bta/jv/bta_jv_act.c

   1 /******************************************************************************
   2  *
   3  *  Copyright (C) 2006-2012 Broadcom Corporation
   4  *
   5  *  Licensed under the Apache License, Version 2.0 (the "License");
   6  *  you may not use this file except in compliance with the License.
   7  *  You may obtain a copy of the License at:
   8  *
   9  *  http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  *  Unless required by applicable law or agreed to in writing, software
  12  *  distributed under the License is distributed on an "AS IS" BASIS,
  13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  *  See the License for the specific language governing permissions and
  15  *  limitations under the License.
  16  *
  17  ******************************************************************************/
  18
  19 /******************************************************************************
  20  *
  21  *  This file contains action functions for BTA JV APIs.
  22  *
  23  ******************************************************************************/
  24 #include <hardware/bluetooth.h>
  25 #include <arpa/inet.h>
  26 #include <pthread.h>
  27 #include <stdlib.h>
  28 #include <string.h>
  29
  30 #include "osi/include/allocator.h"
  31 #include "bt_types.h"
  32 #include "gki.h"
  33 #include "utl.h"
  34 #include "bta_sys.h"
  35 #include "bta_api.h"
  36 #include "bta_jv_api.h"
  37 #include "bta_jv_int.h"
  38 #include "bta_jv_co.h"
  39 #include "btm_api.h"
  40 #include "btm_int.h"
  41 #include "sdp_api.h"
  42 #include "l2c_api.h"
  43 #include "port_api.h"
  44 #include "rfcdefs.h"
  45 #include "avct_api.h"
  46 #include "avdt_api.h"
  47 #include "gap_api.h"
  48 #include "l2c_api.h"
  49
  50 #include "osi/include/osi.h"
  51
  52
  53 /* one of these exists for each client */
  54 struct fc_client {
  55     struct fc_client    *next_all_list;
  56     struct fc_client    *next_chan_list;
  57     BD_ADDR              remote_addr;
  58     uint32_t             id;
  59     tBTA_JV_L2CAP_CBACK *p_cback;
  60     void                *user_data;
  61     uint16_t             handle;
  62     uint16_t             chan;
  63     uint8_t              sec_id;
  64     unsigned             server      : 1;
  65     unsigned             init_called : 1;
  66 };
  67
  68 /* one of these exists for each channel we're dealing with */
  69 struct fc_channel {
  70     struct fc_channel   *next;
  71     struct fc_client    *clients;
  72     uint8_t              has_server : 1;
  73     uint16_t             chan;
  74 };
  75
  76
  77 static struct fc_client *fc_clients;
  78 static struct fc_channel *fc_channels;
  79 static uint32_t fc_next_id;
  80
  81
  82 static void fcchan_conn_chng_cbk(UINT16 chan, BD_ADDR bd_addr, BOOLEAN connected,
  83         UINT16 reason, tBT_TRANSPORT );
  84 static void fcchan_data_cbk(UINT16 chan, BD_ADDR bd_addr, BT_HDR *p_buf);
  85
  86
  87 extern void uuid_to_string_legacy(bt_uuid_t *p_uuid, char *str);
  88 static inline void logu(const char* title, const uint8_t * p_uuid)
  89 {
  90     char uuids[128];
  91     uuid_to_string_legacy((bt_uuid_t*)p_uuid, uuids);
  92     APPL_TRACE_DEBUG("%s: %s", title, uuids);
  93 }
  94
  95
  96 static tBTA_JV_PCB * bta_jv_add_rfc_port(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pcb_open);
  97 static tBTA_JV_STATUS bta_jv_free_set_pm_profile_cb(UINT32 jv_handle);
  98 static void bta_jv_pm_conn_busy(tBTA_JV_PM_CB *p_cb);
  99 static void bta_jv_pm_conn_idle(tBTA_JV_PM_CB *p_cb);
 100 static void bta_jv_pm_state_change(tBTA_JV_PM_CB *p_cb, const tBTA_JV_CONN_STATE state);
 101 tBTA_JV_STATUS bta_jv_set_pm_conn_state(tBTA_JV_PM_CB *p_cb, const tBTA_JV_CONN_STATE
 102         new_st);
 103
 104 /*******************************************************************************
 105 **
 106 ** Function     bta_jv_alloc_sec_id
 107 **
 108 ** Description  allocate a security id
 109 **
 110 ** Returns
 111 **
 112 *******************************************************************************/
 113 UINT8 bta_jv_alloc_sec_id(void)
 114 {
 115     UINT8 ret = 0;
 116     int i;
 117     for(i=0; i<BTA_JV_NUM_SERVICE_ID; i++)
 118     {
 119         if(0 == bta_jv_cb.sec_id[i])
 120         {
 121             bta_jv_cb.sec_id[i] = BTA_JV_FIRST_SERVICE_ID + i;
 122             ret = bta_jv_cb.sec_id[i];
 123             break;
 124         }
 125     }
 126     return ret;
 127
 128 }
 129 static int get_sec_id_used(void)
 130 {
 131     int i;
 132     int used = 0;
 133     for(i=0; i<BTA_JV_NUM_SERVICE_ID; i++)
 134     {
 135         if(bta_jv_cb.sec_id[i])
 136             used++;
 137     }
 138     if (used == BTA_JV_NUM_SERVICE_ID)
 139         APPL_TRACE_ERROR("get_sec_id_used, sec id exceeds the limit:%d",
 140                 BTA_JV_NUM_SERVICE_ID);
 141     return used;
 142 }
 143 static int get_rfc_cb_used(void)
 144 {
 145     int i;
 146     int used = 0;
 147     for(i=0; i<BTA_JV_MAX_RFC_CONN; i++)
 148     {
 149         if(bta_jv_cb.rfc_cb[i].handle )
 150             used++;
 151     }
 152     if (used == BTA_JV_MAX_RFC_CONN)
 153         APPL_TRACE_ERROR("get_sec_id_used, rfc ctrl block exceeds the limit:%d",
 154                 BTA_JV_MAX_RFC_CONN);
 155     return used;
 156 }
 157
 158 /*******************************************************************************
 159 **
 160 ** Function     bta_jv_free_sec_id
 161 **
 162 ** Description  free the given security id
 163 **
 164 ** Returns
 165 **
 166 *******************************************************************************/
 167 static void bta_jv_free_sec_id(UINT8 *p_sec_id)
 168 {
 169     UINT8 sec_id = *p_sec_id;
 170     *p_sec_id = 0;
 171     if(sec_id >= BTA_JV_FIRST_SERVICE_ID && sec_id <= BTA_JV_LAST_SERVICE_ID)
 172     {
 173         BTM_SecClrService(sec_id);
 174         bta_jv_cb.sec_id[sec_id - BTA_JV_FIRST_SERVICE_ID] = 0;
 175     }
 176 }
 177
 178 /*******************************************************************************
 179 **
 180 ** Function     bta_jv_alloc_rfc_cb
 181 **
 182 ** Description  allocate a control block for the given port handle
 183 **
 184 ** Returns
 185 **
 186 *******************************************************************************/
 187 tBTA_JV_RFC_CB * bta_jv_alloc_rfc_cb(UINT16 port_handle, tBTA_JV_PCB **pp_pcb)
 188 {
 189     tBTA_JV_RFC_CB *p_cb = NULL;
 190     tBTA_JV_PCB *p_pcb;
 191     int i, j;
 192     for(i=0; i<BTA_JV_MAX_RFC_CONN; i++)
 193     {
 194         if (0 == bta_jv_cb.rfc_cb[i].handle )
 195         {
 196             p_cb = &bta_jv_cb.rfc_cb[i];
 197             /* mask handle to distinguish it with L2CAP handle */
 198             p_cb->handle = (i + 1) | BTA_JV_RFCOMM_MASK;
 199
 200             p_cb->max_sess          = 1;
 201             p_cb->curr_sess         = 1;
 202             for (j = 0; j < BTA_JV_MAX_RFC_SR_SESSION; j++)
 203                 p_cb->rfc_hdl[j] = 0;
 204             p_cb->rfc_hdl[0]        = port_handle;
 205             APPL_TRACE_DEBUG( "bta_jv_alloc_rfc_cb port_handle:%d handle:0x%2x",
 206                     port_handle, p_cb->handle);
 207
 208             p_pcb = &bta_jv_cb.port_cb[port_handle - 1];
 209             p_pcb->handle = p_cb->handle;
 210             p_pcb->port_handle = port_handle;
 211             p_pcb->p_pm_cb = NULL;
 212             *pp_pcb = p_pcb;
 213             break;
 214         }
 215     }
 216     if(p_cb == NULL)
 217     {
 218         APPL_TRACE_ERROR( "bta_jv_alloc_rfc_cb: port_handle:%d, ctrl block exceeds "
 219                 "limit:%d", port_handle, BTA_JV_MAX_RFC_CONN);
 220     }
 221     return p_cb;
 222 }
 223
 224 /*******************************************************************************
 225 **
 226 ** Function     bta_jv_rfc_port_to_pcb
 227 **
 228 ** Description  find the port control block associated with the given port handle
 229 **
 230 ** Returns
 231 **
 232 *******************************************************************************/
 233 tBTA_JV_PCB * bta_jv_rfc_port_to_pcb(UINT16 port_handle)
 234 {
 235     tBTA_JV_PCB *p_pcb = NULL;
 236
 237     if ((port_handle > 0) && (port_handle <= MAX_RFC_PORTS)
 238             && bta_jv_cb.port_cb[port_handle - 1].handle)
 239     {
 240         p_pcb = &bta_jv_cb.port_cb[port_handle - 1];
 241     }
 242
 243     return p_pcb;
 244 }
 245
 246 /*******************************************************************************
 247 **
 248 ** Function     bta_jv_rfc_port_to_cb
 249 **
 250 ** Description  find the RFCOMM control block associated with the given port handle
 251 **
 252 ** Returns
 253 **
 254 *******************************************************************************/
 255 tBTA_JV_RFC_CB * bta_jv_rfc_port_to_cb(UINT16 port_handle)
 256 {
 257     tBTA_JV_RFC_CB *p_cb = NULL;
 258     UINT32 handle;
 259
 260     if ((port_handle > 0) && (port_handle <= MAX_RFC_PORTS)
 261             && bta_jv_cb.port_cb[port_handle - 1].handle)
 262     {
 263         handle = bta_jv_cb.port_cb[port_handle - 1].handle;
 264         handle &= BTA_JV_RFC_HDL_MASK;
 265         handle &= ~BTA_JV_RFCOMM_MASK;
 266         if (handle)
 267             p_cb = &bta_jv_cb.rfc_cb[handle - 1];
 268     }
 269     else
 270     {
 271         APPL_TRACE_WARNING("bta_jv_rfc_port_to_cb(port_handle:0x%x):jv handle:0x%x not"
 272                 " FOUND", port_handle, bta_jv_cb.port_cb[port_handle - 1].handle);
 273     }
 274     return p_cb;
 275 }
 276
 277 static tBTA_JV_STATUS bta_jv_free_rfc_cb(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pcb)
 278 {
 279     tBTA_JV_STATUS status = BTA_JV_SUCCESS;
 280     BOOLEAN remove_server = FALSE;
 281     int close_pending = 0;
 282
 283     if (!p_cb || !p_pcb)
 284     {
 285         APPL_TRACE_ERROR("bta_jv_free_sr_rfc_cb, p_cb or p_pcb cannot be null");
 286         return BTA_JV_FAILURE;
 287     }
 288     APPL_TRACE_DEBUG("bta_jv_free_sr_rfc_cb: max_sess:%d, curr_sess:%d, p_pcb:%p, user:"
 289             "%p, state:%d, jv handle: 0x%x" ,p_cb->max_sess, p_cb->curr_sess, p_pcb,
 290             p_pcb->user_data, p_pcb->state, p_pcb->handle);
 291
 292     if (p_cb->curr_sess <= 0)
 293         return BTA_JV_SUCCESS;
 294
 295     switch (p_pcb->state)
 296     {
 297     case BTA_JV_ST_CL_CLOSING:
 298     case BTA_JV_ST_SR_CLOSING:
 299         APPL_TRACE_WARNING("bta_jv_free_sr_rfc_cb: return on closing, port state:%d, "
 300                 "scn:%d, p_pcb:%p, user_data:%p", p_pcb->state, p_cb->scn, p_pcb,
 301                 p_pcb->user_data);
 302         status = BTA_JV_FAILURE;
 303         return status;
 304     case BTA_JV_ST_CL_OPEN:
 305     case BTA_JV_ST_CL_OPENING:
 306         APPL_TRACE_DEBUG("bta_jv_free_sr_rfc_cb: state: %d, scn:%d,"
 307                           " user_data:%p", p_pcb->state, p_cb->scn, p_pcb->user_data);
 308         p_pcb->state = BTA_JV_ST_CL_CLOSING;
 309         break;
 310     case BTA_JV_ST_SR_LISTEN:
 311         p_pcb->state = BTA_JV_ST_SR_CLOSING;
 312         remove_server = TRUE;
 313         APPL_TRACE_DEBUG("bta_jv_free_sr_rfc_cb: state: BTA_JV_ST_SR_LISTEN, scn:%d,"
 314                 " user_data:%p", p_cb->scn, p_pcb->user_data);
 315         break;
 316     case BTA_JV_ST_SR_OPEN:
 317         p_pcb->state = BTA_JV_ST_SR_CLOSING;
 318         APPL_TRACE_DEBUG("bta_jv_free_sr_rfc_cb: state: BTA_JV_ST_SR_OPEN, scn:%d,"
 319                 " user_data:%p", p_cb->scn, p_pcb->user_data);
 320         break;
 321     default:
 322         APPL_TRACE_WARNING("bta_jv_free_sr_rfc_cb():failed, ignore port state:%d, scn:"
 323                 "%d, p_pcb:%p, jv handle: 0x%x, port_handle: %d, user_data:%p",
 324                 p_pcb->state, p_cb->scn, p_pcb, p_pcb->handle, p_pcb->port_handle,
 325                 p_pcb->user_data);
 326         status = BTA_JV_FAILURE;
 327         break;
 328     }
 329     if (BTA_JV_SUCCESS == status)
 330     {
 331         int port_status;
 332
 333         if (!remove_server)
 334             port_status = RFCOMM_RemoveConnection(p_pcb->port_handle);
 335         else
 336             port_status = RFCOMM_RemoveServer(p_pcb->port_handle);
 337         if (port_status != PORT_SUCCESS)
 338         {
 339             status = BTA_JV_FAILURE;
 340             APPL_TRACE_WARNING("bta_jv_free_rfc_cb(jv handle: 0x%x, state %d)::"
 341                     "port_status: %d, port_handle: %d, close_pending: %d:Remove",
 342                     p_pcb->handle, p_pcb->state, port_status, p_pcb->port_handle,
 343                     close_pending);
 344         }
 345     }
 346     if (!close_pending)
 347     {
 348         p_pcb->port_handle = 0;
 349         p_pcb->state = BTA_JV_ST_NONE;
 350         bta_jv_free_set_pm_profile_cb(p_pcb->handle);
 351
 352         //Initialize congestion flags
 353         p_pcb->cong = FALSE;
 354         p_pcb->user_data = 0;
 355         int si = BTA_JV_RFC_HDL_TO_SIDX(p_pcb->handle);
 356         if (0 <= si && si < BTA_JV_MAX_RFC_SR_SESSION)
 357             p_cb->rfc_hdl[si] = 0;
 358         p_pcb->handle = 0;
 359         p_cb->curr_sess--;
 360         if (p_cb->curr_sess == 0)
 361         {
 362             p_cb->scn = 0;
 363             bta_jv_free_sec_id(&p_cb->sec_id);
 364             p_cb->p_cback = NULL;
 365             p_cb->handle = 0;
 366             p_cb->curr_sess = -1;
 367         }
 368         if (remove_server) {
 369             bta_jv_free_sec_id(&p_cb->sec_id);
 370         }
 371     }
 372     return status;
 373 }
 374
 375 /*******************************************************************************
 376 **
 377 ** Function     bta_jv_free_l2c_cb
 378 **
 379 ** Description  free the given L2CAP control block
 380 **
 381 ** Returns
 382 **
 383 *******************************************************************************/
 384 tBTA_JV_STATUS bta_jv_free_l2c_cb(tBTA_JV_L2C_CB *p_cb)
 385 {
 386     tBTA_JV_STATUS status = BTA_JV_SUCCESS;
 387
 388     if(BTA_JV_ST_NONE != p_cb->state)
 389     {
 390         bta_jv_free_set_pm_profile_cb((UINT32)p_cb->handle);
 391         if (GAP_ConnClose(p_cb->handle) != BT_PASS)
 392                 status = BTA_JV_FAILURE;
 393     }
 394     p_cb->psm = 0;
 395     p_cb->state = BTA_JV_ST_NONE;
 396     bta_jv_free_sec_id(&p_cb->sec_id);
 397     p_cb->p_cback = NULL;
 398     return status;
 399 }
 400
 401 /*******************************************************************************
 402 **
 403 **
 404 ** Function    bta_jv_clear_pm_cb
 405 **
 406 ** Description clears jv pm control block and optionally calls bta_sys_conn_close()
 407 **             In general close_conn should be set to TRUE to remove registering with
 408 **             dm pm!
 409 **
 410 ** WARNING:    Make sure to clear pointer form port or l2c to this control block too!
 411 **
 412 *******************************************************************************/
 413 static void bta_jv_clear_pm_cb(tBTA_JV_PM_CB *p_pm_cb, BOOLEAN close_conn)
 414 {
 415     /* needs to be called if registered with bta pm, otherwise we may run out of dm pm slots! */
 416     if (close_conn)
 417         bta_sys_conn_close(BTA_ID_JV, p_pm_cb->app_id, p_pm_cb->peer_bd_addr);
 418     p_pm_cb->state = BTA_JV_PM_FREE_ST;
 419     p_pm_cb->app_id = BTA_JV_PM_ALL;
 420     p_pm_cb->handle = BTA_JV_PM_HANDLE_CLEAR;
 421     bdcpy(p_pm_cb->peer_bd_addr, bd_addr_null);
 422 }
 423
 424 /*******************************************************************************
 425  **
 426  ** Function     bta_jv_free_set_pm_profile_cb
 427  **
 428  ** Description  free pm profile control block
 429  **
 430  ** Returns     BTA_JV_SUCCESS if cb has been freed correctly,
 431  **             BTA_JV_FAILURE in case of no profile has been registered or already freed
 432  **
 433  *******************************************************************************/
 434 static tBTA_JV_STATUS bta_jv_free_set_pm_profile_cb(UINT32 jv_handle)
 435 {
 436     tBTA_JV_STATUS status = BTA_JV_FAILURE;
 437     tBTA_JV_PM_CB  **p_cb;
 438     int i, j, bd_counter = 0, appid_counter = 0;
 439
 440     for (i = 0; i < BTA_JV_PM_MAX_NUM; i++)
 441     {
 442         p_cb = NULL;
 443         if ((bta_jv_cb.pm_cb[i].state != BTA_JV_PM_FREE_ST) &&
 444                 (jv_handle == bta_jv_cb.pm_cb[i].handle))
 445         {
 446             for (j = 0; j < BTA_JV_PM_MAX_NUM; j++)
 447             {
 448                 if (bdcmp(bta_jv_cb.pm_cb[j].peer_bd_addr, bta_jv_cb.pm_cb[i].peer_bd_addr) == 0)
 449                     bd_counter++;
 450                 if (bta_jv_cb.pm_cb[j].app_id == bta_jv_cb.pm_cb[i].app_id)
 451                     appid_counter++;
 452             }
 453
 454             APPL_TRACE_API("%s(jv_handle: 0x%2x), idx: %d, "
 455                     "app_id: 0x%x",__func__, jv_handle, i, bta_jv_cb.pm_cb[i].app_id);
 456             APPL_TRACE_API("%s, bd_counter = %d, "
 457                     "appid_counter = %d", __func__, bd_counter, appid_counter);
 458             if (bd_counter > 1)
 459             {
 460                 bta_jv_pm_conn_idle(&bta_jv_cb.pm_cb[i]);
 461             }
 462
 463             if (bd_counter <= 1 || (appid_counter <= 1))
 464             {
 465                 bta_jv_clear_pm_cb(&bta_jv_cb.pm_cb[i], TRUE);
 466             }
 467             else
 468             {
 469                 bta_jv_clear_pm_cb(&bta_jv_cb.pm_cb[i], FALSE);
 470             }
 471
 472             if (BTA_JV_RFCOMM_MASK & jv_handle)
 473             {
 474                 UINT32 hi = ((jv_handle & BTA_JV_RFC_HDL_MASK) & ~BTA_JV_RFCOMM_MASK) - 1;
 475                 UINT32 si = BTA_JV_RFC_HDL_TO_SIDX(jv_handle);
 476                 if (hi < BTA_JV_MAX_RFC_CONN && bta_jv_cb.rfc_cb[hi].p_cback && si
 477                         < BTA_JV_MAX_RFC_SR_SESSION && bta_jv_cb.rfc_cb[hi].rfc_hdl[si])
 478                 {
 479                     tBTA_JV_PCB *p_pcb = bta_jv_rfc_port_to_pcb(bta_jv_cb.rfc_cb[hi].rfc_hdl[si]);
 480                     if (p_pcb)
 481                     {
 482                         if (NULL == p_pcb->p_pm_cb)
 483                             APPL_TRACE_WARNING("%s(jv_handle:"
 484                                     " 0x%x):port_handle: 0x%x, p_pm_cb: %d: no link to "
 485                                     "pm_cb?", __func__, jv_handle, p_pcb->port_handle, i);
 486                         p_cb = &p_pcb->p_pm_cb;
 487                     }
 488                 }
 489             }
 490             else
 491             {
 492                 if (jv_handle < BTA_JV_MAX_L2C_CONN)
 493                 {
 494                     tBTA_JV_L2C_CB *p_l2c_cb = &bta_jv_cb.l2c_cb[jv_handle];
 495                     if (NULL == p_l2c_cb->p_pm_cb)
 496                         APPL_TRACE_WARNING("%s(jv_handle: "
 497                                 "0x%x): p_pm_cb: %d: no link to pm_cb?", __func__, jv_handle, i);
 498                     p_cb = &p_l2c_cb->p_pm_cb;
 499                 }
 500             }
 501             if (p_cb)
 502             {
 503                 *p_cb = NULL;
 504                 status = BTA_JV_SUCCESS;
 505             }
 506         }
 507     }
 508     return status;
 509 }
 510
 511 /*******************************************************************************
 512  **
 513  ** Function    bta_jv_alloc_set_pm_profile_cb
 514  **
 515  ** Description set PM profile control block
 516  **
 517  ** Returns     pointer to allocated cb or NULL in case of failure
 518  **
 519  *******************************************************************************/
 520 static tBTA_JV_PM_CB *bta_jv_alloc_set_pm_profile_cb(UINT32 jv_handle, tBTA_JV_PM_ID app_id)
 521 {
 522     BOOLEAN bRfcHandle = (jv_handle & BTA_JV_RFCOMM_MASK) != 0;
 523     BD_ADDR peer_bd_addr;
 524     int i, j;
 525     tBTA_JV_PM_CB **pp_cb;
 526
 527     for (i = 0; i < BTA_JV_PM_MAX_NUM; i++)
 528     {
 529         pp_cb = NULL;
 530         if (bta_jv_cb.pm_cb[i].state == BTA_JV_PM_FREE_ST)
 531         {
 532             /* rfc handle bd addr retrieval requires core stack handle */
 533             if (bRfcHandle)
 534             {
 535                 for (j = 0; j < BTA_JV_MAX_RFC_CONN; j++)
 536                 {
 537                     if (jv_handle == bta_jv_cb.port_cb[j].handle)
 538                     {
 539                         pp_cb = &bta_jv_cb.port_cb[j].p_pm_cb;
 540                         if (PORT_SUCCESS != PORT_CheckConnection(
 541                                 bta_jv_cb.port_cb[j].port_handle, peer_bd_addr, NULL))
 542                             i = BTA_JV_PM_MAX_NUM;
 543                         break;
 544                     }
 545                 }
 546             }
 547             else
 548             {
 549                 /* use jv handle for l2cap bd address retrieval */
 550                 for (j = 0; j < BTA_JV_MAX_L2C_CONN; j++)
 551                 {
 552                     if (jv_handle == bta_jv_cb.l2c_cb[j].handle)
 553                     {
 554                         pp_cb = &bta_jv_cb.l2c_cb[j].p_pm_cb;
 555                         UINT8 *p_bd_addr = GAP_ConnGetRemoteAddr((UINT16)jv_handle);
 556                         if (NULL != p_bd_addr)
 557                             bdcpy(peer_bd_addr, p_bd_addr);
 558                         else
 559                             i = BTA_JV_PM_MAX_NUM;
 560                         break;
 561                     }
 562                 }
 563             }
 564             APPL_TRACE_API("bta_jv_alloc_set_pm_profile_cb(handle 0x%2x, app_id %d): "
 565                     "idx: %d, (BTA_JV_PM_MAX_NUM: %d), pp_cb: 0x%x", jv_handle, app_id,
 566                     i, BTA_JV_PM_MAX_NUM, pp_cb);
 567             break;
 568         }
 569     }
 570
 571     if ((i != BTA_JV_PM_MAX_NUM) && (NULL != pp_cb))
 572     {
 573         *pp_cb = &bta_jv_cb.pm_cb[i];
 574         bta_jv_cb.pm_cb[i].handle = jv_handle;
 575         bta_jv_cb.pm_cb[i].app_id = app_id;
 576         bdcpy(bta_jv_cb.pm_cb[i].peer_bd_addr, peer_bd_addr);
 577         bta_jv_cb.pm_cb[i].state = BTA_JV_PM_IDLE_ST;
 578         return &bta_jv_cb.pm_cb[i];
 579     }
 580     APPL_TRACE_WARNING("bta_jv_alloc_set_pm_profile_cb(jv_handle: 0x%x, app_id: %d) "
 581             "return NULL", jv_handle, app_id);
 582     return (tBTA_JV_PM_CB *)NULL;
 583 }
 584
 585 /*******************************************************************************
 586 **
 587 ** Function     bta_jv_check_psm
 588 **
 589 ** Description  for now use only the legal PSM per JSR82 spec
 590 **
 591 ** Returns      TRUE, if allowed
 592 **
 593 *******************************************************************************/
 594 BOOLEAN bta_jv_check_psm(UINT16 psm)
 595 {
 596     BOOLEAN ret = FALSE;
 597
 598     if (L2C_IS_VALID_PSM(psm))
 599     {
 600         if (psm < 0x1001)
 601         {
 602             /* see if this is defined by spec */
 603             switch (psm)
 604             {
 605             case SDP_PSM:           /* 1 */
 606             case BT_PSM_RFCOMM:     /* 3 */
 607                 /* do not allow java app to use these 2 PSMs */
 608                 break;
 609
 610             case TCS_PSM_INTERCOM:  /* 5 */
 611             case TCS_PSM_CORDLESS:  /* 7 */
 612                 if( FALSE == bta_sys_is_register(BTA_ID_CT) &&
 613                     FALSE == bta_sys_is_register(BTA_ID_CG) )
 614                     ret = TRUE;
 615                 break;
 616
 617             case BT_PSM_BNEP:       /* F */
 618                 if(FALSE == bta_sys_is_register(BTA_ID_PAN))
 619                     ret = TRUE;
 620                 break;
 621
 622             case HID_PSM_CONTROL:   /* 0x11 */
 623             case HID_PSM_INTERRUPT: /* 0x13 */
 624                 //FIX: allow HID Device and HID Host to coexist
 625                 if( FALSE == bta_sys_is_register(BTA_ID_HD) ||
 626                     FALSE == bta_sys_is_register(BTA_ID_HH) )
 627                     ret = TRUE;
 628                 break;
 629
 630             case AVCT_PSM:          /* 0x17 */
 631             case AVDT_PSM:          /* 0x19 */
 632                 if ((FALSE == bta_sys_is_register(BTA_ID_AV)) &&
 633                    (FALSE == bta_sys_is_register(BTA_ID_AVK)))
 634                     ret = TRUE;
 635                 break;
 636
 637             default:
 638                 ret = TRUE;
 639                 break;
 640             }
 641         }
 642         else
 643         {
 644             ret = TRUE;
 645         }
 646     }
 647     return ret;
 648
 649 }
 650
 651 /*******************************************************************************
 652 **
 653 ** Function     bta_jv_enable
 654 **
 655 ** Description  Initialises the JAVA I/F
 656 **
 657 ** Returns      void
 658 **
 659 *******************************************************************************/
 660 void bta_jv_enable(tBTA_JV_MSG *p_data)
 661 {
 662     tBTA_JV_STATUS status = BTA_JV_SUCCESS;
 663     bta_jv_cb.p_dm_cback = p_data->enable.p_cback;
 664     bta_jv_cb.p_dm_cback(BTA_JV_ENABLE_EVT, (tBTA_JV *)&status, 0);
 665     memset(bta_jv_cb.free_psm_list,0,sizeof(bta_jv_cb.free_psm_list));
 666 }
 667
 668 /*******************************************************************************
 669 **
 670 ** Function     bta_jv_disable
 671 **
 672 ** Description  Disables the BT device manager
 673 **              free the resources used by java
 674 **
 675 ** Returns      void
 676 **
 677 *******************************************************************************/
 678 void bta_jv_disable (tBTA_JV_MSG *p_data)
 679 {
 680     UNUSED(p_data);
 681
 682     APPL_TRACE_ERROR("%s",__func__);
 683 }
 684
 685
 686 /**
 687  * We keep a list of PSM's that have been freed from JAVA, for reuse.
 688  * This function will return a free PSM, and delete it from the free
 689  * list.
 690  * If no free PSMs exist, 0 will be returned.
 691  */
 692 static UINT16 bta_jv_get_free_psm() {
 693     const int cnt = sizeof(bta_jv_cb.free_psm_list)/sizeof(bta_jv_cb.free_psm_list[0]);
 694     for (int i = 0; i < cnt; i++) {
 695         UINT16 psm = bta_jv_cb.free_psm_list[i];
 696         if (psm != 0) {
 697             APPL_TRACE_DEBUG("%s(): Reusing PSM: 0x%04d", __func__, psm)
 698             bta_jv_cb.free_psm_list[i] = 0;
 699             return psm;
 700         }
 701     }
 702     return 0;
 703 }
 704
 705 static void bta_jv_set_free_psm(UINT16 psm) {
 706     int free_index = -1;
 707     const int cnt = sizeof(bta_jv_cb.free_psm_list)/sizeof(bta_jv_cb.free_psm_list[0]);
 708     for (int i = 0; i < cnt; i++) {
 709         if (bta_jv_cb.free_psm_list[i] == 0) {
 710             free_index = i;
 711         } else if (psm == bta_jv_cb.free_psm_list[i]) {
 712             return; // PSM already freed?
 713         }
 714     }
 715     if (free_index != -1) {
 716         bta_jv_cb.free_psm_list[free_index] = psm;
 717         APPL_TRACE_DEBUG("%s(): Recycling PSM: 0x%04d", __func__, psm)
 718     } else {
 719         APPL_TRACE_ERROR("%s unable to free psm 0x%x no more free slots",__func__, psm);
 720     }
 721 }
 722
 723 /*******************************************************************************
 724 **
 725 ** Function     bta_jv_get_channel_id
 726 **
 727 ** Description  Obtain a free SCN (Server Channel Number)
 728 **              (RFCOMM channel or L2CAP PSM)
 729 **
 730 ** Returns      void
 731 **
 732 *******************************************************************************/
 733 void bta_jv_get_channel_id(tBTA_JV_MSG *p_data)
 734 {
 735     UINT16   psm = 0;
 736
 737     switch (p_data->alloc_channel.type) {
 738         case BTA_JV_CONN_TYPE_RFCOMM: {
 739             INT32   channel = p_data->alloc_channel.channel;
 740             UINT8 scn = 0;
 741             if (channel > 0)
 742             {
 743                 if (BTM_TryAllocateSCN(channel) == FALSE)
 744                 {
 745                     APPL_TRACE_ERROR("rfc channel:%d already in use or invalid", channel);
 746                     channel = 0;
 747                 }
 748             } else if ((channel = BTM_AllocateSCN()) == 0) {
 749                 APPL_TRACE_ERROR("run out of rfc channels");
 750                 channel = 0;
 751             }
 752             if (channel != 0) {
 753                 bta_jv_cb.scn[channel-1] = TRUE;
 754                 scn = (UINT8) channel;
 755             }
 756             if (bta_jv_cb.p_dm_cback)
 757                 bta_jv_cb.p_dm_cback(BTA_JV_GET_SCN_EVT, (tBTA_JV *)&scn,
 758                         p_data->alloc_channel.user_data);
 759             return;
 760         }
 761         case BTA_JV_CONN_TYPE_L2CAP:
 762             psm = bta_jv_get_free_psm();
 763             if (psm == 0) {
 764                 psm = L2CA_AllocatePSM();
 765                 APPL_TRACE_DEBUG("%s() returned PSM: 0x%04x", __func__, psm);
 766             }
 767             break;
 768         case BTA_JV_CONN_TYPE_L2CAP_LE:
 769             break;
 770         default:
 771             break;
 772     }
 773
 774     if (bta_jv_cb.p_dm_cback)
 775         bta_jv_cb.p_dm_cback(BTA_JV_GET_PSM_EVT, (tBTA_JV *)&psm, p_data->alloc_channel.user_data);
 776 }
 777
 778 /*******************************************************************************
 779 **
 780 ** Function     bta_jv_free_scn
 781 **
 782 ** Description  free a SCN
 783 **
 784 ** Returns      void
 785 **
 786 *******************************************************************************/
 787 void bta_jv_free_scn(tBTA_JV_MSG *p_data)
 788 {
 789     UINT16   scn = p_data->free_channel.scn;
 790
 791     switch (p_data->free_channel.type) {
 792         case BTA_JV_CONN_TYPE_RFCOMM: {
 793             if (scn > 0 && scn <= BTA_JV_MAX_SCN && bta_jv_cb.scn[scn-1])
 794             {
 795                 /* this scn is used by JV */
 796                 bta_jv_cb.scn[scn-1] = FALSE;
 797                 BTM_FreeSCN(scn);
 798             }
 799             break;
 800         }
 801         case BTA_JV_CONN_TYPE_L2CAP:
 802             bta_jv_set_free_psm(scn);
 803             break;
 804         case BTA_JV_CONN_TYPE_L2CAP_LE:
 805             // TODO: Not yet implemented...
 806             break;
 807         default:
 808             break;
 809     }
 810 }
 811 static inline tBT_UUID shorten_sdp_uuid(const tBT_UUID* u)
 812 {
 813     static uint8_t bt_base_uuid[] =
 814        {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x80, 0x00, 0x00, 0x80, 0x5F, 0x9B, 0x34, 0xFB };
 815
 816     logu("in, uuid:", u->uu.uuid128);
 817     APPL_TRACE_DEBUG("uuid len:%d", u->len);
 818     if(u->len == 16)
 819     {
 820         if(memcmp(&u->uu.uuid128[4], &bt_base_uuid[4], 12) == 0)
 821         {
 822             tBT_UUID su;
 823             memset(&su, 0, sizeof(su));
 824             if(u->uu.uuid128[0] == 0 && u->uu.uuid128[1] == 0)
 825             {
 826                 su.len = 2;
 827                 uint16_t u16;
 828                 memcpy(&u16, &u->uu.uuid128[2], sizeof(u16));
 829                 su.uu.uuid16 = ntohs(u16);
 830                 APPL_TRACE_DEBUG("shorten to 16 bits uuid: %x", su.uu.uuid16);
 831             }
 832             else
 833             {
 834                 su.len = 4;
 835                 uint32_t u32;
 836                 memcpy(&u32, &u->uu.uuid128[0], sizeof(u32));
 837                 su.uu.uuid32 = ntohl(u32);
 838                 APPL_TRACE_DEBUG("shorten to 32 bits uuid: %x", su.uu.uuid32);
 839             }
 840             return su;
 841         }
 842     }
 843     APPL_TRACE_DEBUG("cannot shorten none-reserved 128 bits uuid");
 844     return *u;
 845 }
 846
 847 /*******************************************************************************
 848 **
 849 ** Function     bta_jv_start_discovery_cback
 850 **
 851 ** Description  Callback for Start Discovery
 852 **
 853 ** Returns      void
 854 **
 855 *******************************************************************************/
 856 static void bta_jv_start_discovery_cback(UINT16 result, void * user_data)
 857 {
 858     tBTA_JV_STATUS status;
 859
 860     APPL_TRACE_DEBUG("bta_jv_start_discovery_cback res: 0x%x", result);
 861
 862     bta_jv_cb.sdp_active = BTA_JV_SDP_ACT_NONE;
 863     if(bta_jv_cb.p_dm_cback)
 864     {
 865         tBTA_JV_DISCOVERY_COMP dcomp;
 866         dcomp.scn = 0;
 867         status = BTA_JV_FAILURE;
 868         if (result == SDP_SUCCESS || result == SDP_DB_FULL)
 869         {
 870             tSDP_DISC_REC       *p_sdp_rec = NULL;
 871             tSDP_PROTOCOL_ELEM  pe;
 872             logu("bta_jv_cb.uuid", bta_jv_cb.uuid.uu.uuid128);
 873             tBT_UUID su = shorten_sdp_uuid(&bta_jv_cb.uuid);
 874             logu("shorten uuid:", su.uu.uuid128);
 875             p_sdp_rec = SDP_FindServiceUUIDInDb(p_bta_jv_cfg->p_sdp_db, &su, p_sdp_rec);
 876             APPL_TRACE_DEBUG("p_sdp_rec:%p", p_sdp_rec);
 877             if (p_sdp_rec && SDP_FindProtocolListElemInRec(p_sdp_rec, UUID_PROTOCOL_RFCOMM, &pe))
 878             {
 879                 dcomp.scn = (UINT8) pe.params[0];
 880                 status = BTA_JV_SUCCESS;
 881             }
 882         }
 883
 884         dcomp.status = status;
 885         bta_jv_cb.p_dm_cback(BTA_JV_DISCOVERY_COMP_EVT, (tBTA_JV *)&dcomp, user_data);
 886     }
 887 }
 888
 889 /*******************************************************************************
 890 **
 891 ** Function     bta_jv_start_discovery
 892 **
 893 ** Description  Discovers services on a remote device
 894 **
 895 ** Returns      void
 896 **
 897 *******************************************************************************/
 898 void bta_jv_start_discovery(tBTA_JV_MSG *p_data)
 899 {
 900     tBTA_JV_STATUS status = BTA_JV_FAILURE;
 901     APPL_TRACE_DEBUG("bta_jv_start_discovery in, sdp_active:%d", bta_jv_cb.sdp_active);
 902     if (bta_jv_cb.sdp_active != BTA_JV_SDP_ACT_NONE)
 903     {
 904         /* SDP is still in progress */
 905         status = BTA_JV_BUSY;
 906         if(bta_jv_cb.p_dm_cback)
 907             bta_jv_cb.p_dm_cback(BTA_JV_DISCOVERY_COMP_EVT, (tBTA_JV *)&status, p_data->start_discovery.user_data);
 908         return;
 909     }
 910
 911     /* init the database/set up the filter */
 912     APPL_TRACE_DEBUG("call SDP_InitDiscoveryDb, p_data->start_discovery.num_uuid:%d",
 913         p_data->start_discovery.num_uuid);
 914     SDP_InitDiscoveryDb (p_bta_jv_cfg->p_sdp_db, p_bta_jv_cfg->sdp_db_size,
 915                     p_data->start_discovery.num_uuid, p_data->start_discovery.uuid_list, 0, NULL);
 916
 917     /* tell SDP to keep the raw data */
 918     p_bta_jv_cfg->p_sdp_db->raw_data = p_bta_jv_cfg->p_sdp_raw_data;
 919     p_bta_jv_cfg->p_sdp_db->raw_size = p_bta_jv_cfg->sdp_raw_size;
 920
 921     bta_jv_cb.p_sel_raw_data     = 0;
 922     bta_jv_cb.uuid = p_data->start_discovery.uuid_list[0];
 923
 924     bta_jv_cb.sdp_active = BTA_JV_SDP_ACT_YES;
 925     if (!SDP_ServiceSearchAttributeRequest2(p_data->start_discovery.bd_addr,
 926                                    p_bta_jv_cfg->p_sdp_db,
 927                                    bta_jv_start_discovery_cback, p_data->start_discovery.user_data))
 928     {
 929         bta_jv_cb.sdp_active = BTA_JV_SDP_ACT_NONE;
 930         /* failed to start SDP. report the failure right away */
 931         if(bta_jv_cb.p_dm_cback)
 932             bta_jv_cb.p_dm_cback(BTA_JV_DISCOVERY_COMP_EVT, (tBTA_JV *)&status, p_data->start_discovery.user_data);
 933     }
 934     /*
 935     else report the result when the cback is called
 936     */
 937 }
 938
 939 /*******************************************************************************
 940 **
 941 ** Function     bta_jv_create_record
 942 **
 943 ** Description  Create an SDP record with the given attributes
 944 **
 945 ** Returns      void
 946 **
 947 *******************************************************************************/
 948 void bta_jv_create_record(tBTA_JV_MSG *p_data)
 949 {
 950     tBTA_JV_API_CREATE_RECORD *cr = &(p_data->create_record);
 951     tBTA_JV_CREATE_RECORD   evt_data;
 952     evt_data.status = BTA_JV_SUCCESS;
 953     if(bta_jv_cb.p_dm_cback)
 954         //callback user immediately to create his own sdp record in stack thread context
 955         bta_jv_cb.p_dm_cback(BTA_JV_CREATE_RECORD_EVT, (tBTA_JV *)&evt_data, cr->user_data);
 956 }
 957
 958 /*******************************************************************************
 959 **
 960 ** Function     bta_jv_delete_record
 961 **
 962 ** Description  Delete an SDP record
 963 **
 964 **
 965 ** Returns      void
 966 **
 967 *******************************************************************************/
 968 void bta_jv_delete_record(tBTA_JV_MSG *p_data)
 969 {
 970     tBTA_JV_API_ADD_ATTRIBUTE *dr = &(p_data->add_attr);
 971     if(dr->handle)
 972     {
 973         /* this is a record created by btif layer*/
 974         SDP_DeleteRecord(dr->handle);
 975     }
 976 }
 977
 978 /*******************************************************************************
 979 **
 980 ** Function     bta_jv_l2cap_client_cback
 981 **
 982 ** Description  handles the l2cap client events
 983 **
 984 ** Returns      void
 985 **
 986 *******************************************************************************/
 987 static void bta_jv_l2cap_client_cback(UINT16 gap_handle, UINT16 event)
 988 {
 989     tBTA_JV_L2C_CB  *p_cb = &bta_jv_cb.l2c_cb[gap_handle];
 990     tBTA_JV     evt_data;
 991
 992     if (gap_handle >= BTA_JV_MAX_L2C_CONN && !p_cb->p_cback)
 993         return;
 994
 995     APPL_TRACE_DEBUG( "%s: %d evt:x%x",__func__, gap_handle, event);
 996     evt_data.l2c_open.status = BTA_JV_SUCCESS;
 997     evt_data.l2c_open.handle = gap_handle;
 998
 999     switch (event)
1000     {
1001     case GAP_EVT_CONN_OPENED:
1002         bdcpy(evt_data.l2c_open.rem_bda, GAP_ConnGetRemoteAddr(gap_handle));
1003         evt_data.l2c_open.tx_mtu = GAP_ConnGetRemMtuSize(gap_handle);
1004         p_cb->state = BTA_JV_ST_CL_OPEN;
1005         p_cb->p_cback(BTA_JV_L2CAP_OPEN_EVT, &evt_data, p_cb->user_data);
1006         break;
1007
1008     case GAP_EVT_CONN_CLOSED:
1009         p_cb->state = BTA_JV_ST_NONE;
1010         bta_jv_free_sec_id(&p_cb->sec_id);
1011         evt_data.l2c_close.async = TRUE;
1012         p_cb->p_cback(BTA_JV_L2CAP_CLOSE_EVT, &evt_data, p_cb->user_data);
1013         p_cb->p_cback = NULL;
1014         break;
1015
1016     case GAP_EVT_CONN_DATA_AVAIL:
1017         evt_data.data_ind.handle = gap_handle;
1018         /* Reset idle timer to avoid requesting sniff mode while receiving data */
1019         bta_jv_pm_conn_busy(p_cb->p_pm_cb);
1020         p_cb->p_cback(BTA_JV_L2CAP_DATA_IND_EVT, &evt_data, p_cb->user_data);
1021         bta_jv_pm_conn_idle(p_cb->p_pm_cb);
1022         break;
1023
1024     case GAP_EVT_CONN_CONGESTED:
1025     case GAP_EVT_CONN_UNCONGESTED:
1026         p_cb->cong = (event == GAP_EVT_CONN_CONGESTED) ? TRUE : FALSE;
1027         evt_data.l2c_cong.cong = p_cb->cong;
1028         p_cb->p_cback(BTA_JV_L2CAP_CONG_EVT, &evt_data, p_cb->user_data);
1029         break;
1030
1031     default:
1032         break;
1033     }
1034 }
1035
1036 /*******************************************************************************
1037 **
1038 ** Function     bta_jv_l2cap_connect
1039 **
1040 ** Description  makes an l2cap client connection
1041 **
1042 ** Returns      void
1043 **
1044 *******************************************************************************/
1045 void bta_jv_l2cap_connect(tBTA_JV_MSG *p_data)
1046 {
1047     tBTA_JV_L2C_CB      *p_cb;
1048     tBTA_JV_L2CAP_CL_INIT  evt_data;
1049     UINT16  handle=GAP_INVALID_HANDLE;
1050     UINT8   sec_id;
1051     tL2CAP_CFG_INFO cfg;
1052     tBTA_JV_API_L2CAP_CONNECT *cc = &(p_data->l2cap_connect);
1053     UINT8 chan_mode_mask = GAP_FCR_CHAN_OPT_BASIC;
1054     tL2CAP_ERTM_INFO    *ertm_info = NULL;
1055
1056     memset(&cfg, 0, sizeof(tL2CAP_CFG_INFO));
1057
1058     if (cc->has_cfg == TRUE)
1059     {
1060         cfg = cc->cfg;
1061         if (cfg.fcr_present && cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) {
1062             chan_mode_mask = GAP_FCR_CHAN_OPT_ERTM;
1063         }
1064     }
1065
1066     if (cc->has_ertm_info == TRUE)
1067     {
1068         ertm_info = &(cc->ertm_info);
1069     }
1070
1071     /* We need to use this value for MTU to be able to handle cases where cfg is not set in req. */
1072     cfg.mtu_present = TRUE;
1073     cfg.mtu = cc->rx_mtu;
1074
1075     /* TODO: DM role manager
1076     L2CA_SetDesireRole(cc->role);
1077     */
1078
1079     sec_id = bta_jv_alloc_sec_id();
1080     evt_data.sec_id = sec_id;
1081     evt_data.status = BTA_JV_FAILURE;
1082
1083     if (sec_id)
1084     {
1085         if (bta_jv_check_psm(cc->remote_psm)) /* allowed */
1086         {
1087             if ((handle = GAP_ConnOpen("", sec_id, 0, cc->peer_bd_addr, cc->remote_psm,
1088                 &cfg, ertm_info, cc->sec_mask, chan_mode_mask,
1089                 bta_jv_l2cap_client_cback)) != GAP_INVALID_HANDLE )
1090             {
1091                 evt_data.status = BTA_JV_SUCCESS;
1092             }
1093         }
1094     }
1095
1096     if (evt_data.status == BTA_JV_SUCCESS)
1097     {
1098         p_cb = &bta_jv_cb.l2c_cb[handle];
1099         p_cb->handle = handle;
1100         p_cb->p_cback = cc->p_cback;
1101         p_cb->user_data = cc->user_data;
1102         p_cb->psm = 0;  /* not a server */
1103         p_cb->sec_id = sec_id;
1104         p_cb->state = BTA_JV_ST_CL_OPENING;
1105     }
1106     else
1107     {
1108         bta_jv_free_sec_id(&sec_id);
1109     }
1110
1111     evt_data.handle = handle;
1112     cc->p_cback(BTA_JV_L2CAP_CL_INIT_EVT, (tBTA_JV *)&evt_data, cc->user_data);
1113 }
1114
1115
1116 /*******************************************************************************
1117 **
1118 ** Function     bta_jv_l2cap_close
1119 **
1120 ** Description  Close an L2CAP client connection
1121 **
1122 ** Returns      void
1123 **
1124 *******************************************************************************/
1125 void bta_jv_l2cap_close(tBTA_JV_MSG *p_data)
1126 {
1127     tBTA_JV_L2CAP_CLOSE  evt_data;
1128     tBTA_JV_API_L2CAP_CLOSE *cc = &(p_data->l2cap_close);
1129     tBTA_JV_L2CAP_CBACK *p_cback = cc->p_cb->p_cback;
1130     void *user_data = cc->p_cb->user_data;
1131
1132     evt_data.handle = cc->handle;
1133     evt_data.status = bta_jv_free_l2c_cb(cc->p_cb);
1134     evt_data.async = FALSE;
1135
1136     if (p_cback)
1137         p_cback(BTA_JV_L2CAP_CLOSE_EVT, (tBTA_JV *)&evt_data, user_data);
1138 }
1139
1140 /*******************************************************************************
1141 **
1142 ** Function         bta_jv_l2cap_server_cback
1143 **
1144 ** Description      handles the l2cap server callback
1145 **
1146 ** Returns          void
1147 **
1148 *******************************************************************************/
1149 static void bta_jv_l2cap_server_cback(UINT16 gap_handle, UINT16 event)
1150 {
1151     tBTA_JV_L2C_CB  *p_cb = &bta_jv_cb.l2c_cb[gap_handle];
1152     tBTA_JV evt_data;
1153     tBTA_JV_L2CAP_CBACK *p_cback;
1154     void *user_data;
1155
1156     if (gap_handle >= BTA_JV_MAX_L2C_CONN && !p_cb->p_cback)
1157         return;
1158
1159     APPL_TRACE_DEBUG( "%s: %d evt:x%x", __func__, gap_handle, event);
1160     evt_data.l2c_open.status = BTA_JV_SUCCESS;
1161     evt_data.l2c_open.handle = gap_handle;
1162
1163     switch (event)
1164     {
1165     case GAP_EVT_CONN_OPENED:
1166         bdcpy(evt_data.l2c_open.rem_bda, GAP_ConnGetRemoteAddr(gap_handle));
1167         evt_data.l2c_open.tx_mtu = GAP_ConnGetRemMtuSize(gap_handle);
1168         p_cb->state = BTA_JV_ST_SR_OPEN;
1169         p_cb->p_cback(BTA_JV_L2CAP_OPEN_EVT, &evt_data, p_cb->user_data);
1170         break;
1171
1172     case GAP_EVT_CONN_CLOSED:
1173         evt_data.l2c_close.async = TRUE;
1174         evt_data.l2c_close.handle = p_cb->handle;
1175         p_cback = p_cb->p_cback;
1176         user_data = p_cb->user_data;
1177         evt_data.l2c_close.status = bta_jv_free_l2c_cb(p_cb);
1178         p_cback(BTA_JV_L2CAP_CLOSE_EVT, &evt_data, user_data);
1179         break;
1180
1181     case GAP_EVT_CONN_DATA_AVAIL:
1182         evt_data.data_ind.handle = gap_handle;
1183         /* Reset idle timer to avoid requesting sniff mode while receiving data */
1184         bta_jv_pm_conn_busy(p_cb->p_pm_cb);
1185         p_cb->p_cback(BTA_JV_L2CAP_DATA_IND_EVT, &evt_data, p_cb->user_data);
1186         bta_jv_pm_conn_idle(p_cb->p_pm_cb);
1187         break;
1188
1189     case GAP_EVT_CONN_CONGESTED:
1190     case GAP_EVT_CONN_UNCONGESTED:
1191         p_cb->cong = (event == GAP_EVT_CONN_CONGESTED) ? TRUE : FALSE;
1192         evt_data.l2c_cong.cong = p_cb->cong;
1193         p_cb->p_cback(BTA_JV_L2CAP_CONG_EVT, &evt_data, p_cb->user_data);
1194         break;
1195
1196     default:
1197         break;
1198     }
1199 }
1200
1201 /*******************************************************************************
1202 **
1203 ** Function     bta_jv_l2cap_start_server
1204 **
1205 ** Description  starts an L2CAP server
1206 **
1207 ** Returns      void
1208 **
1209 *******************************************************************************/
1210 void bta_jv_l2cap_start_server(tBTA_JV_MSG *p_data)
1211 {
1212     tBTA_JV_L2C_CB      *p_cb;
1213     UINT8   sec_id;
1214     UINT16  handle;
1215     tL2CAP_CFG_INFO cfg;
1216     tBTA_JV_L2CAP_START evt_data;
1217     tBTA_JV_API_L2CAP_SERVER *ls = &(p_data->l2cap_server);
1218     UINT8 chan_mode_mask = GAP_FCR_CHAN_OPT_BASIC;
1219     tL2CAP_ERTM_INFO    *ertm_info = NULL;
1220
1221     memset(&cfg, 0, sizeof(tL2CAP_CFG_INFO));
1222
1223     if (ls->has_cfg == TRUE) {
1224         cfg = ls->cfg;
1225         if (cfg.fcr_present && cfg.fcr.mode == L2CAP_FCR_ERTM_MODE) {
1226             chan_mode_mask = GAP_FCR_CHAN_OPT_ERTM;
1227         }
1228     }
1229
1230     if (ls->has_ertm_info == TRUE) {
1231         ertm_info = &(ls->ertm_info);
1232     }
1233
1234     //FIX: MTU=0 means not present
1235     if (ls->rx_mtu >0)
1236     {
1237         cfg.mtu_present = TRUE;
1238         cfg.mtu = ls->rx_mtu;
1239     }
1240     else
1241     {
1242         cfg.mtu_present = FALSE;
1243         cfg.mtu = 0;
1244     }
1245
1246     /* TODO DM role manager
1247     L2CA_SetDesireRole(ls->role);
1248     */
1249
1250     sec_id = bta_jv_alloc_sec_id();
1251     if (0 == sec_id || (FALSE == bta_jv_check_psm(ls->local_psm)) ||
1252         (handle = GAP_ConnOpen("JV L2CAP", sec_id, 1, 0, ls->local_psm, &cfg, ertm_info,
1253             ls->sec_mask, chan_mode_mask, bta_jv_l2cap_server_cback)) == GAP_INVALID_HANDLE)
1254     {
1255         bta_jv_free_sec_id(&sec_id);
1256         evt_data.status = BTA_JV_FAILURE;
1257     }
1258     else
1259     {
1260         p_cb = &bta_jv_cb.l2c_cb[handle];
1261         evt_data.status = BTA_JV_SUCCESS;
1262         evt_data.handle = handle;
1263         evt_data.sec_id = sec_id;
1264         p_cb->p_cback = ls->p_cback;
1265         p_cb->user_data = ls->user_data;
1266         p_cb->handle = handle;
1267         p_cb->sec_id = sec_id;
1268         p_cb->state = BTA_JV_ST_SR_LISTEN;
1269         p_cb->psm = ls->local_psm;
1270     }
1271
1272     ls->p_cback(BTA_JV_L2CAP_START_EVT, (tBTA_JV *)&evt_data, ls->user_data);
1273 }
1274
1275 /*******************************************************************************
1276 **
1277 ** Function     bta_jv_l2cap_stop_server
1278 **
1279 ** Description  stops an L2CAP server
1280 **
1281 ** Returns      void
1282 **
1283 *******************************************************************************/
1284 void bta_jv_l2cap_stop_server(tBTA_JV_MSG *p_data)
1285 {
1286     tBTA_JV_L2C_CB      *p_cb;
1287     tBTA_JV_L2CAP_CLOSE  evt_data;
1288     tBTA_JV_API_L2CAP_SERVER *ls = &(p_data->l2cap_server);
1289     tBTA_JV_L2CAP_CBACK *p_cback;
1290     void *user_data;
1291     for (int i = 0; i < BTA_JV_MAX_L2C_CONN; i++)
1292     {
1293         if (bta_jv_cb.l2c_cb[i].psm == ls->local_psm)
1294         {
1295             p_cb = &bta_jv_cb.l2c_cb[i];
1296             p_cback = p_cb->p_cback;
1297             user_data = p_cb->user_data;
1298             evt_data.handle = p_cb->handle;
1299             evt_data.status = bta_jv_free_l2c_cb(p_cb);
1300             evt_data.async = FALSE;
1301             p_cback(BTA_JV_L2CAP_CLOSE_EVT, (tBTA_JV *)&evt_data, user_data);
1302             break;
1303         }
1304     }
1305 }
1306
1307
1308
1309 /*******************************************************************************
1310 **
1311 ** Function     bta_jv_l2cap_read
1312 **
1313 ** Description  Read data from an L2CAP connection
1314 **
1315 ** Returns      void
1316 **
1317 *******************************************************************************/
1318 void bta_jv_l2cap_read(tBTA_JV_MSG *p_data)
1319 {
1320     tBTA_JV_L2CAP_READ evt_data;
1321     tBTA_JV_API_L2CAP_READ *rc = &(p_data->l2cap_read);
1322
1323     evt_data.status = BTA_JV_FAILURE;
1324     evt_data.handle = rc->handle;
1325     evt_data.req_id = rc->req_id;
1326     evt_data.p_data = rc->p_data;
1327     evt_data.len    = 0;
1328
1329     if (BT_PASS == GAP_ConnReadData(rc->handle, rc->p_data, rc->len, &evt_data.len))
1330     {
1331         evt_data.status = BTA_JV_SUCCESS;
1332     }
1333
1334     rc->p_cback(BTA_JV_L2CAP_READ_EVT, (tBTA_JV *)&evt_data, rc->user_data);
1335 }
1336
1337
1338 /*******************************************************************************
1339 **
1340 ** Function     bta_jv_l2cap_write
1341 **
1342 ** Description  Write data to an L2CAP connection
1343 **
1344 ** Returns      void
1345 **
1346 *******************************************************************************/
1347 void bta_jv_l2cap_write(tBTA_JV_MSG *p_data)
1348 {
1349     tBTA_JV_L2CAP_WRITE evt_data;
1350     tBTA_JV_API_L2CAP_WRITE *ls = &(p_data->l2cap_write);
1351
1352     /* As we check this callback exists before the tBTA_JV_API_L2CAP_WRITE can be send through the
1353      * API this check should not be needed.
1354      * But the API is not designed to be used (safely at least) in a multi-threaded scheduler, hence
1355      * if the peer device disconnects the l2cap link after the API is called, but before this
1356      * message is handled, the ->p_cback will be cleared at this point. At first glanch this seems
1357      * highly unlikely, but for all obex-profiles with two channels connected - e.g. MAP, this
1358      * happens around 1 of 4 disconnects, as a disconnect on the server channel causes a disconnect
1359      * to be send on the client (notification) channel, but at the peer typically disconnects both
1360      * the OBEX disconnect request crosses the incoming l2cap disconnect.
1361      * If p_cback is cleared, we simply discard the data.
1362      * RISK: The caller must handle any cleanup based on another signal than BTA_JV_L2CAP_WRITE_EVT,
1363      *       which is typically not possible, as the pointer to the allocated buffer is stored
1364      *       in this message, and can therefore not be freed, hence we have a mem-leak-by-design.*/
1365     if (ls->p_cb->p_cback != NULL) {
1366         evt_data.status = BTA_JV_FAILURE;
1367         evt_data.handle = ls->handle;
1368         evt_data.req_id = ls->req_id;
1369         evt_data.cong   = ls->p_cb->cong;
1370         evt_data.len    = 0;
1371         bta_jv_pm_conn_busy(ls->p_cb->p_pm_cb);
1372         if (!evt_data.cong &&
1373            BT_PASS == GAP_ConnWriteData(ls->handle, ls->p_data, ls->len, &evt_data.len))
1374         {
1375            evt_data.status = BTA_JV_SUCCESS;
1376         }
1377         ls->p_cb->p_cback(BTA_JV_L2CAP_WRITE_EVT, (tBTA_JV *)&evt_data, ls->user_data);
1378         bta_jv_set_pm_conn_state(ls->p_cb->p_pm_cb, BTA_JV_CONN_IDLE);
1379     } else {
1380         /* As this pointer is checked in the API function, this occurs only when the channel is
1381          * disconnected after the API function is called, but before the message is handled. */
1382         APPL_TRACE_ERROR("%s() ls->p_cb->p_cback == NULL", __func__);
1383     }
1384 }
1385
1386 /*******************************************************************************
1387 **
1388 ** Function     bta_jv_l2cap_write_fixed
1389 **
1390 ** Description  Write data to an L2CAP connection using Fixed channels
1391 **
1392 ** Returns      void
1393 **
1394 *******************************************************************************/
1395 void bta_jv_l2cap_write_fixed(tBTA_JV_MSG *p_data)
1396 {
1397     tBTA_JV_L2CAP_WRITE_FIXED evt_data;
1398     tBTA_JV_API_L2CAP_WRITE_FIXED *ls = &(p_data->l2cap_write_fixed);
1399     BT_HDR *msg = (BT_HDR *)GKI_getbuf(sizeof(BT_HDR) + ls->len + L2CAP_MIN_OFFSET);
1400     if (!msg)
1401     {
1402       APPL_TRACE_ERROR("%s() could not allocate msg buffer",__func__);
1403         return;
1404     }
1405     evt_data.status  = BTA_JV_FAILURE;
1406     evt_data.channel = ls->channel;
1407     memcpy(evt_data.addr, ls->addr, sizeof(evt_data.addr));
1408     evt_data.req_id  = ls->req_id;
1409     evt_data.len     = 0;
1410
1411
1412     memcpy(((uint8_t*)(msg + 1)) + L2CAP_MIN_OFFSET, ls->p_data, ls->len);
1413     msg->len = ls->len;
1414     msg->offset = L2CAP_MIN_OFFSET;
1415
1416     L2CA_SendFixedChnlData(ls->channel, ls->addr, msg);
1417
1418     ls->p_cback(BTA_JV_L2CAP_WRITE_FIXED_EVT, (tBTA_JV *)&evt_data, ls->user_data);
1419 }
1420
1421 /*******************************************************************************
1422 **
1423 ** Function     bta_jv_port_data_co_cback
1424 **
1425 ** Description  port data callback function of rfcomm
1426 **              connections
1427 **
1428 ** Returns      void
1429 **
1430 *******************************************************************************/
1431 static int bta_jv_port_data_co_cback(UINT16 port_handle, UINT8 *buf, UINT16 len, int type)
1432 {
1433     tBTA_JV_RFC_CB  *p_cb = bta_jv_rfc_port_to_cb(port_handle);
1434     tBTA_JV_PCB     *p_pcb = bta_jv_rfc_port_to_pcb(port_handle);
1435     int ret = 0;
1436     APPL_TRACE_DEBUG("%s, p_cb:%p, p_pcb:%p, len:%d, type:%d", __func__, p_cb, p_pcb, len, type);
1437     if (p_pcb != NULL)
1438     {
1439         switch(type)
1440         {
1441             case DATA_CO_CALLBACK_TYPE_INCOMING:
1442                 bta_jv_pm_conn_busy(p_pcb->p_pm_cb);
1443                 ret = bta_co_rfc_data_incoming(p_pcb->user_data, (BT_HDR*)buf);
1444                 bta_jv_pm_conn_idle(p_pcb->p_pm_cb);
1445                 return ret;
1446             case DATA_CO_CALLBACK_TYPE_OUTGOING_SIZE:
1447                 return bta_co_rfc_data_outgoing_size(p_pcb->user_data, (int*)buf);
1448             case DATA_CO_CALLBACK_TYPE_OUTGOING:
1449                 return bta_co_rfc_data_outgoing(p_pcb->user_data, buf, len);
1450             default:
1451                 APPL_TRACE_ERROR("unknown callout type:%d", type);
1452                 break;
1453         }
1454     }
1455     return 0;
1456 }
1457
1458 /*******************************************************************************
1459 **
1460 ** Function     bta_jv_port_mgmt_cl_cback
1461 **
1462 ** Description  callback for port mamangement function of rfcomm
1463 **              client connections
1464 **
1465 ** Returns      void
1466 **
1467 *******************************************************************************/
1468 static void bta_jv_port_mgmt_cl_cback(UINT32 code, UINT16 port_handle)
1469 {
1470     tBTA_JV_RFC_CB  *p_cb = bta_jv_rfc_port_to_cb(port_handle);
1471     tBTA_JV_PCB     *p_pcb = bta_jv_rfc_port_to_pcb(port_handle);
1472     tBTA_JV evt_data;
1473     BD_ADDR rem_bda;
1474     UINT16 lcid;
1475     tBTA_JV_RFCOMM_CBACK *p_cback;  /* the callback function */
1476
1477     APPL_TRACE_DEBUG( "bta_jv_port_mgmt_cl_cback:code:%d, port_handle%d", code, port_handle);
1478     if(NULL == p_cb || NULL == p_cb->p_cback)
1479         return;
1480
1481     APPL_TRACE_DEBUG( "bta_jv_port_mgmt_cl_cback code=%d port_handle:%d handle:%d",
1482         code, port_handle, p_cb->handle);
1483
1484     PORT_CheckConnection(port_handle, rem_bda, &lcid);
1485
1486     if(code == PORT_SUCCESS)
1487     {
1488         evt_data.rfc_open.handle = p_cb->handle;
1489         evt_data.rfc_open.status = BTA_JV_SUCCESS;
1490         bdcpy(evt_data.rfc_open.rem_bda, rem_bda);
1491         p_pcb->state = BTA_JV_ST_CL_OPEN;
1492         p_cb->p_cback(BTA_JV_RFCOMM_OPEN_EVT, &evt_data, p_pcb->user_data);
1493     }
1494     else
1495     {
1496         evt_data.rfc_close.handle = p_cb->handle;
1497         evt_data.rfc_close.status = BTA_JV_FAILURE;
1498         evt_data.rfc_close.port_status = code;
1499         evt_data.rfc_close.async = TRUE;
1500         if (p_pcb->state == BTA_JV_ST_CL_CLOSING)
1501         {
1502             evt_data.rfc_close.async = FALSE;
1503         }
1504         //p_pcb->state = BTA_JV_ST_NONE;
1505         //p_pcb->cong = FALSE;
1506         p_cback = p_cb->p_cback;
1507         p_cback(BTA_JV_RFCOMM_CLOSE_EVT, &evt_data, p_pcb->user_data);
1508         //bta_jv_free_rfc_cb(p_cb, p_pcb);
1509     }
1510
1511 }
1512
1513 /*******************************************************************************
1514 **
1515 ** Function     bta_jv_port_event_cl_cback
1516 **
1517 ** Description  Callback for RFCOMM client port events
1518 **
1519 ** Returns      void
1520 **
1521 *******************************************************************************/
1522 static void bta_jv_port_event_cl_cback(UINT32 code, UINT16 port_handle)
1523 {
1524     tBTA_JV_RFC_CB  *p_cb = bta_jv_rfc_port_to_cb(port_handle);
1525     tBTA_JV_PCB     *p_pcb = bta_jv_rfc_port_to_pcb(port_handle);
1526     tBTA_JV evt_data;
1527
1528     APPL_TRACE_DEBUG( "bta_jv_port_event_cl_cback:%d", port_handle);
1529     if (NULL == p_cb || NULL == p_cb->p_cback)
1530         return;
1531
1532     APPL_TRACE_DEBUG( "bta_jv_port_event_cl_cback code=x%x port_handle:%d handle:%d",
1533         code, port_handle, p_cb->handle);
1534     if (code & PORT_EV_RXCHAR)
1535     {
1536         evt_data.data_ind.handle = p_cb->handle;
1537         p_cb->p_cback(BTA_JV_RFCOMM_DATA_IND_EVT, &evt_data, p_pcb->user_data);
1538     }
1539
1540     if (code & PORT_EV_FC)
1541     {
1542         p_pcb->cong = (code & PORT_EV_FCS) ? FALSE : TRUE;
1543         evt_data.rfc_cong.cong = p_pcb->cong;
1544         evt_data.rfc_cong.handle = p_cb->handle;
1545         evt_data.rfc_cong.status = BTA_JV_SUCCESS;
1546         p_cb->p_cback(BTA_JV_RFCOMM_CONG_EVT, &evt_data, p_pcb->user_data);
1547     }
1548
1549     if (code & PORT_EV_TXEMPTY)
1550     {
1551         bta_jv_pm_conn_idle(p_pcb->p_pm_cb);
1552     }
1553 }
1554
1555 /*******************************************************************************
1556 **
1557 ** Function     bta_jv_rfcomm_connect
1558 **
1559 ** Description  Client initiates an RFCOMM connection
1560 **
1561 ** Returns      void
1562 **
1563 *******************************************************************************/
1564 void bta_jv_rfcomm_connect(tBTA_JV_MSG *p_data)
1565 {
1566     UINT16 handle = 0;
1567     UINT32 event_mask = BTA_JV_RFC_EV_MASK;
1568     tPORT_STATE port_state;
1569     UINT8   sec_id = 0;
1570     tBTA_JV_RFC_CB  *p_cb = NULL;
1571     tBTA_JV_PCB     *p_pcb;
1572     tBTA_JV_API_RFCOMM_CONNECT *cc = &(p_data->rfcomm_connect);
1573     tBTA_JV_RFCOMM_CL_INIT      evt_data = {0};
1574
1575     /* TODO DM role manager
1576     L2CA_SetDesireRole(cc->role);
1577     */
1578
1579     sec_id = bta_jv_alloc_sec_id();
1580     evt_data.sec_id = sec_id;
1581     evt_data.status = BTA_JV_SUCCESS;
1582     if (0 == sec_id ||
1583         BTM_SetSecurityLevel(TRUE, "", sec_id,  cc->sec_mask, BT_PSM_RFCOMM,
1584                 BTM_SEC_PROTO_RFCOMM, cc->remote_scn) == FALSE)
1585     {
1586         evt_data.status = BTA_JV_FAILURE;
1587         APPL_TRACE_ERROR("sec_id:%d is zero or BTM_SetSecurityLevel failed, remote_scn:%d", sec_id, cc->remote_scn);
1588     }
1589
1590     if (evt_data.status == BTA_JV_SUCCESS &&
1591         RFCOMM_CreateConnection(UUID_SERVCLASS_SERIAL_PORT, cc->remote_scn, FALSE,
1592         BTA_JV_DEF_RFC_MTU, cc->peer_bd_addr, &handle, bta_jv_port_mgmt_cl_cback) != PORT_SUCCESS)
1593     {
1594         APPL_TRACE_ERROR("bta_jv_rfcomm_connect, RFCOMM_CreateConnection failed");
1595         evt_data.status = BTA_JV_FAILURE;
1596     }
1597     if (evt_data.status == BTA_JV_SUCCESS)
1598     {
1599         p_cb = bta_jv_alloc_rfc_cb(handle, &p_pcb);
1600         if(p_cb)
1601         {
1602             p_cb->p_cback = cc->p_cback;
1603             p_cb->sec_id = sec_id;
1604             p_cb->scn = 0;
1605             p_pcb->state = BTA_JV_ST_CL_OPENING;
1606             p_pcb->user_data = cc->user_data;
1607             evt_data.use_co = TRUE;
1608
1609             PORT_SetEventCallback(handle, bta_jv_port_event_cl_cback);
1610             PORT_SetEventMask(handle, event_mask);
1611             PORT_SetDataCOCallback (handle, bta_jv_port_data_co_cback);
1612
1613             PORT_GetState(handle, &port_state);
1614
1615             port_state.fc_type = (PORT_FC_CTS_ON_INPUT | PORT_FC_CTS_ON_OUTPUT);
1616
1617             /* coverity[uninit_use_in_call]
1618                FALSE-POSITIVE: port_state is initialized at PORT_GetState() */
1619             PORT_SetState(handle, &port_state);
1620
1621             evt_data.handle = p_cb->handle;
1622         }
1623         else
1624         {
1625             evt_data.status = BTA_JV_FAILURE;
1626             APPL_TRACE_ERROR("run out of rfc control block");
1627         }
1628     }
1629     cc->p_cback(BTA_JV_RFCOMM_CL_INIT_EVT, (tBTA_JV *)&evt_data, cc->user_data);
1630     if(evt_data.status == BTA_JV_FAILURE)
1631     {
1632         if(sec_id)
1633             bta_jv_free_sec_id(&sec_id);
1634         if(handle)
1635             RFCOMM_RemoveConnection(handle);
1636     }
1637  }
1638
1639 static int find_rfc_pcb(void* user_data, tBTA_JV_RFC_CB **cb, tBTA_JV_PCB **pcb)
1640 {
1641     *cb = NULL;
1642     *pcb = NULL;
1643     int i;
1644     for (i = 0; i < MAX_RFC_PORTS; i++)
1645     {
1646         UINT32 rfc_handle = bta_jv_cb.port_cb[i].handle & BTA_JV_RFC_HDL_MASK;
1647         rfc_handle &= ~BTA_JV_RFCOMM_MASK;
1648         if (rfc_handle && bta_jv_cb.port_cb[i].user_data == user_data)
1649         {
1650             *pcb = &bta_jv_cb.port_cb[i];
1651             *cb = &bta_jv_cb.rfc_cb[rfc_handle - 1];
1652             APPL_TRACE_DEBUG("find_rfc_pcb(): FOUND rfc_cb_handle 0x%x, port.jv_handle:"
1653                     " 0x%x, state: %d, rfc_cb->handle: 0x%x", rfc_handle, (*pcb)->handle,
1654                     (*pcb)->state, (*cb)->handle);
1655             return 1;
1656         }
1657     }
1658     APPL_TRACE_DEBUG("find_rfc_pcb: cannot find rfc_cb from user data: %u", PTR_TO_UINT(user_data));
1659     return 0;
1660 }
1661
1662 /*******************************************************************************
1663 **
1664 ** Function     bta_jv_rfcomm_close
1665 **
1666 ** Description  Close an RFCOMM connection
1667 **
1668 ** Returns      void
1669 **
1670 *******************************************************************************/
1671 void bta_jv_rfcomm_close(tBTA_JV_MSG *p_data)
1672 {
1673     tBTA_JV_API_RFCOMM_CLOSE *cc = &(p_data->rfcomm_close);
1674     tBTA_JV_RFC_CB           *p_cb = NULL;
1675     tBTA_JV_PCB              *p_pcb = NULL;
1676     APPL_TRACE_DEBUG("bta_jv_rfcomm_close, rfc handle:%d", cc->handle);
1677     if (!cc->handle)
1678     {
1679         APPL_TRACE_ERROR("bta_jv_rfcomm_close, rfc handle is null");
1680         return;
1681     }
1682
1683     void* user_data = cc->user_data;
1684     if (!find_rfc_pcb(user_data, &p_cb, &p_pcb))
1685         return;
1686     bta_jv_free_rfc_cb(p_cb, p_pcb);
1687     APPL_TRACE_DEBUG("bta_jv_rfcomm_close: sec id in use:%d, rfc_cb in use:%d",
1688                 get_sec_id_used(), get_rfc_cb_used());
1689 }
1690
1691 /*******************************************************************************
1692 **
1693 ** Function     bta_jv_port_mgmt_sr_cback
1694 **
1695 ** Description  callback for port mamangement function of rfcomm
1696 **              server connections
1697 **
1698 ** Returns      void
1699 **
1700 *******************************************************************************/
1701 static void bta_jv_port_mgmt_sr_cback(UINT32 code, UINT16 port_handle)
1702 {
1703     tBTA_JV_PCB     *p_pcb = bta_jv_rfc_port_to_pcb(port_handle);
1704     tBTA_JV_RFC_CB  *p_cb = bta_jv_rfc_port_to_cb(port_handle);
1705     tBTA_JV evt_data;
1706     BD_ADDR rem_bda;
1707     UINT16 lcid;
1708     APPL_TRACE_DEBUG("bta_jv_port_mgmt_sr_cback, code:%d, port_handle:%d", code, port_handle);
1709     if (NULL == p_cb || NULL == p_cb->p_cback)
1710     {
1711         APPL_TRACE_ERROR("bta_jv_port_mgmt_sr_cback, p_cb:%p, p_cb->p_cback%p",
1712                 p_cb, p_cb ? p_cb->p_cback : NULL);
1713         return;
1714     }
1715     void *user_data = p_pcb->user_data;
1716     APPL_TRACE_DEBUG( "bta_jv_port_mgmt_sr_cback code=%d port_handle:0x%x handle:0x%x, p_pcb:%p, user:%d",
1717         code, port_handle, p_cb->handle, p_pcb, p_pcb->user_data);
1718
1719     PORT_CheckConnection(port_handle, rem_bda, &lcid);
1720     int failed = TRUE;
1721     if (code == PORT_SUCCESS)
1722     {
1723         evt_data.rfc_srv_open.handle = p_pcb->handle;
1724         evt_data.rfc_srv_open.status = BTA_JV_SUCCESS;
1725         bdcpy(evt_data.rfc_srv_open.rem_bda, rem_bda);
1726         tBTA_JV_PCB *p_pcb_new_listen  = bta_jv_add_rfc_port(p_cb, p_pcb);
1727         if (p_pcb_new_listen)
1728         {
1729             evt_data.rfc_srv_open.new_listen_handle = p_pcb_new_listen->handle;
1730             p_pcb_new_listen->user_data = p_cb->p_cback(BTA_JV_RFCOMM_SRV_OPEN_EVT, &evt_data, user_data);
1731             APPL_TRACE_DEBUG("PORT_SUCCESS: curr_sess:%d, max_sess:%d", p_cb->curr_sess, p_cb->max_sess);
1732             failed = FALSE;
1733         }
1734         else
1735             APPL_TRACE_ERROR("bta_jv_add_rfc_port failed to create new listen port");
1736     }
1737     if (failed)
1738     {
1739         evt_data.rfc_close.handle = p_cb->handle;
1740         evt_data.rfc_close.status = BTA_JV_FAILURE;
1741         evt_data.rfc_close.async = TRUE;
1742         evt_data.rfc_close.port_status = code;
1743         p_pcb->cong = FALSE;
1744
1745         tBTA_JV_RFCOMM_CBACK    *p_cback = p_cb->p_cback;
1746         APPL_TRACE_DEBUG("PORT_CLOSED before BTA_JV_RFCOMM_CLOSE_EVT: curr_sess:%d, max_sess:%d",
1747                             p_cb->curr_sess, p_cb->max_sess);
1748         if (BTA_JV_ST_SR_CLOSING == p_pcb->state)
1749         {
1750             evt_data.rfc_close.async = FALSE;
1751             evt_data.rfc_close.status = BTA_JV_SUCCESS;
1752         }
1753         //p_pcb->state = BTA_JV_ST_NONE;
1754         p_cback(BTA_JV_RFCOMM_CLOSE_EVT, &evt_data, user_data);
1755         //bta_jv_free_rfc_cb(p_cb, p_pcb);
1756
1757         APPL_TRACE_DEBUG("PORT_CLOSED after BTA_JV_RFCOMM_CLOSE_EVT: curr_sess:%d, max_sess:%d",
1758                 p_cb->curr_sess, p_cb->max_sess);
1759      }
1760 }
1761
1762 /*******************************************************************************
1763 **
1764 ** Function     bta_jv_port_event_sr_cback
1765 **
1766 ** Description  Callback for RFCOMM server port events
1767 **
1768 ** Returns      void
1769 **
1770 *******************************************************************************/
1771 static void bta_jv_port_event_sr_cback(UINT32 code, UINT16 port_handle)
1772 {
1773     tBTA_JV_PCB     *p_pcb = bta_jv_rfc_port_to_pcb(port_handle);
1774     tBTA_JV_RFC_CB  *p_cb = bta_jv_rfc_port_to_cb(port_handle);
1775     tBTA_JV evt_data;
1776
1777     if (NULL == p_cb || NULL == p_cb->p_cback)
1778         return;
1779
1780     APPL_TRACE_DEBUG( "bta_jv_port_event_sr_cback code=x%x port_handle:%d handle:%d",
1781         code, port_handle, p_cb->handle);
1782
1783     void *user_data = p_pcb->user_data;
1784     if (code & PORT_EV_RXCHAR)
1785     {
1786         evt_data.data_ind.handle = p_cb->handle;
1787         p_cb->p_cback(BTA_JV_RFCOMM_DATA_IND_EVT, &evt_data, user_data);
1788     }
1789
1790     if (code & PORT_EV_FC)
1791     {
1792         p_pcb->cong = (code & PORT_EV_FCS) ? FALSE : TRUE;
1793         evt_data.rfc_cong.cong = p_pcb->cong;
1794         evt_data.rfc_cong.handle = p_cb->handle;
1795         evt_data.rfc_cong.status = BTA_JV_SUCCESS;
1796         p_cb->p_cback(BTA_JV_RFCOMM_CONG_EVT, &evt_data, user_data);
1797     }
1798
1799     if (code & PORT_EV_TXEMPTY)
1800     {
1801         bta_jv_pm_conn_idle(p_pcb->p_pm_cb);
1802     }
1803 }
1804
1805 /*******************************************************************************
1806 **
1807 ** Function     bta_jv_add_rfc_port
1808 **
1809 ** Description  add a port for server when the existing posts is open
1810 **
1811 ** Returns   return a pointer to tBTA_JV_PCB just added
1812 **
1813 *******************************************************************************/
1814 static tBTA_JV_PCB * bta_jv_add_rfc_port(tBTA_JV_RFC_CB *p_cb, tBTA_JV_PCB *p_pcb_open)
1815 {
1816     UINT8   used = 0, i, listen=0;
1817     UINT32  si = 0;
1818     tPORT_STATE port_state;
1819     UINT32 event_mask = BTA_JV_RFC_EV_MASK;
1820     tBTA_JV_PCB *p_pcb = NULL;
1821     if (p_cb->max_sess > 1)
1822     {
1823         for (i=0; i < p_cb->max_sess; i++)
1824         {
1825             if (p_cb->rfc_hdl[i] != 0)
1826             {
1827                 p_pcb = &bta_jv_cb.port_cb[p_cb->rfc_hdl[i] - 1];
1828                 if (p_pcb->state == BTA_JV_ST_SR_LISTEN)
1829                 {
1830                     listen++;
1831                     if (p_pcb_open == p_pcb)
1832                     {
1833                         APPL_TRACE_DEBUG("bta_jv_add_rfc_port, port_handle:%d, change the listen port to open state",
1834                                               p_pcb->port_handle);
1835                         p_pcb->state = BTA_JV_ST_SR_OPEN;
1836
1837                     }
1838                     else
1839                     {
1840                         APPL_TRACE_ERROR("bta_jv_add_rfc_port, open pcb not matching listen one,"
1841                             "listen count:%d, listen pcb handle:%d, open pcb:%d",
1842                                listen, p_pcb->port_handle, p_pcb_open->handle);
1843                         return NULL;
1844                     }
1845                 }
1846                 used++;
1847             }
1848             else if (si == 0)
1849             {
1850                 si = i + 1;
1851             }
1852         }
1853
1854         APPL_TRACE_DEBUG("bta_jv_add_rfc_port max_sess=%d used:%d curr_sess:%d, listen:%d si:%d",
1855                     p_cb->max_sess, used, p_cb->curr_sess, listen, si);
1856         if (used < p_cb->max_sess && listen == 1 && si)
1857         {
1858             si--;
1859             if (RFCOMM_CreateConnection(p_cb->sec_id, p_cb->scn, TRUE,
1860                 BTA_JV_DEF_RFC_MTU, (UINT8 *) bd_addr_any, &(p_cb->rfc_hdl[si]), bta_jv_port_mgmt_sr_cback) == PORT_SUCCESS)
1861             {
1862                 p_cb->curr_sess++;
1863                 p_pcb = &bta_jv_cb.port_cb[p_cb->rfc_hdl[si] - 1];
1864                 p_pcb->state = BTA_JV_ST_SR_LISTEN;
1865                 p_pcb->port_handle = p_cb->rfc_hdl[si];
1866                 p_pcb->user_data = p_pcb_open->user_data;
1867
1868                 PORT_ClearKeepHandleFlag(p_pcb->port_handle);
1869                 PORT_SetEventCallback(p_pcb->port_handle, bta_jv_port_event_sr_cback);
1870                 PORT_SetDataCOCallback (p_pcb->port_handle, bta_jv_port_data_co_cback);
1871                 PORT_SetEventMask(p_pcb->port_handle, event_mask);
1872                 PORT_GetState(p_pcb->port_handle, &port_state);
1873
1874                 port_state.fc_type = (PORT_FC_CTS_ON_INPUT | PORT_FC_CTS_ON_OUTPUT);
1875
1876                 PORT_SetState(p_pcb->port_handle, &port_state);
1877                 p_pcb->handle = BTA_JV_RFC_H_S_TO_HDL(p_cb->handle, si);
1878                 APPL_TRACE_DEBUG("bta_jv_add_rfc_port: p_pcb->handle:0x%x, curr_sess:%d",
1879                                     p_pcb->handle, p_cb->curr_sess);
1880             }
1881         }
1882         else
1883             APPL_TRACE_ERROR("bta_jv_add_rfc_port, cannot create new rfc listen port");
1884     }
1885     APPL_TRACE_DEBUG("bta_jv_add_rfc_port: sec id in use:%d, rfc_cb in use:%d",
1886                 get_sec_id_used(), get_rfc_cb_used());
1887     return p_pcb;
1888 }
1889
1890 /*******************************************************************************
1891 **
1892 ** Function     bta_jv_rfcomm_start_server
1893 **
1894 ** Description  waits for an RFCOMM client to connect
1895 **
1896 **
1897 ** Returns      void
1898 **
1899 *******************************************************************************/
1900 void bta_jv_rfcomm_start_server(tBTA_JV_MSG *p_data)
1901 {
1902     UINT16 handle = 0;
1903     UINT32 event_mask = BTA_JV_RFC_EV_MASK;
1904     tPORT_STATE port_state;
1905     UINT8   sec_id = 0;
1906     tBTA_JV_RFC_CB  *p_cb = NULL;
1907     tBTA_JV_PCB     *p_pcb;
1908     tBTA_JV_API_RFCOMM_SERVER *rs = &(p_data->rfcomm_server);
1909     tBTA_JV_RFCOMM_START        evt_data = {0};
1910     /* TODO DM role manager
1911     L2CA_SetDesireRole(rs->role);
1912     */
1913     evt_data.status = BTA_JV_FAILURE;
1914     APPL_TRACE_DEBUG("bta_jv_rfcomm_start_server: sec id in use:%d, rfc_cb in use:%d",
1915                 get_sec_id_used(), get_rfc_cb_used());
1916
1917     do
1918     {
1919         sec_id = bta_jv_alloc_sec_id();
1920
1921         if (0 == sec_id ||
1922             BTM_SetSecurityLevel(FALSE, "JV PORT", sec_id,  rs->sec_mask,
1923                 BT_PSM_RFCOMM, BTM_SEC_PROTO_RFCOMM, rs->local_scn) == FALSE)
1924         {
1925             APPL_TRACE_ERROR("bta_jv_rfcomm_start_server, run out of sec_id");
1926             break;
1927         }
1928
1929         if (RFCOMM_CreateConnection(sec_id, rs->local_scn, TRUE,
1930             BTA_JV_DEF_RFC_MTU, (UINT8 *) bd_addr_any, &handle, bta_jv_port_mgmt_sr_cback) != PORT_SUCCESS)
1931         {
1932             APPL_TRACE_ERROR("bta_jv_rfcomm_start_server, RFCOMM_CreateConnection failed");
1933             break;
1934         }
1935
1936
1937         p_cb = bta_jv_alloc_rfc_cb(handle, &p_pcb);
1938         if (!p_cb)
1939         {
1940             APPL_TRACE_ERROR("bta_jv_rfcomm_start_server, run out of rfc control block");
1941             break;
1942         }
1943
1944         p_cb->max_sess = rs->max_session;
1945         p_cb->p_cback = rs->p_cback;
1946         p_cb->sec_id = sec_id;
1947         p_cb->scn = rs->local_scn;
1948         p_pcb->state = BTA_JV_ST_SR_LISTEN;
1949         p_pcb->user_data = rs->user_data;
1950         evt_data.status = BTA_JV_SUCCESS;
1951         evt_data.handle = p_cb->handle;
1952         evt_data.sec_id = sec_id;
1953         evt_data.use_co = TRUE;
1954
1955         PORT_ClearKeepHandleFlag(handle);
1956         PORT_SetEventCallback(handle, bta_jv_port_event_sr_cback);
1957         PORT_SetEventMask(handle, event_mask);
1958         PORT_GetState(handle, &port_state);
1959
1960         port_state.fc_type = (PORT_FC_CTS_ON_INPUT | PORT_FC_CTS_ON_OUTPUT);
1961
1962         PORT_SetState(handle, &port_state);
1963     } while (0);
1964
1965     rs->p_cback(BTA_JV_RFCOMM_START_EVT, (tBTA_JV *)&evt_data, rs->user_data);
1966     if (evt_data.status == BTA_JV_SUCCESS)
1967     {
1968         PORT_SetDataCOCallback (handle, bta_jv_port_data_co_cback);
1969     }
1970     else
1971     {
1972         if (sec_id)
1973             bta_jv_free_sec_id(&sec_id);
1974         if (handle)
1975             RFCOMM_RemoveConnection(handle);
1976     }
1977 }
1978
1979 /*******************************************************************************
1980 **
1981 ** Function     bta_jv_rfcomm_stop_server
1982 **
1983 ** Description  stops an RFCOMM server
1984 **
1985 ** Returns      void
1986 **
1987 *******************************************************************************/
1988
1989 void bta_jv_rfcomm_stop_server(tBTA_JV_MSG *p_data)
1990 {
1991     tBTA_JV_API_RFCOMM_SERVER *ls = &(p_data->rfcomm_server);
1992     tBTA_JV_RFC_CB           *p_cb = NULL;
1993     tBTA_JV_PCB              *p_pcb = NULL;
1994     APPL_TRACE_DEBUG("bta_jv_rfcomm_stop_server");
1995     if (!ls->handle)
1996     {
1997         APPL_TRACE_ERROR("bta_jv_rfcomm_stop_server, jv handle is null");
1998         return;
1999     }
2000     void* user_data = ls->user_data;
2001     if (!find_rfc_pcb(user_data, &p_cb, &p_pcb))
2002         return;
2003     APPL_TRACE_DEBUG("bta_jv_rfcomm_stop_server: p_pcb:%p, p_pcb->port_handle:%d",
2004                         p_pcb, p_pcb->port_handle);
2005     bta_jv_free_rfc_cb(p_cb, p_pcb);
2006     APPL_TRACE_DEBUG("bta_jv_rfcomm_stop_server: sec id in use:%d, rfc_cb in use:%d",
2007                 get_sec_id_used(), get_rfc_cb_used());
2008 }
2009
2010 /*******************************************************************************
2011 **
2012 ** Function     bta_jv_rfcomm_read
2013 **
2014 ** Description  Read data from an RFCOMM connection
2015 **
2016 ** Returns      void
2017 **
2018 *******************************************************************************/
2019 void bta_jv_rfcomm_read(tBTA_JV_MSG *p_data)
2020 {
2021     tBTA_JV_API_RFCOMM_READ *rc = &(p_data->rfcomm_read);
2022     tBTA_JV_RFC_CB  *p_cb = rc->p_cb;
2023     tBTA_JV_PCB     *p_pcb = rc->p_pcb;
2024     tBTA_JV_RFCOMM_READ    evt_data;
2025
2026     evt_data.status = BTA_JV_FAILURE;
2027     evt_data.handle = p_cb->handle;
2028     evt_data.req_id = rc->req_id;
2029     evt_data.p_data = rc->p_data;
2030     if (PORT_ReadData(rc->p_pcb->port_handle, (char *)rc->p_data, rc->len, &evt_data.len) ==
2031         PORT_SUCCESS)
2032     {
2033         evt_data.status = BTA_JV_SUCCESS;
2034     }
2035
2036     p_cb->p_cback(BTA_JV_RFCOMM_READ_EVT, (tBTA_JV *)&evt_data, p_pcb->user_data);
2037 }
2038
2039 /*******************************************************************************
2040 **
2041 ** Function     bta_jv_rfcomm_write
2042 **
2043 ** Description  write data to an RFCOMM connection
2044 **
2045 ** Returns      void
2046 **
2047 *******************************************************************************/
2048 void bta_jv_rfcomm_write(tBTA_JV_MSG *p_data)
2049 {
2050     tBTA_JV_API_RFCOMM_WRITE *wc = &(p_data->rfcomm_write);
2051     tBTA_JV_RFC_CB  *p_cb = wc->p_cb;
2052     tBTA_JV_PCB     *p_pcb = wc->p_pcb;
2053     tBTA_JV_RFCOMM_WRITE    evt_data;
2054
2055     evt_data.status = BTA_JV_FAILURE;
2056     evt_data.handle = p_cb->handle;
2057     evt_data.req_id = wc->req_id;
2058     evt_data.cong   = p_pcb->cong;
2059     evt_data.len    = 0;
2060     bta_jv_pm_conn_busy(p_pcb->p_pm_cb);
2061     if (!evt_data.cong &&
2062         PORT_WriteDataCO(p_pcb->port_handle, &evt_data.len) ==
2063         PORT_SUCCESS)
2064     {
2065         evt_data.status = BTA_JV_SUCCESS;
2066     }
2067     //update congestion flag
2068     evt_data.cong   = p_pcb->cong;
2069     if (p_cb->p_cback)
2070     {
2071         p_cb->p_cback(BTA_JV_RFCOMM_WRITE_EVT, (tBTA_JV *)&evt_data, p_pcb->user_data);
2072     }
2073     else
2074     {
2075         APPL_TRACE_ERROR("bta_jv_rfcomm_write :: WARNING ! No JV callback set");
2076     }
2077 }
2078
2079 /*******************************************************************************
2080  **
2081  ** Function     bta_jv_set_pm_profile
2082  **
2083  ** Description  Set or free power mode profile for a JV application
2084  **
2085  ** Returns      void
2086  **
2087  *******************************************************************************/
2088 void bta_jv_set_pm_profile(tBTA_JV_MSG *p_data)
2089 {
2090     tBTA_JV_STATUS status;
2091     tBTA_JV_PM_CB *p_cb;
2092
2093     APPL_TRACE_API("bta_jv_set_pm_profile(handle: 0x%x, app_id: %d, init_st: %d)",
2094             p_data->set_pm.handle, p_data->set_pm.app_id, p_data->set_pm.init_st);
2095
2096     /* clear PM control block */
2097     if (p_data->set_pm.app_id == BTA_JV_PM_ID_CLEAR)
2098     {
2099         status = bta_jv_free_set_pm_profile_cb(p_data->set_pm.handle);
2100
2101         if (status != BTA_JV_SUCCESS)
2102         {
2103             APPL_TRACE_WARNING("bta_jv_set_pm_profile() free pm cb failed: reason %d",
2104                     status);
2105         }
2106     }
2107     else /* set PM control block */
2108     {
2109         p_cb = bta_jv_alloc_set_pm_profile_cb(p_data->set_pm.handle,
2110                 p_data->set_pm.app_id);
2111
2112         if (NULL != p_cb)
2113             bta_jv_pm_state_change(p_cb, p_data->set_pm.init_st);
2114         else
2115             APPL_TRACE_WARNING("bta_jv_alloc_set_pm_profile_cb() failed");
2116     }
2117 }
2118
2119 /*******************************************************************************
2120  **
2121  ** Function     bta_jv_change_pm_state
2122  **
2123  ** Description  change jv pm connect state, used internally
2124  **
2125  ** Returns      void
2126  **
2127  *******************************************************************************/
2128 void bta_jv_change_pm_state(tBTA_JV_MSG *p_data)
2129 {
2130     tBTA_JV_API_PM_STATE_CHANGE *p_msg = (tBTA_JV_API_PM_STATE_CHANGE *)p_data;
2131
2132     if (p_msg->p_cb)
2133         bta_jv_pm_state_change(p_msg->p_cb, p_msg->state);
2134 }
2135
2136
2137 /*******************************************************************************
2138  **
2139  ** Function    bta_jv_set_pm_conn_state
2140  **
2141  ** Description Send pm event state change to jv state machine to serialize jv pm changes
2142  **             in relation to other jv messages. internal API use mainly.
2143  **
2144  ** Params:     p_cb: jv pm control block, NULL pointer returns failure
2145  **             new_state: new PM connections state, setting is forced by action function
2146  **
2147  ** Returns     BTA_JV_SUCCESS, BTA_JV_FAILURE (buffer allocation, or NULL ptr!)
2148  **
2149  *******************************************************************************/
2150 tBTA_JV_STATUS bta_jv_set_pm_conn_state(tBTA_JV_PM_CB *p_cb, const tBTA_JV_CONN_STATE
2151         new_st)
2152 {
2153     tBTA_JV_STATUS status = BTA_JV_FAILURE;
2154     tBTA_JV_API_PM_STATE_CHANGE *p_msg;
2155
2156     if (NULL == p_cb)
2157         return status;
2158
2159     APPL_TRACE_API("bta_jv_set_pm_conn_state(handle:0x%x, state: %d)", p_cb->handle,
2160             new_st);
2161     if ((p_msg = (tBTA_JV_API_PM_STATE_CHANGE *)GKI_getbuf(
2162             sizeof(tBTA_JV_API_PM_STATE_CHANGE))) != NULL)
2163     {
2164         p_msg->hdr.event = BTA_JV_API_PM_STATE_CHANGE_EVT;
2165         p_msg->p_cb = p_cb;
2166         p_msg->state = new_st;
2167         bta_sys_sendmsg(p_msg);
2168         status = BTA_JV_SUCCESS;
2169     }
2170     return (status);
2171 }
2172
2173 /*******************************************************************************
2174  **
2175  ** Function    bta_jv_pm_conn_busy
2176  **
2177  ** Description set pm connection busy state (input param safe)
2178  **
2179  ** Params      p_cb: pm control block of jv connection
2180  **
2181  ** Returns     void
2182  **
2183  *******************************************************************************/
2184 static void bta_jv_pm_conn_busy(tBTA_JV_PM_CB *p_cb)
2185 {
2186     if ((NULL != p_cb) && (BTA_JV_PM_IDLE_ST == p_cb->state))
2187         bta_jv_pm_state_change(p_cb, BTA_JV_CONN_BUSY);
2188 }
2189
2190 /*******************************************************************************
2191  **
2192  ** Function    bta_jv_pm_conn_busy
2193  **
2194  ** Description set pm connection busy state (input param safe)
2195  **
2196  ** Params      p_cb: pm control block of jv connection
2197  **
2198  ** Returns     void
2199  **
2200  *******************************************************************************/
2201 static void bta_jv_pm_conn_idle(tBTA_JV_PM_CB *p_cb)
2202 {
2203     if ((NULL != p_cb) && (BTA_JV_PM_IDLE_ST != p_cb->state))
2204         bta_jv_pm_state_change(p_cb, BTA_JV_CONN_IDLE);
2205 }
2206
2207 /*******************************************************************************
2208  **
2209  ** Function     bta_jv_pm_state_change
2210  **
2211  ** Description  Notify power manager there is state change
2212  **
2213  ** Params      p_cb: must be NONE NULL
2214  **
2215  ** Returns      void
2216  **
2217  *******************************************************************************/
2218 static void bta_jv_pm_state_change(tBTA_JV_PM_CB *p_cb, const tBTA_JV_CONN_STATE state)
2219 {
2220     APPL_TRACE_API("bta_jv_pm_state_change(p_cb: 0x%x, handle: 0x%x, busy/idle_state: %d"
2221             ", app_id: %d, conn_state: %d)", p_cb, p_cb->handle, p_cb->state,
2222             p_cb->app_id, state);
2223
2224     switch (state)
2225     {
2226     case BTA_JV_CONN_OPEN:
2227         bta_sys_conn_open(BTA_ID_JV, p_cb->app_id, p_cb->peer_bd_addr);
2228         break;
2229
2230     case BTA_JV_CONN_CLOSE:
2231         bta_sys_conn_close(BTA_ID_JV, p_cb->app_id, p_cb->peer_bd_addr);
2232         break;
2233
2234     case BTA_JV_APP_OPEN:
2235         bta_sys_app_open(BTA_ID_JV, p_cb->app_id, p_cb->peer_bd_addr);
2236         break;
2237
2238     case BTA_JV_APP_CLOSE:
2239         bta_sys_app_close(BTA_ID_JV, p_cb->app_id, p_cb->peer_bd_addr);
2240         break;
2241
2242     case BTA_JV_SCO_OPEN:
2243         bta_sys_sco_open(BTA_ID_JV, p_cb->app_id, p_cb->peer_bd_addr);
2244         break;
2245
2246     case BTA_JV_SCO_CLOSE:
2247         bta_sys_sco_close(BTA_ID_JV, p_cb->app_id, p_cb->peer_bd_addr);
2248         break;
2249
2250     case BTA_JV_CONN_IDLE:
2251         p_cb->state = BTA_JV_PM_IDLE_ST;
2252         bta_sys_idle(BTA_ID_JV, p_cb->app_id, p_cb->peer_bd_addr);
2253         break;
2254
2255     case BTA_JV_CONN_BUSY:
2256         p_cb->state = BTA_JV_PM_BUSY_ST;
2257         bta_sys_busy(BTA_ID_JV, p_cb->app_id, p_cb->peer_bd_addr);
2258         break;
2259
2260     default:
2261         APPL_TRACE_WARNING("bta_jv_pm_state_change(state: %d): Invalid state", state);
2262         break;
2263     }
2264 }
2265 /**********************************************************************************************/
2266
2267
2268 static struct fc_channel *fcchan_get(uint16_t chan, char create)
2269 {
2270     struct fc_channel *t = fc_channels;
2271     static tL2CAP_FIXED_CHNL_REG fcr = {
2272         .pL2CA_FixedConn_Cb = fcchan_conn_chng_cbk,
2273         .pL2CA_FixedData_Cb = fcchan_data_cbk,
2274         .default_idle_tout  = 0xffff,
2275         .fixed_chnl_opts = {
2276             .mode         = L2CAP_FCR_BASIC_MODE,
2277             .max_transmit = 0xFF,
2278             .rtrans_tout  = 2000,
2279             .mon_tout     = 12000,
2280             .mps          = 670,
2281             .tx_win_sz    = 1,
2282         },
2283     };
2284
2285     while (t && t->chan != chan)
2286         t = t->next;
2287
2288     if (t)
2289         return t;
2290     else if (!create)
2291         return NULL; /* we cannot alloc a struct if not asked to */
2292
2293     t = osi_calloc(sizeof(*t));
2294     if (!t)
2295         return NULL;
2296
2297     t->chan = chan;
2298
2299     if (!L2CA_RegisterFixedChannel(chan, &fcr)) {
2300         osi_free(t);
2301         return NULL;
2302     }
2303
2304     //link it in
2305     t->next = fc_channels;
2306     fc_channels = t;
2307
2308     return t;
2309 }
2310
2311 /* pass NULL to find servers */
2312 static struct fc_client *fcclient_find_by_addr(struct fc_client *start, BD_ADDR addr)
2313 {
2314     struct fc_client *t = start;
2315
2316     while (t) {
2317
2318         /* match client if have addr */
2319         if (addr && !memcmp(addr, &t->remote_addr, sizeof(t->remote_addr)))
2320             break;
2321
2322         /* match server if do not have addr */
2323         if (!addr && t->server)
2324             break;
2325
2326         t = t->next_all_list;
2327     }
2328
2329     return t;
2330 }
2331
2332 static struct fc_client *fcclient_find_by_id(uint32_t id)
2333 {
2334     struct fc_client *t = fc_clients;
2335
2336     while (t && t->id != id)
2337         t = t->next_all_list;
2338
2339     return t;
2340 }
2341
2342 static struct fc_client *fcclient_alloc(uint16_t chan, char server, const uint8_t *sec_id_to_use)
2343 {
2344     struct fc_channel *fc = fcchan_get(chan, TRUE);
2345     struct fc_client *t;
2346     uint8_t sec_id;
2347
2348     if (!fc)
2349         return NULL;
2350
2351     if (fc->has_server && server)
2352         return NULL; /* no way to have multiple servers on same channel */
2353
2354     if (sec_id_to_use)
2355         sec_id = *sec_id_to_use;
2356     else
2357         sec_id = bta_jv_alloc_sec_id();
2358
2359     t = osi_calloc(sizeof(*t));
2360     if (t) {
2361         //allocate it a unique ID
2362         do {
2363            t->id = ++fc_next_id;
2364         } while (!t->id || fcclient_find_by_id(t->id));
2365
2366         //populate some params
2367         t->chan = chan;
2368         t->server = server;
2369
2370         //get a security id
2371         t->sec_id = sec_id;
2372
2373         //link it in to global list
2374         t->next_all_list = fc_clients;
2375         fc_clients = t;
2376
2377         //link it in to channel list
2378         t->next_chan_list = fc->clients;
2379         fc->clients = t;
2380
2381         //update channel if needed
2382         if (server)
2383             fc->has_server = TRUE;
2384     } else if (!sec_id_to_use)
2385        bta_jv_free_sec_id(&sec_id);
2386
2387     return t;
2388 }
2389
2390 static void fcclient_free(struct fc_client *fc)
2391 {
2392     struct fc_client *t = fc_clients;
2393     struct fc_channel *tc = fcchan_get(fc->chan, FALSE);
2394
2395     //remove from global list
2396     while (t && t->next_all_list != fc)
2397         t = t->next_all_list;
2398
2399     if (!t && fc != fc_clients)
2400         return; /* prevent double-free */
2401
2402     if (t)
2403         t->next_all_list = fc->next_all_list;
2404     else
2405         fc_clients = fc->next_all_list;
2406
2407     //remove from channel list
2408     if (tc) {
2409         t = tc->clients;
2410
2411         while (t && t->next_chan_list != fc)
2412             t = t->next_chan_list;
2413
2414         if (t)
2415             t->next_chan_list = fc->next_chan_list;
2416         else
2417             tc->clients = fc->next_chan_list;
2418
2419         //if was server then channel no longer has a server
2420         if (fc->server)
2421             tc->has_server = FALSE;
2422     }
2423
2424     //free security id
2425     bta_jv_free_sec_id(&fc->sec_id);
2426
2427     osi_free(fc);
2428 }
2429
2430 static void fcchan_conn_chng_cbk(UINT16 chan, BD_ADDR bd_addr, BOOLEAN connected, UINT16 reason, tBT_TRANSPORT transport)
2431 {
2432     tBTA_JV init_evt;
2433     tBTA_JV open_evt;
2434     struct fc_channel *tc;
2435     struct fc_client *t = NULL, *new_conn;
2436     tBTA_JV_L2CAP_CBACK *p_cback = NULL;
2437     char call_init = FALSE;
2438     void *user_data = NULL;
2439
2440
2441     tc = fcchan_get(chan, FALSE);
2442     if (tc) {
2443         t = fcclient_find_by_addr(tc->clients, bd_addr); // try to find an open socked for that addr
2444         if (t) {
2445             p_cback = t->p_cback;
2446             user_data = t->user_data;
2447         } else {
2448             t = fcclient_find_by_addr(tc->clients, NULL); // try to find a listening socked for that channel
2449             if (t) {
2450                 //found: create a normal connection socket and assign the connection to it
2451                 new_conn = fcclient_alloc(chan, FALSE, &t->sec_id);
2452                 if (new_conn){
2453
2454                     memcpy(&new_conn->remote_addr, bd_addr, sizeof(new_conn->remote_addr));
2455                     new_conn->p_cback = NULL; //for now
2456                     new_conn->init_called = TRUE; /*nop need to do it again */
2457
2458                     p_cback = t->p_cback;
2459                     user_data = t->user_data;
2460
2461                     t = new_conn;
2462                 }
2463             } else {
2464                 //drop it
2465                 return;
2466             }
2467         }
2468     }
2469
2470     if (t) {
2471
2472         if (!t->init_called) {
2473
2474             call_init = TRUE;
2475             t->init_called = TRUE;
2476
2477             init_evt.l2c_cl_init.handle = t->id;
2478             init_evt.l2c_cl_init.status = BTA_JV_SUCCESS;
2479             init_evt.l2c_cl_init.sec_id = t->sec_id;
2480         }
2481
2482         open_evt.l2c_open.handle = t->id;
2483         open_evt.l2c_open.tx_mtu = 23; /* 23, why not ?*/
2484         memcpy(&open_evt.l2c_le_open.rem_bda, &t->remote_addr, sizeof(open_evt.l2c_le_open.rem_bda));
2485         open_evt.l2c_le_open.p_p_cback = (void**)&t->p_cback;
2486         open_evt.l2c_le_open.p_user_data = &t->user_data;
2487         open_evt.l2c_le_open.status = BTA_JV_SUCCESS;
2488
2489         if (connected) {
2490             open_evt.l2c_open.status = BTA_JV_SUCCESS;
2491         } else {
2492             fcclient_free(t);
2493             open_evt.l2c_open.status = BTA_JV_FAILURE;
2494         }
2495     }
2496
2497     if (call_init)
2498         p_cback(BTA_JV_L2CAP_CL_INIT_EVT, &init_evt, user_data);
2499
2500     //call this with lock taken so socket does not disappear from under us */
2501     if (p_cback) {
2502         p_cback(BTA_JV_L2CAP_OPEN_EVT, &open_evt, user_data);
2503         if (!t->p_cback) /* no callback set, means they do not want this one... */
2504             fcclient_free(t);
2505     }
2506 }
2507
2508 static void fcchan_data_cbk(UINT16 chan, BD_ADDR bd_addr, BT_HDR *p_buf)
2509 {
2510     tBTA_JV evt_data;
2511     struct fc_channel *tc;
2512     struct fc_client *t = NULL;
2513     tBTA_JV_L2CAP_CBACK *sock_cback = NULL;
2514     void *sock_user_data;
2515
2516     tc = fcchan_get(chan, FALSE);
2517     if (tc) {
2518         t = fcclient_find_by_addr(tc->clients, bd_addr); // try to find an open socked for that addr and channel
2519         if (!t) {
2520             //no socket -> drop it
2521             return;
2522         }
2523     }
2524
2525     sock_cback = t->p_cback;
2526     sock_user_data = t->user_data;
2527     evt_data.le_data_ind.handle = t->id;
2528     evt_data.le_data_ind.p_buf = p_buf;
2529
2530     if (sock_cback)
2531         sock_cback(BTA_JV_L2CAP_DATA_IND_EVT, &evt_data, sock_user_data);
2532 }
2533
2534
2535 /*******************************************************************************
2536 **
2537 ** Function     bta_jv_l2cap_connect_le
2538 **
2539 ** Description  makes an le l2cap client connection
2540 **
2541 ** Returns      void
2542 **
2543 *******************************************************************************/
2544 void bta_jv_l2cap_connect_le(tBTA_JV_MSG *p_data)
2545 {
2546     tBTA_JV_API_L2CAP_CONNECT *cc = &(p_data->l2cap_connect);
2547     tBTA_JV evt;
2548     uint32_t id;
2549     char call_init_f = TRUE;
2550     struct fc_client *t;
2551
2552     evt.l2c_cl_init.handle = GAP_INVALID_HANDLE;
2553     evt.l2c_cl_init.status = BTA_JV_FAILURE;
2554
2555     t = fcclient_alloc(cc->remote_chan, FALSE, NULL);
2556     if (!t) {
2557         cc->p_cback(BTA_JV_L2CAP_CL_INIT_EVT, &evt, cc->user_data);
2558         return;
2559     }
2560
2561     t->p_cback = cc->p_cback;
2562     t->user_data = cc->user_data;
2563     memcpy(&t->remote_addr, &cc->peer_bd_addr, sizeof(t->remote_addr));
2564     id = t->id;
2565     t->init_called = FALSE;
2566
2567     if (L2CA_ConnectFixedChnl(t->chan, t->remote_addr)) {
2568
2569         evt.l2c_cl_init.status = BTA_JV_SUCCESS;
2570         evt.l2c_cl_init.handle = id;
2571     }
2572
2573     //it could have been deleted/moved from under us, so re-find it */
2574     t = fcclient_find_by_id(id);
2575     if (t) {
2576         if (evt.l2c_cl_init.status == BTA_JV_SUCCESS)
2577             call_init_f = !t->init_called;
2578         else
2579             fcclient_free(t);
2580     }
2581     if (call_init_f)
2582         cc->p_cback(BTA_JV_L2CAP_CL_INIT_EVT, &evt, cc->user_data);
2583     t->init_called = TRUE;
2584 }
2585
2586
2587 /*******************************************************************************
2588 **
2589 ** Function     bta_jv_l2cap_stop_server_le
2590 **
2591 ** Description  stops an LE L2CAP server
2592 **
2593 ** Returns      void
2594 **
2595 *******************************************************************************/
2596 void bta_jv_l2cap_stop_server_le(tBTA_JV_MSG *p_data)
2597 {
2598     tBTA_JV  evt;
2599     tBTA_JV_API_L2CAP_SERVER *ls = &(p_data->l2cap_server);
2600     tBTA_JV_L2CAP_CBACK *p_cback = NULL;
2601     struct fc_channel *fcchan;
2602     struct fc_client *fcclient;
2603     void *user_data;
2604
2605     evt.l2c_close.status = BTA_JV_FAILURE;
2606     evt.l2c_close.async = FALSE;
2607     evt.l2c_close.handle = GAP_INVALID_HANDLE;
2608
2609     fcchan = fcchan_get(ls->local_chan, FALSE);
2610     if (fcchan) {
2611         while((fcclient = fcchan->clients)) {
2612             p_cback = fcclient->p_cback;
2613             user_data = fcclient->user_data;
2614
2615             evt.l2c_close.handle = fcclient->id;
2616             evt.l2c_close.status = BTA_JV_SUCCESS;
2617             evt.l2c_close.async = FALSE;
2618
2619             fcclient_free(fcclient);
2620
2621             if (p_cback)
2622                 p_cback(BTA_JV_L2CAP_CLOSE_EVT, &evt, user_data);
2623         }
2624     }
2625 }
2626
2627 /*******************************************************************************
2628 **
2629 ** Function     bta_jv_l2cap_start_server_le
2630 **
2631 ** Description  starts an LE L2CAP server
2632 **
2633 ** Returns      void
2634 **
2635 *******************************************************************************/
2636 void bta_jv_l2cap_start_server_le(tBTA_JV_MSG *p_data)
2637 {
2638     tBTA_JV_API_L2CAP_SERVER *ss = &(p_data->l2cap_server);
2639     tBTA_JV_L2CAP_START evt_data;
2640     struct fc_client *t;
2641
2642     evt_data.handle = GAP_INVALID_HANDLE;
2643     evt_data.status = BTA_JV_FAILURE;
2644
2645
2646     t = fcclient_alloc(ss->local_chan, TRUE, NULL);
2647     if (!t)
2648         goto out;
2649
2650     t->p_cback = ss->p_cback;
2651     t->user_data = ss->user_data;
2652
2653     //if we got here, we're registered...
2654     evt_data.status = BTA_JV_SUCCESS;
2655     evt_data.handle = t->id;
2656     evt_data.sec_id = t->sec_id;
2657
2658 out:
2659     ss->p_cback(BTA_JV_L2CAP_START_EVT, (tBTA_JV *)&evt_data, ss->user_data);
2660 }
2661
2662 /*******************************************************************************
2663 **
2664 ** Function     bta_jv_l2cap_close_fixed
2665 **
2666 ** Description  close a fixed channel connection. calls no callbacks. idempotent
2667 **
2668 ** Returns      void
2669 **
2670 *******************************************************************************/
2671 extern void bta_jv_l2cap_close_fixed (tBTA_JV_MSG *p_data)
2672 {
2673     tBTA_JV_API_L2CAP_CLOSE *cc = &(p_data->l2cap_close);
2674     struct fc_client *t;
2675
2676     t = fcclient_find_by_id(cc->handle);
2677     if (t)
2678         fcclient_free(t);
2679 }