1 /******************************************************************************
2 *
3 * Copyright 2002-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /******************************************************************************
20 *
21 * This module contains functions for parsing and building AVDTP signaling
22 * messages. It also contains functions called by the SCB or CCB state
23 * machines for sending command, response, and reject messages. It also
24 * contains a function that processes incoming messages and dispatches them
25 * to the appropriate SCB or CCB.
26 *
27 ******************************************************************************/
28
29 #define LOG_TAG "bluetooth"
30
31 #include <string.h>
32
33 #include "avdt_api.h"
34 #include "avdt_int.h"
35 #include "avdtc_api.h"
36 #include "bt_target.h"
37 #include "osi/include/allocator.h"
38 #include "osi/include/log.h"
39 #include "osi/include/osi.h"
40 #include "stack/include/bt_hdr.h"
41 #include "stack/include/bt_types.h"
42
43 /*****************************************************************************
44 * constants
45 ****************************************************************************/
46
47 /* mask of all psc values */
48 #define AVDT_MSG_PSC_MASK \
49 (AVDT_PSC_TRANS | AVDT_PSC_REPORT | AVDT_PSC_DELAY_RPT | AVDT_PSC_RECOV | \
50 AVDT_PSC_HDRCMP | AVDT_PSC_MUX)
51 #define AVDT_PSC_PROTECT (1 << 4) /* Content Protection */
52 #define AVDT_PSC_CODEC (1 << 7) /* codec */
53
54 /*****************************************************************************
55 * type definitions
56 ****************************************************************************/
57
58 /* type for message building functions */
59 typedef void (*tAVDT_MSG_BLD)(uint8_t** p, tAVDT_MSG* p_msg);
60
61 /* type for message parsing functions */
62 typedef uint8_t (*tAVDT_MSG_PRS)(tAVDT_MSG* p_msg, uint8_t* p, uint16_t len);
63
64 /*****************************************************************************
65 * local function declarations
66 ****************************************************************************/
67
68 static void avdt_msg_bld_none(uint8_t** p, tAVDT_MSG* p_msg);
69 static void avdt_msg_bld_single(uint8_t** p, tAVDT_MSG* p_msg);
70 static void avdt_msg_bld_setconfig_cmd(uint8_t** p, tAVDT_MSG* p_msg);
71 static void avdt_msg_bld_reconfig_cmd(uint8_t** p, tAVDT_MSG* p_msg);
72 static void avdt_msg_bld_multi(uint8_t** p, tAVDT_MSG* p_msg);
73 static void avdt_msg_bld_security_cmd(uint8_t** p, tAVDT_MSG* p_msg);
74 static void avdt_msg_bld_discover_rsp(uint8_t** p, tAVDT_MSG* p_msg);
75 static void avdt_msg_bld_svccap(uint8_t** p, tAVDT_MSG* p_msg);
76 static void avdt_msg_bld_security_rsp(uint8_t** p, tAVDT_MSG* p_msg);
77 static void avdt_msg_bld_all_svccap(uint8_t** p, tAVDT_MSG* p_msg);
78 static void avdt_msg_bld_delay_rpt(uint8_t** p, tAVDT_MSG* p_msg);
79
80 static uint8_t avdt_msg_prs_none(tAVDT_MSG* p_msg, uint8_t* p, uint16_t len);
81 static uint8_t avdt_msg_prs_single(tAVDT_MSG* p_msg, uint8_t* p, uint16_t len);
82 static uint8_t avdt_msg_prs_setconfig_cmd(tAVDT_MSG* p_msg, uint8_t* p,
83 uint16_t len);
84 static uint8_t avdt_msg_prs_reconfig_cmd(tAVDT_MSG* p_msg, uint8_t* p,
85 uint16_t len);
86 static uint8_t avdt_msg_prs_multi(tAVDT_MSG* p_msg, uint8_t* p, uint16_t len);
87 static uint8_t avdt_msg_prs_security_cmd(tAVDT_MSG* p_msg, uint8_t* p,
88 uint16_t len);
89 static uint8_t avdt_msg_prs_discover_rsp(tAVDT_MSG* p_msg, uint8_t* p,
90 uint16_t len);
91 static uint8_t avdt_msg_prs_svccap(tAVDT_MSG* p_msg, uint8_t* p, uint16_t len);
92 static uint8_t avdt_msg_prs_all_svccap(tAVDT_MSG* p_msg, uint8_t* p,
93 uint16_t len);
94 static uint8_t avdt_msg_prs_security_rsp(tAVDT_MSG* p_msg, uint8_t* p,
95 uint16_t len);
96 static uint8_t avdt_msg_prs_delay_rpt(tAVDT_MSG* p_msg, uint8_t* p,
97 uint16_t len);
98
99 /*****************************************************************************
100 * constants
101 ****************************************************************************/
102
103 /* table of information element minimum lengths used for parsing */
104 const uint8_t avdt_msg_ie_len_min[] = {
105 0, /* unused */
106 AVDT_LEN_TRANS_MIN, /* media transport */
107 AVDT_LEN_REPORT_MIN, /* reporting */
108 AVDT_LEN_RECOV_MIN, /* recovery */
109 AVDT_LEN_PROTECT_MIN, /* content protection */
110 AVDT_LEN_HDRCMP_MIN, /* header compression */
111 AVDT_LEN_MUX_MIN, /* multiplexing */
112 AVDT_LEN_CODEC_MIN, /* codec */
113 AVDT_LEN_DELAY_RPT_MIN /* delay report */
114 };
115
116 /* table of information element minimum lengths used for parsing */
117 const uint8_t avdt_msg_ie_len_max[] = {
118 0, /* unused */
119 AVDT_LEN_TRANS_MAX, /* media transport */
120 AVDT_LEN_REPORT_MAX, /* reporting */
121 AVDT_LEN_RECOV_MAX, /* recovery */
122 AVDT_LEN_PROTECT_MAX, /* content protection */
123 AVDT_LEN_HDRCMP_MAX, /* header compression */
124 AVDT_LEN_MUX_MAX, /* multiplexing */
125 AVDT_LEN_CODEC_MAX, /* codec */
126 AVDT_LEN_DELAY_RPT_MAX /* delay report */
127 };
128
129 /* table of error codes used when decoding information elements */
130 const uint8_t avdt_msg_ie_err[] = {
131 0, /* unused */
132 AVDT_ERR_MEDIA_TRANS, /* media transport */
133 AVDT_ERR_LENGTH, /* reporting */
134 AVDT_ERR_RECOV_FMT, /* recovery */
135 AVDT_ERR_CP_FMT, /* content protection */
136 AVDT_ERR_ROHC_FMT, /* header compression */
137 AVDT_ERR_MUX_FMT, /* multiplexing */
138 AVDT_ERR_SERVICE, /* codec */
139 AVDT_ERR_SERVICE /* delay report ?? */
140 };
141
142 /* table of packet type minimum lengths */
143 static const uint8_t avdt_msg_pkt_type_len[] = {
144 AVDT_LEN_TYPE_SINGLE, AVDT_LEN_TYPE_START, AVDT_LEN_TYPE_CONT,
145 AVDT_LEN_TYPE_END};
146
147 /* function table for building command messages */
148 const tAVDT_MSG_BLD avdt_msg_bld_cmd[] = {
149 avdt_msg_bld_none, /* discover */
150 avdt_msg_bld_single, /* get capabilities */
151 avdt_msg_bld_setconfig_cmd, /* set configuration */
152 avdt_msg_bld_single, /* get configuration */
153 avdt_msg_bld_reconfig_cmd, /* reconfigure */
154 avdt_msg_bld_single, /* open */
155 avdt_msg_bld_multi, /* start */
156 avdt_msg_bld_single, /* close */
157 avdt_msg_bld_multi, /* suspend */
158 avdt_msg_bld_single, /* abort */
159 avdt_msg_bld_security_cmd, /* security control */
160 avdt_msg_bld_single, /* get all capabilities */
161 avdt_msg_bld_delay_rpt /* delay report */
162 };
163
164 /* function table for building response messages */
165 const tAVDT_MSG_BLD avdt_msg_bld_rsp[] = {
166 avdt_msg_bld_discover_rsp, /* discover */
167 avdt_msg_bld_svccap, /* get capabilities */
168 avdt_msg_bld_none, /* set configuration */
169 avdt_msg_bld_all_svccap, /* get configuration */
170 avdt_msg_bld_none, /* reconfigure */
171 avdt_msg_bld_none, /* open */
172 avdt_msg_bld_none, /* start */
173 avdt_msg_bld_none, /* close */
174 avdt_msg_bld_none, /* suspend */
175 avdt_msg_bld_none, /* abort */
176 avdt_msg_bld_security_rsp, /* security control */
177 avdt_msg_bld_all_svccap, /* get all capabilities */
178 avdt_msg_bld_none /* delay report */
179 };
180
181 /* function table for parsing command messages */
182 const tAVDT_MSG_PRS avdt_msg_prs_cmd[] = {
183 avdt_msg_prs_none, /* discover */
184 avdt_msg_prs_single, /* get capabilities */
185 avdt_msg_prs_setconfig_cmd, /* set configuration */
186 avdt_msg_prs_single, /* get configuration */
187 avdt_msg_prs_reconfig_cmd, /* reconfigure */
188 avdt_msg_prs_single, /* open */
189 avdt_msg_prs_multi, /* start */
190 avdt_msg_prs_single, /* close */
191 avdt_msg_prs_multi, /* suspend */
192 avdt_msg_prs_single, /* abort */
193 avdt_msg_prs_security_cmd, /* security control */
194 avdt_msg_prs_single, /* get all capabilities */
195 avdt_msg_prs_delay_rpt /* delay report */
196 };
197
198 /* function table for parsing response messages */
199 const tAVDT_MSG_PRS avdt_msg_prs_rsp[] = {
200 avdt_msg_prs_discover_rsp, /* discover */
201 avdt_msg_prs_svccap, /* get capabilities */
202 avdt_msg_prs_none, /* set configuration */
203 avdt_msg_prs_all_svccap, /* get configuration */
204 avdt_msg_prs_none, /* reconfigure */
205 avdt_msg_prs_none, /* open */
206 avdt_msg_prs_none, /* start */
207 avdt_msg_prs_none, /* close */
208 avdt_msg_prs_none, /* suspend */
209 avdt_msg_prs_none, /* abort */
210 avdt_msg_prs_security_rsp, /* security control */
211 avdt_msg_prs_all_svccap, /* get all capabilities */
212 avdt_msg_prs_none /* delay report */
213 };
214
215 /* command message-to-event lookup table */
216 const uint8_t avdt_msg_cmd_2_evt[] = {
217 AVDT_CCB_MSG_DISCOVER_CMD_EVT + AVDT_CCB_MKR, /* discover */
218 AVDT_CCB_MSG_GETCAP_CMD_EVT + AVDT_CCB_MKR, /* get capabilities */
219 AVDT_SCB_MSG_SETCONFIG_CMD_EVT, /* set configuration */
220 AVDT_SCB_MSG_GETCONFIG_CMD_EVT, /* get configuration */
221 AVDT_SCB_MSG_RECONFIG_CMD_EVT, /* reconfigure */
222 AVDT_SCB_MSG_OPEN_CMD_EVT, /* open */
223 AVDT_CCB_MSG_START_CMD_EVT + AVDT_CCB_MKR, /* start */
224 AVDT_SCB_MSG_CLOSE_CMD_EVT, /* close */
225 AVDT_CCB_MSG_SUSPEND_CMD_EVT + AVDT_CCB_MKR, /* suspend */
226 AVDT_SCB_MSG_ABORT_CMD_EVT, /* abort */
227 AVDT_SCB_MSG_SECURITY_CMD_EVT, /* security control */
228 AVDT_CCB_MSG_GETCAP_CMD_EVT + AVDT_CCB_MKR, /* get all capabilities */
229 AVDT_SCB_MSG_DELAY_RPT_CMD_EVT /* delay report */
230 };
231
232 /* response message-to-event lookup table */
233 const uint8_t avdt_msg_rsp_2_evt[] = {
234 AVDT_CCB_MSG_DISCOVER_RSP_EVT + AVDT_CCB_MKR, /* discover */
235 AVDT_CCB_MSG_GETCAP_RSP_EVT + AVDT_CCB_MKR, /* get capabilities */
236 AVDT_SCB_MSG_SETCONFIG_RSP_EVT, /* set configuration */
237 AVDT_SCB_MSG_GETCONFIG_RSP_EVT, /* get configuration */
238 AVDT_SCB_MSG_RECONFIG_RSP_EVT, /* reconfigure */
239 AVDT_SCB_MSG_OPEN_RSP_EVT, /* open */
240 AVDT_CCB_MSG_START_RSP_EVT + AVDT_CCB_MKR, /* start */
241 AVDT_SCB_MSG_CLOSE_RSP_EVT, /* close */
242 AVDT_CCB_MSG_SUSPEND_RSP_EVT + AVDT_CCB_MKR, /* suspend */
243 AVDT_SCB_MSG_ABORT_RSP_EVT, /* abort */
244 AVDT_SCB_MSG_SECURITY_RSP_EVT, /* security control */
245 AVDT_CCB_MSG_GETCAP_RSP_EVT + AVDT_CCB_MKR, /* get all capabilities */
246 AVDT_SCB_MSG_DELAY_RPT_RSP_EVT /* delay report */
247 };
248
249 /* reject message-to-event lookup table */
250 const uint8_t avdt_msg_rej_2_evt[] = {
251 AVDT_CCB_MSG_DISCOVER_RSP_EVT + AVDT_CCB_MKR, /* discover */
252 AVDT_CCB_MSG_GETCAP_RSP_EVT + AVDT_CCB_MKR, /* get capabilities */
253 AVDT_SCB_MSG_SETCONFIG_REJ_EVT, /* set configuration */
254 AVDT_SCB_MSG_GETCONFIG_RSP_EVT, /* get configuration */
255 AVDT_SCB_MSG_RECONFIG_RSP_EVT, /* reconfigure */
256 AVDT_SCB_MSG_OPEN_REJ_EVT, /* open */
257 AVDT_CCB_MSG_START_RSP_EVT + AVDT_CCB_MKR, /* start */
258 AVDT_SCB_MSG_CLOSE_RSP_EVT, /* close */
259 AVDT_CCB_MSG_SUSPEND_RSP_EVT + AVDT_CCB_MKR, /* suspend */
260 AVDT_SCB_MSG_ABORT_RSP_EVT, /* abort */
261 AVDT_SCB_MSG_SECURITY_RSP_EVT, /* security control */
262 AVDT_CCB_MSG_GETCAP_RSP_EVT + AVDT_CCB_MKR, /* get all capabilities */
263 0 /* delay report */
264 };
265
266 /*******************************************************************************
267 *
268 * Function avdt_msg_bld_cfg
269 *
270 * Description This function builds the configuration parameters contained
271 * in a command or response message.
272 *
273 *
274 * Returns void.
275 *
276 ******************************************************************************/
avdt_msg_bld_cfg(uint8_t ** p,AvdtpSepConfig * p_cfg)277 static void avdt_msg_bld_cfg(uint8_t** p, AvdtpSepConfig* p_cfg) {
278 uint8_t len;
279
280 /* for now, just build media transport, codec, and content protection, and
281 * multiplexing */
282
283 /* media transport */
284 if (p_cfg->psc_mask & AVDT_PSC_TRANS) {
285 *(*p)++ = AVDT_CAT_TRANS;
286 *(*p)++ = 0; /* length */
287 }
288
289 /* reporting transport */
290 if (p_cfg->psc_mask & AVDT_PSC_REPORT) {
291 *(*p)++ = AVDT_CAT_REPORT;
292 *(*p)++ = 0; /* length */
293 }
294
295 /* codec */
296 if (p_cfg->num_codec != 0) {
297 *(*p)++ = AVDT_CAT_CODEC;
298 len = p_cfg->codec_info[0] + 1;
299 if (len > AVDT_CODEC_SIZE) len = AVDT_CODEC_SIZE;
300
301 memcpy(*p, p_cfg->codec_info, len);
302 *p += len;
303 }
304
305 /* content protection */
306 if (p_cfg->num_protect != 0) {
307 *(*p)++ = AVDT_CAT_PROTECT;
308 len = p_cfg->protect_info[0] + 1;
309 if (len > AVDT_PROTECT_SIZE) len = AVDT_PROTECT_SIZE;
310
311 memcpy(*p, p_cfg->protect_info, len);
312 *p += len;
313 }
314
315 /* delay report */
316 if (p_cfg->psc_mask & AVDT_PSC_DELAY_RPT) {
317 *(*p)++ = AVDT_CAT_DELAY_RPT;
318 *(*p)++ = 0; /* length */
319 }
320 }
321
322 /*******************************************************************************
323 *
324 * Function avdt_msg_bld_none
325 *
326 * Description This message building function builds an empty message.
327 *
328 *
329 * Returns void.
330 *
331 ******************************************************************************/
avdt_msg_bld_none(UNUSED_ATTR uint8_t ** p,UNUSED_ATTR tAVDT_MSG * p_msg)332 static void avdt_msg_bld_none(UNUSED_ATTR uint8_t** p,
333 UNUSED_ATTR tAVDT_MSG* p_msg) {
334 return;
335 }
336
337 /*******************************************************************************
338 *
339 * Function avdt_msg_bld_single
340 *
341 * Description This message building function builds a message containing
342 * a single SEID.
343 *
344 *
345 * Returns void.
346 *
347 ******************************************************************************/
avdt_msg_bld_single(uint8_t ** p,tAVDT_MSG * p_msg)348 static void avdt_msg_bld_single(uint8_t** p, tAVDT_MSG* p_msg) {
349 AVDT_MSG_BLD_SEID(*p, p_msg->single.seid);
350 }
351
352 /*******************************************************************************
353 *
354 * Function avdt_msg_bld_setconfig_cmd
355 *
356 * Description This message building function builds a set configuration
357 * command message.
358 *
359 *
360 * Returns void.
361 *
362 ******************************************************************************/
avdt_msg_bld_setconfig_cmd(uint8_t ** p,tAVDT_MSG * p_msg)363 static void avdt_msg_bld_setconfig_cmd(uint8_t** p, tAVDT_MSG* p_msg) {
364 AVDT_MSG_BLD_SEID(*p, p_msg->config_cmd.hdr.seid);
365 AVDT_MSG_BLD_SEID(*p, p_msg->config_cmd.int_seid);
366 avdt_msg_bld_cfg(p, p_msg->config_cmd.p_cfg);
367 }
368
369 /*******************************************************************************
370 *
371 * Function avdt_msg_bld_reconfig_cmd
372 *
373 * Description This message building function builds a reconfiguration
374 * command message.
375 *
376 *
377 * Returns void.
378 *
379 ******************************************************************************/
avdt_msg_bld_reconfig_cmd(uint8_t ** p,tAVDT_MSG * p_msg)380 static void avdt_msg_bld_reconfig_cmd(uint8_t** p, tAVDT_MSG* p_msg) {
381 AVDT_MSG_BLD_SEID(*p, p_msg->reconfig_cmd.hdr.seid);
382
383 /* force psc mask zero to build only codec and security */
384 p_msg->reconfig_cmd.p_cfg->psc_mask = 0;
385 avdt_msg_bld_cfg(p, p_msg->reconfig_cmd.p_cfg);
386 }
387
388 /*******************************************************************************
389 *
390 * Function avdt_msg_bld_multi
391 *
392 * Description This message building function builds a message containing
393 * multiple SEID's.
394 *
395 *
396 * Returns void.
397 *
398 ******************************************************************************/
avdt_msg_bld_multi(uint8_t ** p,tAVDT_MSG * p_msg)399 static void avdt_msg_bld_multi(uint8_t** p, tAVDT_MSG* p_msg) {
400 int i;
401
402 for (i = 0; i < p_msg->multi.num_seps; i++) {
403 AVDT_MSG_BLD_SEID(*p, p_msg->multi.seid_list[i]);
404 }
405 }
406
407 /*******************************************************************************
408 *
409 * Function avdt_msg_bld_security_cmd
410 *
411 * Description This message building function builds a security
412 * command message.
413 *
414 * Returns void.
415 *
416 ******************************************************************************/
avdt_msg_bld_security_cmd(uint8_t ** p,tAVDT_MSG * p_msg)417 static void avdt_msg_bld_security_cmd(uint8_t** p, tAVDT_MSG* p_msg) {
418 AVDT_MSG_BLD_SEID(*p, p_msg->security_cmd.hdr.seid);
419 memcpy(*p, p_msg->security_cmd.p_data, p_msg->security_cmd.len);
420 *p += p_msg->security_cmd.len;
421 }
422
423 /*******************************************************************************
424 *
425 * Function avdt_msg_bld_delay_rpt
426 *
427 * Description This message building function builds a delay report
428 * command message.
429 *
430 * Returns void.
431 *
432 ******************************************************************************/
avdt_msg_bld_delay_rpt(uint8_t ** p,tAVDT_MSG * p_msg)433 static void avdt_msg_bld_delay_rpt(uint8_t** p, tAVDT_MSG* p_msg) {
434 AVDT_MSG_BLD_SEID(*p, p_msg->delay_rpt_cmd.hdr.seid);
435 UINT16_TO_BE_STREAM(*p, p_msg->delay_rpt_cmd.delay);
436 }
437
438 /*******************************************************************************
439 *
440 * Function avdt_msg_bld_discover_rsp
441 *
442 * Description This message building function builds a discover
443 * response message.
444 *
445 *
446 * Returns void.
447 *
448 ******************************************************************************/
avdt_msg_bld_discover_rsp(uint8_t ** p,tAVDT_MSG * p_msg)449 static void avdt_msg_bld_discover_rsp(uint8_t** p, tAVDT_MSG* p_msg) {
450 int i;
451
452 for (i = 0; i < p_msg->discover_rsp.num_seps; i++) {
453 /* build discover rsp info */
454 AVDT_MSG_BLD_DISC(*p, p_msg->discover_rsp.p_sep_info[i].seid,
455 p_msg->discover_rsp.p_sep_info[i].in_use,
456 p_msg->discover_rsp.p_sep_info[i].media_type,
457 p_msg->discover_rsp.p_sep_info[i].tsep);
458 }
459 }
460
461 /*******************************************************************************
462 *
463 * Function avdt_msg_bld_svccap
464 *
465 * Description This message building function builds a message containing
466 * service capabilities parameters.
467 *
468 *
469 * Returns void.
470 *
471 ******************************************************************************/
avdt_msg_bld_svccap(uint8_t ** p,tAVDT_MSG * p_msg)472 static void avdt_msg_bld_svccap(uint8_t** p, tAVDT_MSG* p_msg) {
473 AvdtpSepConfig cfg = *p_msg->svccap.p_cfg;
474
475 // Include only the Basic Capability
476 cfg.psc_mask &= AVDT_LEG_PSC;
477
478 avdt_msg_bld_cfg(p, &cfg);
479 }
480
481 /*******************************************************************************
482 *
483 * Function avdt_msg_bld_all_svccap
484 *
485 * Description This message building function builds a message containing
486 * service capabilities parameters.
487 *
488 *
489 * Returns void.
490 *
491 ******************************************************************************/
avdt_msg_bld_all_svccap(uint8_t ** p,tAVDT_MSG * p_msg)492 static void avdt_msg_bld_all_svccap(uint8_t** p, tAVDT_MSG* p_msg) {
493 avdt_msg_bld_cfg(p, p_msg->svccap.p_cfg);
494 }
495
496 /*******************************************************************************
497 *
498 * Function avdt_msg_bld_security_rsp
499 *
500 * Description This message building function builds a security
501 * response message.
502 *
503 *
504 * Returns void.
505 *
506 ******************************************************************************/
avdt_msg_bld_security_rsp(uint8_t ** p,tAVDT_MSG * p_msg)507 static void avdt_msg_bld_security_rsp(uint8_t** p, tAVDT_MSG* p_msg) {
508 memcpy(*p, p_msg->security_rsp.p_data, p_msg->security_rsp.len);
509 *p += p_msg->security_rsp.len;
510 }
511
512 /*******************************************************************************
513 *
514 * Function avdt_msg_prs_cfg
515 *
516 * Description This message parsing function parses the configuration
517 * parameters field of a message.
518 *
519 *
520 * Returns Error code or zero if no error, and element that failed
521 * in p_elem.
522 *
523 ******************************************************************************/
avdt_msg_prs_cfg(AvdtpSepConfig * p_cfg,uint8_t * p,uint16_t len,uint8_t * p_elem,uint8_t sig_id)524 static uint8_t avdt_msg_prs_cfg(AvdtpSepConfig* p_cfg, uint8_t* p, uint16_t len,
525 uint8_t* p_elem, uint8_t sig_id) {
526 uint8_t* p_end;
527 uint8_t elem = 0;
528 uint8_t elem_len;
529 uint8_t tmp;
530 uint8_t err = 0;
531 uint8_t protect_offset = 0;
532
533 if (!p_cfg) {
534 AVDT_TRACE_ERROR("not expecting this cfg");
535 return AVDT_ERR_BAD_STATE;
536 }
537
538 p_cfg->psc_mask = 0;
539 p_cfg->num_codec = 0;
540 p_cfg->num_protect = 0;
541
542 /* while there is still data to parse */
543 p_end = p + len;
544 while ((p < p_end) && (err == 0)) {
545 /* verify overall length */
546 if ((p_end - p) < AVDT_LEN_CFG_MIN) {
547 err = AVDT_ERR_PAYLOAD;
548 break;
549 }
550
551 /* get and verify info elem id, length */
552 elem = *p++;
553 elem_len = *p++;
554
555 if ((elem == 0) || (elem > AVDT_CAT_MAX_CUR)) {
556 /* this may not be really bad.
557 * It may be a service category that is too new for us.
558 * allow these to be parsed without reporting an error.
559 * If this is a "capability" (as in GetCapRsp & GetConfigRsp), this is
560 * filtered out.
561 * If this is a Configuration (as in SetConfigCmd & ReconfigCmd),
562 * this will be marked as an error in the caller of this function */
563 if ((sig_id == AVDT_SIG_SETCONFIG) || (sig_id == AVDT_SIG_RECONFIG)) {
564 /* Cannot accept unknown category. */
565 err = AVDT_ERR_CATEGORY;
566 break;
567 } else /* GETCAP or GET_ALLCAP */
568 {
569 /* Skip unknown categories. */
570 p += elem_len;
571 AVDT_TRACE_DEBUG("skipping unknown service category=%d len: %d", elem,
572 elem_len);
573 continue;
574 }
575 }
576
577 if ((elem_len > avdt_msg_ie_len_max[elem]) ||
578 (elem_len < avdt_msg_ie_len_min[elem])) {
579 err = avdt_msg_ie_err[elem];
580 break;
581 }
582
583 /* add element to psc mask, but mask out codec or protect */
584 p_cfg->psc_mask |= (1 << elem);
585 AVDT_TRACE_DEBUG("elem=%d elem_len: %d psc_mask=0x%x", elem, elem_len,
586 p_cfg->psc_mask);
587
588 /* parse individual information elements with additional parameters */
589 switch (elem) {
590 case AVDT_CAT_RECOV:
591 if ((p_end - p) < 3) {
592 err = AVDT_ERR_PAYLOAD;
593 break;
594 }
595 p_cfg->recov_type = *p++;
596 p_cfg->recov_mrws = *p++;
597 p_cfg->recov_mnmp = *p++;
598 if (p_cfg->recov_type != AVDT_RECOV_RFC2733) {
599 err = AVDT_ERR_RECOV_TYPE;
600 } else if ((p_cfg->recov_mrws < AVDT_RECOV_MRWS_MIN) ||
601 (p_cfg->recov_mrws > AVDT_RECOV_MRWS_MAX) ||
602 (p_cfg->recov_mnmp < AVDT_RECOV_MNMP_MIN) ||
603 (p_cfg->recov_mnmp > AVDT_RECOV_MNMP_MAX)) {
604 err = AVDT_ERR_RECOV_FMT;
605 }
606 break;
607
608 case AVDT_CAT_PROTECT:
609 p_cfg->psc_mask &= ~AVDT_PSC_PROTECT;
610 if (p + elem_len > p_end) {
611 err = AVDT_ERR_LENGTH;
612 break;
613 }
614 if ((elem_len + protect_offset) < AVDT_PROTECT_SIZE) {
615 p_cfg->num_protect++;
616 p_cfg->protect_info[protect_offset] = elem_len;
617 protect_offset++;
618 memcpy(&p_cfg->protect_info[protect_offset], p, elem_len);
619 protect_offset += elem_len;
620 }
621 p += elem_len;
622 break;
623
624 case AVDT_CAT_HDRCMP:
625 if ((p_end - p) < 1) {
626 err = AVDT_ERR_PAYLOAD;
627 break;
628 }
629 p_cfg->hdrcmp_mask = *p++;
630 break;
631
632 case AVDT_CAT_CODEC:
633 p_cfg->psc_mask &= ~AVDT_PSC_CODEC;
634 tmp = elem_len;
635 if (elem_len >= AVDT_CODEC_SIZE) {
636 tmp = AVDT_CODEC_SIZE - 1;
637 }
638 if (p + tmp > p_end) {
639 err = AVDT_ERR_LENGTH;
640 break;
641 }
642 p_cfg->num_codec++;
643 p_cfg->codec_info[0] = elem_len;
644 memcpy(&p_cfg->codec_info[1], p, tmp);
645 p += elem_len;
646 break;
647
648 case AVDT_CAT_DELAY_RPT:
649 AVDT_TRACE_DEBUG("%s: Remote device supports delay reporting",
650 __func__);
651 break;
652
653 default:
654 p += elem_len;
655 break;
656 } /* switch */
657 } /* while ! err, !end*/
658 *p_elem = elem;
659 AVDT_TRACE_DEBUG("err=0x%x, elem:0x%x psc_mask=0x%x", err, elem,
660 p_cfg->psc_mask);
661
662 return err;
663 }
664
665 /*******************************************************************************
666 *
667 * Function avdt_msg_prs_none
668 *
669 * Description This message parsing function parses a message with no
670 * parameters.
671 *
672 *
673 * Returns Error code or zero if no error.
674 *
675 ******************************************************************************/
avdt_msg_prs_none(UNUSED_ATTR tAVDT_MSG * p_msg,UNUSED_ATTR uint8_t * p,UNUSED_ATTR uint16_t len)676 static uint8_t avdt_msg_prs_none(UNUSED_ATTR tAVDT_MSG* p_msg,
677 UNUSED_ATTR uint8_t* p,
678 UNUSED_ATTR uint16_t len) {
679 return 0;
680 }
681
682 /*******************************************************************************
683 *
684 * Function avdt_msg_prs_single
685 *
686 * Description This message parsing function parses a message with a
687 * single SEID.
688 *
689 *
690 * Returns Error code or zero if no error.
691 *
692 ******************************************************************************/
avdt_msg_prs_single(tAVDT_MSG * p_msg,uint8_t * p,uint16_t len)693 static uint8_t avdt_msg_prs_single(tAVDT_MSG* p_msg, uint8_t* p, uint16_t len) {
694 uint8_t err = 0;
695
696 /* verify len */
697 if (len != AVDT_LEN_SINGLE) {
698 err = AVDT_ERR_LENGTH;
699 } else {
700 AVDT_MSG_PRS_SEID(p, p_msg->single.seid);
701
702 if (avdt_scb_by_hdl(p_msg->single.seid) == NULL) {
703 err = AVDT_ERR_SEID;
704 }
705 }
706 return err;
707 }
708
709 /*******************************************************************************
710 *
711 * Function avdt_msg_prs_setconfig_cmd
712 *
713 * Description This message parsing function parses a set configuration
714 * command message.
715 *
716 *
717 * Returns Error code or zero if no error.
718 *
719 ******************************************************************************/
avdt_msg_prs_setconfig_cmd(tAVDT_MSG * p_msg,uint8_t * p,uint16_t len)720 static uint8_t avdt_msg_prs_setconfig_cmd(tAVDT_MSG* p_msg, uint8_t* p,
721 uint16_t len) {
722 uint8_t err = 0;
723
724 p_msg->hdr.err_param = 0;
725
726 /* verify len */
727 if (len < AVDT_LEN_SETCONFIG_MIN) {
728 err = AVDT_ERR_LENGTH;
729 } else {
730 /* get seids */
731 AVDT_MSG_PRS_SEID(p, p_msg->config_cmd.hdr.seid);
732 if (avdt_scb_by_hdl(p_msg->config_cmd.hdr.seid) == NULL) {
733 err = AVDT_ERR_SEID;
734 }
735
736 AVDT_MSG_PRS_SEID(p, p_msg->config_cmd.int_seid);
737 if ((p_msg->config_cmd.int_seid < AVDT_SEID_MIN) ||
738 (p_msg->config_cmd.int_seid > AVDT_SEID_MAX)) {
739 err = AVDT_ERR_SEID;
740 }
741 }
742
743 if (!err) {
744 /* parse configuration parameters */
745 len -= 2;
746 err = avdt_msg_prs_cfg(p_msg->config_cmd.p_cfg, p, len,
747 &p_msg->hdr.err_param, AVDT_SIG_SETCONFIG);
748
749 if (!err) {
750 /* verify protocol service capabilities are supported */
751 if (((p_msg->config_cmd.p_cfg->psc_mask & (~AVDT_PSC)) != 0) ||
752 (p_msg->config_cmd.p_cfg->num_codec == 0)) {
753 err = AVDT_ERR_INVALID_CAP;
754 }
755 }
756 }
757
758 return err;
759 }
760
761 /*******************************************************************************
762 *
763 * Function avdt_msg_prs_reconfig_cmd
764 *
765 * Description This message parsing function parses a reconfiguration
766 * command message.
767 *
768 *
769 * Returns Error code or zero if no error.
770 *
771 ******************************************************************************/
avdt_msg_prs_reconfig_cmd(tAVDT_MSG * p_msg,uint8_t * p,uint16_t len)772 static uint8_t avdt_msg_prs_reconfig_cmd(tAVDT_MSG* p_msg, uint8_t* p,
773 uint16_t len) {
774 uint8_t err = 0;
775
776 p_msg->hdr.err_param = 0;
777
778 /* verify len */
779 if (len < AVDT_LEN_RECONFIG_MIN) {
780 err = AVDT_ERR_LENGTH;
781 } else {
782 /* get seid */
783 AVDT_MSG_PRS_SEID(p, p_msg->reconfig_cmd.hdr.seid);
784 if (avdt_scb_by_hdl(p_msg->reconfig_cmd.hdr.seid) == NULL) {
785 err = AVDT_ERR_SEID;
786 } else {
787 /* parse config parameters */
788 len--;
789 err = avdt_msg_prs_cfg(p_msg->config_cmd.p_cfg, p, len,
790 &p_msg->hdr.err_param, AVDT_SIG_RECONFIG);
791
792 /* verify no protocol service capabilities in parameters */
793 if (!err) {
794 AVDT_TRACE_DEBUG("avdt_msg_prs_reconfig_cmd psc_mask=0x%x/0x%x",
795 p_msg->config_cmd.p_cfg->psc_mask, AVDT_MSG_PSC_MASK);
796 if ((p_msg->config_cmd.p_cfg->psc_mask != 0) ||
797 (p_msg->config_cmd.p_cfg->num_codec == 0 &&
798 p_msg->config_cmd.p_cfg->num_protect == 0)) {
799 err = AVDT_ERR_INVALID_CAP;
800 }
801 }
802 }
803 }
804 return err;
805 }
806
807 /*******************************************************************************
808 *
809 * Function avdt_msg_prs_multi
810 *
811 * Description This message parsing function parses a message containing
812 * multiple SEID's.
813 *
814 *
815 * Returns Error code or zero if no error.
816 *
817 ******************************************************************************/
avdt_msg_prs_multi(tAVDT_MSG * p_msg,uint8_t * p,uint16_t len)818 static uint8_t avdt_msg_prs_multi(tAVDT_MSG* p_msg, uint8_t* p, uint16_t len) {
819 int i;
820 uint8_t err = 0;
821
822 p_msg->hdr.err_param = 0;
823
824 /* verify len */
825 if (len < AVDT_LEN_MULTI_MIN || (len > AVDT_NUM_SEPS)) {
826 err = AVDT_ERR_LENGTH;
827 } else {
828 /* get and verify all seps */
829 for (i = 0; i < len; i++) {
830 AVDT_MSG_PRS_SEID(p, p_msg->multi.seid_list[i]);
831 if (avdt_scb_by_hdl(p_msg->multi.seid_list[i]) == NULL) {
832 err = AVDT_ERR_SEID;
833 p_msg->hdr.err_param = p_msg->multi.seid_list[i];
834 break;
835 }
836 }
837 p_msg->multi.num_seps = (uint8_t)i;
838 }
839
840 return err;
841 }
842
843 /*******************************************************************************
844 *
845 * Function avdt_msg_prs_security_cmd
846 *
847 * Description This message parsing function parses a security
848 * command message.
849 *
850 *
851 * Returns Error code or zero if no error.
852 *
853 ******************************************************************************/
avdt_msg_prs_security_cmd(tAVDT_MSG * p_msg,uint8_t * p,uint16_t len)854 static uint8_t avdt_msg_prs_security_cmd(tAVDT_MSG* p_msg, uint8_t* p,
855 uint16_t len) {
856 uint8_t err = 0;
857
858 /* verify len */
859 if (len < AVDT_LEN_SECURITY_MIN) {
860 err = AVDT_ERR_LENGTH;
861 } else {
862 /* get seid */
863 AVDT_MSG_PRS_SEID(p, p_msg->security_cmd.hdr.seid);
864 if (avdt_scb_by_hdl(p_msg->security_cmd.hdr.seid) == NULL) {
865 err = AVDT_ERR_SEID;
866 } else {
867 p_msg->security_cmd.p_data = p;
868 p_msg->security_cmd.len = len - 1;
869 }
870 }
871 return err;
872 }
873
874 /*******************************************************************************
875 *
876 * Function avdt_msg_prs_discover_rsp
877 *
878 * Description This message parsing function parses a discover
879 * response message.
880 *
881 *
882 * Returns Error code or zero if no error.
883 *
884 ******************************************************************************/
avdt_msg_prs_discover_rsp(tAVDT_MSG * p_msg,uint8_t * p,uint16_t len)885 static uint8_t avdt_msg_prs_discover_rsp(tAVDT_MSG* p_msg, uint8_t* p,
886 uint16_t len) {
887 int i;
888 uint8_t err = 0;
889
890 /* determine number of seps; seps in msg is len/2, but set to minimum
891 ** of seps app has supplied memory for and seps in msg
892 */
893 if (p_msg->discover_rsp.num_seps > (len / 2)) {
894 p_msg->discover_rsp.num_seps = (len / 2);
895 }
896
897 /* parse out sep info */
898 for (i = 0; i < p_msg->discover_rsp.num_seps; i++) {
899 /* parse discover rsp info */
900 AVDT_MSG_PRS_DISC(p, p_msg->discover_rsp.p_sep_info[i].seid,
901 p_msg->discover_rsp.p_sep_info[i].in_use,
902 p_msg->discover_rsp.p_sep_info[i].media_type,
903 p_msg->discover_rsp.p_sep_info[i].tsep);
904
905 /* verify that seid is valid */
906 if ((p_msg->discover_rsp.p_sep_info[i].seid < AVDT_SEID_MIN) ||
907 (p_msg->discover_rsp.p_sep_info[i].seid > AVDT_SEID_MAX)) {
908 err = AVDT_ERR_SEID;
909 break;
910 }
911 }
912
913 return err;
914 }
915
916 /*******************************************************************************
917 *
918 * Function avdt_msg_prs_svccap
919 *
920 * Description This message parsing function parses a message containing
921 * service capabilities parameters.
922 *
923 *
924 * Returns Error code or zero if no error.
925 *
926 ******************************************************************************/
avdt_msg_prs_svccap(tAVDT_MSG * p_msg,uint8_t * p,uint16_t len)927 static uint8_t avdt_msg_prs_svccap(tAVDT_MSG* p_msg, uint8_t* p, uint16_t len) {
928 /* parse parameters */
929 uint8_t err = avdt_msg_prs_cfg(p_msg->svccap.p_cfg, p, len,
930 &p_msg->hdr.err_param, AVDT_SIG_GETCAP);
931 if (p_msg->svccap.p_cfg) {
932 p_msg->svccap.p_cfg->psc_mask &= AVDT_LEG_PSC;
933 }
934
935 return (err);
936 }
937
938 /*******************************************************************************
939 *
940 * Function avdt_msg_prs_all_svccap
941 *
942 * Description This message parsing function parses a message containing
943 * service capabilities parameters.
944 *
945 *
946 * Returns Error code or zero if no error.
947 *
948 ******************************************************************************/
avdt_msg_prs_all_svccap(tAVDT_MSG * p_msg,uint8_t * p,uint16_t len)949 static uint8_t avdt_msg_prs_all_svccap(tAVDT_MSG* p_msg, uint8_t* p,
950 uint16_t len) {
951 uint8_t err = avdt_msg_prs_cfg(p_msg->svccap.p_cfg, p, len,
952 &p_msg->hdr.err_param, AVDT_SIG_GET_ALLCAP);
953 if (p_msg->svccap.p_cfg) {
954 p_msg->svccap.p_cfg->psc_mask &= AVDT_MSG_PSC_MASK;
955 }
956 return (err);
957 }
958
959 /*******************************************************************************
960 *
961 * Function avdt_msg_prs_security_rsp
962 *
963 * Description This message parsing function parsing a security
964 * response message.
965 *
966 *
967 * Returns Error code or zero if no error.
968 *
969 ******************************************************************************/
avdt_msg_prs_security_rsp(tAVDT_MSG * p_msg,uint8_t * p,uint16_t len)970 static uint8_t avdt_msg_prs_security_rsp(tAVDT_MSG* p_msg, uint8_t* p,
971 uint16_t len) {
972 p_msg->security_rsp.p_data = p;
973 p_msg->security_rsp.len = len;
974
975 return 0;
976 }
977
978 /*******************************************************************************
979 *
980 * Function avdt_msg_prs_rej
981 *
982 * Description
983 *
984 *
985 * Returns Error code or zero if no error.
986 *
987 ******************************************************************************/
avdt_msg_prs_rej(tAVDT_MSG * p_msg,uint8_t * p,uint16_t len,uint8_t sig)988 static uint8_t avdt_msg_prs_rej(tAVDT_MSG* p_msg, uint8_t* p, uint16_t len,
989 uint8_t sig) {
990 uint8_t error = 0;
991
992 if (len > 0) {
993 if ((sig == AVDT_SIG_SETCONFIG) || (sig == AVDT_SIG_RECONFIG)) {
994 p_msg->hdr.err_param = *p++;
995 len--;
996 } else if ((sig == AVDT_SIG_START) || (sig == AVDT_SIG_SUSPEND)) {
997 AVDT_MSG_PRS_SEID(p, p_msg->hdr.err_param);
998 len--;
999 }
1000 }
1001
1002 if (len < 1) {
1003 error = AVDT_ERR_LENGTH;
1004 } else {
1005 p_msg->hdr.err_code = *p;
1006 }
1007
1008 return error;
1009 }
1010
1011 /*******************************************************************************
1012 *
1013 * Function avdt_msg_prs_delay_rpt
1014 *
1015 * Description This message parsing function parses a security
1016 * command message.
1017 *
1018 *
1019 * Returns Error code or zero if no error.
1020 *
1021 ******************************************************************************/
avdt_msg_prs_delay_rpt(tAVDT_MSG * p_msg,uint8_t * p,uint16_t len)1022 static uint8_t avdt_msg_prs_delay_rpt(tAVDT_MSG* p_msg, uint8_t* p,
1023 uint16_t len) {
1024 uint8_t err = 0;
1025
1026 /* verify len */
1027 if (len != AVDT_LEN_DELAY_RPT) {
1028 AVDT_TRACE_WARNING("avdt_msg_prs_delay_rpt expected len: %u got: %u",
1029 AVDT_LEN_DELAY_RPT, len);
1030 err = AVDT_ERR_LENGTH;
1031 } else {
1032 /* get seid */
1033 AVDT_MSG_PRS_SEID(p, p_msg->delay_rpt_cmd.hdr.seid);
1034
1035 if (avdt_scb_by_hdl(p_msg->delay_rpt_cmd.hdr.seid) == NULL) {
1036 err = AVDT_ERR_SEID;
1037 } else {
1038 BE_STREAM_TO_UINT16(p_msg->delay_rpt_cmd.delay, p);
1039 AVDT_TRACE_DEBUG("avdt_msg_prs_delay_rpt delay: %u",
1040 p_msg->delay_rpt_cmd.delay);
1041 }
1042 }
1043 return err;
1044 }
1045
1046 /*******************************************************************************
1047 *
1048 * Function avdt_msg_send
1049 *
1050 * Description Send, and if necessary fragment the next message.
1051 *
1052 *
1053 * Returns Congested state; true if CCB congested, false if not.
1054 *
1055 ******************************************************************************/
avdt_msg_send(AvdtpCcb * p_ccb,BT_HDR * p_msg)1056 bool avdt_msg_send(AvdtpCcb* p_ccb, BT_HDR* p_msg) {
1057 uint16_t curr_msg_len;
1058 uint8_t pkt_type;
1059 uint8_t hdr_len;
1060 AvdtpTransportChannel* p_tbl;
1061 BT_HDR* p_buf;
1062 uint8_t* p;
1063 uint8_t label;
1064 uint8_t msg;
1065 uint8_t sig;
1066 uint8_t nosp = 0; /* number of subsequent packets */
1067
1068 /* look up transport channel table entry to get peer mtu */
1069 p_tbl = avdt_ad_tc_tbl_by_type(AVDT_CHAN_SIG, p_ccb, NULL);
1070
1071 /* set the current message if there is a message passed in */
1072 if (p_msg != NULL) {
1073 p_ccb->p_curr_msg = p_msg;
1074 }
1075
1076 /* store copy of curr_msg->len */
1077 curr_msg_len = p_ccb->p_curr_msg->len;
1078
1079 /* while not congested and we haven't sent it all */
1080 while ((!p_ccb->cong) && (p_ccb->p_curr_msg != NULL)) {
1081 /* check what kind of message we've got here; we are using the offset
1082 ** to indicate that a message is being fragmented
1083 */
1084
1085 /* if message isn't being fragmented and it fits in mtu */
1086 if ((p_ccb->p_curr_msg->offset == AVDT_MSG_OFFSET) &&
1087 (p_ccb->p_curr_msg->len <= p_tbl->peer_mtu - AVDT_LEN_TYPE_SINGLE)) {
1088 pkt_type = AVDT_PKT_TYPE_SINGLE;
1089 hdr_len = AVDT_LEN_TYPE_SINGLE;
1090 p_buf = p_ccb->p_curr_msg;
1091 }
1092 /* if message isn't being fragmented and it doesn't fit in mtu */
1093 else if ((p_ccb->p_curr_msg->offset == AVDT_MSG_OFFSET) &&
1094 (p_ccb->p_curr_msg->len >
1095 p_tbl->peer_mtu - AVDT_LEN_TYPE_SINGLE)) {
1096 pkt_type = AVDT_PKT_TYPE_START;
1097 hdr_len = AVDT_LEN_TYPE_START;
1098 nosp = (p_ccb->p_curr_msg->len + AVDT_LEN_TYPE_START - p_tbl->peer_mtu) /
1099 (p_tbl->peer_mtu - 1) +
1100 2;
1101
1102 /* get a new buffer for fragment we are sending */
1103 p_buf = (BT_HDR*)osi_malloc(AVDT_CMD_BUF_SIZE);
1104
1105 /* copy portion of data from current message to new buffer */
1106 p_buf->offset = L2CAP_MIN_OFFSET + hdr_len;
1107 p_buf->len = p_tbl->peer_mtu - hdr_len;
1108 memcpy((uint8_t*)(p_buf + 1) + p_buf->offset,
1109 (uint8_t*)(p_ccb->p_curr_msg + 1) + p_ccb->p_curr_msg->offset,
1110 p_buf->len);
1111 }
1112 /* if message is being fragmented and remaining bytes don't fit in mtu */
1113 else if ((p_ccb->p_curr_msg->offset > AVDT_MSG_OFFSET) &&
1114 (p_ccb->p_curr_msg->len >
1115 (p_tbl->peer_mtu - AVDT_LEN_TYPE_CONT))) {
1116 pkt_type = AVDT_PKT_TYPE_CONT;
1117 hdr_len = AVDT_LEN_TYPE_CONT;
1118
1119 /* get a new buffer for fragment we are sending */
1120 p_buf = (BT_HDR*)osi_malloc(AVDT_CMD_BUF_SIZE);
1121
1122 /* copy portion of data from current message to new buffer */
1123 p_buf->offset = L2CAP_MIN_OFFSET + hdr_len;
1124 p_buf->len = p_tbl->peer_mtu - hdr_len;
1125 memcpy((uint8_t*)(p_buf + 1) + p_buf->offset,
1126 (uint8_t*)(p_ccb->p_curr_msg + 1) + p_ccb->p_curr_msg->offset,
1127 p_buf->len);
1128 }
1129 /* if message is being fragmented and remaining bytes do fit in mtu */
1130 else {
1131 pkt_type = AVDT_PKT_TYPE_END;
1132 hdr_len = AVDT_LEN_TYPE_END;
1133 p_buf = p_ccb->p_curr_msg;
1134 }
1135
1136 /* label, sig id, msg type are in hdr of p_curr_msg */
1137 label = AVDT_LAYERSPEC_LABEL(p_ccb->p_curr_msg->layer_specific);
1138 msg = AVDT_LAYERSPEC_MSG(p_ccb->p_curr_msg->layer_specific);
1139 sig = (uint8_t)p_ccb->p_curr_msg->event;
1140 AVDT_TRACE_DEBUG("avdt_msg_send label:%d, msg:%d, sig:%d", label, msg, sig);
1141
1142 /* keep track of how much of msg we've sent */
1143 curr_msg_len -= p_buf->len;
1144 if (curr_msg_len == 0) {
1145 /* entire message sent; mark as finished */
1146 p_ccb->p_curr_msg = NULL;
1147
1148 /* start timer here for commands */
1149 if (msg == AVDT_MSG_TYPE_CMD) {
1150 /* if retransmit timeout set to zero, sig doesn't use retransmit */
1151 if ((sig == AVDT_SIG_DISCOVER) || (sig == AVDT_SIG_GETCAP) ||
1152 (sig == AVDT_SIG_SECURITY) || (avdtp_cb.rcb.ret_tout == 0)) {
1153 alarm_cancel(p_ccb->idle_ccb_timer);
1154 alarm_cancel(p_ccb->ret_ccb_timer);
1155 uint64_t interval_ms = avdtp_cb.rcb.sig_tout * 1000;
1156 alarm_set_on_mloop(p_ccb->rsp_ccb_timer, interval_ms,
1157 avdt_ccb_rsp_ccb_timer_timeout, p_ccb);
1158 } else if (sig != AVDT_SIG_DELAY_RPT) {
1159 alarm_cancel(p_ccb->idle_ccb_timer);
1160 alarm_cancel(p_ccb->rsp_ccb_timer);
1161 uint64_t interval_ms = avdtp_cb.rcb.ret_tout * 1000;
1162 alarm_set_on_mloop(p_ccb->ret_ccb_timer, interval_ms,
1163 avdt_ccb_ret_ccb_timer_timeout, p_ccb);
1164 }
1165 }
1166 } else {
1167 /* message being fragmented and not completely sent */
1168 p_ccb->p_curr_msg->len -= p_buf->len;
1169 p_ccb->p_curr_msg->offset += p_buf->len;
1170 }
1171
1172 /* set up to build header */
1173 p_buf->len += hdr_len;
1174 p_buf->offset -= hdr_len;
1175 p = (uint8_t*)(p_buf + 1) + p_buf->offset;
1176
1177 /* build header */
1178 AVDT_MSG_BLD_HDR(p, label, pkt_type, msg);
1179 if (pkt_type == AVDT_PKT_TYPE_START) {
1180 AVDT_MSG_BLD_NOSP(p, nosp);
1181 }
1182 if ((pkt_type == AVDT_PKT_TYPE_START) ||
1183 (pkt_type == AVDT_PKT_TYPE_SINGLE)) {
1184 AVDT_MSG_BLD_SIG(p, sig);
1185 }
1186
1187 /* send msg buffer down */
1188 avdt_ad_write_req(AVDT_CHAN_SIG, p_ccb, NULL, p_buf);
1189 }
1190 return (p_ccb->cong);
1191 }
1192
1193 /*******************************************************************************
1194 *
1195 * Function avdt_msg_asmbl
1196 *
1197 * Description Reassemble incoming message.
1198 *
1199 *
1200 * Returns Pointer to reassembled message; NULL if no message
1201 * available.
1202 *
1203 ******************************************************************************/
avdt_msg_asmbl(AvdtpCcb * p_ccb,BT_HDR * p_buf)1204 BT_HDR* avdt_msg_asmbl(AvdtpCcb* p_ccb, BT_HDR* p_buf) {
1205 uint8_t* p;
1206 uint8_t pkt_type;
1207 BT_HDR* p_ret;
1208
1209 /* parse the message header */
1210 p = (uint8_t*)(p_buf + 1) + p_buf->offset;
1211
1212 /* Check if is valid length */
1213 if (p_buf->len < 1) {
1214 osi_free(p_buf);
1215 p_ret = NULL;
1216 return p_ret;
1217 }
1218 AVDT_MSG_PRS_PKT_TYPE(p, pkt_type);
1219
1220 /* quick sanity check on length */
1221 if (p_buf->len < avdt_msg_pkt_type_len[pkt_type]) {
1222 osi_free(p_buf);
1223 AVDT_TRACE_WARNING("Bad length during reassembly");
1224 p_ret = NULL;
1225 }
1226 /* single packet */
1227 else if (pkt_type == AVDT_PKT_TYPE_SINGLE) {
1228 /* if reassembly in progress drop message and process new single */
1229 if (p_ccb->p_rx_msg != NULL)
1230 AVDT_TRACE_WARNING("Got single during reassembly");
1231
1232 osi_free_and_reset((void**)&p_ccb->p_rx_msg);
1233
1234 p_ret = p_buf;
1235 }
1236 /* start packet */
1237 else if (pkt_type == AVDT_PKT_TYPE_START) {
1238 /* if reassembly in progress drop message and process new single */
1239 if (p_ccb->p_rx_msg != NULL)
1240 AVDT_TRACE_WARNING("Got start during reassembly");
1241
1242 osi_free_and_reset((void**)&p_ccb->p_rx_msg);
1243
1244 /*
1245 * Allocate bigger buffer for reassembly. As lower layers are
1246 * not aware of possible packet size after reassembly, they
1247 * would have allocated smaller buffer.
1248 */
1249 if (sizeof(BT_HDR) + p_buf->offset + p_buf->len > BT_DEFAULT_BUFFER_SIZE) {
1250 osi_free(p_buf);
1251 p_ret = NULL;
1252 return p_ret;
1253 }
1254 p_ccb->p_rx_msg = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);
1255 memcpy(p_ccb->p_rx_msg, p_buf, sizeof(BT_HDR) + p_buf->offset + p_buf->len);
1256
1257 /* Free original buffer */
1258 osi_free(p_buf);
1259
1260 /* update p to point to new buffer */
1261 p = (uint8_t*)(p_ccb->p_rx_msg + 1) + p_ccb->p_rx_msg->offset;
1262
1263 /* copy first header byte over nosp */
1264 *(p + 1) = *p;
1265
1266 /* set offset to point to where to copy next */
1267 p_ccb->p_rx_msg->offset += p_ccb->p_rx_msg->len;
1268
1269 /* adjust length for packet header */
1270 p_ccb->p_rx_msg->len -= 1;
1271
1272 p_ret = NULL;
1273 }
1274 /* continue or end */
1275 else {
1276 /* if no reassembly in progress drop message */
1277 if (p_ccb->p_rx_msg == NULL) {
1278 osi_free(p_buf);
1279 AVDT_TRACE_WARNING("Pkt type=%d out of order", pkt_type);
1280 p_ret = NULL;
1281 } else {
1282 /* get size of buffer holding assembled message */
1283 /*
1284 * NOTE: The buffer is allocated above at the beginning of the
1285 * reassembly, and is always of size BT_DEFAULT_BUFFER_SIZE.
1286 */
1287 size_t buf_len = BT_DEFAULT_BUFFER_SIZE - sizeof(BT_HDR);
1288
1289 /* adjust offset and len of fragment for header byte */
1290 p_buf->offset += AVDT_LEN_TYPE_CONT;
1291 p_buf->len -= AVDT_LEN_TYPE_CONT;
1292
1293 /* verify length */
1294 if (((size_t) p_ccb->p_rx_msg->offset + (size_t) p_buf->len) > buf_len) {
1295 /* won't fit; free everything */
1296 AVDT_TRACE_WARNING("%s: Fragmented message too big!", __func__);
1297 osi_free_and_reset((void**)&p_ccb->p_rx_msg);
1298 osi_free(p_buf);
1299 p_ret = NULL;
1300 } else {
1301 /* copy contents of p_buf to p_rx_msg */
1302 memcpy((uint8_t*)(p_ccb->p_rx_msg + 1) + p_ccb->p_rx_msg->offset,
1303 (uint8_t*)(p_buf + 1) + p_buf->offset, p_buf->len);
1304
1305 if (pkt_type == AVDT_PKT_TYPE_END) {
1306 p_ccb->p_rx_msg->offset -= p_ccb->p_rx_msg->len;
1307 p_ccb->p_rx_msg->len += p_buf->len;
1308 p_ret = p_ccb->p_rx_msg;
1309 p_ccb->p_rx_msg = NULL;
1310 } else {
1311 p_ccb->p_rx_msg->offset += p_buf->len;
1312 p_ccb->p_rx_msg->len += p_buf->len;
1313 p_ret = NULL;
1314 }
1315 osi_free(p_buf);
1316 }
1317 }
1318 }
1319 return p_ret;
1320 }
1321
1322 /*******************************************************************************
1323 *
1324 * Function avdt_msg_send_cmd
1325 *
1326 * Description This function is called to send a command message. The
1327 * sig_id parameter indicates the message type, p_params
1328 * points to the message parameters, if any. It gets a buffer
1329 * from the AVDTP command pool, executes the message building
1330 * function for this message type. It then queues the message
1331 * in the command queue for this CCB.
1332 *
1333 *
1334 * Returns Nothing.
1335 *
1336 ******************************************************************************/
avdt_msg_send_cmd(AvdtpCcb * p_ccb,void * p_scb,uint8_t sig_id,tAVDT_MSG * p_params)1337 void avdt_msg_send_cmd(AvdtpCcb* p_ccb, void* p_scb, uint8_t sig_id,
1338 tAVDT_MSG* p_params) {
1339 uint8_t* p;
1340 uint8_t* p_start;
1341 BT_HDR* p_buf = (BT_HDR*)osi_malloc(AVDT_CMD_BUF_SIZE);
1342
1343 /* set up buf pointer and offset */
1344 p_buf->offset = AVDT_MSG_OFFSET;
1345 p_start = p = (uint8_t*)(p_buf + 1) + p_buf->offset;
1346
1347 /* execute parameter building function to build message */
1348 (*avdt_msg_bld_cmd[sig_id - 1])(&p, p_params);
1349
1350 /* set len */
1351 p_buf->len = (uint16_t)(p - p_start);
1352
1353 /* now store scb hdls, if any, in buf */
1354 if (p_scb != NULL) {
1355 p = (uint8_t*)(p_buf + 1);
1356
1357 /* for start and suspend, p_scb points to array of handles */
1358 if ((sig_id == AVDT_SIG_START) || (sig_id == AVDT_SIG_SUSPEND)) {
1359 memcpy(p, (uint8_t*)p_scb, p_buf->len);
1360 }
1361 /* for all others, p_scb points to scb as usual */
1362 else {
1363 *p = avdt_scb_to_hdl((AvdtpScb*)p_scb);
1364 }
1365 }
1366
1367 /* stash sig, label, and message type in buf */
1368 p_buf->event = sig_id;
1369 AVDT_BLD_LAYERSPEC(p_buf->layer_specific, AVDT_MSG_TYPE_CMD, p_ccb->label);
1370
1371 /* increment label */
1372 p_ccb->label = (p_ccb->label + 1) % 16;
1373
1374 /* queue message and trigger ccb to send it */
1375 fixed_queue_enqueue(p_ccb->cmd_q, p_buf);
1376 avdt_ccb_event(p_ccb, AVDT_CCB_SENDMSG_EVT, NULL);
1377 }
1378
1379 /*******************************************************************************
1380 *
1381 * Function avdt_msg_send_rsp
1382 *
1383 * Description This function is called to send a response message. The
1384 * sig_id parameter indicates the message type, p_params
1385 * points to the message parameters, if any. It gets a buffer
1386 * from the AVDTP command pool, executes the message building
1387 * function for this message type. It then queues the message
1388 * in the response queue for this CCB.
1389 *
1390 *
1391 * Returns Nothing.
1392 *
1393 ******************************************************************************/
avdt_msg_send_rsp(AvdtpCcb * p_ccb,uint8_t sig_id,tAVDT_MSG * p_params)1394 void avdt_msg_send_rsp(AvdtpCcb* p_ccb, uint8_t sig_id, tAVDT_MSG* p_params) {
1395 uint8_t* p;
1396 uint8_t* p_start;
1397 BT_HDR* p_buf = (BT_HDR*)osi_malloc(AVDT_CMD_BUF_SIZE);
1398
1399 /* set up buf pointer and offset */
1400 p_buf->offset = AVDT_MSG_OFFSET;
1401 p_start = p = (uint8_t*)(p_buf + 1) + p_buf->offset;
1402
1403 /* execute parameter building function to build message */
1404 (*avdt_msg_bld_rsp[sig_id - 1])(&p, p_params);
1405
1406 /* set length */
1407 p_buf->len = (uint16_t)(p - p_start);
1408
1409 /* stash sig, label, and message type in buf */
1410 p_buf->event = sig_id;
1411 AVDT_BLD_LAYERSPEC(p_buf->layer_specific, AVDT_MSG_TYPE_RSP,
1412 p_params->hdr.label);
1413
1414 /* queue message and trigger ccb to send it */
1415 fixed_queue_enqueue(p_ccb->rsp_q, p_buf);
1416 avdt_ccb_event(p_ccb, AVDT_CCB_SENDMSG_EVT, NULL);
1417 }
1418
1419 /*******************************************************************************
1420 *
1421 * Function avdt_msg_send_rej
1422 *
1423 * Description This function is called to send a reject message. The
1424 * sig_id parameter indicates the message type. It gets
1425 * a buffer from the AVDTP command pool and builds the
1426 * message based on the message type and the error code.
1427 * It then queues the message in the response queue for
1428 * this CCB.
1429 *
1430 *
1431 * Returns Nothing.
1432 *
1433 ******************************************************************************/
avdt_msg_send_rej(AvdtpCcb * p_ccb,uint8_t sig_id,tAVDT_MSG * p_params)1434 void avdt_msg_send_rej(AvdtpCcb* p_ccb, uint8_t sig_id, tAVDT_MSG* p_params) {
1435 uint8_t* p;
1436 uint8_t* p_start;
1437 BT_HDR* p_buf = (BT_HDR*)osi_malloc(AVDT_CMD_BUF_SIZE);
1438
1439 /* set up buf pointer and offset */
1440 p_buf->offset = AVDT_MSG_OFFSET;
1441 p_start = p = (uint8_t*)(p_buf + 1) + p_buf->offset;
1442
1443 /* if sig id included, build into message */
1444 if (sig_id != AVDT_SIG_NONE) {
1445 /* if this sig has a parameter, add the parameter */
1446 if ((sig_id == AVDT_SIG_SETCONFIG) || (sig_id == AVDT_SIG_RECONFIG)) {
1447 AVDT_MSG_BLD_PARAM(p, p_params->hdr.err_param);
1448 } else if ((sig_id == AVDT_SIG_START) || (sig_id == AVDT_SIG_SUSPEND)) {
1449 AVDT_MSG_BLD_SEID(p, p_params->hdr.err_param);
1450 }
1451
1452 /* add the error code */
1453 AVDT_MSG_BLD_ERR(p, p_params->hdr.err_code);
1454 }
1455 AVDT_TRACE_DEBUG("avdt_msg_send_rej");
1456
1457 /* calculate length */
1458 p_buf->len = (uint16_t)(p - p_start);
1459
1460 /* stash sig, label, and message type in buf */
1461 p_buf->event = sig_id;
1462 AVDT_BLD_LAYERSPEC(p_buf->layer_specific, AVDT_MSG_TYPE_REJ,
1463 p_params->hdr.label);
1464
1465 /* queue message and trigger ccb to send it */
1466 fixed_queue_enqueue(p_ccb->rsp_q, p_buf);
1467 avdt_ccb_event(p_ccb, AVDT_CCB_SENDMSG_EVT, NULL);
1468 }
1469
1470 /*******************************************************************************
1471 *
1472 * Function avdt_msg_send_grej
1473 *
1474 * Description This function is called to send a general reject message.
1475 * The sig_id parameter indicates the message type. It gets
1476 * a buffer from the AVDTP command pool and builds the
1477 * message based on the message type and the error code.
1478 * It then queues the message in the response queue for
1479 * this CCB.
1480 *
1481 *
1482 * Returns Nothing.
1483 *
1484 ******************************************************************************/
avdt_msg_send_grej(AvdtpCcb * p_ccb,uint8_t sig_id,tAVDT_MSG * p_params)1485 void avdt_msg_send_grej(AvdtpCcb* p_ccb, uint8_t sig_id, tAVDT_MSG* p_params) {
1486 uint8_t* p;
1487 uint8_t* p_start;
1488 BT_HDR* p_buf = (BT_HDR*)osi_malloc(AVDT_CMD_BUF_SIZE);
1489
1490 /* set up buf pointer and offset */
1491 p_buf->offset = AVDT_MSG_OFFSET;
1492 p_start = p = (uint8_t*)(p_buf + 1) + p_buf->offset;
1493
1494 /* calculate length */
1495 p_buf->len = (uint16_t)(p - p_start);
1496
1497 /* stash sig, label, and message type in buf */
1498 p_buf->event = sig_id;
1499 AVDT_BLD_LAYERSPEC(p_buf->layer_specific, AVDT_MSG_TYPE_GRJ,
1500 p_params->hdr.label);
1501 AVDT_TRACE_DEBUG(__func__);
1502
1503 /* queue message and trigger ccb to send it */
1504 fixed_queue_enqueue(p_ccb->rsp_q, p_buf);
1505 avdt_ccb_event(p_ccb, AVDT_CCB_SENDMSG_EVT, NULL);
1506 }
1507
1508 /*******************************************************************************
1509 *
1510 * Function avdt_msg_ind
1511 *
1512 * Description This function is called by the adaption layer when an
1513 * incoming message is received on the signaling channel.
1514 * It parses the message and sends an event to the appropriate
1515 * SCB or CCB for the message.
1516 *
1517 *
1518 * Returns Nothing.
1519 *
1520 ******************************************************************************/
avdt_msg_ind(AvdtpCcb * p_ccb,BT_HDR * p_buf)1521 void avdt_msg_ind(AvdtpCcb* p_ccb, BT_HDR* p_buf) {
1522 AvdtpScb* p_scb;
1523 uint8_t* p;
1524 bool ok = true;
1525 bool handle_rsp = false;
1526 bool gen_rej = false;
1527 uint8_t label;
1528 uint8_t pkt_type;
1529 uint8_t msg_type;
1530 uint8_t sig = 0;
1531 tAVDT_MSG msg{};
1532 AvdtpSepConfig cfg{};
1533 uint8_t err;
1534 uint8_t evt = 0;
1535 uint8_t scb_hdl;
1536
1537 /* reassemble message; if no message available (we received a fragment) return
1538 */
1539 p_buf = avdt_msg_asmbl(p_ccb, p_buf);
1540 if (p_buf == NULL) {
1541 return;
1542 }
1543
1544 p = (uint8_t*)(p_buf + 1) + p_buf->offset;
1545
1546 /* parse the message header */
1547 AVDT_MSG_PRS_HDR(p, label, pkt_type, msg_type);
1548
1549 AVDT_TRACE_DEBUG("msg_type=%d, sig=%d", msg_type, sig);
1550 /* set up label and ccb_idx in message hdr */
1551 msg.hdr.label = label;
1552 msg.hdr.ccb_idx = avdt_ccb_to_idx(p_ccb);
1553
1554 /* verify msg type */
1555 if (msg_type == AVDT_MSG_TYPE_GRJ) {
1556 AVDT_TRACE_WARNING("Dropping msg msg_type=%d", msg_type);
1557 ok = false;
1558 }
1559 /* check for general reject */
1560 else if ((msg_type == AVDT_MSG_TYPE_REJ) &&
1561 (p_buf->len == AVDT_LEN_GEN_REJ)) {
1562 gen_rej = true;
1563 if (p_ccb->p_curr_cmd != NULL) {
1564 msg.hdr.sig_id = sig = (uint8_t)p_ccb->p_curr_cmd->event;
1565 evt = avdt_msg_rej_2_evt[sig - 1];
1566 msg.hdr.err_code = AVDT_ERR_NSC;
1567 msg.hdr.err_param = 0;
1568 }
1569 } else /* not a general reject */
1570 {
1571 /* get and verify signal */
1572 AVDT_MSG_PRS_SIG(p, sig);
1573 msg.hdr.sig_id = sig;
1574 if ((sig == 0) || (sig > AVDT_SIG_MAX)) {
1575 AVDT_TRACE_WARNING("Dropping msg sig=%d msg_type:%d", sig, msg_type);
1576 ok = false;
1577
1578 /* send a general reject */
1579 if (msg_type == AVDT_MSG_TYPE_CMD) {
1580 avdt_msg_send_grej(p_ccb, sig, &msg);
1581 }
1582 }
1583 }
1584
1585 if (ok && !gen_rej) {
1586 /* skip over header (msg length already verified during reassembly) */
1587 p_buf->len -= AVDT_LEN_TYPE_SINGLE;
1588
1589 /* set up to parse message */
1590 if ((msg_type == AVDT_MSG_TYPE_RSP) && (sig == AVDT_SIG_DISCOVER)) {
1591 /* parse discover rsp message to struct supplied by app */
1592 msg.discover_rsp.p_sep_info = (tAVDT_SEP_INFO*)p_ccb->p_proc_data;
1593 msg.discover_rsp.num_seps = p_ccb->proc_param;
1594 } else if ((msg_type == AVDT_MSG_TYPE_RSP) &&
1595 ((sig == AVDT_SIG_GETCAP) || (sig == AVDT_SIG_GET_ALLCAP))) {
1596 /* parse discover rsp message to struct supplied by app */
1597 msg.svccap.p_cfg = (AvdtpSepConfig*)p_ccb->p_proc_data;
1598 } else if ((msg_type == AVDT_MSG_TYPE_RSP) && (sig == AVDT_SIG_GETCONFIG)) {
1599 /* parse get config rsp message to struct allocated locally */
1600 msg.svccap.p_cfg = &cfg;
1601 } else if ((msg_type == AVDT_MSG_TYPE_CMD) && (sig == AVDT_SIG_SETCONFIG)) {
1602 /* parse config cmd message to struct allocated locally */
1603 msg.config_cmd.p_cfg = &cfg;
1604 } else if ((msg_type == AVDT_MSG_TYPE_CMD) && (sig == AVDT_SIG_RECONFIG)) {
1605 /* parse reconfig cmd message to struct allocated locally */
1606 msg.reconfig_cmd.p_cfg = &cfg;
1607 }
1608
1609 /* parse message; while we're at it map message sig to event */
1610 if (msg_type == AVDT_MSG_TYPE_CMD) {
1611 msg.hdr.err_code = err =
1612 (*avdt_msg_prs_cmd[sig - 1])(&msg, p, p_buf->len);
1613 evt = avdt_msg_cmd_2_evt[sig - 1];
1614 } else if (msg_type == AVDT_MSG_TYPE_RSP) {
1615 msg.hdr.err_code = err =
1616 (*avdt_msg_prs_rsp[sig - 1])(&msg, p, p_buf->len);
1617 evt = avdt_msg_rsp_2_evt[sig - 1];
1618 } else /* msg_type == AVDT_MSG_TYPE_REJ */
1619 {
1620 err = avdt_msg_prs_rej(&msg, p, p_buf->len, sig);
1621 evt = avdt_msg_rej_2_evt[sig - 1];
1622 }
1623
1624 /* if parsing failed */
1625 if (err != 0) {
1626 AVDT_TRACE_WARNING("Parsing failed sig=%d err=0x%x", sig, err);
1627
1628 /* if its a rsp or rej, drop it; if its a cmd, send a rej;
1629 ** note special case for abort; never send abort reject
1630 */
1631 ok = false;
1632 if ((msg_type == AVDT_MSG_TYPE_CMD) && (sig != AVDT_SIG_ABORT)) {
1633 avdt_msg_send_rej(p_ccb, sig, &msg);
1634 }
1635 }
1636 }
1637
1638 /* if its a rsp or rej, check sent cmd to see if we're waiting for
1639 ** the rsp or rej. If we didn't send a cmd for it, drop it. If
1640 ** it does match a cmd, stop timer for the cmd.
1641 */
1642 if (ok) {
1643 if ((msg_type == AVDT_MSG_TYPE_RSP) || (msg_type == AVDT_MSG_TYPE_REJ)) {
1644 if ((p_ccb->p_curr_cmd != NULL) && (p_ccb->p_curr_cmd->event == sig) &&
1645 (AVDT_LAYERSPEC_LABEL(p_ccb->p_curr_cmd->layer_specific) == label)) {
1646 /* stop timer */
1647 alarm_cancel(p_ccb->idle_ccb_timer);
1648 alarm_cancel(p_ccb->ret_ccb_timer);
1649 alarm_cancel(p_ccb->rsp_ccb_timer);
1650
1651 /* clear retransmission count */
1652 p_ccb->ret_count = 0;
1653
1654 /* later in this function handle ccb event */
1655 handle_rsp = true;
1656 } else {
1657 ok = false;
1658 AVDT_TRACE_WARNING("Cmd not found for rsp sig=%d label=%d", sig, label);
1659 }
1660 }
1661 }
1662
1663 if (ok) {
1664 /* if it's a ccb event send to ccb */
1665 if (evt & AVDT_CCB_MKR) {
1666 tAVDT_CCB_EVT avdt_ccb_evt;
1667 avdt_ccb_evt.msg = msg;
1668 avdt_ccb_event(p_ccb, (uint8_t)(evt & ~AVDT_CCB_MKR), &avdt_ccb_evt);
1669 }
1670 /* if it's a scb event */
1671 else {
1672 /* Scb events always have a single seid. For cmd, get seid from
1673 ** message. For rej and rsp, get seid from p_curr_cmd.
1674 */
1675 if (msg_type == AVDT_MSG_TYPE_CMD) {
1676 scb_hdl = msg.single.seid;
1677 } else {
1678 scb_hdl = *((uint8_t*)(p_ccb->p_curr_cmd + 1));
1679 }
1680
1681 /* Map seid to the scb and send it the event. For cmd, seid has
1682 ** already been verified by parsing function.
1683 */
1684 if (evt) {
1685 p_scb = avdt_scb_by_hdl(scb_hdl);
1686 if (p_scb != NULL) {
1687 tAVDT_SCB_EVT avdt_scb_evt;
1688 avdt_scb_evt.msg = msg;
1689 avdt_scb_event(p_scb, evt, &avdt_scb_evt);
1690 }
1691 }
1692 }
1693 }
1694
1695 /* free message buffer */
1696 osi_free(p_buf);
1697
1698 /* if its a rsp or rej, send event to ccb to free associated
1699 ** cmd msg buffer and handle cmd queue
1700 */
1701 if (handle_rsp) {
1702 avdt_ccb_event(p_ccb, AVDT_CCB_RCVRSP_EVT, NULL);
1703 }
1704 }
1705