREAM_TO_UINT32(report.sr.octet_count, p);
348         break;
349 
350       case AVDT_RTCP_PT_RR: /* the packet type - RR (Receiver Report) */
351         min_len += 20;
352         if (min_len > len) {
353           android_errorWriteLog(0x534e4554, "111450156");
354           AVDT_TRACE_WARNING(
355               "%s: hdl packet length %d too short: must be at least %d",
356               __func__, len, min_len);
357           goto avdt_scb_hdl_report_exit;
358         }
359         report.rr.frag_lost = *p;
360         BE_STREAM_TO_UINT32(report.rr.packet_lost, p);
361         report.rr.packet_lost &= 0xFFFFFF;
362         BE_STREAM_TO_UINT32(report.rr.seq_num_rcvd, p);
363         BE_STREAM_TO_UINT32(report.rr.jitter, p);
364         BE_STREAM_TO_UINT32(report.rr.lsr, p);
365         BE_STREAM_TO_UINT32(report.rr.dlsr, p);
366         break;
367 
368       case AVDT_RTCP_PT_SDES: /* the packet type - SDES (Source Description) */
369         uint8_t sdes_type;
370         min_len += 1;
371         if (min_len > len) {
372           android_errorWriteLog(0x534e4554, "111450156");
373           AVDT_TRACE_WARNING(
374               "%s: hdl packet length %d too short: must be at least %d",
375               __func__, len, min_len);
376           goto avdt_scb_hdl_report_exit;
377         }
378         BE_STREAM_TO_UINT8(sdes_type, p);
379         if (sdes_type == AVDT_RTCP_SDES_CNAME) {
380           uint8_t name_length;
381           min_len += 1;
382           if (min_len > len) {
383             android_errorWriteLog(0x534e4554, "111450156");
384             AVDT_TRACE_WARNING(
385                 "%s: hdl packet length %d too short: must be at least %d",
386                 __func__, len, min_len);
387             goto avdt_scb_hdl_report_exit;
388           }
389           BE_STREAM_TO_UINT8(name_length, p);
390           if (name_length > len - min_len ||
391               name_length > AVDT_MAX_CNAME_SIZE) {
392             result = AVDT_BAD_PARAMS;
393           } else {
394             BE_STREAM_TO_ARRAY(p, &(report.cname[0]), name_length);
395           }
396         } else {
397           if (min_len + 1 > len) {
398             android_errorWriteLog(0x534e4554, "111450156");
399             AVDT_TRACE_WARNING(
400                 "%s: hdl packet length %d too short: must be at least %d",
401                 __func__, len, min_len);
402             goto avdt_scb_hdl_report_exit;
403           }
404           AVDT_TRACE_WARNING("%s: SDES SSRC=0x%08x sc=%d %d len=%d", __func__,
405                              ssrc, o_cc, sdes_type, *p);
406           result = AVDT_BUSY;
407         }
408         break;
409 
410       default:
411         AVDT_TRACE_ERROR("Bad Report pkt - packet type: %d", pt);
412         result = AVDT_BAD_PARAMS;
413     }
414 
415     if (result == AVDT_SUCCESS)
416       (*p_scb->stream_config.p_report_cback)(avdt_scb_to_hdl(p_scb), pt,
417                                              &report);
418   }
419 avdt_scb_hdl_report_exit:
420   p_start += len;
421   return p_start;
422 }
423 
424 /*******************************************************************************
425  *
426  * Function         avdt_scb_hdl_pkt
427  *
428  * Description
429  *
430  * Returns          Nothing.
431  *
432  ******************************************************************************/
avdt_scb_hdl_pkt(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)433 void avdt_scb_hdl_pkt(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
434   if (p_data->p_pkt->layer_specific == AVDT_CHAN_REPORT) {
435     uint8_t* p = (uint8_t*)(p_data->p_pkt + 1) + p_data->p_pkt->offset;
436     avdt_scb_hdl_report(p_scb, p, p_data->p_pkt->len);
437     osi_free_and_reset((void**)&p_data->p_pkt);
438   } else {
439     avdt_scb_hdl_pkt_no_frag(p_scb, p_data);
440   }
441 }
442 
443 /*******************************************************************************
444  *
445  * Function         avdt_scb_drop_pkt
446  *
447  * Description      Drop an incoming media packet.  This function is called if
448  *                  a media packet is received in any state besides streaming.
449  *
450  * Returns          Nothing.
451  *
452  ******************************************************************************/
avdt_scb_drop_pkt(UNUSED_ATTR AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)453 void avdt_scb_drop_pkt(UNUSED_ATTR AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
454   AVDT_TRACE_ERROR("%s dropped incoming media packet", __func__);
455   osi_free_and_reset((void**)&p_data->p_pkt);
456 }
457 
458 /*******************************************************************************
459  *
460  * Function         avdt_scb_hdl_reconfig_cmd
461  *
462  * Description      This function calls the application callback function
463  *                  with a reconfiguration indication.
464  *
465  * Returns          Nothing.
466  *
467  ******************************************************************************/
avdt_scb_hdl_reconfig_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)468 void avdt_scb_hdl_reconfig_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
469   /* if command not supported */
470   if (p_scb->stream_config.nsc_mask & AvdtpStreamConfig::AVDT_NSC_RECONFIG) {
471     /* send reject */
472     p_data->msg.hdr.err_code = AVDT_ERR_NSC;
473     p_data->msg.hdr.err_param = 0;
474     avdt_scb_event(p_scb, AVDT_SCB_API_RECONFIG_RSP_EVT, p_data);
475   } else {
476     /* store requested configuration */
477     p_scb->req_cfg = *p_data->msg.reconfig_cmd.p_cfg;
478 
479     /* call application callback */
480     (*p_scb->stream_config.p_avdt_ctrl_cback)(
481         avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_RECONFIG_IND_EVT,
482         (tAVDT_CTRL*)&p_data->msg.reconfig_cmd, p_scb->stream_config.scb_index);
483   }
484 }
485 
486 /*******************************************************************************
487  *
488  * Function         avdt_scb_hdl_reconfig_rsp
489  *
490  * Description      This function calls the application callback function
491  *                  with a reconfiguration confirm.
492  *
493  * Returns          Nothing.
494  *
495  ******************************************************************************/
avdt_scb_hdl_reconfig_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)496 void avdt_scb_hdl_reconfig_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
497   if (p_data->msg.hdr.err_code == 0) {
498     /* store new configuration */
499     if (p_scb->req_cfg.num_codec > 0) {
500       p_scb->curr_cfg.num_codec = p_scb->req_cfg.num_codec;
501       memcpy(p_scb->curr_cfg.codec_info, p_scb->req_cfg.codec_info,
502              AVDT_CODEC_SIZE);
503     }
504     if (p_scb->req_cfg.num_protect > 0) {
505       p_scb->curr_cfg.num_protect = p_scb->req_cfg.num_protect;
506       memcpy(p_scb->curr_cfg.protect_info, p_scb->req_cfg.protect_info,
507              AVDT_PROTECT_SIZE);
508     }
509   }
510 
511   p_data->msg.svccap.p_cfg = &p_scb->curr_cfg;
512 
513   /* call application callback */
514   (*p_scb->stream_config.p_avdt_ctrl_cback)(
515       avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_RECONFIG_CFM_EVT,
516       (tAVDT_CTRL*)&p_data->msg.svccap, p_scb->stream_config.scb_index);
517 }
518 
519 /*******************************************************************************
520  *
521  * Function         avdt_scb_hdl_security_cmd
522  *
523  * Description      This function calls the application callback with a
524  *                  security indication.
525  *
526  * Returns          Nothing.
527  *
528  ******************************************************************************/
avdt_scb_hdl_security_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)529 void avdt_scb_hdl_security_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
530   /* if command not supported */
531   if (p_scb->stream_config.nsc_mask & AvdtpStreamConfig::AVDT_NSC_SECURITY) {
532     /* send reject */
533     p_data->msg.hdr.err_code = AVDT_ERR_NSC;
534     avdt_scb_event(p_scb, AVDT_SCB_API_SECURITY_RSP_EVT, p_data);
535   } else {
536     /* call application callback */
537     (*p_scb->stream_config.p_avdt_ctrl_cback)(
538         avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_SECURITY_IND_EVT,
539         (tAVDT_CTRL*)&p_data->msg.security_cmd, p_scb->stream_config.scb_index);
540   }
541 }
542 
543 /*******************************************************************************
544  *
545  * Function         avdt_scb_hdl_security_rsp
546  *
547  * Description      This function calls the application callback with a
548  *                  security confirm.
549  *
550  * Returns          Nothing.
551  *
552  ******************************************************************************/
avdt_scb_hdl_security_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)553 void avdt_scb_hdl_security_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
554   /* call application callback */
555   (*p_scb->stream_config.p_avdt_ctrl_cback)(
556       avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_SECURITY_CFM_EVT,
557       (tAVDT_CTRL*)&p_data->msg.security_cmd, p_scb->stream_config.scb_index);
558 }
559 
560 /*******************************************************************************
561  *
562  * Function         avdt_scb_hdl_setconfig_cmd
563  *
564  * Description      This function marks the SCB as in use and copies the
565  *                  configuration and peer SEID to the SCB.  It then calls
566  *                  the application callback with a configuration indication.
567  *
568  * Returns          Nothing.
569  *
570  ******************************************************************************/
avdt_scb_hdl_setconfig_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)571 void avdt_scb_hdl_setconfig_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
572   AVDT_TRACE_DEBUG("%s: p_scb->in_use=%d p_avdt_scb=%p scb_index=%d", __func__,
573                    p_scb->in_use, p_scb, p_scb->stream_config.scb_index);
574 
575   if (!p_scb->in_use) {
576     AVDT_TRACE_DEBUG(
577         "%s: codec: %s", __func__,
578         A2DP_CodecInfoString(p_scb->stream_config.cfg.codec_info).c_str());
579     AVDT_TRACE_DEBUG(
580         "%s: codec: %s", __func__,
581         A2DP_CodecInfoString(p_data->msg.config_cmd.p_cfg->codec_info).c_str());
582     AvdtpSepConfig* p_cfg = p_data->msg.config_cmd.p_cfg;
583     if (A2DP_GetCodecType(p_scb->stream_config.cfg.codec_info) ==
584         A2DP_GetCodecType(p_cfg->codec_info)) {
585       /* copy info to scb */
586       AvdtpCcb* p_ccb = avdt_ccb_by_idx(p_data->msg.config_cmd.hdr.ccb_idx);
587       if (p_scb->p_ccb != p_ccb) {
588         AVDT_TRACE_ERROR(
589             "%s: mismatch in AVDTP SCB/CCB state: (p_scb->p_ccb=%p != "
590             "p_ccb=%p): "
591             "p_scb=%p scb_handle=%d ccb_idx=%d",
592             __func__, p_scb->p_ccb, p_ccb, p_scb, p_scb->ScbHandle(),
593             p_data->msg.config_cmd.hdr.ccb_idx);
594         avdt_scb_rej_not_in_use(p_scb, p_data);
595         return;
596       }
597       /* set sep as in use */
598       p_scb->in_use = true;
599 
600       p_scb->peer_seid = p_data->msg.config_cmd.int_seid;
601       p_scb->req_cfg = *p_cfg;
602       /* call app callback */
603       /* handle of scb- which is same as sep handle of bta_av_cb.p_scb*/
604       (*p_scb->stream_config.p_avdt_ctrl_cback)(
605           avdt_scb_to_hdl(p_scb),
606           p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
607           AVDT_CONFIG_IND_EVT, (tAVDT_CTRL*)&p_data->msg.config_cmd,
608           p_scb->stream_config.scb_index);
609     } else {
610       p_data->msg.hdr.err_code = AVDT_ERR_UNSUP_CFG;
611       p_data->msg.hdr.err_param = 0;
612       avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
613                         p_data->msg.hdr.sig_id, &p_data->msg);
614     }
615   } else {
616     AVDT_TRACE_DEBUG("%s: calling avdt_scb_rej_in_use()", __func__);
617     avdt_scb_rej_in_use(p_scb, p_data);
618   }
619 }
620 
621 /*******************************************************************************
622  *
623  * Function         avdt_scb_hdl_setconfig_rej
624  *
625  * Description      This function marks the SCB as not in use and calls the
626  *                  application callback with an open confirm indicating
627  *                  failure.
628  *
629  * Returns          Nothing.
630  *
631  ******************************************************************************/
avdt_scb_hdl_setconfig_rej(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)632 void avdt_scb_hdl_setconfig_rej(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
633   /* clear scb variables */
634   avdt_scb_clr_vars(p_scb, p_data);
635 
636   /* tell ccb we're done with signaling channel */
637   avdt_ccb_event(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
638                  AVDT_CCB_UL_CLOSE_EVT, NULL);
639 
640   /* call application callback */
641   (*p_scb->stream_config.p_avdt_ctrl_cback)(
642       avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_OPEN_CFM_EVT,
643       (tAVDT_CTRL*)&p_data->msg.hdr, p_scb->stream_config.scb_index);
644 }
645 
646 /*******************************************************************************
647  *
648  * Function         avdt_scb_snd_snk_delay_rpt_req
649  *
650  * Description      This function sends the delay report request once it is sink
651  *
652  * Returns          Nothing.
653  *
654  ******************************************************************************/
avdt_scb_snd_snk_delay_rpt_req(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)655 void avdt_scb_snd_snk_delay_rpt_req(AvdtpScb* p_scb,
656                                     UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
657   if (p_scb->p_ccb == NULL) {
658     return;
659   }
660 
661   // In sink mode, report a fixed delay value when this device is the sink
662   // side. Delay value in this function is in unit of 1/10ms.
663   if (p_scb->stream_config.tsep != AVDT_TSEP_SNK) {
664     return;
665   }
666 
667   tAVDT_SCB_EVT evt;
668   evt.apidelay.hdr.seid = p_scb->peer_seid;
669   evt.apidelay.delay = AVDT_SINK_DELAY_MS * 10;
670   avdt_scb_event(p_scb, AVDT_SCB_API_DELAY_RPT_REQ_EVT, &evt);
671 }
672 
673 /*******************************************************************************
674  *
675  * Function         avdt_scb_hdl_setconfig_rsp
676  *
677  * Description      This function sends the SCB an AVDT_SCB_API_OPEN_REQ_EVT
678  *                  to initiate sending of an open command message.
679  *
680  *                  This function sends the SCB an AVDT_SCB_API_DELAY_RPT_REQ_EVT
681  *                  to initiate sending of delay report command message only
682  *                  when the endpoint takes sink role.
683  *
684  * Returns          Nothing.
685  *
686  ******************************************************************************/
avdt_scb_hdl_setconfig_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)687 void avdt_scb_hdl_setconfig_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
688   tAVDT_EVT_HDR single;
689 
690   if (p_scb->p_ccb != NULL) {
691     /* save configuration */
692     p_scb->curr_cfg = p_scb->req_cfg;
693 
694     // In sink mode, report delay value when this device initiates the connection.
695     // Delay reporting is sent before open request (i.e., in configured state).
696     avdt_scb_snd_snk_delay_rpt_req(p_scb, p_data);
697 
698     /* initiate open */
699     single.seid = p_scb->peer_seid;
700     tAVDT_SCB_EVT avdt_scb_evt;
701     avdt_scb_evt.msg.single = single;
702     avdt_scb_event(p_scb, AVDT_SCB_API_OPEN_REQ_EVT, &avdt_scb_evt);
703   }
704 }
705 
706 /*******************************************************************************
707  *
708  * Function         avdt_scb_hdl_start_cmd
709  *
710  * Description      This function calls the application callback with a
711  *                  start indication.
712  *
713  * Returns          Nothing.
714  *
715  ******************************************************************************/
avdt_scb_hdl_start_cmd(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)716 void avdt_scb_hdl_start_cmd(AvdtpScb* p_scb,
717                             UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
718   (*p_scb->stream_config.p_avdt_ctrl_cback)(
719       avdt_scb_to_hdl(p_scb),
720       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
721       AVDT_START_IND_EVT, NULL, p_scb->stream_config.scb_index);
722 }
723 
724 /*******************************************************************************
725  *
726  * Function         avdt_scb_hdl_start_rsp
727  *
728  * Description      This function calls the application callback with a
729  *                  start confirm.
730  *
731  * Returns          Nothing.
732  *
733  ******************************************************************************/
avdt_scb_hdl_start_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)734 void avdt_scb_hdl_start_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
735   (*p_scb->stream_config.p_avdt_ctrl_cback)(
736       avdt_scb_to_hdl(p_scb),
737       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
738       AVDT_START_CFM_EVT, (tAVDT_CTRL*)&p_data->msg.hdr,
739       p_scb->stream_config.scb_index);
740 }
741 
742 /*******************************************************************************
743  *
744  * Function         avdt_scb_hdl_suspend_cmd
745  *
746  * Description      This function calls the application callback with a suspend
747  *                  indication.
748  *
749  * Returns          Nothing.
750  *
751  ******************************************************************************/
avdt_scb_hdl_suspend_cmd(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)752 void avdt_scb_hdl_suspend_cmd(AvdtpScb* p_scb,
753                               UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
754   (*p_scb->stream_config.p_avdt_ctrl_cback)(
755       avdt_scb_to_hdl(p_scb),
756       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
757       AVDT_SUSPEND_IND_EVT, NULL, p_scb->stream_config.scb_index);
758 }
759 
760 /*******************************************************************************
761  *
762  * Function         avdt_scb_hdl_suspend_rsp
763  *
764  * Description      This function calls the application callback with a suspend
765  *                  confirm.
766  *
767  * Returns          Nothing.
768  *
769  ******************************************************************************/
avdt_scb_hdl_suspend_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)770 void avdt_scb_hdl_suspend_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
771   (*p_scb->stream_config.p_avdt_ctrl_cback)(
772       avdt_scb_to_hdl(p_scb),
773       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
774       AVDT_SUSPEND_CFM_EVT, (tAVDT_CTRL*)&p_data->msg.hdr,
775       p_scb->stream_config.scb_index);
776 }
777 
778 /*******************************************************************************
779  *
780  * Function         avdt_scb_hdl_tc_close
781  *
782  * Description      This function is called when the transport channel is
783  *                  closed.  It marks the SCB as not in use and
784  *                  initializes certain SCB parameters.  It then sends
785  *                  an AVDT_CCB_UL_CLOSE_EVT to the CCB if the SCB
786  *                  initiated the close.  It then checks to see if the SCB
787  *                  is to be removed.  If it is it deallocates the SCB.
788  *                  Finally, it calls the application callback with a close
789  *                  indication.
790  *
791  * Returns          Nothing.
792  *
793  ******************************************************************************/
avdt_scb_hdl_tc_close(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)794 void avdt_scb_hdl_tc_close(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
795   uint8_t hdl = avdt_scb_to_hdl(p_scb);
796   tAVDT_CTRL_CBACK* p_avdt_ctrl_cback = p_scb->stream_config.p_avdt_ctrl_cback;
797   tAVDT_CTRL avdt_ctrl;
798   uint8_t event;
799   AvdtpCcb* p_ccb = p_scb->p_ccb;
800   RawAddress remote_addr = p_ccb->peer_addr;
801   uint8_t scb_index = p_scb->stream_config.scb_index;
802 
803   /* set up hdr */
804   avdt_ctrl.hdr.err_code = p_scb->close_code;
805 
806   /* clear sep variables */
807   avdt_scb_clr_vars(p_scb, p_data);
808   p_scb->media_seq = 0;
809   p_scb->cong = false;
810 
811   /* free pkt we're holding, if any */
812   osi_free_and_reset((void**)&p_scb->p_pkt);
813 
814   alarm_cancel(p_scb->transport_channel_timer);
815 
816   if ((p_scb->role == AVDT_CLOSE_INT) || (p_scb->role == AVDT_OPEN_INT)) {
817     /* tell ccb we're done with signaling channel */
818     avdt_ccb_event(p_ccb, AVDT_CCB_UL_CLOSE_EVT, NULL);
819   }
820   event =
821       (p_scb->role == AVDT_CLOSE_INT) ? AVDT_CLOSE_CFM_EVT : AVDT_CLOSE_IND_EVT;
822   p_scb->role = AVDT_CLOSE_ACP;
823 
824   if (p_scb->remove) {
825     avdt_scb_dealloc(p_scb, NULL);
826   }
827 
828   /* call app callback */
829   (*p_avdt_ctrl_cback)(hdl, remote_addr, event, &avdt_ctrl, scb_index);
830 }
831 
832 /*******************************************************************************
833  *
834  * Function         avdt_scb_snd_delay_rpt_req
835  *
836  * Description      This function calls the application callback with a delay
837  *                  report.
838  *
839  * Returns          Nothing.
840  *
841  ******************************************************************************/
avdt_scb_snd_delay_rpt_req(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)842 void avdt_scb_snd_delay_rpt_req(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
843   if (p_scb->stream_config.cfg.psc_mask & AVDT_PSC_DELAY_RPT) {
844     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_DELAY_RPT,
845                       (tAVDT_MSG*)&p_data->apidelay);
846   }
847 }
848 
849 /*******************************************************************************
850  *
851  * Function         avdt_scb_hdl_delay_rpt_cmd
852  *
853  * Description      This function calls the application callback with a delay
854  *                  report.
855  *
856  * Returns          Nothing.
857  *
858  ******************************************************************************/
avdt_scb_hdl_delay_rpt_cmd(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)859 void avdt_scb_hdl_delay_rpt_cmd(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
860   (*p_scb->stream_config.p_avdt_ctrl_cback)(
861       avdt_scb_to_hdl(p_scb),
862       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
863       AVDT_DELAY_REPORT_EVT, (tAVDT_CTRL*)&p_data->msg.hdr,
864       p_scb->stream_config.scb_index);
865 
866   if (p_scb->p_ccb)
867     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_DELAY_RPT, &p_data->msg);
868   else
869     avdt_scb_rej_not_in_use(p_scb, p_data);
870 }
871 
872 /*******************************************************************************
873  *
874  * Function         avdt_scb_hdl_delay_rpt_rsp
875  *
876  * Description      This function calls the application callback with a delay
877  *                  report.
878  *
879  * Returns          Nothing.
880  *
881  ******************************************************************************/
avdt_scb_hdl_delay_rpt_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)882 void avdt_scb_hdl_delay_rpt_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
883   (*p_scb->stream_config.p_avdt_ctrl_cback)(
884       avdt_scb_to_hdl(p_scb),
885       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
886       AVDT_DELAY_REPORT_CFM_EVT, (tAVDT_CTRL*)&p_data->msg.hdr,
887       p_scb->stream_config.scb_index);
888 }
889 
890 /*******************************************************************************
891  *
892  * Function         avdt_scb_hdl_tc_close_sto
893  *
894  * Description      This function is called when a channel is closed in OPEN
895  *                  state.  Check the channel type and process accordingly.
896  *
897  * Returns          Nothing.
898  *
899  ******************************************************************************/
avdt_scb_hdl_tc_close_sto(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)900 void avdt_scb_hdl_tc_close_sto(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
901   tAVDT_CTRL avdt_ctrl;
902   /* AVDT_CHAN_SIG does not visit this action */
903   if (p_data && p_data->close.type != AVDT_CHAN_MEDIA) {
904     /* it's reporting or recovery channel,
905      * the channel close in open state means the peer does not support it */
906     if (p_data->close.old_tc_state == AVDT_AD_ST_OPEN) {
907       avdt_ctrl.hdr.err_code = 0;
908       avdt_ctrl.hdr.err_param = 0;
909       /* call app callback */
910       (*p_scb->stream_config.p_avdt_ctrl_cback)(
911           avdt_scb_to_hdl(p_scb),
912           p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
913           AVDT_REPORT_DISCONN_EVT, &avdt_ctrl, p_scb->stream_config.scb_index);
914     }
915   } else {
916     /* must be in OPEN state. need to go back to idle */
917     avdt_scb_event(p_scb, AVDT_SCB_MSG_ABORT_RSP_EVT, NULL);
918     avdt_scb_hdl_tc_close(p_scb, p_data);
919   }
920 }
921 
922 /*******************************************************************************
923  *
924  * Function         avdt_scb_hdl_tc_open
925  *
926  * Description      This function is called when the transport channel is
927  *                  opened while in the opening state.  It calls the
928  *                  application callback with an open indication or open
929  *                  confirm depending on who initiated the open procedure.
930  *
931  * Returns          Nothing.
932  *
933  ******************************************************************************/
avdt_scb_hdl_tc_open(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)934 void avdt_scb_hdl_tc_open(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
935   uint8_t event;
936   uint8_t role;
937 
938   alarm_cancel(p_scb->transport_channel_timer);
939 
940   event =
941       (p_scb->role == AVDT_OPEN_INT) ? AVDT_OPEN_CFM_EVT : AVDT_OPEN_IND_EVT;
942   p_data->open.hdr.err_code = 0;
943 
944   AVDT_TRACE_DEBUG("%s: psc_mask: cfg: 0x%x, req:0x%x, cur: 0x%x", __func__,
945                    p_scb->stream_config.cfg.psc_mask, p_scb->req_cfg.psc_mask,
946                    p_scb->curr_cfg.psc_mask);
947   if (p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT) {
948     /* open the reporting channel, if both devices support it */
949     role = (p_scb->role == AVDT_OPEN_INT) ? AVDT_INT : AVDT_ACP;
950     avdt_ad_open_req(AVDT_CHAN_REPORT, p_scb->p_ccb, p_scb, role);
951   }
952 
953   /* call app callback */
954   (*p_scb->stream_config.p_avdt_ctrl_cback)(
955       avdt_scb_to_hdl(p_scb),
956       p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty, event,
957       (tAVDT_CTRL*)&p_data->open, p_scb->stream_config.scb_index);
958 }
959 
960 /*******************************************************************************
961  *
962  * Function         avdt_scb_hdl_tc_open_sto
963  *
964  * Description      This function is called when the transport channel is
965  *                  opened while in the opening state.  It calls the
966  *                  application callback with an open indication or open
967  *                  confirm depending on who initiated the open procedure.
968  *
969  * Returns          Nothing.
970  *
971  ******************************************************************************/
avdt_scb_hdl_tc_open_sto(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)972 void avdt_scb_hdl_tc_open_sto(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
973   tAVDT_CTRL avdt_ctrl;
974   /* open reporting channel here, when it is implemented */
975 
976   /* call app callback */
977   if (p_data->open.hdr.err_code == AVDT_CHAN_REPORT) {
978     avdt_ctrl.hdr.err_code = 0;
979     avdt_ctrl.hdr.err_param = 1;
980     (*p_scb->stream_config.p_avdt_ctrl_cback)(
981         avdt_scb_to_hdl(p_scb),
982         p_scb->p_ccb ? p_scb->p_ccb->peer_addr : RawAddress::kEmpty,
983         AVDT_REPORT_CONN_EVT, &avdt_ctrl, p_scb->stream_config.scb_index);
984   }
985 }
986 
987 /*******************************************************************************
988  *
989  * Function         avdt_scb_hdl_write_req
990  *
991  * Description      This function frees the media packet currently stored in
992  *                  the SCB, if any.  Then it builds a new media packet from
993  *                  with the passed in buffer and stores it in the SCB.
994  *
995  * Returns          Nothing.
996  *
997  ******************************************************************************/
avdt_scb_hdl_write_req(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)998 void avdt_scb_hdl_write_req(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
999   uint8_t* p;
1000   uint32_t ssrc;
1001   bool add_rtp_header = !(p_data->apiwrite.opt & AVDT_DATA_OPT_NO_RTP);
1002 
1003   /* free packet we're holding, if any; to be replaced with new */
1004   if (p_scb->p_pkt != NULL) {
1005     /* this shouldn't be happening */
1006     AVDT_TRACE_WARNING("Dropped media packet; congested");
1007   }
1008   osi_free_and_reset((void**)&p_scb->p_pkt);
1009 
1010   /* Recompute only if the RTP header wasn't disabled by the API */
1011   if (add_rtp_header) {
1012     bool is_content_protection = (p_scb->curr_cfg.num_protect > 0);
1013     add_rtp_header =
1014         A2DP_UsesRtpHeader(is_content_protection, p_scb->curr_cfg.codec_info);
1015   }
1016 
1017   /* Build a media packet, and add an RTP header if required. */
1018   if (add_rtp_header) {
1019     ssrc = avdt_scb_gen_ssrc(p_scb);
1020 
1021     p_data->apiwrite.p_buf->len += AVDT_MEDIA_HDR_SIZE;
1022     p_data->apiwrite.p_buf->offset -= AVDT_MEDIA_HDR_SIZE;
1023     p_scb->media_seq++;
1024     p = (uint8_t*)(p_data->apiwrite.p_buf + 1) + p_data->apiwrite.p_buf->offset;
1025 
1026     UINT8_TO_BE_STREAM(p, AVDT_MEDIA_OCTET1);
1027     UINT8_TO_BE_STREAM(p, p_data->apiwrite.m_pt);
1028     UINT16_TO_BE_STREAM(p, p_scb->media_seq);
1029     UINT32_TO_BE_STREAM(p, p_data->apiwrite.time_stamp);
1030     UINT32_TO_BE_STREAM(p, ssrc);
1031   }
1032 
1033   /* store it */
1034   p_scb->p_pkt = p_data->apiwrite.p_buf;
1035 }
1036 
1037 /*******************************************************************************
1038  *
1039  * Function         avdt_scb_snd_abort_req
1040  *
1041  * Description      This function sends an abort command message.
1042  *
1043  * Returns          Nothing.
1044  *
1045  ******************************************************************************/
avdt_scb_snd_abort_req(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1046 void avdt_scb_snd_abort_req(AvdtpScb* p_scb,
1047                             UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1048   tAVDT_EVT_HDR hdr;
1049 
1050   AVDT_TRACE_DEBUG("%s: p_scb->p_ccb=%p", __func__, p_scb->p_ccb);
1051 
1052   if (p_scb->p_ccb != NULL) {
1053     p_scb->role = AVDT_CLOSE_INT;
1054 
1055     hdr.seid = p_scb->peer_seid;
1056 
1057     tAVDT_MSG avdt_msg;
1058     avdt_msg.hdr = hdr;
1059     avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_ABORT, &avdt_msg);
1060   }
1061 }
1062 
1063 /*******************************************************************************
1064  *
1065  * Function         avdt_scb_snd_abort_rsp
1066  *
1067  * Description      This function sends an abort response message.
1068  *
1069  * Returns          Nothing.
1070  *
1071  ******************************************************************************/
avdt_scb_snd_abort_rsp(UNUSED_ATTR AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1072 void avdt_scb_snd_abort_rsp(UNUSED_ATTR AvdtpScb* p_scb,
1073                             tAVDT_SCB_EVT* p_data) {
1074   avdt_msg_send_rsp(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx), AVDT_SIG_ABORT,
1075                     &p_data->msg);
1076 }
1077 
1078 /*******************************************************************************
1079  *
1080  * Function         avdt_scb_snd_close_req
1081  *
1082  * Description      This function sends a close command message.
1083  *
1084  * Returns          Nothing.
1085  *
1086  ******************************************************************************/
avdt_scb_snd_close_req(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1087 void avdt_scb_snd_close_req(AvdtpScb* p_scb,
1088                             UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1089   tAVDT_EVT_HDR hdr;
1090 
1091   p_scb->role = AVDT_CLOSE_INT;
1092 
1093   hdr.seid = p_scb->peer_seid;
1094 
1095   tAVDT_MSG avdt_msg;
1096   avdt_msg.hdr = hdr;
1097   avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_CLOSE, &avdt_msg);
1098 }
1099 
1100 /*******************************************************************************
1101  *
1102  * Function         avdt_scb_snd_stream_close
1103  *
1104  * Description      This function sends a close command message.
1105  *
1106  * Returns          Nothing.
1107  *
1108  ******************************************************************************/
avdt_scb_snd_stream_close(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1109 void avdt_scb_snd_stream_close(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1110   osi_free_and_reset((void**)&p_scb->p_pkt);
1111   avdt_scb_snd_close_req(p_scb, p_data);
1112 }
1113 
1114 /*******************************************************************************
1115  *
1116  * Function         avdt_scb_snd_close_rsp
1117  *
1118  * Description      This function sends a close response message.
1119  *
1120  * Returns          Nothing.
1121  *
1122  ******************************************************************************/
avdt_scb_snd_close_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1123 void avdt_scb_snd_close_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1124   avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_CLOSE, &p_data->msg);
1125 }
1126 
1127 /*******************************************************************************
1128  *
1129  * Function         avdt_scb_snd_getconfig_req
1130  *
1131  * Description      This function sends a get configuration command message.
1132  *
1133  * Returns          Nothing.
1134  *
1135  ******************************************************************************/
avdt_scb_snd_getconfig_req(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1136 void avdt_scb_snd_getconfig_req(AvdtpScb* p_scb,
1137                                 UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1138   tAVDT_EVT_HDR hdr;
1139 
1140   hdr.seid = p_scb->peer_seid;
1141 
1142   tAVDT_MSG avdt_msg;
1143   avdt_msg.hdr = hdr;
1144   avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_GETCONFIG, &avdt_msg);
1145 }
1146 
1147 /*******************************************************************************
1148  *
1149  * Function         avdt_scb_snd_getconfig_rsp
1150  *
1151  * Description      This function sends a get configuration response message.
1152  *
1153  * Returns          Nothing.
1154  *
1155  ******************************************************************************/
avdt_scb_snd_getconfig_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1156 void avdt_scb_snd_getconfig_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1157   avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_GETCONFIG, &p_data->msg);
1158 }
1159 
1160 /*******************************************************************************
1161  *
1162  * Function         avdt_scb_snd_open_req
1163  *
1164  * Description      This function sends an open command message.
1165  *
1166  * Returns          Nothing.
1167  *
1168  ******************************************************************************/
avdt_scb_snd_open_req(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1169 void avdt_scb_snd_open_req(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1170   tAVDT_EVT_HDR hdr;
1171 
1172   hdr.seid = p_scb->peer_seid;
1173 
1174   tAVDT_MSG avdt_msg;
1175   avdt_msg.hdr = hdr;
1176   avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_OPEN, &avdt_msg);
1177 }
1178 
1179 /*******************************************************************************
1180  *
1181  * Function         avdt_scb_snd_open_rsp
1182  *
1183  * Description      This function sends an open response message.  It also
1184  *                  calls avdt_ad_open_req() to accept a transport channel
1185  *                  connection.
1186  *
1187  * Returns          Nothing.
1188  *
1189  ******************************************************************************/
avdt_scb_snd_open_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1190 void avdt_scb_snd_open_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1191   /* notify adaption that we're waiting for transport channel open */
1192   p_scb->role = AVDT_OPEN_ACP;
1193   avdt_ad_open_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, AVDT_ACP);
1194 
1195   /* send response */
1196   avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_OPEN, &p_data->msg);
1197 
1198   alarm_set_on_mloop(p_scb->transport_channel_timer,
1199                      AVDT_SCB_TC_CONN_TIMEOUT_MS,
1200                      avdt_scb_transport_channel_timer_timeout, p_scb);
1201 }
1202 
1203 /*******************************************************************************
1204  *
1205  * Function         avdt_scb_snd_reconfig_req
1206  *
1207  * Description      This function stores the configuration parameters in the
1208  *                  SCB and sends a reconfiguration command message.
1209  *
1210  * Returns          Nothing.
1211  *
1212  ******************************************************************************/
avdt_scb_snd_reconfig_req(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1213 void avdt_scb_snd_reconfig_req(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1214   AVDT_TRACE_DEBUG("%s: p_scb->peer_seid=%d p_data->msg.hdr.seid=%d", __func__,
1215                    p_scb->peer_seid, p_data->msg.hdr.seid);
1216   AVDT_TRACE_DEBUG(
1217       "%s: codec: %s", __func__,
1218       A2DP_CodecInfoString(p_data->msg.config_cmd.p_cfg->codec_info).c_str());
1219 
1220   p_scb->req_cfg = *p_data->msg.config_cmd.p_cfg;
1221   p_data->msg.hdr.seid = p_scb->peer_seid;
1222   avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_RECONFIG, &p_data->msg);
1223 }
1224 
1225 /*******************************************************************************
1226  *
1227  * Function         avdt_scb_snd_reconfig_rsp
1228  *
1229  * Description      This function stores the configuration parameters in the
1230  *                  SCB and sends a reconfiguration response message.
1231  *
1232  * Returns          Nothing.
1233  *
1234  ******************************************************************************/
avdt_scb_snd_reconfig_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1235 void avdt_scb_snd_reconfig_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1236   if (p_data->msg.hdr.err_code == 0) {
1237     /* store new configuration */
1238     if (p_scb->req_cfg.num_codec > 0) {
1239       p_scb->curr_cfg.num_codec = p_scb->req_cfg.num_codec;
1240       memcpy(p_scb->curr_cfg.codec_info, p_scb->req_cfg.codec_info,
1241              AVDT_CODEC_SIZE);
1242     }
1243     if (p_scb->req_cfg.num_protect > 0) {
1244       p_scb->curr_cfg.num_protect = p_scb->req_cfg.num_protect;
1245       memcpy(p_scb->curr_cfg.protect_info, p_scb->req_cfg.protect_info,
1246              AVDT_PROTECT_SIZE);
1247     }
1248 
1249     /* send response */
1250     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_RECONFIG, &p_data->msg);
1251   } else {
1252     /* send reject */
1253     avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_RECONFIG, &p_data->msg);
1254   }
1255 }
1256 
1257 /*******************************************************************************
1258  *
1259  * Function         avdt_scb_snd_security_req
1260  *
1261  * Description      This function sends a security command message.
1262  *
1263  * Returns          Nothing.
1264  *
1265  ******************************************************************************/
avdt_scb_snd_security_req(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1266 void avdt_scb_snd_security_req(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1267   p_data->msg.hdr.seid = p_scb->peer_seid;
1268   avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_SECURITY, &p_data->msg);
1269 }
1270 
1271 /*******************************************************************************
1272  *
1273  * Function         avdt_scb_snd_security_rsp
1274  *
1275  * Description      This function sends a security response message.
1276  *
1277  * Returns          Nothing.
1278  *
1279  ******************************************************************************/
avdt_scb_snd_security_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1280 void avdt_scb_snd_security_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1281   if (p_data->msg.hdr.err_code == 0) {
1282     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_SECURITY, &p_data->msg);
1283   } else {
1284     avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_SECURITY, &p_data->msg);
1285   }
1286 }
1287 
1288 /*******************************************************************************
1289  *
1290  * Function         avdt_scb_snd_setconfig_rej
1291  *
1292  * Description      This function marks the SCB as not in use and sends a
1293  *                  set configuration reject message.
1294  *
1295  * Returns          Nothing.
1296  *
1297  ******************************************************************************/
avdt_scb_snd_setconfig_rej(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1298 void avdt_scb_snd_setconfig_rej(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1299   if (p_scb->p_ccb != NULL) {
1300     avdt_msg_send_rej(p_scb->p_ccb, AVDT_SIG_SETCONFIG, &p_data->msg);
1301 
1302     /* clear scb variables */
1303     avdt_scb_clr_vars(p_scb, p_data);
1304   }
1305 }
1306 
1307 /*******************************************************************************
1308  *
1309  * Function         avdt_scb_snd_setconfig_req
1310  *
1311  * Description      This function marks the SCB as in use and copies the
1312  *                  configuration parameters to the SCB.  Then the function
1313  *                  sends a set configuration command message and initiates
1314  *                  opening of the signaling channel.
1315  *
1316  * Returns          Nothing.
1317  *
1318  ******************************************************************************/
avdt_scb_snd_setconfig_req(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1319 void avdt_scb_snd_setconfig_req(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1320   AvdtpSepConfig *p_req, *p_cfg;
1321 
1322   AVDT_TRACE_DEBUG(
1323       "%s: codec: %s", __func__,
1324       A2DP_CodecInfoString(p_data->msg.config_cmd.p_cfg->codec_info).c_str());
1325 
1326   /* copy API parameters to scb, set scb as in use */
1327 
1328   AvdtpCcb* p_ccb = avdt_ccb_by_idx(p_data->msg.config_cmd.hdr.ccb_idx);
1329   if (p_scb->p_ccb != p_ccb) {
1330     AVDT_TRACE_ERROR(
1331         "%s: mismatch in AVDTP SCB/CCB state: (p_scb->p_ccb=%p != p_ccb=%p): "
1332         "p_scb=%p scb_handle=%d ccb_idx=%d",
1333         __func__, p_scb->p_ccb, p_ccb, p_scb, p_scb->ScbHandle(),
1334         p_data->msg.config_cmd.hdr.ccb_idx);
1335     avdt_scb_rej_not_in_use(p_scb, p_data);
1336     return;
1337   }
1338   p_scb->in_use = true;
1339   p_scb->peer_seid = p_data->msg.config_cmd.hdr.seid;
1340   p_req = p_data->msg.config_cmd.p_cfg;
1341   p_cfg = &p_scb->stream_config.cfg;
1342   p_scb->req_cfg = *p_data->msg.config_cmd.p_cfg;
1343 
1344   avdt_msg_send_cmd(p_scb->p_ccb, p_scb, AVDT_SIG_SETCONFIG, &p_data->msg);
1345 
1346   /* tell ccb to open channel */
1347   avdt_ccb_event(p_scb->p_ccb, AVDT_CCB_UL_OPEN_EVT, NULL);
1348 }
1349 
1350 /*******************************************************************************
1351  *
1352  * Function         avdt_scb_snd_setconfig_rsp
1353  *
1354  * Description      This function copies the requested configuration into the
1355  *                  current configuration and sends a set configuration
1356  *                  response message.
1357  *
1358  * Returns          Nothing.
1359  *
1360  ******************************************************************************/
avdt_scb_snd_setconfig_rsp(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1361 void avdt_scb_snd_setconfig_rsp(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1362   if (p_scb->p_ccb != NULL) {
1363     p_scb->curr_cfg = p_scb->req_cfg;
1364 
1365     avdt_msg_send_rsp(p_scb->p_ccb, AVDT_SIG_SETCONFIG, &p_data->msg);
1366   }
1367 }
1368 
1369 /*******************************************************************************
1370  *
1371  * Function         avdt_scb_snd_tc_close
1372  *
1373  * Description      This function calls avdt_ad_close_req() to close the
1374  *                  transport channel for this SCB.
1375  *
1376  * Returns          Nothing.
1377  *
1378  ******************************************************************************/
avdt_scb_snd_tc_close(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1379 void avdt_scb_snd_tc_close(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1380   if (p_scb->curr_cfg.psc_mask & AVDT_PSC_REPORT)
1381     avdt_ad_close_req(AVDT_CHAN_REPORT, p_scb->p_ccb, p_scb);
1382   avdt_ad_close_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb);
1383 }
1384 
1385 /*******************************************************************************
1386  *
1387  * Function         avdt_scb_cb_err
1388  *
1389  * Description      This function calls the application callback function
1390  *                  indicating an error.
1391  *
1392  * Returns          Nothing.
1393  *
1394  ******************************************************************************/
avdt_scb_cb_err(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1395 void avdt_scb_cb_err(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1396   tAVDT_CTRL avdt_ctrl;
1397 
1398   /* set error code and parameter */
1399   avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
1400   avdt_ctrl.hdr.err_param = 0;
1401 
1402   /* call callback, using lookup table to get callback event */
1403   (*p_scb->stream_config.p_avdt_ctrl_cback)(
1404       avdt_scb_to_hdl(p_scb), RawAddress::kEmpty,
1405       avdt_scb_cback_evt[p_scb->curr_evt], &avdt_ctrl,
1406       p_scb->stream_config.scb_index);
1407 }
1408 
1409 /*******************************************************************************
1410  *
1411  * Function         avdt_scb_cong_state
1412  *
1413  * Description      This function sets the congestion state of the SCB media
1414  *                  transport channel.
1415  *
1416  * Returns          Nothing.
1417  *
1418  ******************************************************************************/
avdt_scb_cong_state(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1419 void avdt_scb_cong_state(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1420   p_scb->cong = p_data->llcong;
1421 }
1422 
1423 /*******************************************************************************
1424  *
1425  * Function         avdt_scb_rej_state
1426  *
1427  * Description      This function sends a reject message to the peer indicating
1428  *                  incorrect state for the received command message.
1429  *
1430  * Returns          Nothing.
1431  *
1432  ******************************************************************************/
avdt_scb_rej_state(UNUSED_ATTR AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1433 void avdt_scb_rej_state(UNUSED_ATTR AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1434   p_data->msg.hdr.err_code = AVDT_ERR_BAD_STATE;
1435   p_data->msg.hdr.err_param = 0;
1436   avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
1437                     p_data->msg.hdr.sig_id, &p_data->msg);
1438 }
1439 
1440 /*******************************************************************************
1441  *
1442  * Function         avdt_scb_rej_in_use
1443  *
1444  * Description      This function sends a reject message to the peer indicating
1445  *                  the stream is in use.
1446  *
1447  * Returns          Nothing.
1448  *
1449  ******************************************************************************/
avdt_scb_rej_in_use(UNUSED_ATTR AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1450 void avdt_scb_rej_in_use(UNUSED_ATTR AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1451   p_data->msg.hdr.err_code = AVDT_ERR_IN_USE;
1452   p_data->msg.hdr.err_param = 0;
1453   avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
1454                     p_data->msg.hdr.sig_id, &p_data->msg);
1455 }
1456 
1457 /*******************************************************************************
1458  *
1459  * Function         avdt_scb_rej_not_in_use
1460  *
1461  * Description      This function sends a reject message to the peer indicating
1462  *                  the stream is in use.
1463  *
1464  * Returns          Nothing.
1465  *
1466  ******************************************************************************/
avdt_scb_rej_not_in_use(UNUSED_ATTR AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1467 void avdt_scb_rej_not_in_use(UNUSED_ATTR AvdtpScb* p_scb,
1468                              tAVDT_SCB_EVT* p_data) {
1469   p_data->msg.hdr.err_code = AVDT_ERR_NOT_IN_USE;
1470   p_data->msg.hdr.err_param = 0;
1471   avdt_msg_send_rej(avdt_ccb_by_idx(p_data->msg.hdr.ccb_idx),
1472                     p_data->msg.hdr.sig_id, &p_data->msg);
1473 }
1474 
1475 /*******************************************************************************
1476  *
1477  * Function         avdt_scb_set_remove
1478  *
1479  * Description      This function marks an SCB to be removed.
1480  *
1481  * Returns          Nothing.
1482  *
1483  ******************************************************************************/
avdt_scb_set_remove(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1484 void avdt_scb_set_remove(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1485   p_scb->remove = true;
1486 }
1487 
1488 /*******************************************************************************
1489  *
1490  * Function         avdt_scb_free_pkt
1491  *
1492  * Description      This function frees the media packet passed in.
1493  *
1494  * Returns          Nothing.
1495  *
1496  ******************************************************************************/
avdt_scb_free_pkt(AvdtpScb * p_scb,tAVDT_SCB_EVT * p_data)1497 void avdt_scb_free_pkt(AvdtpScb* p_scb, tAVDT_SCB_EVT* p_data) {
1498   tAVDT_CTRL avdt_ctrl;
1499 
1500   /* set error code and parameter */
1501   avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
1502   avdt_ctrl.hdr.err_param = 0;
1503 
1504   osi_free_and_reset((void**)&p_data->apiwrite.p_buf);
1505 
1506   AVDT_TRACE_WARNING("Dropped media packet");
1507 
1508   /* we need to call callback to keep data flow going */
1509   (*p_scb->stream_config.p_avdt_ctrl_cback)(
1510       avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_WRITE_CFM_EVT,
1511       &avdt_ctrl, p_scb->stream_config.scb_index);
1512 }
1513 
1514 /*******************************************************************************
1515  *
1516  * Function         avdt_scb_clr_pkt
1517  *
1518  * Description      This function frees the media packet stored in the SCB.
1519  *
1520  * Returns          Nothing.
1521  *
1522  ******************************************************************************/
avdt_scb_clr_pkt(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1523 void avdt_scb_clr_pkt(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1524   tAVDT_CTRL avdt_ctrl;
1525   AvdtpCcb* p_ccb;
1526   uint8_t tcid;
1527   uint16_t lcid;
1528 
1529   /* set error code and parameter */
1530   avdt_ctrl.hdr.err_code = AVDT_ERR_BAD_STATE;
1531   avdt_ctrl.hdr.err_param = 0;
1532   /* flush the media data queued at L2CAP */
1533   p_ccb = p_scb->p_ccb;
1534   if (p_ccb != NULL) {
1535     /* get tcid from type, scb */
1536     tcid = avdt_ad_type_to_tcid(AVDT_CHAN_MEDIA, p_scb);
1537 
1538     lcid = avdtp_cb.ad.rt_tbl[avdt_ccb_to_idx(p_ccb)][tcid].lcid;
1539     L2CA_FlushChannel(lcid, L2CAP_FLUSH_CHANS_ALL);
1540   }
1541 
1542   if (p_scb->p_pkt != NULL) {
1543     osi_free_and_reset((void**)&p_scb->p_pkt);
1544 
1545     AVDT_TRACE_DEBUG("Dropped stored media packet");
1546 
1547     /* we need to call callback to keep data flow going */
1548     (*p_scb->stream_config.p_avdt_ctrl_cback)(
1549         avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_WRITE_CFM_EVT,
1550         &avdt_ctrl, p_scb->stream_config.scb_index);
1551   }
1552 }
1553 
1554 /*******************************************************************************
1555  *
1556  * Function         avdt_scb_chk_snd_pkt
1557  *
1558  * Description      This function checks if the SCB is congested, and if not
1559  *                  congested it sends a stored media packet, if any.  After it
1560  *                  sends the packet it calls the application callback function
1561  *                  with a write confirm.
1562  *
1563  * Returns          Nothing.
1564  *
1565  ******************************************************************************/
avdt_scb_chk_snd_pkt(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1566 void avdt_scb_chk_snd_pkt(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1567   tAVDT_CTRL avdt_ctrl;
1568   BT_HDR* p_pkt;
1569 
1570   avdt_ctrl.hdr.err_code = 0;
1571 
1572   if (!p_scb->cong) {
1573     if (p_scb->p_pkt != NULL) {
1574       p_pkt = p_scb->p_pkt;
1575       p_scb->p_pkt = NULL;
1576       avdt_ad_write_req(AVDT_CHAN_MEDIA, p_scb->p_ccb, p_scb, p_pkt);
1577 
1578       (*p_scb->stream_config.p_avdt_ctrl_cback)(
1579           avdt_scb_to_hdl(p_scb), RawAddress::kEmpty, AVDT_WRITE_CFM_EVT,
1580           &avdt_ctrl, p_scb->stream_config.scb_index);
1581     }
1582   }
1583 }
1584 
1585 /*******************************************************************************
1586  *
1587  * Function         avdt_scb_transport_channel_timer
1588  *
1589  * Description      This function is called to start a timer when the peer
1590  *                  initiates closing of the stream.  The timer verifies that
1591  *                  the peer disconnects the transport channel.
1592  *
1593  * Returns          Nothing.
1594  *
1595  ******************************************************************************/
avdt_scb_transport_channel_timer(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1596 void avdt_scb_transport_channel_timer(AvdtpScb* p_scb,
1597                                       UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1598   alarm_set_on_mloop(p_scb->transport_channel_timer,
1599                      AVDT_SCB_TC_DISC_TIMEOUT_MS,
1600                      avdt_scb_transport_channel_timer_timeout, p_scb);
1601 }
1602 
1603 /*******************************************************************************
1604  *
1605  * Function         avdt_scb_clr_vars
1606  *
1607  * Description      This function initializes certain SCB variables.
1608  *
1609  * Returns          Nothing.
1610  *
1611  ******************************************************************************/
avdt_scb_clr_vars(AvdtpScb * p_scb,UNUSED_ATTR tAVDT_SCB_EVT * p_data)1612 void avdt_scb_clr_vars(AvdtpScb* p_scb, UNUSED_ATTR tAVDT_SCB_EVT* p_data) {
1613   p_scb->in_use = false;
1614   p_scb->peer_seid = 0;
1615 }
1616