profiles/audio/avdtp.c

   1 /*
   2  *
   3  *  BlueZ - Bluetooth protocol stack for Linux
   4  *
   5  *  Copyright (C) 2006-2010  Nokia Corporation
   6  *  Copyright (C) 2004-2010  Marcel Holtmann <marcel@holtmann.org>
   7  *
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  22  *
  23  */
  24
  25 #ifdef HAVE_CONFIG_H
  26 #include <config.h>
  27 #endif
  28
  29 #include <stdlib.h>
  30 #include <stdio.h>
  31 #include <stdint.h>
  32 #include <stdbool.h>
  33 #include <errno.h>
  34 #include <unistd.h>
  35 #include <assert.h>
  36
  37 #include <glib.h>
  38
  39 #include "lib/bluetooth.h"
  40 #include "lib/sdp.h"
  41 #include "lib/sdp_lib.h"
  42 #include "lib/uuid.h"
  43
  44 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
  45 #include <sys/ioctl.h>
  46 #include <bluetooth/hci.h>
  47 #endif  /* TIZEN_FEATURE_BLUEZ_MODIFY */
  48
  49 #include "btio/btio.h"
  50 #include "src/log.h"
  51 #include "src/shared/util.h"
  52 #include "src/shared/queue.h"
  53 #include "src/adapter.h"
  54 #include "src/device.h"
  55
  56 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
  57 #include "src/service.h"
  58 #include "../../profile.h"
  59 #endif
  60
  61 #include "avdtp.h"
  62 #include "sink.h"
  63 #include "source.h"
  64
  65 #define AVDTP_PSM 25
  66
  67 #define MAX_SEID 0x3E
  68 static unsigned int seids;
  69
  70 #ifndef MAX
  71 # define MAX(x, y) ((x) > (y) ? (x) : (y))
  72 #endif
  73
  74 #define AVDTP_DISCOVER                          0x01
  75 #define AVDTP_GET_CAPABILITIES                  0x02
  76 #define AVDTP_SET_CONFIGURATION                 0x03
  77 #define AVDTP_GET_CONFIGURATION                 0x04
  78 #define AVDTP_RECONFIGURE                       0x05
  79 #define AVDTP_OPEN                              0x06
  80 #define AVDTP_START                             0x07
  81 #define AVDTP_CLOSE                             0x08
  82 #define AVDTP_SUSPEND                           0x09
  83 #define AVDTP_ABORT                             0x0A
  84 #define AVDTP_SECURITY_CONTROL                  0x0B
  85 #define AVDTP_GET_ALL_CAPABILITIES              0x0C
  86 #define AVDTP_DELAY_REPORT                      0x0D
  87
  88 #define AVDTP_PKT_TYPE_SINGLE                   0x00
  89 #define AVDTP_PKT_TYPE_START                    0x01
  90 #define AVDTP_PKT_TYPE_CONTINUE                 0x02
  91 #define AVDTP_PKT_TYPE_END                      0x03
  92
  93 #define AVDTP_MSG_TYPE_COMMAND                  0x00
  94 #define AVDTP_MSG_TYPE_GEN_REJECT               0x01
  95 #define AVDTP_MSG_TYPE_ACCEPT                   0x02
  96 #define AVDTP_MSG_TYPE_REJECT                   0x03
  97
  98 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
  99 #define REQ_TIMEOUT 10
 100 #else
 101 #define REQ_TIMEOUT 6
 102 #endif
 103 #define ABORT_TIMEOUT 2
 104 #define DISCONNECT_TIMEOUT 1
 105 #define START_TIMEOUT 1
 106
 107 #if __BYTE_ORDER == __LITTLE_ENDIAN
 108
 109 struct avdtp_common_header {
 110         uint8_t message_type:2;
 111         uint8_t packet_type:2;
 112         uint8_t transaction:4;
 113 } __attribute__ ((packed));
 114
 115 struct avdtp_single_header {
 116         uint8_t message_type:2;
 117         uint8_t packet_type:2;
 118         uint8_t transaction:4;
 119         uint8_t signal_id:6;
 120         uint8_t rfa0:2;
 121 } __attribute__ ((packed));
 122
 123 struct avdtp_start_header {
 124         uint8_t message_type:2;
 125         uint8_t packet_type:2;
 126         uint8_t transaction:4;
 127         uint8_t no_of_packets;
 128         uint8_t signal_id:6;
 129         uint8_t rfa0:2;
 130 } __attribute__ ((packed));
 131
 132 struct avdtp_continue_header {
 133         uint8_t message_type:2;
 134         uint8_t packet_type:2;
 135         uint8_t transaction:4;
 136 } __attribute__ ((packed));
 137
 138 struct seid_info {
 139         uint8_t rfa0:1;
 140         uint8_t inuse:1;
 141         uint8_t seid:6;
 142         uint8_t rfa2:3;
 143         uint8_t type:1;
 144         uint8_t media_type:4;
 145 } __attribute__ ((packed));
 146
 147 struct seid {
 148         uint8_t rfa0:2;
 149         uint8_t seid:6;
 150 } __attribute__ ((packed));
 151
 152 #elif __BYTE_ORDER == __BIG_ENDIAN
 153
 154 struct avdtp_common_header {
 155         uint8_t transaction:4;
 156         uint8_t packet_type:2;
 157         uint8_t message_type:2;
 158 } __attribute__ ((packed));
 159
 160 struct avdtp_single_header {
 161         uint8_t transaction:4;
 162         uint8_t packet_type:2;
 163         uint8_t message_type:2;
 164         uint8_t rfa0:2;
 165         uint8_t signal_id:6;
 166 } __attribute__ ((packed));
 167
 168 struct avdtp_start_header {
 169         uint8_t transaction:4;
 170         uint8_t packet_type:2;
 171         uint8_t message_type:2;
 172         uint8_t no_of_packets;
 173         uint8_t rfa0:2;
 174         uint8_t signal_id:6;
 175 } __attribute__ ((packed));
 176
 177 struct avdtp_continue_header {
 178         uint8_t transaction:4;
 179         uint8_t packet_type:2;
 180         uint8_t message_type:2;
 181 } __attribute__ ((packed));
 182
 183 struct seid_info {
 184         uint8_t seid:6;
 185         uint8_t inuse:1;
 186         uint8_t rfa0:1;
 187         uint8_t media_type:4;
 188         uint8_t type:1;
 189         uint8_t rfa2:3;
 190 } __attribute__ ((packed));
 191
 192 struct seid {
 193         uint8_t seid:6;
 194         uint8_t rfa0:2;
 195 } __attribute__ ((packed));
 196
 197 #else
 198 #error "Unknown byte order"
 199 #endif
 200
 201 /* packets */
 202
 203 struct discover_resp {
 204         struct seid_info seps[0];
 205 } __attribute__ ((packed));
 206
 207 struct getcap_resp {
 208         uint8_t caps[0];
 209 } __attribute__ ((packed));
 210
 211 struct start_req {
 212         struct seid first_seid;
 213         struct seid other_seids[0];
 214 } __attribute__ ((packed));
 215
 216 struct suspend_req {
 217         struct seid first_seid;
 218         struct seid other_seids[0];
 219 } __attribute__ ((packed));
 220
 221 struct seid_rej {
 222         uint8_t error;
 223 } __attribute__ ((packed));
 224
 225 struct conf_rej {
 226         uint8_t category;
 227         uint8_t error;
 228 } __attribute__ ((packed));
 229
 230 #if __BYTE_ORDER == __LITTLE_ENDIAN
 231
 232 struct seid_req {
 233         uint8_t rfa0:2;
 234         uint8_t acp_seid:6;
 235 } __attribute__ ((packed));
 236
 237 struct setconf_req {
 238         uint8_t rfa0:2;
 239         uint8_t acp_seid:6;
 240         uint8_t rfa1:2;
 241         uint8_t int_seid:6;
 242
 243         uint8_t caps[0];
 244 } __attribute__ ((packed));
 245
 246 struct stream_rej {
 247         uint8_t rfa0:2;
 248         uint8_t acp_seid:6;
 249         uint8_t error;
 250 } __attribute__ ((packed));
 251
 252 struct reconf_req {
 253         uint8_t rfa0:2;
 254         uint8_t acp_seid:6;
 255
 256         uint8_t serv_cap;
 257         uint8_t serv_cap_len;
 258
 259         uint8_t caps[0];
 260 } __attribute__ ((packed));
 261
 262 struct delay_req {
 263         uint8_t rfa0:2;
 264         uint8_t acp_seid:6;
 265         uint16_t delay;
 266 } __attribute__ ((packed));
 267
 268 #elif __BYTE_ORDER == __BIG_ENDIAN
 269
 270 struct seid_req {
 271         uint8_t acp_seid:6;
 272         uint8_t rfa0:2;
 273 } __attribute__ ((packed));
 274
 275 struct setconf_req {
 276         uint8_t acp_seid:6;
 277         uint8_t rfa0:2;
 278         uint8_t int_seid:6;
 279         uint8_t rfa1:2;
 280
 281         uint8_t caps[0];
 282 } __attribute__ ((packed));
 283
 284 struct stream_rej {
 285         uint8_t acp_seid:6;
 286         uint8_t rfa0:2;
 287         uint8_t error;
 288 } __attribute__ ((packed));
 289
 290 struct reconf_req {
 291         uint8_t acp_seid:6;
 292         uint8_t rfa0:2;
 293
 294         uint8_t serv_cap;
 295         uint8_t serv_cap_len;
 296
 297         uint8_t caps[0];
 298 } __attribute__ ((packed));
 299
 300 struct delay_req {
 301         uint8_t acp_seid:6;
 302         uint8_t rfa0:2;
 303         uint16_t delay;
 304 } __attribute__ ((packed));
 305
 306 #else
 307 #error "Unknown byte order"
 308 #endif
 309
 310 struct in_buf {
 311         gboolean active;
 312         int no_of_packets;
 313         uint8_t transaction;
 314         uint8_t message_type;
 315         uint8_t signal_id;
 316         uint8_t buf[1024];
 317         uint8_t data_size;
 318 };
 319
 320 struct pending_req {
 321         uint8_t transaction;
 322         uint8_t signal_id;
 323         void *data;
 324         size_t data_size;
 325         struct avdtp_stream *stream; /* Set if the request targeted a stream */
 326         guint timeout;
 327         gboolean collided;
 328 };
 329
 330 struct avdtp_remote_sep {
 331         uint8_t seid;
 332         uint8_t type;
 333         uint8_t media_type;
 334         struct avdtp_service_capability *codec;
 335         gboolean delay_reporting;
 336         GSList *caps; /* of type struct avdtp_service_capability */
 337         struct avdtp_stream *stream;
 338 };
 339
 340 struct avdtp_local_sep {
 341         avdtp_state_t state;
 342         struct avdtp_stream *stream;
 343         struct seid_info info;
 344         uint8_t codec;
 345         gboolean delay_reporting;
 346         GSList *caps;
 347         struct avdtp_sep_ind *ind;
 348         struct avdtp_sep_cfm *cfm;
 349         void *user_data;
 350 };
 351
 352 struct stream_callback {
 353         avdtp_stream_state_cb cb;
 354         void *user_data;
 355         unsigned int id;
 356 };
 357
 358 struct avdtp_state_callback {
 359         avdtp_session_state_cb cb;
 360         struct btd_device *dev;
 361         unsigned int id;
 362         void *user_data;
 363 };
 364
 365 struct discover_callback {
 366         unsigned int id;
 367         avdtp_discover_cb_t cb;
 368         void *user_data;
 369 };
 370
 371 struct avdtp_stream {
 372         GIOChannel *io;
 373         uint16_t imtu;
 374         uint16_t omtu;
 375         struct avdtp *session;
 376         struct avdtp_local_sep *lsep;
 377         uint8_t rseid;
 378         GSList *caps;
 379         GSList *callbacks;
 380         struct avdtp_service_capability *codec;
 381         guint io_id;            /* Transport GSource ID */
 382         guint timer;            /* Waiting for other side to close or open
 383                                  * the transport channel */
 384         gboolean open_acp;      /* If we are in ACT role for Open */
 385         gboolean close_int;     /* If we are in INT role for Close */
 386         gboolean abort_int;     /* If we are in INT role for Abort */
 387         guint start_timer;      /* Wait START command timer */
 388         gboolean delay_reporting;
 389         uint16_t delay;         /* AVDTP 1.3 Delay Reporting feature */
 390         gboolean starting;      /* only valid while sep state == OPEN */
 391 };
 392
 393 /* Structure describing an AVDTP connection between two devices */
 394
 395 struct avdtp {
 396         unsigned int ref;
 397
 398         uint16_t version;
 399
 400         struct queue *lseps;
 401         struct btd_device *device;
 402
 403         avdtp_session_state_t state;
 404
 405         GIOChannel *io;
 406         guint io_id;
 407
 408         GSList *seps; /* Elements of type struct avdtp_remote_sep * */
 409
 410         GSList *streams; /* Elements of type struct avdtp_stream * */
 411
 412         GSList *req_queue; /* Elements of type struct pending_req * */
 413         GSList *prio_queue; /* Same as req_queue but is processed before it */
 414
 415         struct avdtp_stream *pending_open;
 416
 417         uint16_t imtu;
 418         uint16_t omtu;
 419
 420         struct in_buf in;
 421
 422         char *buf;
 423
 424         struct discover_callback *discover;
 425         struct pending_req *req;
 426
 427         guint dc_timer;
 428
 429         /* Attempt stream setup instead of disconnecting */
 430         gboolean stream_setup;
 431 };
 432
 433 static GSList *state_callbacks = NULL;
 434
 435 static int send_request(struct avdtp *session, gboolean priority,
 436                         struct avdtp_stream *stream, uint8_t signal_id,
 437                         void *buffer, size_t size);
 438 static gboolean avdtp_parse_resp(struct avdtp *session,
 439                                         struct avdtp_stream *stream,
 440                                         uint8_t transaction, uint8_t signal_id,
 441                                         void *buf, int size);
 442 static gboolean avdtp_parse_rej(struct avdtp *session,
 443                                         struct avdtp_stream *stream,
 444                                         uint8_t transaction, uint8_t signal_id,
 445                                         void *buf, int size);
 446 static int process_queue(struct avdtp *session);
 447 static void avdtp_sep_set_state(struct avdtp *session,
 448                                 struct avdtp_local_sep *sep,
 449                                 avdtp_state_t state);
 450
 451 static const char *avdtp_statestr(avdtp_state_t state)
 452 {
 453         switch (state) {
 454         case AVDTP_STATE_IDLE:
 455                 return "IDLE";
 456         case AVDTP_STATE_CONFIGURED:
 457                 return "CONFIGURED";
 458         case AVDTP_STATE_OPEN:
 459                 return "OPEN";
 460         case AVDTP_STATE_STREAMING:
 461                 return "STREAMING";
 462         case AVDTP_STATE_CLOSING:
 463                 return "CLOSING";
 464         case AVDTP_STATE_ABORTING:
 465                 return "ABORTING";
 466         default:
 467                 return "<unknown state>";
 468         }
 469 }
 470
 471 static gboolean try_send(int sk, void *data, size_t len)
 472 {
 473         int err;
 474
 475         do {
 476                 err = send(sk, data, len, 0);
 477         } while (err < 0 && errno == EINTR);
 478
 479         if (err < 0) {
 480                 error("send: %s (%d)", strerror(errno), errno);
 481                 return FALSE;
 482         } else if ((size_t) err != len) {
 483                 error("try_send: complete buffer not sent (%d/%zu bytes)",
 484                                                                 err, len);
 485                 return FALSE;
 486         }
 487
 488         return TRUE;
 489 }
 490
 491 static gboolean avdtp_send(struct avdtp *session, uint8_t transaction,
 492                                 uint8_t message_type, uint8_t signal_id,
 493                                 void *data, size_t len)
 494 {
 495         unsigned int cont_fragments, sent;
 496         struct avdtp_start_header start;
 497         struct avdtp_continue_header cont;
 498         int sock;
 499
 500         if (session->io == NULL) {
 501                 error("avdtp_send: session is closed");
 502                 return FALSE;
 503         }
 504
 505         sock = g_io_channel_unix_get_fd(session->io);
 506
 507         /* Single packet - no fragmentation */
 508         if (sizeof(struct avdtp_single_header) + len <= session->omtu) {
 509                 struct avdtp_single_header single;
 510
 511                 memset(&single, 0, sizeof(single));
 512
 513                 single.transaction = transaction;
 514                 single.packet_type = AVDTP_PKT_TYPE_SINGLE;
 515                 single.message_type = message_type;
 516                 single.signal_id = signal_id;
 517
 518                 memcpy(session->buf, &single, sizeof(single));
 519                 memcpy(session->buf + sizeof(single), data, len);
 520
 521                 return try_send(sock, session->buf, sizeof(single) + len);
 522         }
 523
 524         /* Check if there is enough space to start packet */
 525         if (session->omtu < sizeof(start)) {
 526                 error("No enough space to fragment packet");
 527                 return FALSE;
 528         }
 529
 530         /* Count the number of needed fragments */
 531         cont_fragments = (len - (session->omtu - sizeof(start))) /
 532                                         (session->omtu - sizeof(cont)) + 1;
 533
 534         DBG("%zu bytes split into %d fragments", len, cont_fragments + 1);
 535
 536         /* Send the start packet */
 537         memset(&start, 0, sizeof(start));
 538         start.transaction = transaction;
 539         start.packet_type = AVDTP_PKT_TYPE_START;
 540         start.message_type = message_type;
 541         start.no_of_packets = cont_fragments + 1;
 542         start.signal_id = signal_id;
 543
 544         memcpy(session->buf, &start, sizeof(start));
 545         memcpy(session->buf + sizeof(start), data,
 546                                         session->omtu - sizeof(start));
 547
 548         if (!try_send(sock, session->buf, session->omtu))
 549                 return FALSE;
 550
 551         DBG("first packet with %zu bytes sent", session->omtu - sizeof(start));
 552
 553         sent = session->omtu - sizeof(start);
 554
 555         /* Send the continue fragments and the end packet */
 556         while (sent < len) {
 557                 int left, to_copy;
 558
 559                 left = len - sent;
 560                 if (left + sizeof(cont) > session->omtu) {
 561                         cont.packet_type = AVDTP_PKT_TYPE_CONTINUE;
 562                         to_copy = session->omtu - sizeof(cont);
 563                         DBG("sending continue with %d bytes", to_copy);
 564                 } else {
 565                         cont.packet_type = AVDTP_PKT_TYPE_END;
 566                         to_copy = left;
 567                         DBG("sending end with %d bytes", to_copy);
 568                 }
 569
 570                 cont.transaction = transaction;
 571                 cont.message_type = message_type;
 572
 573                 memcpy(session->buf, &cont, sizeof(cont));
 574                 memcpy(session->buf + sizeof(cont), data + sent, to_copy);
 575
 576                 if (!try_send(sock, session->buf, to_copy + sizeof(cont)))
 577                         return FALSE;
 578
 579                 sent += to_copy;
 580         }
 581
 582         return TRUE;
 583 }
 584
 585 static void pending_req_free(void *data)
 586 {
 587         struct pending_req *req = data;
 588
 589         if (req->timeout)
 590                 g_source_remove(req->timeout);
 591         g_free(req->data);
 592         g_free(req);
 593 }
 594
 595 static void close_stream(struct avdtp_stream *stream)
 596 {
 597         int sock;
 598
 599         if (stream->io == NULL)
 600                 return;
 601
 602         sock = g_io_channel_unix_get_fd(stream->io);
 603
 604         shutdown(sock, SHUT_RDWR);
 605
 606         g_io_channel_shutdown(stream->io, FALSE, NULL);
 607
 608         g_io_channel_unref(stream->io);
 609         stream->io = NULL;
 610 }
 611
 612 static gboolean stream_close_timeout(gpointer user_data)
 613 {
 614         struct avdtp_stream *stream = user_data;
 615
 616         DBG("Timed out waiting for peer to close the transport channel");
 617
 618         stream->timer = 0;
 619
 620         close_stream(stream);
 621
 622         return FALSE;
 623 }
 624
 625 static gboolean stream_open_timeout(gpointer user_data)
 626 {
 627         struct avdtp_stream *stream = user_data;
 628
 629         DBG("Timed out waiting for peer to open the transport channel");
 630
 631         stream->timer = 0;
 632
 633         stream->session->pending_open = NULL;
 634
 635         avdtp_abort(stream->session, stream);
 636
 637         return FALSE;
 638 }
 639
 640 void avdtp_error_init(struct avdtp_error *err, uint8_t category, int id)
 641 {
 642         err->category = category;
 643
 644         if (category == AVDTP_ERRNO)
 645                 err->err.posix_errno = id;
 646         else
 647                 err->err.error_code = id;
 648 }
 649
 650 uint8_t avdtp_error_category(struct avdtp_error *err)
 651 {
 652         return err->category;
 653 }
 654
 655 int avdtp_error_error_code(struct avdtp_error *err)
 656 {
 657         assert(err->category != AVDTP_ERRNO);
 658         return err->err.error_code;
 659 }
 660
 661 int avdtp_error_posix_errno(struct avdtp_error *err)
 662 {
 663         assert(err->category == AVDTP_ERRNO);
 664         return err->err.posix_errno;
 665 }
 666
 667 static struct avdtp_stream *find_stream_by_rseid(struct avdtp *session,
 668                                                         uint8_t rseid)
 669 {
 670         GSList *l;
 671
 672         for (l = session->streams; l != NULL; l = g_slist_next(l)) {
 673                 struct avdtp_stream *stream = l->data;
 674
 675                 if (stream->rseid == rseid)
 676                         return stream;
 677         }
 678
 679         return NULL;
 680 }
 681
 682 static struct avdtp_remote_sep *find_remote_sep(GSList *seps, uint8_t seid)
 683 {
 684         GSList *l;
 685
 686         for (l = seps; l != NULL; l = g_slist_next(l)) {
 687                 struct avdtp_remote_sep *sep = l->data;
 688
 689                 if (sep->seid == seid)
 690                         return sep;
 691         }
 692
 693         return NULL;
 694 }
 695
 696 static void avdtp_set_state(struct avdtp *session,
 697                                         avdtp_session_state_t new_state)
 698 {
 699         GSList *l;
 700         avdtp_session_state_t old_state = session->state;
 701
 702         session->state = new_state;
 703
 704         for (l = state_callbacks; l != NULL;) {
 705                 struct avdtp_state_callback *cb = l->data;
 706
 707                 l = g_slist_next(l);
 708
 709                 if (session->device != cb->dev)
 710                         continue;
 711
 712                 cb->cb(cb->dev, session, old_state, new_state, cb->user_data);
 713         }
 714 }
 715
 716 static void stream_free(void *data)
 717 {
 718         struct avdtp_stream *stream = data;
 719         struct avdtp_remote_sep *rsep;
 720
 721         stream->lsep->info.inuse = 0;
 722         stream->lsep->stream = NULL;
 723
 724         rsep = find_remote_sep(stream->session->seps, stream->rseid);
 725         if (rsep)
 726                 rsep->stream = NULL;
 727
 728         if (stream->timer)
 729                 g_source_remove(stream->timer);
 730
 731         if (stream->io)
 732                 close_stream(stream);
 733
 734         if (stream->io_id)
 735                 g_source_remove(stream->io_id);
 736
 737         g_slist_free_full(stream->callbacks, g_free);
 738         g_slist_free_full(stream->caps, g_free);
 739
 740         g_free(stream);
 741 }
 742
 743 static gboolean transport_cb(GIOChannel *chan, GIOCondition cond,
 744                                 gpointer data)
 745 {
 746         struct avdtp_stream *stream = data;
 747         struct avdtp_local_sep *sep = stream->lsep;
 748
 749         if (stream->close_int && sep->cfm && sep->cfm->close)
 750                 sep->cfm->close(stream->session, sep, stream, NULL,
 751                                 sep->user_data);
 752
 753         if (!(cond & G_IO_NVAL))
 754                 close_stream(stream);
 755
 756         stream->io_id = 0;
 757
 758         if (!stream->abort_int)
 759                 avdtp_sep_set_state(stream->session, sep, AVDTP_STATE_IDLE);
 760
 761         return FALSE;
 762 }
 763
 764 static int get_send_buffer_size(int sk)
 765 {
 766         int size;
 767         socklen_t optlen = sizeof(size);
 768
 769         if (getsockopt(sk, SOL_SOCKET, SO_SNDBUF, &size, &optlen) < 0) {
 770                 int err = -errno;
 771                 error("getsockopt(SO_SNDBUF) failed: %s (%d)", strerror(-err),
 772                                                                         -err);
 773                 return err;
 774         }
 775
 776         /*
 777          * Doubled value is returned by getsockopt since kernel uses that
 778          * space for its own purposes (see man 7 socket, bookkeeping overhead
 779          * for SO_SNDBUF).
 780          */
 781         return size / 2;
 782 }
 783
 784 static int set_send_buffer_size(int sk, int size)
 785 {
 786         socklen_t optlen = sizeof(size);
 787
 788         if (setsockopt(sk, SOL_SOCKET, SO_SNDBUF, &size, optlen) < 0) {
 789                 int err = -errno;
 790                 error("setsockopt(SO_SNDBUF) failed: %s (%d)", strerror(-err),
 791                                                                         -err);
 792                 return err;
 793         }
 794
 795         return 0;
 796 }
 797
 798 static void handle_transport_connect(struct avdtp *session, GIOChannel *io,
 799                                         uint16_t imtu, uint16_t omtu)
 800 {
 801         struct avdtp_stream *stream = session->pending_open;
 802         struct avdtp_local_sep *sep = stream->lsep;
 803         int sk, buf_size, min_buf_size;
 804         GError *err = NULL;
 805
 806         session->pending_open = NULL;
 807
 808         if (stream->timer) {
 809                 g_source_remove(stream->timer);
 810                 stream->timer = 0;
 811         }
 812
 813         if (io == NULL) {
 814                 if (!stream->open_acp && sep->cfm && sep->cfm->open) {
 815                         struct avdtp_error err;
 816                         avdtp_error_init(&err, AVDTP_ERRNO, EIO);
 817                         sep->cfm->open(session, sep, NULL, &err,
 818                                         sep->user_data);
 819                 }
 820                 return;
 821         }
 822
 823         if (stream->io == NULL)
 824                 stream->io = g_io_channel_ref(io);
 825
 826         stream->omtu = omtu;
 827         stream->imtu = imtu;
 828
 829         /* Apply special settings only if local SEP is of type SRC */
 830         if (sep->info.type != AVDTP_SEP_TYPE_SOURCE)
 831                 goto proceed;
 832
 833         bt_io_set(stream->io, &err, BT_IO_OPT_FLUSHABLE, TRUE,
 834                                                         BT_IO_OPT_INVALID);
 835         if (err != NULL) {
 836                 error("Enabling flushable packets failed: %s", err->message);
 837                 g_error_free(err);
 838         } else
 839                 DBG("Flushable packets enabled");
 840
 841         sk = g_io_channel_unix_get_fd(stream->io);
 842         buf_size = get_send_buffer_size(sk);
 843         if (buf_size < 0)
 844                 goto proceed;
 845
 846         DBG("sk %d, omtu %d, send buffer size %d", sk, omtu, buf_size);
 847 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
 848         min_buf_size = omtu * 10;
 849 #else
 850         min_buf_size = omtu * 2;
 851 #endif
 852         if (buf_size < min_buf_size) {
 853                 DBG("send buffer size to be increassed to %d",
 854                                 min_buf_size);
 855                 set_send_buffer_size(sk, min_buf_size);
 856         }
 857 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
 858         else {
 859                 DBG("send buffer size to be decreassed to %d",
 860                                 min_buf_size);
 861                 set_send_buffer_size(sk, min_buf_size);
 862         }
 863 #endif
 864 proceed:
 865         if (!stream->open_acp && sep->cfm && sep->cfm->open)
 866                 sep->cfm->open(session, sep, stream, NULL, sep->user_data);
 867
 868         avdtp_sep_set_state(session, sep, AVDTP_STATE_OPEN);
 869
 870         stream->io_id = g_io_add_watch(io, G_IO_ERR | G_IO_HUP | G_IO_NVAL,
 871                                         (GIOFunc) transport_cb, stream);
 872 }
 873
 874 static int pending_req_cmp(gconstpointer a, gconstpointer b)
 875 {
 876         const struct pending_req *req = a;
 877         const struct avdtp_stream *stream = b;
 878
 879         if (req->stream == stream)
 880                 return 0;
 881
 882         return -1;
 883 }
 884
 885 static void cleanup_queue(struct avdtp *session, struct avdtp_stream *stream)
 886 {
 887         GSList *l;
 888         struct pending_req *req;
 889
 890         while ((l = g_slist_find_custom(session->prio_queue, stream,
 891                                                         pending_req_cmp))) {
 892                 req = l->data;
 893                 pending_req_free(req);
 894                 session->prio_queue = g_slist_remove(session->prio_queue, req);
 895         }
 896
 897         while ((l = g_slist_find_custom(session->req_queue, stream,
 898                                                         pending_req_cmp))) {
 899                 req = l->data;
 900                 pending_req_free(req);
 901                 session->req_queue = g_slist_remove(session->req_queue, req);
 902         }
 903 }
 904
 905 static void handle_unanswered_req(struct avdtp *session,
 906                                                 struct avdtp_stream *stream)
 907 {
 908         struct pending_req *req;
 909         struct avdtp_local_sep *lsep;
 910         struct avdtp_error err;
 911
 912         if (session->req->signal_id == AVDTP_ABORT) {
 913                 /* Avoid freeing the Abort request here */
 914                 DBG("handle_unanswered_req: Abort req, returning");
 915                 session->req->stream = NULL;
 916                 return;
 917         }
 918
 919         req = session->req;
 920         session->req = NULL;
 921
 922         avdtp_error_init(&err, AVDTP_ERRNO, EIO);
 923
 924         lsep = stream->lsep;
 925
 926         switch (req->signal_id) {
 927         case AVDTP_RECONFIGURE:
 928                 error("No reply to Reconfigure request");
 929                 if (lsep && lsep->cfm && lsep->cfm->reconfigure)
 930                         lsep->cfm->reconfigure(session, lsep, stream, &err,
 931                                                 lsep->user_data);
 932                 break;
 933         case AVDTP_OPEN:
 934                 error("No reply to Open request");
 935                 if (lsep && lsep->cfm && lsep->cfm->open)
 936                         lsep->cfm->open(session, lsep, stream, &err,
 937                                         lsep->user_data);
 938                 break;
 939         case AVDTP_START:
 940                 error("No reply to Start request");
 941                 if (lsep && lsep->cfm && lsep->cfm->start)
 942                         lsep->cfm->start(session, lsep, stream, &err,
 943                                                 lsep->user_data);
 944                 break;
 945         case AVDTP_SUSPEND:
 946                 error("No reply to Suspend request");
 947                 if (lsep && lsep->cfm && lsep->cfm->suspend)
 948                         lsep->cfm->suspend(session, lsep, stream, &err,
 949                                                 lsep->user_data);
 950                 break;
 951         case AVDTP_CLOSE:
 952                 error("No reply to Close request");
 953                 if (lsep && lsep->cfm && lsep->cfm->close)
 954                         lsep->cfm->close(session, lsep, stream, &err,
 955                                                 lsep->user_data);
 956                 break;
 957         case AVDTP_SET_CONFIGURATION:
 958                 error("No reply to SetConfiguration request");
 959                 if (lsep && lsep->cfm && lsep->cfm->set_configuration)
 960                         lsep->cfm->set_configuration(session, lsep, stream,
 961                                                         &err, lsep->user_data);
 962         }
 963
 964         pending_req_free(req);
 965 }
 966
 967 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
 968 static gboolean send_broadcom_a2dp_qos(const bdaddr_t *dst, gboolean qos_high)
 969 {
 970         int dd;
 971         int err = 0;
 972         struct hci_conn_info_req *cr;
 973         broadcom_qos_cp cp;
 974
 975         dd = hci_open_dev(0);
 976
 977         if (dd < 0)
 978                 return FALSE;
 979
 980         cr = g_malloc0(sizeof(*cr) + sizeof(struct hci_conn_info));
 981
 982         cr->type = ACL_LINK;
 983         bacpy(&cr->bdaddr, dst);
 984
 985         err = ioctl(dd, HCIGETCONNINFO, cr);
 986         if (err < 0) {
 987                 error("Fail to get HCIGETCOINFO");
 988                 g_free(cr);
 989                 hci_close_dev(dd);
 990                 return FALSE;
 991         }
 992
 993         cp.handle = cr->conn_info->handle;
 994         DBG("Handle %d", cp.handle);
 995         g_free(cr);
 996
 997         if (qos_high)
 998                 cp.priority = BRCM_QOS_PRIORITY_HIGH;
 999         else
1000                 cp.priority = BRCM_QOS_PRIORITY_NORMAL;
1001
1002         if (hci_send_cmd(dd, OGF_VENDOR_CMD, BROADCOM_QOS_CMD,
1003                                 BROADCOM_QOS_CP_SIZE, &cp) < 0) {
1004                 hci_close_dev(dd);
1005                 return FALSE;
1006         }
1007         DBG("Send Broadcom Qos Patch %s", qos_high ? "High" : "Low");
1008
1009         hci_close_dev(dd);
1010
1011         return TRUE;
1012 }
1013
1014 static gboolean send_sprd_a2dp_qos(const bdaddr_t *dst, gboolean qos_high)
1015 {
1016         int dd;
1017         int err = 0;
1018         struct hci_conn_info_req *cr;
1019         qos_setup_cp cp;
1020
1021         dd = hci_open_dev(0);
1022
1023         cr = g_malloc0(sizeof(*cr) + sizeof(struct hci_conn_info));
1024
1025         cr->type = ACL_LINK;
1026         bacpy(&cr->bdaddr, dst);
1027
1028         err = ioctl(dd, HCIGETCONNINFO, cr);
1029         if (err < 0) {
1030                 error("Fail to get HCIGETCOINFO");
1031                 g_free(cr);
1032                 hci_close_dev(dd);
1033                 return FALSE;
1034         }
1035
1036         cp.handle = cr->conn_info->handle;
1037         cp.flags = 0x00;
1038         DBG("Handle %d", cp.handle);
1039         g_free(cr);
1040
1041         if (qos_high) {
1042                 cp.qos.service_type = 0x02;
1043                 cp.qos.token_rate = 0X000000C8;
1044                 cp.qos.peak_bandwidth = 0X000000C8;
1045                 cp.qos.latency = 0x00000001;
1046                 cp.qos.delay_variation = 0xFFFFFFFF;
1047         } else {
1048                 cp.qos.service_type = 0x01;
1049                 cp.qos.token_rate = 0X00000000;
1050                 cp.qos.peak_bandwidth = 0X00000000;
1051                 cp.qos.latency = 0x00000001;
1052                 cp.qos.delay_variation = 0xFFFFFFFF;
1053         }
1054
1055         if (hci_send_cmd(dd, OGF_LINK_POLICY, OCF_QOS_SETUP,
1056                                 QOS_SETUP_CP_SIZE, &cp) < 0) {
1057                 hci_close_dev(dd);
1058                 return FALSE;
1059         }
1060         DBG("Send Spreadtrum Qos Patch %s", qos_high ? "High" : "Low");
1061
1062         hci_close_dev(dd);
1063
1064         return TRUE;
1065 }
1066
1067 static gboolean fix_role_to_master(const bdaddr_t *dst, gboolean fix_to_master)
1068 {
1069         int dd;
1070         int err = 0;
1071         struct hci_conn_info_req *cr;
1072         switch_role_cp sr_cp;
1073         write_link_policy_cp lp_cp;
1074
1075         dd = hci_open_dev(0);
1076         if (dd < 0) {
1077                 error("hci_open_dev is failed");
1078                 return FALSE;
1079         }
1080
1081         cr = g_malloc0(sizeof(*cr) + sizeof(struct hci_conn_info));
1082
1083         cr->type = ACL_LINK;
1084         bacpy(&cr->bdaddr, dst);
1085         err = ioctl(dd, HCIGETCONNINFO, cr);
1086         if (err < 0) {
1087                 error("Fail to get HCIGETCOINFO : %d", err);
1088                 g_free(cr);
1089                 hci_close_dev(dd);
1090                 return FALSE;
1091         }
1092
1093         if (!(cr->conn_info->link_mode & HCI_LM_MASTER) && fix_to_master) {
1094                 DBG("Need to role switch");
1095
1096                 bacpy(&sr_cp.bdaddr, dst);
1097                 sr_cp.role = 0x00;      /* 0x00 : Master, 0x01 : Slave */
1098                 if (hci_send_cmd(dd, OGF_LINK_POLICY, OCF_SWITCH_ROLE,
1099                                         SWITCH_ROLE_CP_SIZE, &sr_cp) < 0) {
1100                         error("switch role is failed");
1101                         g_free(cr);
1102                         hci_close_dev(dd);
1103                         return FALSE;
1104                 }
1105         }
1106
1107         lp_cp.handle = cr->conn_info->handle;
1108         DBG("Handle %d", lp_cp.handle);
1109         g_free(cr);
1110
1111         lp_cp.policy = fix_to_master ? 0x00 : HCI_LP_SNIFF | HCI_LP_RSWITCH;
1112         DBG("Request link policy : 0x%X", lp_cp.policy);
1113
1114         if (hci_send_cmd(dd, OGF_LINK_POLICY, OCF_WRITE_LINK_POLICY,
1115                                 WRITE_LINK_POLICY_CP_SIZE, &lp_cp) < 0) {
1116                 error("write link policy is failed : %d", lp_cp.policy);
1117                 hci_close_dev(dd);
1118                 return FALSE;
1119         }
1120
1121         hci_close_dev(dd);
1122
1123         return TRUE;
1124 }
1125 #endif  /* TIZEN_FEATURE_BLUEZ_MODIFY */
1126
1127 static void avdtp_sep_set_state(struct avdtp *session,
1128                                 struct avdtp_local_sep *sep,
1129                                 avdtp_state_t state)
1130 {
1131         struct avdtp_stream *stream = sep->stream;
1132 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
1133         struct btd_adapter *adapter = device_get_adapter(session->device);
1134         const bdaddr_t *dst;
1135
1136         dst = device_get_address(session->device);
1137 #endif
1138         avdtp_state_t old_state;
1139         struct avdtp_error err, *err_ptr = NULL;
1140         GSList *l;
1141
1142         if (!stream) {
1143                 error("Error changing sep state: stream not available");
1144                 return;
1145         }
1146
1147         if (sep->state == state) {
1148                 avdtp_error_init(&err, AVDTP_ERRNO, EIO);
1149                 DBG("stream state change failed: %s", avdtp_strerror(&err));
1150                 err_ptr = &err;
1151         } else {
1152                 err_ptr = NULL;
1153                 DBG("stream state changed: %s -> %s",
1154                                 avdtp_statestr(sep->state),
1155                                 avdtp_statestr(state));
1156         }
1157
1158         old_state = sep->state;
1159         sep->state = state;
1160
1161         switch (state) {
1162         case AVDTP_STATE_CONFIGURED:
1163                 if (sep->info.type == AVDTP_SEP_TYPE_SINK)
1164                         avdtp_delay_report(session, stream, stream->delay);
1165                 break;
1166         case AVDTP_STATE_OPEN:
1167                 stream->starting = FALSE;
1168 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
1169                 if (TIZEN_FEATURE_BLUEZ_BRCM_QOS) {
1170                         send_broadcom_a2dp_qos(dst, FALSE);
1171                 } else if (TIZEN_FEATURE_BLUEZ_SPRD_QOS) {
1172                         if (old_state == AVDTP_STATE_STREAMING)
1173                                 send_sprd_a2dp_qos(dst, FALSE);
1174                 }
1175
1176                 if (TIZEN_FEATURE_BLUEZ_ROLE_CHANGE)
1177                         fix_role_to_master(dst, FALSE);
1178
1179                 btd_adapter_set_streaming_mode(adapter, dst, FALSE);
1180 #endif  /* TIZEN_FEATURE_BLUEZ_MODIFY */
1181                 break;
1182         case AVDTP_STATE_STREAMING:
1183                 if (stream->start_timer) {
1184                         g_source_remove(stream->start_timer);
1185                         stream->start_timer = 0;
1186                 }
1187
1188 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
1189                 if (TIZEN_FEATURE_BLUEZ_BRCM_QOS) {
1190                         send_broadcom_a2dp_qos(dst, TRUE);
1191                 } else if (TIZEN_FEATURE_BLUEZ_SPRD_QOS) {
1192                         if (old_state == AVDTP_STATE_OPEN)
1193                                 send_sprd_a2dp_qos(dst, TRUE);
1194                 }
1195                 if (TIZEN_FEATURE_BLUEZ_ROLE_CHANGE)
1196                         fix_role_to_master(dst, TRUE);
1197
1198                 btd_adapter_set_streaming_mode(adapter, dst, TRUE);
1199 #endif  /* TIZEN_FEATURE_BLUEZ_MODIFY */
1200                 stream->open_acp = FALSE;
1201                 break;
1202         case AVDTP_STATE_CLOSING:
1203         case AVDTP_STATE_ABORTING:
1204                 if (stream->start_timer) {
1205                         g_source_remove(stream->start_timer);
1206                         stream->start_timer = 0;
1207                 }
1208                 break;
1209         case AVDTP_STATE_IDLE:
1210                 if (stream->start_timer) {
1211                         g_source_remove(stream->start_timer);
1212                         stream->start_timer = 0;
1213                 }
1214                 if (session->pending_open == stream)
1215                         handle_transport_connect(session, NULL, 0, 0);
1216                 if (session->req && session->req->stream == stream)
1217                         handle_unanswered_req(session, stream);
1218                 /* Remove pending commands for this stream from the queue */
1219                 cleanup_queue(session, stream);
1220                 break;
1221         default:
1222                 break;
1223         }
1224
1225         l = stream->callbacks;
1226         while (l != NULL) {
1227                 struct stream_callback *cb = l->data;
1228                 l = g_slist_next(l);
1229                 cb->cb(stream, old_state, state, err_ptr, cb->user_data);
1230         }
1231
1232         if (state == AVDTP_STATE_IDLE &&
1233                                 g_slist_find(session->streams, stream)) {
1234                 session->streams = g_slist_remove(session->streams, stream);
1235                 stream_free(stream);
1236         }
1237 }
1238
1239 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
1240 void finalize_discovery(struct avdtp *session, int err)
1241 #else
1242 static void finalize_discovery(struct avdtp *session, int err)
1243 #endif
1244 {
1245         struct discover_callback *discover = session->discover;
1246         struct avdtp_error avdtp_err;
1247
1248         if (!discover)
1249                 return;
1250
1251         avdtp_error_init(&avdtp_err, AVDTP_ERRNO, err);
1252
1253         if (discover->id > 0)
1254                 g_source_remove(discover->id);
1255
1256         if (discover->cb)
1257                 discover->cb(session, session->seps, err ? &avdtp_err : NULL,
1258                                                         discover->user_data);
1259         g_free(discover);
1260         session->discover = NULL;
1261 }
1262
1263 static void release_stream(struct avdtp_stream *stream, struct avdtp *session)
1264 {
1265         struct avdtp_local_sep *sep = stream->lsep;
1266
1267         if (sep->cfm && sep->cfm->abort &&
1268                                 (sep->state != AVDTP_STATE_ABORTING ||
1269                                                         stream->abort_int))
1270                 sep->cfm->abort(session, sep, stream, NULL, sep->user_data);
1271
1272         avdtp_sep_set_state(session, sep, AVDTP_STATE_IDLE);
1273 }
1274
1275 static void sep_free(gpointer data)
1276 {
1277         struct avdtp_remote_sep *sep = data;
1278
1279         g_slist_free_full(sep->caps, g_free);
1280         g_free(sep);
1281 }
1282
1283 static void remove_disconnect_timer(struct avdtp *session)
1284 {
1285         g_source_remove(session->dc_timer);
1286         session->dc_timer = 0;
1287         session->stream_setup = FALSE;
1288 }
1289
1290 static void avdtp_free(void *data)
1291 {
1292         struct avdtp *session = data;
1293
1294         DBG("%p", session);
1295
1296         g_slist_free_full(session->streams, stream_free);
1297
1298         if (session->io) {
1299                 g_io_channel_shutdown(session->io, FALSE, NULL);
1300                 g_io_channel_unref(session->io);
1301         }
1302
1303         if (session->io_id) {
1304                 g_source_remove(session->io_id);
1305                 session->io_id = 0;
1306         }
1307
1308         if (session->dc_timer)
1309                 remove_disconnect_timer(session);
1310
1311         if (session->req)
1312                 pending_req_free(session->req);
1313
1314         g_slist_free_full(session->req_queue, pending_req_free);
1315         g_slist_free_full(session->prio_queue, pending_req_free);
1316         g_slist_free_full(session->seps, sep_free);
1317
1318         g_free(session->buf);
1319
1320         btd_device_unref(session->device);
1321         g_free(session);
1322 }
1323
1324 static void connection_lost(struct avdtp *session, int err)
1325 {
1326         char address[18];
1327 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
1328         struct btd_service *service;
1329 #endif
1330
1331         session = avdtp_ref(session);
1332
1333         ba2str(device_get_address(session->device), address);
1334         DBG("Disconnected from %s", address);
1335
1336 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
1337         service = btd_device_get_service(session->device, A2DP_SINK_UUID);
1338         if (service)
1339                 btd_service_connecting_complete(service, -err);
1340 #endif
1341         g_slist_foreach(session->streams, (GFunc) release_stream, session);
1342         session->streams = NULL;
1343
1344         finalize_discovery(session, err);
1345
1346         avdtp_set_state(session, AVDTP_SESSION_STATE_DISCONNECTED);
1347
1348         DBG("%p: ref=%d", session, session->ref);
1349
1350         avdtp_unref(session);
1351 }
1352
1353 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
1354 static gboolean disconnect_acl_timeout(gpointer user_data)
1355 {
1356         struct btd_device *device = user_data;
1357
1358         DBG("");
1359
1360         btd_device_disconnect(device);
1361
1362         return FALSE;
1363 }
1364 #endif
1365
1366 static gboolean disconnect_timeout(gpointer user_data)
1367 {
1368         struct avdtp *session = user_data;
1369         struct btd_service *service;
1370         gboolean stream_setup;
1371 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
1372         struct btd_device *device = NULL;
1373         struct btd_adapter *adapter = NULL;
1374         const bdaddr_t *bdaddr = NULL;
1375
1376         DBG("");
1377 #endif
1378
1379 /* Fix : REVERSE_INULL */
1380 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
1381         if (session->device == NULL) {
1382                 error("session device NOT found");
1383                 return FALSE;
1384         }
1385 #endif
1386
1387         session->dc_timer = 0;
1388
1389         stream_setup = session->stream_setup;
1390         session->stream_setup = FALSE;
1391
1392         service = btd_device_get_service(session->device, A2DP_SINK_UUID);
1393         if (service && stream_setup) {
1394                 sink_setup_stream(service, session);
1395                 return FALSE;
1396         }
1397
1398         service = btd_device_get_service(session->device, A2DP_SOURCE_UUID);
1399         if (service && stream_setup) {
1400                 source_setup_stream(service, session);
1401                 return FALSE;
1402         }
1403
1404 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
1405         if (session->device) {
1406                 adapter = device_get_adapter(session->device);
1407                 bdaddr = device_get_address(session->device);
1408                 if (adapter && bdaddr)
1409                         device = btd_adapter_find_device(adapter, bdaddr, BDADDR_BREDR);
1410                 if (!device)
1411                         error("device is NOT found");
1412         }
1413 #endif
1414
1415         connection_lost(session, ETIMEDOUT);
1416
1417 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
1418         if (device)
1419                 g_timeout_add(100,
1420                         disconnect_acl_timeout,
1421                         device);
1422 #endif
1423
1424         return FALSE;
1425 }
1426
1427 #if defined TIZEN_FEATURE_BLUEZ_MODIFY
1428 static void set_disconnect_timer_for_sink(struct avdtp *session, gboolean disconn)
1429 {
1430         char name[6];
1431
1432         if (session->dc_timer)
1433                 remove_disconnect_timer(session);
1434
1435         device_get_name(session->device, name, sizeof(name));
1436         DBG("name : [%s]", name);
1437         if (g_str_equal(name, "VW BT") || g_str_equal(name, "VW MI") ||
1438                                                 g_str_equal(name, "Seat ")) {
1439                 session->dc_timer = g_timeout_add_seconds(3, disconnect_timeout,
1440                                 session);
1441         } else if (g_str_equal(name, "CAR M")) {
1442                 session->dc_timer = g_timeout_add(200, disconnect_timeout,
1443                                 session);
1444         } else {
1445                 if (disconn == TRUE)
1446                         session->dc_timer = g_timeout_add(100,
1447                                         disconnect_timeout,
1448                                         session);
1449                 else
1450                         session->dc_timer = g_timeout_add_seconds(DISCONNECT_TIMEOUT,
1451                                         disconnect_timeout,
1452                                         session);
1453         }
1454 }
1455 #endif
1456
1457 static void set_disconnect_timer(struct avdtp *session)
1458 {
1459 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
1460         char name[6];
1461 #endif
1462         if (session->dc_timer)
1463                 remove_disconnect_timer(session);
1464
1465 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
1466         device_get_name(session->device, name, sizeof(name));
1467         DBG("name : [%s]", name);
1468         if (g_str_equal(name, "VW BT") || g_str_equal(name, "VW MI") ||
1469                                                 g_str_equal(name, "Seat ")) {
1470                 session->dc_timer = g_timeout_add_seconds(3, disconnect_timeout,
1471                                 session);
1472         } else if (g_str_equal(name, "CAR M")) {
1473                 session->dc_timer = g_timeout_add(200, disconnect_timeout,
1474                                 session);
1475         } else {
1476                 session->dc_timer = g_timeout_add_seconds(DISCONNECT_TIMEOUT,
1477                                 disconnect_timeout,
1478                                 session);
1479         }
1480 #endif
1481 }
1482
1483 void avdtp_unref(struct avdtp *session)
1484 {
1485         if (!session)
1486                 return;
1487
1488         session->ref--;
1489 #if defined TIZEN_FEATURE_BLUEZ_MODIFY
1490         struct btd_adapter *adapter;
1491         adapter = avdtp_get_adapter(session);
1492 #endif
1493
1494         DBG("%p: ref=%d", session, session->ref);
1495
1496         if (session->ref > 0)
1497                 return;
1498
1499         switch (session->state) {
1500         case AVDTP_SESSION_STATE_CONNECTED:
1501 #if defined TIZEN_FEATURE_BLUEZ_MODIFY
1502                 if (btd_adapter_get_a2dp_role(adapter) == BLUETOOTH_A2DP_SINK_ROLE)
1503                         set_disconnect_timer_for_sink(session, TRUE);
1504                 else
1505                         set_disconnect_timer(session);
1506 #else
1507                 set_disconnect_timer(session);
1508 #endif
1509                 break;
1510         case AVDTP_SESSION_STATE_CONNECTING:
1511                 connection_lost(session, ECONNABORTED);
1512                 break;
1513         case AVDTP_SESSION_STATE_DISCONNECTED:
1514         default:
1515                 avdtp_free(session);
1516                 break;
1517         }
1518 }
1519
1520 struct avdtp *avdtp_ref(struct avdtp *session)
1521 {
1522         session->ref++;
1523         DBG("%p: ref=%d", session, session->ref);
1524         if (session->dc_timer)
1525                 remove_disconnect_timer(session);
1526         return session;
1527 }
1528
1529 static bool match_by_seid(const void *data, const void *user_data)
1530 {
1531         const struct avdtp_local_sep *sep = data;
1532         uint8_t seid = PTR_TO_UINT(user_data);
1533
1534         return sep->info.seid == seid;
1535 }
1536
1537 static struct avdtp_local_sep *find_local_sep_by_seid(struct avdtp *session,
1538                                                                 uint8_t seid)
1539 {
1540         return queue_find(session->lseps, match_by_seid, INT_TO_PTR(seid));
1541 }
1542
1543 struct avdtp_remote_sep *avdtp_find_remote_sep(struct avdtp *session,
1544                                                 struct avdtp_local_sep *lsep)
1545 {
1546         GSList *l;
1547
1548         if (lsep->info.inuse)
1549                 return NULL;
1550
1551         for (l = session->seps; l != NULL; l = g_slist_next(l)) {
1552                 struct avdtp_remote_sep *sep = l->data;
1553                 struct avdtp_service_capability *cap;
1554                 struct avdtp_media_codec_capability *codec_data;
1555
1556                 /* Type must be different: source <-> sink */
1557                 if (sep->type == lsep->info.type)
1558                         continue;
1559
1560                 if (sep->media_type != lsep->info.media_type)
1561                         continue;
1562
1563                 if (!sep->codec)
1564                         continue;
1565
1566                 cap = sep->codec;
1567                 codec_data = (void *) cap->data;
1568
1569                 if (codec_data->media_codec_type != lsep->codec)
1570                         continue;
1571
1572                 if (lsep->ind && lsep->ind->match_codec)
1573                         if (!lsep->ind->match_codec(session, codec_data,
1574                                                         lsep->user_data))
1575                                 continue;
1576
1577                 if (sep->stream == NULL)
1578                         return sep;
1579         }
1580
1581         return NULL;
1582 }
1583
1584 static GSList *caps_to_list(uint8_t *data, int size,
1585                                 struct avdtp_service_capability **codec,
1586                                 gboolean *delay_reporting)
1587 {
1588         GSList *caps;
1589         int processed;
1590
1591         if (delay_reporting)
1592                 *delay_reporting = FALSE;
1593
1594         for (processed = 0, caps = NULL; processed + 2 <= size;) {
1595                 struct avdtp_service_capability *cap;
1596                 uint8_t length, category;
1597
1598                 category = data[0];
1599                 length = data[1];
1600
1601                 if (processed + 2 + length > size) {
1602                         error("Invalid capability data in getcap resp");
1603                         break;
1604                 }
1605
1606                 cap = g_malloc(sizeof(struct avdtp_service_capability) +
1607                                         length);
1608                 memcpy(cap, data, 2 + length);
1609
1610                 processed += 2 + length;
1611                 data += 2 + length;
1612
1613                 caps = g_slist_append(caps, cap);
1614
1615                 if (category == AVDTP_MEDIA_CODEC &&
1616                                 length >=
1617                                 sizeof(struct avdtp_media_codec_capability))
1618                         *codec = cap;
1619                 else if (category == AVDTP_DELAY_REPORTING && delay_reporting)
1620                         *delay_reporting = TRUE;
1621         }
1622
1623         return caps;
1624 }
1625
1626 static gboolean avdtp_unknown_cmd(struct avdtp *session, uint8_t transaction,
1627                                                         uint8_t signal_id)
1628 {
1629         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_GEN_REJECT,
1630                                                         signal_id, NULL, 0);
1631 }
1632
1633 static void copy_seps(void *data, void *user_data)
1634 {
1635         struct avdtp_local_sep *sep = data;
1636         struct seid_info **p = user_data;
1637
1638         memcpy(*p, &sep->info, sizeof(struct seid_info));
1639         *p = *p + 1;
1640 }
1641
1642 static gboolean avdtp_discover_cmd(struct avdtp *session, uint8_t transaction,
1643                                                         void *buf, int size)
1644 {
1645         unsigned int rsp_size, sep_count;
1646         struct seid_info *seps, *p;
1647         gboolean ret;
1648
1649         sep_count = queue_length(session->lseps);
1650
1651         if (sep_count == 0) {
1652                 uint8_t err = AVDTP_NOT_SUPPORTED_COMMAND;
1653                 return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
1654                                         AVDTP_DISCOVER, &err, sizeof(err));
1655         }
1656
1657         rsp_size = sep_count * sizeof(struct seid_info);
1658
1659         seps = g_new0(struct seid_info, sep_count);
1660         p = seps;
1661
1662         queue_foreach(session->lseps, copy_seps, &p);
1663
1664         ret = avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
1665                                 AVDTP_DISCOVER, seps, rsp_size);
1666         g_free(seps);
1667
1668         return ret;
1669 }
1670
1671 static gboolean avdtp_getcap_cmd(struct avdtp *session, uint8_t transaction,
1672                                         struct seid_req *req, unsigned int size,
1673                                         gboolean get_all)
1674 {
1675         GSList *l, *caps;
1676         struct avdtp_local_sep *sep = NULL;
1677         unsigned int rsp_size;
1678         uint8_t err, buf[1024], *ptr = buf;
1679         uint8_t cmd;
1680
1681         cmd = get_all ? AVDTP_GET_ALL_CAPABILITIES : AVDTP_GET_CAPABILITIES;
1682
1683         if (size < sizeof(struct seid_req)) {
1684                 err = AVDTP_BAD_LENGTH;
1685                 goto failed;
1686         }
1687
1688         sep = find_local_sep_by_seid(session, req->acp_seid);
1689         if (!sep) {
1690                 err = AVDTP_BAD_ACP_SEID;
1691                 goto failed;
1692         }
1693
1694         if (!sep->ind->get_capability(session, sep, get_all, &caps,
1695                                                         &err, sep->user_data))
1696                 goto failed;
1697
1698         for (l = caps, rsp_size = 0; l != NULL; l = g_slist_next(l)) {
1699                 struct avdtp_service_capability *cap = l->data;
1700
1701                 if (rsp_size + cap->length + 2 > sizeof(buf))
1702                         break;
1703
1704                 memcpy(ptr, cap, cap->length + 2);
1705                 rsp_size += cap->length + 2;
1706                 ptr += cap->length + 2;
1707
1708                 g_free(cap);
1709         }
1710
1711         g_slist_free(caps);
1712
1713         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT, cmd,
1714                                                                 buf, rsp_size);
1715
1716 failed:
1717         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT, cmd,
1718                                                         &err, sizeof(err));
1719 }
1720
1721 static void setconf_cb(struct avdtp *session, struct avdtp_stream *stream,
1722                                                 struct avdtp_error *err)
1723 {
1724         struct conf_rej rej;
1725         struct avdtp_local_sep *sep;
1726
1727         if (err != NULL) {
1728                 rej.error = AVDTP_UNSUPPORTED_CONFIGURATION;
1729                 rej.category = err->err.error_code;
1730                 avdtp_send(session, session->in.transaction,
1731                                 AVDTP_MSG_TYPE_REJECT, AVDTP_SET_CONFIGURATION,
1732                                 &rej, sizeof(rej));
1733                 stream_free(stream);
1734                 return;
1735         }
1736
1737         if (!avdtp_send(session, session->in.transaction, AVDTP_MSG_TYPE_ACCEPT,
1738                                         AVDTP_SET_CONFIGURATION, NULL, 0)) {
1739                 stream_free(stream);
1740                 return;
1741         }
1742
1743         sep = stream->lsep;
1744         sep->stream = stream;
1745         sep->info.inuse = 1;
1746         session->streams = g_slist_append(session->streams, stream);
1747
1748         avdtp_sep_set_state(session, sep, AVDTP_STATE_CONFIGURED);
1749 }
1750
1751 static gboolean avdtp_setconf_cmd(struct avdtp *session, uint8_t transaction,
1752                                 struct setconf_req *req, unsigned int size)
1753 {
1754         struct conf_rej rej;
1755         struct avdtp_local_sep *sep;
1756         struct avdtp_stream *stream;
1757         uint8_t err, category = 0x00;
1758         struct btd_service *service;
1759         GSList *l;
1760
1761         if (size < sizeof(struct setconf_req)) {
1762                 error("Too short getcap request");
1763                 return FALSE;
1764         }
1765
1766         sep = find_local_sep_by_seid(session, req->acp_seid);
1767         if (!sep) {
1768                 err = AVDTP_BAD_ACP_SEID;
1769                 goto failed;
1770         }
1771
1772         if (sep->stream) {
1773                 err = AVDTP_SEP_IN_USE;
1774                 goto failed;
1775         }
1776
1777         switch (sep->info.type) {
1778         case AVDTP_SEP_TYPE_SOURCE:
1779                 service = btd_device_get_service(session->device,
1780                                                         A2DP_SINK_UUID);
1781                 if (service == NULL) {
1782                         btd_device_add_uuid(session->device, A2DP_SINK_UUID);
1783                         service = btd_device_get_service(session->device,
1784                                                         A2DP_SINK_UUID);
1785                         if (service == NULL) {
1786                                 error("Unable to get a audio sink object");
1787                                 err = AVDTP_BAD_STATE;
1788                                 goto failed;
1789                         }
1790                 }
1791                 break;
1792         case AVDTP_SEP_TYPE_SINK:
1793                 service = btd_device_get_service(session->device,
1794                                                         A2DP_SOURCE_UUID);
1795                 if (service == NULL) {
1796                         btd_device_add_uuid(session->device, A2DP_SOURCE_UUID);
1797                         service = btd_device_get_service(session->device,
1798                                                         A2DP_SOURCE_UUID);
1799                         if (service == NULL) {
1800                                 error("Unable to get a audio source object");
1801                                 err = AVDTP_BAD_STATE;
1802                                 goto failed;
1803                         }
1804                 }
1805                 break;
1806         }
1807
1808         stream = g_new0(struct avdtp_stream, 1);
1809         stream->session = session;
1810         stream->lsep = sep;
1811         stream->rseid = req->int_seid;
1812         stream->caps = caps_to_list(req->caps,
1813                                         size - sizeof(struct setconf_req),
1814                                         &stream->codec,
1815                                         &stream->delay_reporting);
1816
1817         /* Verify that the Media Transport capability's length = 0. Reject otherwise */
1818         for (l = stream->caps; l != NULL; l = g_slist_next(l)) {
1819                 struct avdtp_service_capability *cap = l->data;
1820
1821                 if (cap->category == AVDTP_MEDIA_TRANSPORT && cap->length != 0) {
1822                         err = AVDTP_BAD_MEDIA_TRANSPORT_FORMAT;
1823                         goto failed_stream;
1824                 }
1825         }
1826
1827         if (stream->delay_reporting && session->version < 0x0103)
1828                 session->version = 0x0103;
1829
1830         if (sep->ind && sep->ind->set_configuration) {
1831                 if (!sep->ind->set_configuration(session, sep, stream,
1832                                                         stream->caps,
1833                                                         setconf_cb,
1834                                                         sep->user_data)) {
1835                         err = AVDTP_UNSUPPORTED_CONFIGURATION;
1836                         category = 0x00;
1837                         goto failed_stream;
1838                 }
1839         } else {
1840                 if (!avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
1841                                         AVDTP_SET_CONFIGURATION, NULL, 0)) {
1842                         stream_free(stream);
1843                         return FALSE;
1844                 }
1845
1846                 sep->stream = stream;
1847                 sep->info.inuse = 1;
1848                 session->streams = g_slist_append(session->streams, stream);
1849
1850                 avdtp_sep_set_state(session, sep, AVDTP_STATE_CONFIGURED);
1851         }
1852
1853         return TRUE;
1854
1855 failed_stream:
1856         stream_free(stream);
1857 failed:
1858         rej.error = err;
1859         rej.category = category;
1860         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
1861                                 AVDTP_SET_CONFIGURATION, &rej, sizeof(rej));
1862 }
1863
1864 static gboolean avdtp_getconf_cmd(struct avdtp *session, uint8_t transaction,
1865                                         struct seid_req *req, int size)
1866 {
1867         GSList *l;
1868         struct avdtp_local_sep *sep = NULL;
1869         int rsp_size;
1870         uint8_t err;
1871         uint8_t buf[1024];
1872         uint8_t *ptr = buf;
1873
1874         if (size < (int) sizeof(struct seid_req)) {
1875                 error("Too short getconf request");
1876                 return FALSE;
1877         }
1878
1879         memset(buf, 0, sizeof(buf));
1880
1881         sep = find_local_sep_by_seid(session, req->acp_seid);
1882         if (!sep) {
1883                 err = AVDTP_BAD_ACP_SEID;
1884                 goto failed;
1885         }
1886         if (!sep->stream || !sep->stream->caps) {
1887                 err = AVDTP_UNSUPPORTED_CONFIGURATION;
1888                 goto failed;
1889         }
1890
1891         for (l = sep->stream->caps, rsp_size = 0; l != NULL; l = g_slist_next(l)) {
1892                 struct avdtp_service_capability *cap = l->data;
1893
1894                 if (rsp_size + cap->length + 2 > (int) sizeof(buf))
1895                         break;
1896
1897                 memcpy(ptr, cap, cap->length + 2);
1898                 rsp_size += cap->length + 2;
1899                 ptr += cap->length + 2;
1900         }
1901
1902         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
1903                                 AVDTP_GET_CONFIGURATION, buf, rsp_size);
1904
1905 failed:
1906         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
1907                                 AVDTP_GET_CONFIGURATION, &err, sizeof(err));
1908 }
1909
1910 static gboolean avdtp_reconf_cmd(struct avdtp *session, uint8_t transaction,
1911                                         struct seid_req *req, int size)
1912 {
1913         struct conf_rej rej;
1914
1915         rej.error = AVDTP_NOT_SUPPORTED_COMMAND;
1916         rej.category = 0x00;
1917
1918         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
1919                                         AVDTP_RECONFIGURE, &rej, sizeof(rej));
1920 }
1921
1922 static void check_seid_collision(struct pending_req *req, uint8_t id)
1923 {
1924         struct seid_req *seid = req->data;
1925
1926         if (seid->acp_seid == id)
1927                 req->collided = TRUE;
1928 }
1929
1930 static void check_start_collision(struct pending_req *req, uint8_t id)
1931 {
1932         struct start_req *start = req->data;
1933         struct seid *seid = &start->first_seid;
1934         int count = 1 + req->data_size - sizeof(struct start_req);
1935         int i;
1936
1937         for (i = 0; i < count; i++, seid++) {
1938                 if (seid->seid == id) {
1939                         req->collided = TRUE;
1940                         return;
1941                 }
1942         }
1943 }
1944
1945 static void check_suspend_collision(struct pending_req *req, uint8_t id)
1946 {
1947         struct suspend_req *suspend = req->data;
1948         struct seid *seid = &suspend->first_seid;
1949         int count = 1 + req->data_size - sizeof(struct suspend_req);
1950         int i;
1951
1952         for (i = 0; i < count; i++, seid++) {
1953                 if (seid->seid == id) {
1954                         req->collided = TRUE;
1955                         return;
1956                 }
1957         }
1958 }
1959
1960 static void avdtp_check_collision(struct avdtp *session, uint8_t cmd,
1961                                         struct avdtp_stream *stream)
1962 {
1963         struct pending_req *req = session->req;
1964
1965         if (req == NULL || (req->signal_id != cmd && cmd != AVDTP_ABORT))
1966                 return;
1967
1968         if (cmd == AVDTP_ABORT)
1969                 cmd = req->signal_id;
1970
1971         switch (cmd) {
1972         case AVDTP_OPEN:
1973         case AVDTP_CLOSE:
1974                 check_seid_collision(req, stream->rseid);
1975                 break;
1976         case AVDTP_START:
1977                 check_start_collision(req, stream->rseid);
1978                 break;
1979         case AVDTP_SUSPEND:
1980                 check_suspend_collision(req, stream->rseid);
1981                 break;
1982         }
1983 }
1984
1985 static gboolean avdtp_open_cmd(struct avdtp *session, uint8_t transaction,
1986                                 struct seid_req *req, unsigned int size)
1987 {
1988         struct avdtp_local_sep *sep;
1989         struct avdtp_stream *stream;
1990         uint8_t err;
1991
1992         if (size < sizeof(struct seid_req)) {
1993                 error("Too short abort request");
1994                 return FALSE;
1995         }
1996
1997         sep = find_local_sep_by_seid(session, req->acp_seid);
1998         if (!sep) {
1999                 err = AVDTP_BAD_ACP_SEID;
2000                 goto failed;
2001         }
2002
2003         if (sep->state != AVDTP_STATE_CONFIGURED) {
2004                 err = AVDTP_BAD_STATE;
2005                 goto failed;
2006         }
2007
2008         stream = sep->stream;
2009
2010         if (sep->ind && sep->ind->open) {
2011                 if (!sep->ind->open(session, sep, stream, &err,
2012                                         sep->user_data))
2013                         goto failed;
2014         }
2015
2016         avdtp_check_collision(session, AVDTP_OPEN, stream);
2017
2018         if (!avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
2019                                                 AVDTP_OPEN, NULL, 0))
2020                 return FALSE;
2021
2022         stream->open_acp = TRUE;
2023         session->pending_open = stream;
2024         stream->timer = g_timeout_add_seconds(REQ_TIMEOUT,
2025                                                 stream_open_timeout,
2026                                                 stream);
2027
2028         return TRUE;
2029
2030 failed:
2031         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
2032                                 AVDTP_OPEN, &err, sizeof(err));
2033 }
2034
2035 static gboolean avdtp_start_cmd(struct avdtp *session, uint8_t transaction,
2036                                 struct start_req *req, unsigned int size)
2037 {
2038         struct avdtp_local_sep *sep;
2039         struct avdtp_stream *stream;
2040         struct stream_rej rej;
2041         struct seid *seid;
2042         uint8_t err, failed_seid;
2043         int seid_count, i;
2044
2045         if (size < sizeof(struct start_req)) {
2046                 error("Too short start request");
2047                 return FALSE;
2048         }
2049
2050         seid_count = 1 + size - sizeof(struct start_req);
2051
2052         seid = &req->first_seid;
2053
2054         for (i = 0; i < seid_count; i++, seid++) {
2055                 failed_seid = seid->seid;
2056
2057                 sep = find_local_sep_by_seid(session, seid->seid);
2058                 if (!sep || !sep->stream) {
2059                         err = AVDTP_BAD_ACP_SEID;
2060                         goto failed;
2061                 }
2062
2063                 stream = sep->stream;
2064
2065                 /* Also reject start cmd if state is not open */
2066                 if (sep->state != AVDTP_STATE_OPEN) {
2067                         err = AVDTP_BAD_STATE;
2068                         goto failed;
2069                 }
2070                 stream->starting = TRUE;
2071
2072                 if (sep->ind && sep->ind->start) {
2073                         if (!sep->ind->start(session, sep, stream, &err,
2074                                                 sep->user_data))
2075                                 goto failed;
2076                 }
2077
2078                 avdtp_check_collision(session, AVDTP_START, stream);
2079
2080                 avdtp_sep_set_state(session, sep, AVDTP_STATE_STREAMING);
2081         }
2082
2083         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
2084                                                 AVDTP_START, NULL, 0);
2085
2086 failed:
2087         DBG("Rejecting (%d)", err);
2088         memset(&rej, 0, sizeof(rej));
2089         rej.acp_seid = failed_seid;
2090         rej.error = err;
2091         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
2092                                 AVDTP_START, &rej, sizeof(rej));
2093 }
2094
2095 static gboolean avdtp_close_cmd(struct avdtp *session, uint8_t transaction,
2096                                 struct seid_req *req, unsigned int size)
2097 {
2098         struct avdtp_local_sep *sep;
2099         struct avdtp_stream *stream;
2100         uint8_t err;
2101
2102         if (size < sizeof(struct seid_req)) {
2103                 error("Too short close request");
2104                 return FALSE;
2105         }
2106
2107         sep = find_local_sep_by_seid(session, req->acp_seid);
2108         if (!sep || !sep->stream) {
2109                 err = AVDTP_BAD_ACP_SEID;
2110                 goto failed;
2111         }
2112
2113         if (sep->state != AVDTP_STATE_OPEN &&
2114                         sep->state != AVDTP_STATE_STREAMING) {
2115                 err = AVDTP_BAD_STATE;
2116                 goto failed;
2117         }
2118
2119         stream = sep->stream;
2120
2121         if (sep->ind && sep->ind->close) {
2122                 if (!sep->ind->close(session, sep, stream, &err,
2123                                         sep->user_data))
2124                         goto failed;
2125         }
2126
2127         avdtp_check_collision(session, AVDTP_CLOSE, stream);
2128
2129         avdtp_sep_set_state(session, sep, AVDTP_STATE_CLOSING);
2130
2131         if (!avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
2132                                                 AVDTP_CLOSE, NULL, 0))
2133                 return FALSE;
2134
2135         stream->timer = g_timeout_add_seconds(REQ_TIMEOUT,
2136                                         stream_close_timeout,
2137                                         stream);
2138
2139         return TRUE;
2140
2141 failed:
2142         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
2143                                         AVDTP_CLOSE, &err, sizeof(err));
2144 }
2145
2146 static gboolean avdtp_suspend_cmd(struct avdtp *session, uint8_t transaction,
2147                                 struct suspend_req *req, unsigned int size)
2148 {
2149         struct avdtp_local_sep *sep;
2150         struct avdtp_stream *stream;
2151         struct stream_rej rej;
2152         struct seid *seid;
2153         uint8_t err, failed_seid;
2154         int seid_count, i;
2155
2156         if (size < sizeof(struct suspend_req)) {
2157                 error("Too short suspend request");
2158                 return FALSE;
2159         }
2160
2161         seid_count = 1 + size - sizeof(struct suspend_req);
2162
2163         seid = &req->first_seid;
2164
2165         for (i = 0; i < seid_count; i++, seid++) {
2166                 failed_seid = seid->seid;
2167
2168                 sep = find_local_sep_by_seid(session, seid->seid);
2169                 if (!sep || !sep->stream) {
2170                         err = AVDTP_BAD_ACP_SEID;
2171                         goto failed;
2172                 }
2173
2174                 stream = sep->stream;
2175
2176                 if (sep->state != AVDTP_STATE_STREAMING) {
2177                         err = AVDTP_BAD_STATE;
2178                         goto failed;
2179                 }
2180
2181                 if (sep->ind && sep->ind->suspend) {
2182                         if (!sep->ind->suspend(session, sep, stream, &err,
2183                                                 sep->user_data))
2184                                 goto failed;
2185                 }
2186
2187                 avdtp_check_collision(session, AVDTP_SUSPEND, stream);
2188
2189                 avdtp_sep_set_state(session, sep, AVDTP_STATE_OPEN);
2190         }
2191
2192         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
2193                                                 AVDTP_SUSPEND, NULL, 0);
2194
2195 failed:
2196         memset(&rej, 0, sizeof(rej));
2197         rej.acp_seid = failed_seid;
2198         rej.error = err;
2199         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
2200                                 AVDTP_SUSPEND, &rej, sizeof(rej));
2201 }
2202
2203 static gboolean avdtp_abort_cmd(struct avdtp *session, uint8_t transaction,
2204                                 struct seid_req *req, unsigned int size)
2205 {
2206         struct avdtp_local_sep *sep;
2207         uint8_t err;
2208         gboolean ret;
2209
2210         if (size < sizeof(struct seid_req)) {
2211                 error("Too short abort request");
2212                 return FALSE;
2213         }
2214
2215         sep = find_local_sep_by_seid(session, req->acp_seid);
2216         if (!sep || !sep->stream)
2217                 return TRUE;
2218
2219         if (sep->ind && sep->ind->abort)
2220                 sep->ind->abort(session, sep, sep->stream, &err,
2221                                                         sep->user_data);
2222
2223         avdtp_check_collision(session, AVDTP_ABORT, sep->stream);
2224
2225         ret = avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
2226                                                 AVDTP_ABORT, NULL, 0);
2227         if (ret)
2228                 avdtp_sep_set_state(session, sep, AVDTP_STATE_ABORTING);
2229
2230         return ret;
2231 }
2232
2233 static gboolean avdtp_secctl_cmd(struct avdtp *session, uint8_t transaction,
2234                                         struct seid_req *req, int size)
2235 {
2236         return avdtp_unknown_cmd(session, transaction, AVDTP_SECURITY_CONTROL);
2237 }
2238
2239 static gboolean avdtp_delayreport_cmd(struct avdtp *session,
2240                                         uint8_t transaction,
2241                                         struct delay_req *req,
2242                                         unsigned int size)
2243 {
2244         struct avdtp_local_sep *sep;
2245         struct avdtp_stream *stream;
2246         uint8_t err;
2247
2248         if (size < sizeof(struct delay_req)) {
2249                 error("Too short delay report request");
2250                 return FALSE;
2251         }
2252
2253         sep = find_local_sep_by_seid(session, req->acp_seid);
2254         if (!sep || !sep->stream) {
2255                 err = AVDTP_BAD_ACP_SEID;
2256                 goto failed;
2257         }
2258
2259         stream = sep->stream;
2260
2261         if (sep->state != AVDTP_STATE_CONFIGURED &&
2262                                         sep->state != AVDTP_STATE_STREAMING) {
2263                 err = AVDTP_BAD_STATE;
2264                 goto failed;
2265         }
2266
2267         stream->delay = ntohs(req->delay);
2268
2269         if (sep->ind && sep->ind->delayreport) {
2270                 if (!sep->ind->delayreport(session, sep, stream->rseid,
2271                                                 stream->delay, &err,
2272                                                 sep->user_data))
2273                         goto failed;
2274         }
2275
2276         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
2277                                                 AVDTP_DELAY_REPORT, NULL, 0);
2278
2279 failed:
2280         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
2281                                         AVDTP_DELAY_REPORT, &err, sizeof(err));
2282 }
2283
2284 static gboolean avdtp_parse_cmd(struct avdtp *session, uint8_t transaction,
2285                                 uint8_t signal_id, void *buf, int size)
2286 {
2287         switch (signal_id) {
2288         case AVDTP_DISCOVER:
2289                 DBG("Received DISCOVER_CMD");
2290                 return avdtp_discover_cmd(session, transaction, buf, size);
2291         case AVDTP_GET_CAPABILITIES:
2292                 DBG("Received  GET_CAPABILITIES_CMD");
2293                 return avdtp_getcap_cmd(session, transaction, buf, size,
2294                                                                         FALSE);
2295         case AVDTP_GET_ALL_CAPABILITIES:
2296                 DBG("Received  GET_ALL_CAPABILITIES_CMD");
2297                 return avdtp_getcap_cmd(session, transaction, buf, size, TRUE);
2298         case AVDTP_SET_CONFIGURATION:
2299                 DBG("Received SET_CONFIGURATION_CMD");
2300                 return avdtp_setconf_cmd(session, transaction, buf, size);
2301         case AVDTP_GET_CONFIGURATION:
2302                 DBG("Received GET_CONFIGURATION_CMD");
2303                 return avdtp_getconf_cmd(session, transaction, buf, size);
2304         case AVDTP_RECONFIGURE:
2305                 DBG("Received RECONFIGURE_CMD");
2306                 return avdtp_reconf_cmd(session, transaction, buf, size);
2307         case AVDTP_OPEN:
2308                 DBG("Received OPEN_CMD");
2309                 return avdtp_open_cmd(session, transaction, buf, size);
2310         case AVDTP_START:
2311                 DBG("Received START_CMD");
2312                 return avdtp_start_cmd(session, transaction, buf, size);
2313         case AVDTP_CLOSE:
2314                 DBG("Received CLOSE_CMD");
2315                 return avdtp_close_cmd(session, transaction, buf, size);
2316         case AVDTP_SUSPEND:
2317                 DBG("Received SUSPEND_CMD");
2318                 return avdtp_suspend_cmd(session, transaction, buf, size);
2319         case AVDTP_ABORT:
2320                 DBG("Received ABORT_CMD");
2321                 return avdtp_abort_cmd(session, transaction, buf, size);
2322         case AVDTP_SECURITY_CONTROL:
2323                 DBG("Received SECURITY_CONTROL_CMD");
2324                 return avdtp_secctl_cmd(session, transaction, buf, size);
2325         case AVDTP_DELAY_REPORT:
2326                 DBG("Received DELAY_REPORT_CMD");
2327                 return avdtp_delayreport_cmd(session, transaction, buf, size);
2328         default:
2329                 DBG("Received unknown request id %u", signal_id);
2330                 return avdtp_unknown_cmd(session, transaction, signal_id);
2331         }
2332 }
2333
2334 enum avdtp_parse_result { PARSE_ERROR, PARSE_FRAGMENT, PARSE_SUCCESS };
2335
2336 static enum avdtp_parse_result avdtp_parse_data(struct avdtp *session,
2337                                                         void *buf, size_t size)
2338 {
2339         struct avdtp_common_header *header = buf;
2340         struct avdtp_single_header *single = (void *) session->buf;
2341         struct avdtp_start_header *start = (void *) session->buf;
2342         void *payload;
2343         gsize payload_size;
2344
2345         switch (header->packet_type) {
2346         case AVDTP_PKT_TYPE_SINGLE:
2347                 if (size < sizeof(*single)) {
2348                         error("Received too small single packet (%zu bytes)", size);
2349                         return PARSE_ERROR;
2350                 }
2351                 if (session->in.active) {
2352                         error("SINGLE: Invalid AVDTP packet fragmentation");
2353                         return PARSE_ERROR;
2354                 }
2355
2356                 payload = session->buf + sizeof(*single);
2357                 payload_size = size - sizeof(*single);
2358
2359                 session->in.active = TRUE;
2360                 session->in.data_size = 0;
2361                 session->in.no_of_packets = 1;
2362                 session->in.transaction = header->transaction;
2363                 session->in.message_type = header->message_type;
2364                 session->in.signal_id = single->signal_id;
2365
2366                 break;
2367         case AVDTP_PKT_TYPE_START:
2368                 if (size < sizeof(*start)) {
2369                         error("Received too small start packet (%zu bytes)", size);
2370                         return PARSE_ERROR;
2371                 }
2372                 if (session->in.active) {
2373                         error("START: Invalid AVDTP packet fragmentation");
2374                         return PARSE_ERROR;
2375                 }
2376
2377                 session->in.active = TRUE;
2378                 session->in.data_size = 0;
2379                 session->in.transaction = header->transaction;
2380                 session->in.message_type = header->message_type;
2381                 session->in.no_of_packets = start->no_of_packets;
2382                 session->in.signal_id = start->signal_id;
2383
2384                 payload = session->buf + sizeof(*start);
2385                 payload_size = size - sizeof(*start);
2386
2387                 break;
2388         case AVDTP_PKT_TYPE_CONTINUE:
2389                 if (size < sizeof(struct avdtp_continue_header)) {
2390                         error("Received too small continue packet (%zu bytes)",
2391                                                                         size);
2392                         return PARSE_ERROR;
2393                 }
2394                 if (!session->in.active) {
2395                         error("CONTINUE: Invalid AVDTP packet fragmentation");
2396                         return PARSE_ERROR;
2397                 }
2398                 if (session->in.transaction != header->transaction) {
2399                         error("Continue transaction id doesn't match");
2400                         return PARSE_ERROR;
2401                 }
2402                 if (session->in.no_of_packets <= 1) {
2403                         error("Too few continue packets");
2404                         return PARSE_ERROR;
2405                 }
2406
2407                 payload = session->buf + sizeof(struct avdtp_continue_header);
2408                 payload_size = size - sizeof(struct avdtp_continue_header);
2409
2410                 break;
2411         case AVDTP_PKT_TYPE_END:
2412                 if (size < sizeof(struct avdtp_continue_header)) {
2413                         error("Received too small end packet (%zu bytes)", size);
2414                         return PARSE_ERROR;
2415                 }
2416                 if (!session->in.active) {
2417                         error("END: Invalid AVDTP packet fragmentation");
2418                         return PARSE_ERROR;
2419                 }
2420                 if (session->in.transaction != header->transaction) {
2421                         error("End transaction id doesn't match");
2422                         return PARSE_ERROR;
2423                 }
2424                 if (session->in.no_of_packets > 1) {
2425                         error("Got an end packet too early");
2426                         return PARSE_ERROR;
2427                 }
2428
2429                 payload = session->buf + sizeof(struct avdtp_continue_header);
2430                 payload_size = size - sizeof(struct avdtp_continue_header);
2431
2432                 break;
2433         default:
2434                 error("Invalid AVDTP packet type 0x%02X", header->packet_type);
2435                 return PARSE_ERROR;
2436         }
2437
2438         if (session->in.data_size + payload_size >
2439                                         sizeof(session->in.buf)) {
2440                 error("Not enough incoming buffer space!");
2441                 return PARSE_ERROR;
2442         }
2443
2444         memcpy(session->in.buf + session->in.data_size, payload, payload_size);
2445         session->in.data_size += payload_size;
2446
2447         if (session->in.no_of_packets > 1) {
2448                 session->in.no_of_packets--;
2449                 DBG("Received AVDTP fragment. %d to go",
2450                                                 session->in.no_of_packets);
2451                 return PARSE_FRAGMENT;
2452         }
2453
2454         session->in.active = FALSE;
2455
2456         return PARSE_SUCCESS;
2457 }
2458
2459 static gboolean session_cb(GIOChannel *chan, GIOCondition cond,
2460                                 gpointer data)
2461 {
2462         struct avdtp *session = data;
2463         struct avdtp_common_header *header;
2464         ssize_t size;
2465         int fd;
2466
2467         DBG("");
2468
2469         if (cond & G_IO_NVAL)
2470                 return FALSE;
2471
2472         header = (void *) session->buf;
2473
2474         if (cond & (G_IO_HUP | G_IO_ERR))
2475                 goto failed;
2476
2477         fd = g_io_channel_unix_get_fd(chan);
2478         size = read(fd, session->buf, session->imtu);
2479         if (size < 0) {
2480                 error("IO Channel read error");
2481                 goto failed;
2482         }
2483
2484         if ((size_t) size < sizeof(struct avdtp_common_header)) {
2485                 error("Received too small packet (%zu bytes)", size);
2486                 goto failed;
2487         }
2488
2489         switch (avdtp_parse_data(session, session->buf, size)) {
2490         case PARSE_ERROR:
2491                 goto failed;
2492         case PARSE_FRAGMENT:
2493                 return TRUE;
2494         case PARSE_SUCCESS:
2495                 break;
2496         }
2497
2498         if (session->in.message_type == AVDTP_MSG_TYPE_COMMAND) {
2499 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
2500                 struct btd_service *service;
2501
2502                 service = btd_device_get_service(session->device, A2DP_SINK_UUID);
2503                 if (service != NULL) {
2504                         DBG("A2dp state %d", btd_service_get_state(
2505                                         btd_device_get_service(session->device, A2DP_SINK_UUID)));
2506
2507                         if (btd_service_get_state(btd_device_get_service(session->device,
2508                                         A2DP_SINK_UUID)) == BTD_SERVICE_STATE_DISCONNECTING) {
2509                                 DBG("avdtp:%p , disconnect timer is going on", session);
2510                                 return FALSE;
2511                         }
2512                 }
2513 #endif
2514                 if (!avdtp_parse_cmd(session, session->in.transaction,
2515                                         session->in.signal_id,
2516                                         session->in.buf,
2517                                         session->in.data_size)) {
2518                         error("Unable to handle command. Disconnecting");
2519                         goto failed;
2520                 }
2521
2522                 if (session->req && session->req->collided) {
2523                         DBG("Collision detected");
2524                         goto next;
2525                 }
2526
2527                 return TRUE;
2528         }
2529
2530         if (session->req == NULL) {
2531                 error("No pending request, ignoring message");
2532                 return TRUE;
2533         }
2534
2535         if (header->transaction != session->req->transaction) {
2536                 error("Transaction label doesn't match");
2537                 return TRUE;
2538         }
2539
2540         if (session->in.signal_id != session->req->signal_id) {
2541                 error("Response signal doesn't match");
2542                 return TRUE;
2543         }
2544
2545         g_source_remove(session->req->timeout);
2546         session->req->timeout = 0;
2547
2548         switch (header->message_type) {
2549         case AVDTP_MSG_TYPE_ACCEPT:
2550                 if (!avdtp_parse_resp(session, session->req->stream,
2551                                                 session->in.transaction,
2552                                                 session->in.signal_id,
2553                                                 session->in.buf,
2554                                                 session->in.data_size)) {
2555                         error("Unable to parse accept response");
2556                         goto failed;
2557                 }
2558                 break;
2559         case AVDTP_MSG_TYPE_REJECT:
2560                 if (!avdtp_parse_rej(session, session->req->stream,
2561                                                 session->in.transaction,
2562                                                 session->in.signal_id,
2563                                                 session->in.buf,
2564                                                 session->in.data_size)) {
2565                         error("Unable to parse reject response");
2566                         goto failed;
2567                 }
2568                 break;
2569         case AVDTP_MSG_TYPE_GEN_REJECT:
2570                 error("Received a General Reject message");
2571                 break;
2572         default:
2573                 error("Unknown message type 0x%02X", header->message_type);
2574                 break;
2575         }
2576
2577 next:
2578         pending_req_free(session->req);
2579         session->req = NULL;
2580
2581         process_queue(session);
2582
2583         return TRUE;
2584
2585 failed:
2586         connection_lost(session, EIO);
2587
2588         return FALSE;
2589 }
2590
2591 static uint16_t get_version(struct avdtp *session)
2592 {
2593         const sdp_record_t *rec;
2594         sdp_list_t *protos;
2595         sdp_data_t *proto_desc;
2596         uint16_t ver = 0x0100;
2597
2598         rec = btd_device_get_record(session->device, A2DP_SINK_UUID);
2599         if (!rec)
2600                 rec = btd_device_get_record(session->device, A2DP_SOURCE_UUID);
2601
2602         if (!rec)
2603                 return ver;
2604
2605         if (sdp_get_access_protos(rec, &protos) < 0)
2606                 return ver;
2607
2608         proto_desc = sdp_get_proto_desc(protos, AVDTP_UUID);
2609         if (proto_desc && proto_desc->dtd == SDP_UINT16)
2610                 ver = proto_desc->val.uint16;
2611
2612         sdp_list_foreach(protos, (sdp_list_func_t) sdp_list_free, NULL);
2613         sdp_list_free(protos, NULL);
2614
2615         return ver;
2616 }
2617
2618 static void avdtp_connect_cb(GIOChannel *chan, GError *err, gpointer user_data)
2619 {
2620         struct avdtp *session = user_data;
2621         char address[18];
2622         int err_no = EIO;
2623 #if defined TIZEN_FEATURE_BLUEZ_MODIFY
2624         struct btd_adapter *adapter;
2625         adapter = avdtp_get_adapter(session);
2626 #endif
2627
2628         if (err) {
2629                 err_no = err->code;
2630                 error("%s", err->message);
2631                 goto failed;
2632         }
2633
2634         if (!session->io)
2635                 session->io = g_io_channel_ref(chan);
2636
2637         bt_io_get(chan, &err,
2638                         BT_IO_OPT_OMTU, &session->omtu,
2639                         BT_IO_OPT_IMTU, &session->imtu,
2640                         BT_IO_OPT_INVALID);
2641         if (err) {
2642                 err_no = err->code;
2643                 error("%s", err->message);
2644                 goto failed;
2645         }
2646
2647         ba2str(device_get_address(session->device), address);
2648         DBG("AVDTP: connected %s channel to %s",
2649                         session->pending_open ? "transport" : "signaling",
2650                         address);
2651
2652         if (session->state == AVDTP_SESSION_STATE_CONNECTING) {
2653                 DBG("AVDTP imtu=%u, omtu=%u", session->imtu, session->omtu);
2654
2655                 session->buf = g_malloc0(MAX(session->imtu, session->omtu));
2656                 avdtp_set_state(session, AVDTP_SESSION_STATE_CONNECTED);
2657
2658                 if (session->io_id)
2659                         g_source_remove(session->io_id);
2660
2661                 /* This watch should be low priority since otherwise the
2662                  * connect callback might be dispatched before the session
2663                  * callback if the kernel wakes us up at the same time for
2664                  * them. This could happen if a headset is very quick in
2665                  * sending the Start command after connecting the stream
2666                  * transport channel.
2667                  */
2668                 session->io_id = g_io_add_watch_full(chan,
2669                                                 G_PRIORITY_LOW,
2670                                                 G_IO_IN | G_IO_ERR | G_IO_HUP
2671                                                 | G_IO_NVAL,
2672                                                 (GIOFunc) session_cb, session,
2673                                                 NULL);
2674
2675                 if (session->stream_setup) {
2676 #if defined TIZEN_FEATURE_BLUEZ_MODIFY
2677                         if (btd_adapter_get_a2dp_role(adapter) == BLUETOOTH_A2DP_SINK_ROLE)
2678                                 set_disconnect_timer_for_sink(session, FALSE);
2679                         else
2680                                 set_disconnect_timer(session);
2681 #else
2682                         set_disconnect_timer(session);
2683 #endif
2684                 }
2685         } else if (session->pending_open)
2686                 handle_transport_connect(session, chan, session->imtu,
2687                                                                 session->omtu);
2688         else
2689                 goto failed;
2690
2691         process_queue(session);
2692
2693         return;
2694
2695 failed:
2696         if (session->pending_open) {
2697                 struct avdtp_stream *stream = session->pending_open;
2698
2699                 handle_transport_connect(session, NULL, 0, 0);
2700
2701                 if (avdtp_abort(session, stream) < 0)
2702                         avdtp_sep_set_state(session, stream->lsep,
2703                                                 AVDTP_STATE_IDLE);
2704         } else
2705                 connection_lost(session, err_no);
2706 }
2707
2708 struct avdtp *avdtp_new(GIOChannel *chan, struct btd_device *device,
2709                                                         struct queue *lseps)
2710 {
2711         struct avdtp *session;
2712
2713         session = g_new0(struct avdtp, 1);
2714
2715         session->device = btd_device_ref(device);
2716         /* We don't use avdtp_set_state() here since this isn't a state change
2717          * but just setting of the initial state */
2718         session->state = AVDTP_SESSION_STATE_DISCONNECTED;
2719         session->lseps = lseps;
2720
2721         session->version = get_version(session);
2722
2723         if (!chan)
2724                 return session;
2725
2726         avdtp_set_state(session, AVDTP_SESSION_STATE_CONNECTING);
2727
2728         btd_device_add_uuid(device, ADVANCED_AUDIO_UUID);
2729
2730         session->io = g_io_channel_ref(chan);
2731         session->io_id = g_io_add_watch(chan, G_IO_ERR | G_IO_HUP | G_IO_NVAL,
2732                                         (GIOFunc) session_cb, session);
2733
2734         /* This is so that avdtp_connect_cb will know to do the right thing
2735          * with respect to the disconnect timer */
2736         session->stream_setup = TRUE;
2737
2738         avdtp_connect_cb(chan, NULL, session);
2739
2740         return session;
2741 }
2742
2743 static GIOChannel *l2cap_connect(struct avdtp *session)
2744 {
2745         GError *err = NULL;
2746         GIOChannel *io;
2747         const bdaddr_t *src;
2748 #if defined TIZEN_FEATURE_BLUEZ_MODIFY
2749         struct btd_adapter *adapter;
2750         adapter = avdtp_get_adapter(session);
2751 #endif
2752
2753         src = btd_adapter_get_address(device_get_adapter(session->device));
2754
2755 #if defined TIZEN_FEATURE_BLUEZ_MODIFY
2756         if (btd_adapter_get_a2dp_role(adapter) == BLUETOOTH_A2DP_SINK_ROLE) {
2757                 io = bt_io_connect(avdtp_connect_cb, session,
2758                                 NULL, &err,
2759                                 BT_IO_OPT_SOURCE_BDADDR, src,
2760                                 BT_IO_OPT_DEST_BDADDR,
2761                                 device_get_address(session->device),
2762                                 BT_IO_OPT_PSM, AVDTP_PSM,
2763                                 BT_IO_OPT_SEC_LEVEL, BT_IO_SEC_MEDIUM,
2764                                 BT_IO_OPT_IMTU, 895,
2765                                 BT_IO_OPT_INVALID);
2766         } else {
2767                 io = bt_io_connect(avdtp_connect_cb, session,
2768                                 NULL, &err,
2769                                 BT_IO_OPT_SOURCE_BDADDR, src,
2770                                 BT_IO_OPT_DEST_BDADDR,
2771                                 device_get_address(session->device),
2772                                 BT_IO_OPT_PSM, AVDTP_PSM,
2773                                 BT_IO_OPT_SEC_LEVEL, BT_IO_SEC_MEDIUM,
2774                                 BT_IO_OPT_INVALID);
2775         }
2776 #else
2777         io = bt_io_connect(avdtp_connect_cb, session,
2778                         NULL, &err,
2779                         BT_IO_OPT_SOURCE_BDADDR, src,
2780                         BT_IO_OPT_DEST_BDADDR,
2781                         device_get_address(session->device),
2782                         BT_IO_OPT_PSM, AVDTP_PSM,
2783                         BT_IO_OPT_SEC_LEVEL, BT_IO_SEC_MEDIUM,
2784                         BT_IO_OPT_INVALID);
2785 #endif
2786
2787         if (!io) {
2788                 error("%s", err->message);
2789                 g_error_free(err);
2790                 return NULL;
2791         }
2792
2793         return io;
2794 }
2795
2796 static void queue_request(struct avdtp *session, struct pending_req *req,
2797                         gboolean priority)
2798 {
2799         if (priority)
2800                 session->prio_queue = g_slist_append(session->prio_queue, req);
2801         else
2802                 session->req_queue = g_slist_append(session->req_queue, req);
2803 }
2804
2805 static uint8_t req_get_seid(struct pending_req *req)
2806 {
2807         if (req->signal_id == AVDTP_DISCOVER)
2808                 return 0;
2809
2810         return ((struct seid_req *) (req->data))->acp_seid;
2811 }
2812
2813 static int cancel_request(struct avdtp *session, int err)
2814 {
2815         struct pending_req *req;
2816         struct seid_req sreq;
2817         struct avdtp_local_sep *lsep;
2818         struct avdtp_stream *stream;
2819         uint8_t seid;
2820         struct avdtp_error averr;
2821
2822         req = session->req;
2823         session->req = NULL;
2824
2825         avdtp_error_init(&averr, AVDTP_ERRNO, err);
2826
2827         seid = req_get_seid(req);
2828         if (seid)
2829                 stream = find_stream_by_rseid(session, seid);
2830         else
2831                 stream = NULL;
2832
2833         if (stream) {
2834                 stream->abort_int = TRUE;
2835                 lsep = stream->lsep;
2836         } else
2837                 lsep = NULL;
2838
2839         switch (req->signal_id) {
2840         case AVDTP_RECONFIGURE:
2841                 error("Reconfigure: %s (%d)", strerror(err), err);
2842                 if (lsep && lsep->cfm && lsep->cfm->reconfigure)
2843                         lsep->cfm->reconfigure(session, lsep, stream, &averr,
2844                                                 lsep->user_data);
2845                 break;
2846         case AVDTP_OPEN:
2847                 error("Open: %s (%d)", strerror(err), err);
2848                 if (lsep && lsep->cfm && lsep->cfm->open)
2849                         lsep->cfm->open(session, lsep, stream, &averr,
2850                                         lsep->user_data);
2851                 break;
2852         case AVDTP_START:
2853                 error("Start: %s (%d)", strerror(err), err);
2854                 if (lsep && lsep->cfm && lsep->cfm->start) {
2855                         lsep->cfm->start(session, lsep, stream, &averr,
2856                                                 lsep->user_data);
2857                         if (stream)
2858                                 stream->starting = FALSE;
2859                 }
2860                 break;
2861         case AVDTP_SUSPEND:
2862                 error("Suspend: %s (%d)", strerror(err), err);
2863                 if (lsep && lsep->cfm && lsep->cfm->suspend)
2864                         lsep->cfm->suspend(session, lsep, stream, &averr,
2865                                                 lsep->user_data);
2866                 break;
2867         case AVDTP_CLOSE:
2868                 error("Close: %s (%d)", strerror(err), err);
2869                 if (lsep && lsep->cfm && lsep->cfm->close) {
2870                         lsep->cfm->close(session, lsep, stream, &averr,
2871                                                 lsep->user_data);
2872                         if (stream)
2873                                 stream->close_int = FALSE;
2874                 }
2875                 break;
2876         case AVDTP_SET_CONFIGURATION:
2877                 error("SetConfiguration: %s (%d)", strerror(err), err);
2878                 if (lsep && lsep->cfm && lsep->cfm->set_configuration)
2879                         lsep->cfm->set_configuration(session, lsep, stream,
2880                                                         &averr, lsep->user_data);
2881                 goto failed;
2882         case AVDTP_DISCOVER:
2883                 error("Discover: %s (%d)", strerror(err), err);
2884                 goto failed;
2885         case AVDTP_GET_CAPABILITIES:
2886                 error("GetCapabilities: %s (%d)", strerror(err), err);
2887                 goto failed;
2888         case AVDTP_ABORT:
2889                 error("Abort: %s (%d)", strerror(err), err);
2890                 goto failed;
2891         }
2892
2893         if (!stream)
2894                 goto failed;
2895
2896         memset(&sreq, 0, sizeof(sreq));
2897         sreq.acp_seid = seid;
2898
2899         err = send_request(session, TRUE, stream, AVDTP_ABORT, &sreq,
2900                                 sizeof(sreq));
2901         if (err < 0) {
2902                 error("Unable to send abort request");
2903                 goto failed;
2904         }
2905
2906         goto done;
2907
2908 failed:
2909         connection_lost(session, err);
2910 done:
2911         pending_req_free(req);
2912         return err;
2913 }
2914
2915 static gboolean request_timeout(gpointer user_data)
2916 {
2917         struct avdtp *session = user_data;
2918
2919         cancel_request(session, ETIMEDOUT);
2920
2921         return FALSE;
2922 }
2923
2924 static int send_req(struct avdtp *session, gboolean priority,
2925                         struct pending_req *req)
2926 {
2927         static int transaction = 0;
2928         int err;
2929
2930         if (session->state == AVDTP_SESSION_STATE_DISCONNECTED) {
2931                 session->io = l2cap_connect(session);
2932                 if (!session->io) {
2933                         err = -EIO;
2934                         goto failed;
2935                 }
2936                 avdtp_set_state(session, AVDTP_SESSION_STATE_CONNECTING);
2937         }
2938
2939         if (session->state < AVDTP_SESSION_STATE_CONNECTED ||
2940                         session->req != NULL) {
2941                 queue_request(session, req, priority);
2942                 return 0;
2943         }
2944
2945         req->transaction = transaction++;
2946         transaction %= 16;
2947
2948         /* FIXME: Should we retry to send if the buffer
2949         was not totally sent or in case of EINTR? */
2950         if (!avdtp_send(session, req->transaction, AVDTP_MSG_TYPE_COMMAND,
2951                                 req->signal_id, req->data, req->data_size)) {
2952                 err = -EIO;
2953                 goto failed;
2954         }
2955
2956         session->req = req;
2957
2958         req->timeout = g_timeout_add_seconds(req->signal_id == AVDTP_ABORT ?
2959                                         ABORT_TIMEOUT : REQ_TIMEOUT,
2960                                         request_timeout,
2961                                         session);
2962         return 0;
2963
2964 failed:
2965         g_free(req->data);
2966         g_free(req);
2967         return err;
2968 }
2969
2970 static int send_request(struct avdtp *session, gboolean priority,
2971                         struct avdtp_stream *stream, uint8_t signal_id,
2972                         void *buffer, size_t size)
2973 {
2974         struct pending_req *req;
2975
2976         if (stream && stream->abort_int && signal_id != AVDTP_ABORT) {
2977                 DBG("Unable to send requests while aborting");
2978                 return -EINVAL;
2979         }
2980
2981         req = g_new0(struct pending_req, 1);
2982         req->signal_id = signal_id;
2983         req->data = g_malloc(size);
2984         memcpy(req->data, buffer, size);
2985         req->data_size = size;
2986         req->stream = stream;
2987
2988         return send_req(session, priority, req);
2989 }
2990
2991 static gboolean avdtp_discover_resp(struct avdtp *session,
2992                                         struct discover_resp *resp, int size)
2993 {
2994         int sep_count, i;
2995         uint8_t getcap_cmd;
2996         int ret = 0;
2997         gboolean getcap_pending = FALSE;
2998
2999         if (session->version >= 0x0103)
3000                 getcap_cmd = AVDTP_GET_ALL_CAPABILITIES;
3001         else
3002                 getcap_cmd = AVDTP_GET_CAPABILITIES;
3003
3004         sep_count = size / sizeof(struct seid_info);
3005
3006         for (i = 0; i < sep_count; i++) {
3007                 struct avdtp_remote_sep *sep;
3008                 struct avdtp_stream *stream;
3009                 struct seid_req req;
3010
3011                 DBG("seid %d type %d media %d in use %d",
3012                                 resp->seps[i].seid, resp->seps[i].type,
3013                                 resp->seps[i].media_type, resp->seps[i].inuse);
3014
3015                 stream = find_stream_by_rseid(session, resp->seps[i].seid);
3016
3017                 sep = find_remote_sep(session->seps, resp->seps[i].seid);
3018                 if (!sep) {
3019                         if (resp->seps[i].inuse && !stream)
3020                                 continue;
3021                         sep = g_new0(struct avdtp_remote_sep, 1);
3022                         session->seps = g_slist_append(session->seps, sep);
3023                 }
3024
3025                 sep->stream = stream;
3026                 sep->seid = resp->seps[i].seid;
3027                 sep->type = resp->seps[i].type;
3028                 sep->media_type = resp->seps[i].media_type;
3029
3030                 memset(&req, 0, sizeof(req));
3031                 req.acp_seid = sep->seid;
3032
3033                 ret = send_request(session, TRUE, NULL, getcap_cmd,
3034                                                         &req, sizeof(req));
3035                 if (ret < 0)
3036                         break;
3037                 getcap_pending = TRUE;
3038         }
3039
3040         if (!getcap_pending)
3041                 finalize_discovery(session, -ret);
3042
3043         return TRUE;
3044 }
3045
3046 static gboolean avdtp_get_capabilities_resp(struct avdtp *session,
3047                                                 struct getcap_resp *resp,
3048                                                 unsigned int size)
3049 {
3050         struct avdtp_remote_sep *sep;
3051         uint8_t seid;
3052
3053         /* Check for minimum required packet size includes:
3054          *   1. getcap resp header
3055          *   2. media transport capability (2 bytes)
3056          *   3. media codec capability type + length (2 bytes)
3057          *   4. the actual media codec elements
3058          * */
3059         if (size < (sizeof(struct getcap_resp) + 4 +
3060                                 sizeof(struct avdtp_media_codec_capability))) {
3061                 error("Too short getcap resp packet");
3062                 return FALSE;
3063         }
3064
3065         seid = ((struct seid_req *) session->req->data)->acp_seid;
3066
3067         sep = find_remote_sep(session->seps, seid);
3068
3069         DBG("seid %d type %d media %d", sep->seid,
3070                                         sep->type, sep->media_type);
3071
3072         if (sep->caps) {
3073                 g_slist_free_full(sep->caps, g_free);
3074                 sep->caps = NULL;
3075                 sep->codec = NULL;
3076                 sep->delay_reporting = FALSE;
3077         }
3078
3079         sep->caps = caps_to_list(resp->caps, size - sizeof(struct getcap_resp),
3080                                         &sep->codec, &sep->delay_reporting);
3081
3082         return TRUE;
3083 }
3084
3085 static gboolean avdtp_set_configuration_resp(struct avdtp *session,
3086                                                 struct avdtp_stream *stream,
3087                                                 struct avdtp_single_header *resp,
3088                                                 int size)
3089 {
3090         struct avdtp_local_sep *sep = stream->lsep;
3091
3092         if (sep->cfm && sep->cfm->set_configuration)
3093                 sep->cfm->set_configuration(session, sep, stream, NULL,
3094                                                 sep->user_data);
3095
3096         avdtp_sep_set_state(session, sep, AVDTP_STATE_CONFIGURED);
3097
3098         return TRUE;
3099 }
3100
3101 static gboolean avdtp_reconfigure_resp(struct avdtp *session,
3102                                         struct avdtp_stream *stream,
3103                                         struct avdtp_single_header *resp, int size)
3104 {
3105         return TRUE;
3106 }
3107
3108 static gboolean avdtp_open_resp(struct avdtp *session, struct avdtp_stream *stream,
3109                                 struct seid_rej *resp, int size)
3110 {
3111         struct avdtp_local_sep *sep = stream->lsep;
3112
3113         stream->io = l2cap_connect(session);
3114         if (!stream->io) {
3115                 avdtp_sep_set_state(session, sep, AVDTP_STATE_IDLE);
3116                 return FALSE;
3117         }
3118
3119         session->pending_open = stream;
3120
3121         return TRUE;
3122 }
3123
3124 static gboolean avdtp_start_resp(struct avdtp *session,
3125                                         struct avdtp_stream *stream,
3126                                         struct seid_rej *resp, int size)
3127 {
3128         struct avdtp_local_sep *sep = stream->lsep;
3129
3130         if (sep->cfm && sep->cfm->start)
3131                 sep->cfm->start(session, sep, stream, NULL, sep->user_data);
3132
3133         /* We might be in STREAMING already if both sides send START_CMD at the
3134          * same time and the one in SNK role doesn't reject it as it should */
3135         if (sep->state != AVDTP_STATE_STREAMING)
3136                 avdtp_sep_set_state(session, sep, AVDTP_STATE_STREAMING);
3137
3138         return TRUE;
3139 }
3140
3141 static gboolean avdtp_close_resp(struct avdtp *session,
3142                                         struct avdtp_stream *stream,
3143                                         struct seid_rej *resp, int size)
3144 {
3145         struct avdtp_local_sep *sep = stream->lsep;
3146
3147         avdtp_sep_set_state(session, sep, AVDTP_STATE_CLOSING);
3148
3149         close_stream(stream);
3150
3151         return TRUE;
3152 }
3153
3154 static gboolean avdtp_suspend_resp(struct avdtp *session,
3155                                         struct avdtp_stream *stream,
3156                                         void *data, int size)
3157 {
3158         struct avdtp_local_sep *sep = stream->lsep;
3159
3160         avdtp_sep_set_state(session, sep, AVDTP_STATE_OPEN);
3161
3162         if (sep->cfm && sep->cfm->suspend)
3163                 sep->cfm->suspend(session, sep, stream, NULL, sep->user_data);
3164
3165         return TRUE;
3166 }
3167
3168 static gboolean avdtp_abort_resp(struct avdtp *session,
3169                                         struct avdtp_stream *stream,
3170                                         struct seid_rej *resp, int size)
3171 {
3172         struct avdtp_local_sep *sep = stream->lsep;
3173 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
3174         if (!sep) {
3175                 error("Error in getting sep");
3176                 return FALSE;
3177         }
3178 #endif
3179
3180         avdtp_sep_set_state(session, sep, AVDTP_STATE_ABORTING);
3181
3182         if (sep->cfm && sep->cfm->abort)
3183                 sep->cfm->abort(session, sep, stream, NULL, sep->user_data);
3184
3185         avdtp_sep_set_state(session, sep, AVDTP_STATE_IDLE);
3186
3187         return TRUE;
3188 }
3189
3190 static gboolean avdtp_delay_report_resp(struct avdtp *session,
3191                                         struct avdtp_stream *stream,
3192                                         void *data, int size)
3193 {
3194         struct avdtp_local_sep *sep = stream->lsep;
3195
3196         if (sep->cfm && sep->cfm->delay_report)
3197                 sep->cfm->delay_report(session, sep, stream, NULL, sep->user_data);
3198
3199         return TRUE;
3200 }
3201
3202 static gboolean avdtp_parse_resp(struct avdtp *session,
3203                                         struct avdtp_stream *stream,
3204                                         uint8_t transaction, uint8_t signal_id,
3205                                         void *buf, int size)
3206 {
3207         struct pending_req *next;
3208         const char *get_all = "";
3209
3210         if (session->prio_queue)
3211                 next = session->prio_queue->data;
3212         else if (session->req_queue)
3213                 next = session->req_queue->data;
3214         else
3215                 next = NULL;
3216
3217         switch (signal_id) {
3218         case AVDTP_DISCOVER:
3219                 DBG("DISCOVER request succeeded");
3220                 return avdtp_discover_resp(session, buf, size);
3221         case AVDTP_GET_ALL_CAPABILITIES:
3222                 get_all = "ALL_";
3223         case AVDTP_GET_CAPABILITIES:
3224                 DBG("GET_%sCAPABILITIES request succeeded", get_all);
3225                 if (!avdtp_get_capabilities_resp(session, buf, size))
3226                         return FALSE;
3227                 if (!(next && (next->signal_id == AVDTP_GET_CAPABILITIES ||
3228                                 next->signal_id == AVDTP_GET_ALL_CAPABILITIES)))
3229                         finalize_discovery(session, 0);
3230                 return TRUE;
3231         }
3232
3233         /* The remaining commands require an existing stream so bail out
3234          * here if the stream got unexpectedly disconnected */
3235         if (!stream) {
3236                 DBG("AVDTP: stream was closed while waiting for reply");
3237                 return TRUE;
3238         }
3239
3240         switch (signal_id) {
3241         case AVDTP_SET_CONFIGURATION:
3242                 DBG("SET_CONFIGURATION request succeeded");
3243                 return avdtp_set_configuration_resp(session, stream,
3244                                                                 buf, size);
3245         case AVDTP_RECONFIGURE:
3246                 DBG("RECONFIGURE request succeeded");
3247                 return avdtp_reconfigure_resp(session, stream, buf, size);
3248         case AVDTP_OPEN:
3249                 DBG("OPEN request succeeded");
3250                 return avdtp_open_resp(session, stream, buf, size);
3251         case AVDTP_SUSPEND:
3252                 DBG("SUSPEND request succeeded");
3253                 return avdtp_suspend_resp(session, stream, buf, size);
3254         case AVDTP_START:
3255                 DBG("START request succeeded");
3256                 return avdtp_start_resp(session, stream, buf, size);
3257         case AVDTP_CLOSE:
3258                 DBG("CLOSE request succeeded");
3259                 return avdtp_close_resp(session, stream, buf, size);
3260         case AVDTP_ABORT:
3261                 DBG("ABORT request succeeded");
3262                 return avdtp_abort_resp(session, stream, buf, size);
3263         case AVDTP_DELAY_REPORT:
3264                 DBG("DELAY_REPORT request succeeded");
3265                 return avdtp_delay_report_resp(session, stream, buf, size);
3266         }
3267
3268         error("Unknown signal id in accept response: %u", signal_id);
3269         return TRUE;
3270 }
3271
3272 static gboolean seid_rej_to_err(struct seid_rej *rej, unsigned int size,
3273                                         struct avdtp_error *err)
3274 {
3275         if (size < sizeof(struct seid_rej)) {
3276                 error("Too small packet for seid_rej");
3277                 return FALSE;
3278         }
3279
3280         avdtp_error_init(err, 0x00, rej->error);
3281
3282         return TRUE;
3283 }
3284
3285 static gboolean conf_rej_to_err(struct conf_rej *rej, unsigned int size,
3286                                 struct avdtp_error *err)
3287 {
3288         if (size < sizeof(struct conf_rej)) {
3289                 error("Too small packet for conf_rej");
3290                 return FALSE;
3291         }
3292
3293         avdtp_error_init(err, rej->category, rej->error);
3294
3295         return TRUE;
3296 }
3297
3298 static gboolean stream_rej_to_err(struct stream_rej *rej, unsigned int size,
3299                                         struct avdtp_error *err,
3300                                         uint8_t *acp_seid)
3301 {
3302         if (size < sizeof(struct stream_rej)) {
3303                 error("Too small packet for stream_rej");
3304                 return FALSE;
3305         }
3306
3307         avdtp_error_init(err, 0x00, rej->error);
3308
3309         if (acp_seid)
3310                 *acp_seid = rej->acp_seid;
3311
3312         return TRUE;
3313 }
3314
3315 static gboolean avdtp_parse_rej(struct avdtp *session,
3316                                         struct avdtp_stream *stream,
3317                                         uint8_t transaction, uint8_t signal_id,
3318                                         void *buf, int size)
3319 {
3320         struct avdtp_error err;
3321         uint8_t acp_seid;
3322         struct avdtp_local_sep *sep = stream ? stream->lsep : NULL;
3323
3324         switch (signal_id) {
3325         case AVDTP_DISCOVER:
3326                 if (!seid_rej_to_err(buf, size, &err))
3327                         return FALSE;
3328                 error("DISCOVER request rejected: %s (%d)",
3329                                 avdtp_strerror(&err), err.err.error_code);
3330                 return TRUE;
3331         case AVDTP_GET_CAPABILITIES:
3332         case AVDTP_GET_ALL_CAPABILITIES:
3333                 if (!seid_rej_to_err(buf, size, &err))
3334                         return FALSE;
3335                 error("GET_CAPABILITIES request rejected: %s (%d)",
3336                                 avdtp_strerror(&err), err.err.error_code);
3337                 return TRUE;
3338         case AVDTP_OPEN:
3339                 if (!seid_rej_to_err(buf, size, &err))
3340                         return FALSE;
3341                 error("OPEN request rejected: %s (%d)",
3342                                 avdtp_strerror(&err), err.err.error_code);
3343                 if (sep && sep->cfm && sep->cfm->open)
3344                         sep->cfm->open(session, sep, stream, &err,
3345                                         sep->user_data);
3346                 return TRUE;
3347         case AVDTP_SET_CONFIGURATION:
3348                 if (!conf_rej_to_err(buf, size, &err))
3349                         return FALSE;
3350                 error("SET_CONFIGURATION request rejected: %s (%d)",
3351                                 avdtp_strerror(&err), err.err.error_code);
3352                 if (sep && sep->cfm && sep->cfm->set_configuration)
3353                         sep->cfm->set_configuration(session, sep, stream,
3354                                                         &err, sep->user_data);
3355                 return TRUE;
3356         case AVDTP_RECONFIGURE:
3357                 if (!conf_rej_to_err(buf, size, &err))
3358                         return FALSE;
3359                 error("RECONFIGURE request rejected: %s (%d)",
3360                                 avdtp_strerror(&err), err.err.error_code);
3361                 if (sep && sep->cfm && sep->cfm->reconfigure)
3362                         sep->cfm->reconfigure(session, sep, stream, &err,
3363                                                 sep->user_data);
3364                 return TRUE;
3365         case AVDTP_START:
3366                 if (!stream_rej_to_err(buf, size, &err, &acp_seid))
3367                         return FALSE;
3368                 error("START request rejected: %s (%d)",
3369                                 avdtp_strerror(&err), err.err.error_code);
3370                 if (sep && sep->cfm && sep->cfm->start) {
3371                         sep->cfm->start(session, sep, stream, &err,
3372                                         sep->user_data);
3373                         stream->starting = FALSE;
3374                 }
3375                 return TRUE;
3376         case AVDTP_SUSPEND:
3377                 if (!stream_rej_to_err(buf, size, &err, &acp_seid))
3378                         return FALSE;
3379                 error("SUSPEND request rejected: %s (%d)",
3380                                 avdtp_strerror(&err), err.err.error_code);
3381                 if (sep && sep->cfm && sep->cfm->suspend)
3382                         sep->cfm->suspend(session, sep, stream, &err,
3383                                                 sep->user_data);
3384                 return TRUE;
3385         case AVDTP_CLOSE:
3386                 if (!stream_rej_to_err(buf, size, &err, &acp_seid))
3387                         return FALSE;
3388                 error("CLOSE request rejected: %s (%d)",
3389                                 avdtp_strerror(&err), err.err.error_code);
3390                 if (sep && sep->cfm && sep->cfm->close) {
3391                         sep->cfm->close(session, sep, stream, &err,
3392                                         sep->user_data);
3393                         stream->close_int = FALSE;
3394                 }
3395                 return TRUE;
3396         case AVDTP_ABORT:
3397                 if (!stream_rej_to_err(buf, size, &err, &acp_seid))
3398                         return FALSE;
3399                 error("ABORT request rejected: %s (%d)",
3400                                 avdtp_strerror(&err), err.err.error_code);
3401                 if (sep && sep->cfm && sep->cfm->abort)
3402                         sep->cfm->abort(session, sep, stream, &err,
3403                                         sep->user_data);
3404                 return FALSE;
3405         case AVDTP_DELAY_REPORT:
3406                 if (!stream_rej_to_err(buf, size, &err, &acp_seid))
3407                         return FALSE;
3408                 error("DELAY_REPORT request rejected: %s (%d)",
3409                                 avdtp_strerror(&err), err.err.error_code);
3410                 if (sep && sep->cfm && sep->cfm->delay_report)
3411                         sep->cfm->delay_report(session, sep, stream, &err,
3412                                                         sep->user_data);
3413                 return TRUE;
3414         default:
3415                 error("Unknown reject response signal id: %u", signal_id);
3416                 return TRUE;
3417         }
3418 }
3419
3420 struct avdtp_service_capability *avdtp_stream_get_codec(
3421                                                 struct avdtp_stream *stream)
3422 {
3423         GSList *l;
3424
3425         for (l = stream->caps; l; l = l->next) {
3426                 struct avdtp_service_capability *cap = l->data;
3427
3428                 if (cap->category == AVDTP_MEDIA_CODEC)
3429                         return cap;
3430         }
3431
3432         return NULL;
3433 }
3434
3435 static gboolean avdtp_stream_has_capability(struct avdtp_stream *stream,
3436                                         struct avdtp_service_capability *cap)
3437 {
3438         GSList *l;
3439         struct avdtp_service_capability *stream_cap;
3440
3441         for (l = stream->caps; l; l = g_slist_next(l)) {
3442                 stream_cap = l->data;
3443
3444                 if (stream_cap->category != cap->category ||
3445                         stream_cap->length != cap->length)
3446                         continue;
3447
3448                 if (memcmp(stream_cap->data, cap->data, cap->length) == 0)
3449                         return TRUE;
3450         }
3451
3452         return FALSE;
3453 }
3454
3455 gboolean avdtp_stream_has_capabilities(struct avdtp_stream *stream,
3456                                         GSList *caps)
3457 {
3458         for (; caps; caps = g_slist_next(caps)) {
3459                 struct avdtp_service_capability *cap = caps->data;
3460
3461                 if (!avdtp_stream_has_capability(stream, cap))
3462                         return FALSE;
3463         }
3464
3465         return TRUE;
3466 }
3467
3468 struct avdtp_remote_sep *avdtp_stream_get_remote_sep(
3469                                                 struct avdtp_stream *stream)
3470 {
3471         GSList *l;
3472
3473         for (l = stream->session->seps; l; l = l->next) {
3474                 struct avdtp_remote_sep *sep = l->data;
3475
3476                 if (sep->seid == stream->rseid)
3477                         return sep;
3478         }
3479
3480         return NULL;
3481 }
3482
3483 gboolean avdtp_stream_set_transport(struct avdtp_stream *stream, int fd,
3484                                                 size_t imtu, size_t omtu)
3485 {
3486         GIOChannel *io;
3487
3488         if (stream != stream->session->pending_open)
3489                 return FALSE;
3490
3491         io = g_io_channel_unix_new(fd);
3492
3493         handle_transport_connect(stream->session, io, imtu, omtu);
3494
3495         g_io_channel_unref(io);
3496
3497         return TRUE;
3498 }
3499
3500 gboolean avdtp_stream_get_transport(struct avdtp_stream *stream, int *sock,
3501                                         uint16_t *imtu, uint16_t *omtu,
3502                                         GSList **caps)
3503 {
3504         if (stream->io == NULL)
3505                 return FALSE;
3506
3507         if (sock)
3508                 *sock = g_io_channel_unix_get_fd(stream->io);
3509
3510         if (omtu)
3511                 *omtu = stream->omtu;
3512
3513         if (imtu)
3514                 *imtu = stream->imtu;
3515
3516         if (caps)
3517                 *caps = stream->caps;
3518
3519         return TRUE;
3520 }
3521
3522 static int process_queue(struct avdtp *session)
3523 {
3524         GSList **queue, *l;
3525         struct pending_req *req;
3526
3527         if (session->req)
3528                 return 0;
3529
3530         if (session->prio_queue)
3531                 queue = &session->prio_queue;
3532         else
3533                 queue = &session->req_queue;
3534
3535         if (!*queue)
3536                 return 0;
3537
3538         l = *queue;
3539         req = l->data;
3540
3541         *queue = g_slist_remove(*queue, req);
3542
3543         return send_req(session, FALSE, req);
3544 }
3545
3546 struct avdtp_service_capability *avdtp_get_codec(struct avdtp_remote_sep *sep)
3547 {
3548         return sep->codec;
3549 }
3550
3551 struct avdtp_service_capability *avdtp_service_cap_new(uint8_t category,
3552                                                         void *data, int length)
3553 {
3554         struct avdtp_service_capability *cap;
3555
3556         if (category < AVDTP_MEDIA_TRANSPORT || category > AVDTP_DELAY_REPORTING)
3557                 return NULL;
3558
3559         cap = g_malloc(sizeof(struct avdtp_service_capability) + length);
3560         cap->category = category;
3561         cap->length = length;
3562         memcpy(cap->data, data, length);
3563
3564         return cap;
3565 }
3566
3567 static gboolean process_discover(gpointer data)
3568 {
3569         struct avdtp *session = data;
3570
3571         session->discover->id = 0;
3572
3573         finalize_discovery(session, 0);
3574
3575         return FALSE;
3576 }
3577
3578 int avdtp_discover(struct avdtp *session, avdtp_discover_cb_t cb,
3579                         void *user_data)
3580 {
3581         int err;
3582
3583         if (session->discover)
3584                 return -EBUSY;
3585
3586         session->discover = g_new0(struct discover_callback, 1);
3587
3588         if (session->seps) {
3589                 session->discover->cb = cb;
3590                 session->discover->user_data = user_data;
3591                 session->discover->id = g_idle_add(process_discover, session);
3592                 return 0;
3593         }
3594
3595         err = send_request(session, FALSE, NULL, AVDTP_DISCOVER, NULL, 0);
3596         if (err == 0) {
3597                 session->discover->cb = cb;
3598                 session->discover->user_data = user_data;
3599         }
3600
3601         return err;
3602 }
3603
3604 gboolean avdtp_stream_remove_cb(struct avdtp *session,
3605                                 struct avdtp_stream *stream,
3606                                 unsigned int id)
3607 {
3608         GSList *l;
3609         struct stream_callback *cb;
3610
3611         if (!stream)
3612                 return FALSE;
3613
3614         for (cb = NULL, l = stream->callbacks; l != NULL; l = l->next) {
3615                 struct stream_callback *tmp = l->data;
3616                 if (tmp && tmp->id == id) {
3617                         cb = tmp;
3618                         break;
3619                 }
3620         }
3621
3622         if (!cb)
3623                 return FALSE;
3624
3625         stream->callbacks = g_slist_remove(stream->callbacks, cb);
3626         g_free(cb);
3627
3628         return TRUE;
3629 }
3630
3631 unsigned int avdtp_stream_add_cb(struct avdtp *session,
3632                                         struct avdtp_stream *stream,
3633                                         avdtp_stream_state_cb cb, void *data)
3634 {
3635         struct stream_callback *stream_cb;
3636         static unsigned int id = 0;
3637
3638         stream_cb = g_new(struct stream_callback, 1);
3639         stream_cb->cb = cb;
3640         stream_cb->user_data = data;
3641         stream_cb->id = ++id;
3642
3643         stream->callbacks = g_slist_append(stream->callbacks, stream_cb);
3644
3645         return stream_cb->id;
3646 }
3647
3648 int avdtp_get_configuration(struct avdtp *session, struct avdtp_stream *stream)
3649 {
3650         struct seid_req req;
3651
3652         if (session->state < AVDTP_SESSION_STATE_CONNECTED)
3653                 return -EINVAL;
3654
3655         memset(&req, 0, sizeof(req));
3656         req.acp_seid = stream->rseid;
3657
3658         return send_request(session, FALSE, stream, AVDTP_GET_CONFIGURATION,
3659                                                         &req, sizeof(req));
3660 }
3661
3662 static void copy_capabilities(gpointer data, gpointer user_data)
3663 {
3664         struct avdtp_service_capability *src_cap = data;
3665         struct avdtp_service_capability *dst_cap;
3666         GSList **l = user_data;
3667
3668         dst_cap = avdtp_service_cap_new(src_cap->category, src_cap->data,
3669                                         src_cap->length);
3670
3671         *l = g_slist_append(*l, dst_cap);
3672 }
3673
3674 int avdtp_set_configuration(struct avdtp *session,
3675                                 struct avdtp_remote_sep *rsep,
3676                                 struct avdtp_local_sep *lsep,
3677                                 GSList *caps,
3678                                 struct avdtp_stream **stream)
3679 {
3680         struct setconf_req *req;
3681         struct avdtp_stream *new_stream;
3682         unsigned char *ptr;
3683         int err, caps_len;
3684         struct avdtp_service_capability *cap;
3685         GSList *l;
3686
3687         if (session->state != AVDTP_SESSION_STATE_CONNECTED)
3688                 return -ENOTCONN;
3689
3690         if (!(lsep && rsep))
3691                 return -EINVAL;
3692
3693         DBG("%p: int_seid=%u, acp_seid=%u", session,
3694                         lsep->info.seid, rsep->seid);
3695
3696         new_stream = g_new0(struct avdtp_stream, 1);
3697         new_stream->session = session;
3698         new_stream->lsep = lsep;
3699         new_stream->rseid = rsep->seid;
3700
3701         if (rsep->delay_reporting && lsep->delay_reporting) {
3702                 struct avdtp_service_capability *delay_reporting;
3703
3704                 delay_reporting = avdtp_service_cap_new(AVDTP_DELAY_REPORTING,
3705                                                                 NULL, 0);
3706                 caps = g_slist_append(caps, delay_reporting);
3707                 new_stream->delay_reporting = TRUE;
3708         }
3709
3710         g_slist_foreach(caps, copy_capabilities, &new_stream->caps);
3711
3712         /* Calculate total size of request */
3713         for (l = caps, caps_len = 0; l != NULL; l = g_slist_next(l)) {
3714                 cap = l->data;
3715                 caps_len += cap->length + 2;
3716         }
3717
3718         req = g_malloc0(sizeof(struct setconf_req) + caps_len);
3719
3720         req->int_seid = lsep->info.seid;
3721         req->acp_seid = rsep->seid;
3722
3723         /* Copy the capabilities into the request */
3724         for (l = caps, ptr = req->caps; l != NULL; l = g_slist_next(l)) {
3725                 cap = l->data;
3726                 memcpy(ptr, cap, cap->length + 2);
3727                 ptr += cap->length + 2;
3728         }
3729
3730         err = send_request(session, FALSE, new_stream,
3731                                 AVDTP_SET_CONFIGURATION, req,
3732                                 sizeof(struct setconf_req) + caps_len);
3733         if (err < 0)
3734                 stream_free(new_stream);
3735         else {
3736                 lsep->info.inuse = 1;
3737                 lsep->stream = new_stream;
3738                 rsep->stream = new_stream;
3739                 session->streams = g_slist_append(session->streams, new_stream);
3740                 if (stream)
3741                         *stream = new_stream;
3742         }
3743
3744         g_free(req);
3745
3746         return err;
3747 }
3748
3749 int avdtp_open(struct avdtp *session, struct avdtp_stream *stream)
3750 {
3751         struct seid_req req;
3752
3753         if (!g_slist_find(session->streams, stream))
3754                 return -EINVAL;
3755
3756         if (stream->lsep->state > AVDTP_STATE_CONFIGURED)
3757                 return -EINVAL;
3758
3759         memset(&req, 0, sizeof(req));
3760         req.acp_seid = stream->rseid;
3761
3762         return send_request(session, FALSE, stream, AVDTP_OPEN,
3763                                                         &req, sizeof(req));
3764 }
3765
3766 static gboolean start_timeout(gpointer user_data)
3767 {
3768         struct avdtp_stream *stream = user_data;
3769         struct avdtp *session = stream->session;
3770
3771         stream->open_acp = FALSE;
3772
3773         if (avdtp_start(session, stream) < 0)
3774                 error("wait_timeout: avdtp_start failed");
3775
3776         stream->start_timer = 0;
3777
3778         return FALSE;
3779 }
3780
3781 int avdtp_start(struct avdtp *session, struct avdtp_stream *stream)
3782 {
3783         struct start_req req;
3784         int ret;
3785
3786         if (!g_slist_find(session->streams, stream))
3787                 return -EINVAL;
3788
3789         if (stream->lsep->state != AVDTP_STATE_OPEN)
3790                 return -EINVAL;
3791
3792         /* Recommendation 12:
3793          *  If the RD has configured and opened a stream it is also responsible
3794          *  to start the streaming via GAVDP_START.
3795          */
3796         if (stream->open_acp) {
3797                 /* If timer already active wait it */
3798                 if (stream->start_timer)
3799                         return 0;
3800 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
3801                 else {
3802                         char address[18];
3803                         uint32_t timeout_sec = START_TIMEOUT;
3804
3805                         ba2str(device_get_address(session->device), address);
3806                         /* For Bose headset (Bose AE2w) 2 seconds timeout is required to avoid AVDTP ABORT_CMD */
3807                         if (!strncasecmp(address, "00:0C:8A", 8))
3808                                 timeout_sec = 2;
3809                         /* For Gear Circle, HS3000 headset, this headset doesn't initiate start command and
3810                          * when we add timer for 1 second so idle may trigger callback after 1.2 sec or
3811                          * 1.5 sec. So, don't timer for this headset.*/
3812                         if (!strncasecmp(address, "10:92:66", 8) ||
3813                                 !strncasecmp(address, "A8:9F:BA", 8) ||
3814                                 !strncasecmp(address, "00:26:B4", 8)) {
3815                                 start_timeout(stream);
3816                                 return 0;
3817                         }
3818                          /* Here we can't use Mac address as there are changing so check for name */
3819                         char name[10];
3820                         device_get_name(session->device, name, sizeof(name));
3821                         DBG("name : %s", name);
3822                         if (g_str_equal(name, "HS3000")) {
3823                                 start_timeout(stream);
3824                                 return 0;
3825                         }
3826
3827                         stream->start_timer = g_timeout_add_seconds(timeout_sec,
3828                                                                         start_timeout,
3829                                                                         stream);
3830                         return 0;
3831                 }
3832 #else
3833                 stream->start_timer = g_timeout_add_seconds(START_TIMEOUT,
3834                                                                 start_timeout,
3835                                                                 stream);
3836                 return 0;
3837 #endif
3838         }
3839
3840         if (stream->close_int == TRUE) {
3841                 error("avdtp_start: rejecting start since close is initiated");
3842                 return -EINVAL;
3843         }
3844
3845         if (stream->starting == TRUE) {
3846                 DBG("stream already started");
3847                 return -EINPROGRESS;
3848         }
3849
3850         memset(&req, 0, sizeof(req));
3851         req.first_seid.seid = stream->rseid;
3852
3853         ret = send_request(session, FALSE, stream, AVDTP_START,
3854                                                         &req, sizeof(req));
3855         if (ret == 0)
3856                 stream->starting = TRUE;
3857
3858         return ret;
3859 }
3860
3861 int avdtp_close(struct avdtp *session, struct avdtp_stream *stream,
3862                 gboolean immediate)
3863 {
3864         struct seid_req req;
3865         int ret;
3866
3867         if (!g_slist_find(session->streams, stream))
3868                 return -EINVAL;
3869
3870         if (stream->lsep->state < AVDTP_STATE_OPEN)
3871                 return -EINVAL;
3872
3873         if (stream->close_int == TRUE) {
3874                 error("avdtp_close: rejecting since close is already initiated");
3875                 return -EINVAL;
3876         }
3877
3878         if (immediate && session->req && stream == session->req->stream)
3879                 return avdtp_abort(session, stream);
3880
3881         memset(&req, 0, sizeof(req));
3882         req.acp_seid = stream->rseid;
3883
3884         ret = send_request(session, FALSE, stream, AVDTP_CLOSE,
3885                                                         &req, sizeof(req));
3886         if (ret == 0)
3887                 stream->close_int = TRUE;
3888
3889         return ret;
3890 }
3891
3892 int avdtp_suspend(struct avdtp *session, struct avdtp_stream *stream)
3893 {
3894         struct seid_req req;
3895
3896         if (!g_slist_find(session->streams, stream))
3897                 return -EINVAL;
3898
3899         if (stream->lsep->state <= AVDTP_STATE_OPEN || stream->close_int)
3900                 return -EINVAL;
3901
3902         memset(&req, 0, sizeof(req));
3903         req.acp_seid = stream->rseid;
3904
3905         return send_request(session, FALSE, stream, AVDTP_SUSPEND,
3906                                                         &req, sizeof(req));
3907 }
3908
3909 int avdtp_abort(struct avdtp *session, struct avdtp_stream *stream)
3910 {
3911         struct seid_req req;
3912         int ret;
3913
3914         if (!stream && session->discover) {
3915                 /* Don't call cb since it being aborted */
3916                 session->discover->cb = NULL;
3917                 finalize_discovery(session, ECANCELED);
3918                 return -EALREADY;
3919         }
3920
3921         if (!g_slist_find(session->streams, stream))
3922                 return -EINVAL;
3923
3924         if (stream->lsep->state == AVDTP_STATE_ABORTING)
3925                 return -EINVAL;
3926
3927         if (session->req && stream == session->req->stream)
3928                 return cancel_request(session, ECANCELED);
3929
3930         memset(&req, 0, sizeof(req));
3931         req.acp_seid = stream->rseid;
3932
3933         ret = send_request(session, TRUE, stream, AVDTP_ABORT,
3934                                                         &req, sizeof(req));
3935         if (ret == 0)
3936                 stream->abort_int = TRUE;
3937
3938         return ret;
3939 }
3940
3941 int avdtp_delay_report(struct avdtp *session, struct avdtp_stream *stream,
3942                                                         uint16_t delay)
3943 {
3944         struct delay_req req;
3945
3946         if (!g_slist_find(session->streams, stream))
3947                 return -EINVAL;
3948
3949         if (stream->lsep->state != AVDTP_STATE_CONFIGURED &&
3950                                 stream->lsep->state != AVDTP_STATE_STREAMING)
3951                 return -EINVAL;
3952
3953         if (!stream->delay_reporting || session->version < 0x0103)
3954                 return -EINVAL;
3955
3956         stream->delay = delay;
3957
3958         memset(&req, 0, sizeof(req));
3959         req.acp_seid = stream->rseid;
3960         req.delay = htons(delay);
3961
3962         return send_request(session, TRUE, stream, AVDTP_DELAY_REPORT,
3963                                                         &req, sizeof(req));
3964 }
3965
3966 struct avdtp_local_sep *avdtp_register_sep(struct queue *lseps, uint8_t type,
3967                                                 uint8_t media_type,
3968                                                 uint8_t codec_type,
3969                                                 gboolean delay_reporting,
3970                                                 struct avdtp_sep_ind *ind,
3971                                                 struct avdtp_sep_cfm *cfm,
3972                                                 void *user_data)
3973 {
3974         struct avdtp_local_sep *sep;
3975         uint8_t seid = util_get_uid(&seids, MAX_SEID);
3976
3977         if (!seid)
3978                 return NULL;
3979
3980         sep = g_new0(struct avdtp_local_sep, 1);
3981
3982         sep->state = AVDTP_STATE_IDLE;
3983         sep->info.seid = seid;
3984         sep->info.type = type;
3985         sep->info.media_type = media_type;
3986         sep->codec = codec_type;
3987         sep->ind = ind;
3988         sep->cfm = cfm;
3989         sep->user_data = user_data;
3990         sep->delay_reporting = delay_reporting;
3991
3992         DBG("SEP %p registered: type:%d codec:%d seid:%d", sep,
3993                         sep->info.type, sep->codec, sep->info.seid);
3994
3995         if (!queue_push_tail(lseps, sep)) {
3996                 g_free(sep);
3997                 return NULL;
3998         }
3999
4000         return sep;
4001 }
4002
4003 int avdtp_unregister_sep(struct queue *lseps, struct avdtp_local_sep *sep)
4004 {
4005         if (!sep)
4006                 return -EINVAL;
4007
4008         if (sep->stream)
4009                 release_stream(sep->stream, sep->stream->session);
4010
4011         DBG("SEP %p unregistered: type:%d codec:%d seid:%d", sep,
4012                         sep->info.type, sep->codec, sep->info.seid);
4013
4014         util_clear_uid(&seids, sep->info.seid);
4015         queue_remove(lseps, sep);
4016         g_free(sep);
4017
4018         return 0;
4019 }
4020
4021 const char *avdtp_strerror(struct avdtp_error *err)
4022 {
4023         if (err->category == AVDTP_ERRNO)
4024                 return strerror(err->err.posix_errno);
4025
4026         switch(err->err.error_code) {
4027         case AVDTP_BAD_HEADER_FORMAT:
4028                 return "Bad Header Format";
4029         case AVDTP_BAD_LENGTH:
4030                 return "Bad Packet Length";
4031         case AVDTP_BAD_ACP_SEID:
4032                 return "Bad Acceptor SEID";
4033         case AVDTP_SEP_IN_USE:
4034                 return "Stream End Point in Use";
4035         case AVDTP_SEP_NOT_IN_USE:
4036                 return "Stream End Point Not in Use";
4037         case AVDTP_BAD_SERV_CATEGORY:
4038                 return "Bad Service Category";
4039         case AVDTP_BAD_PAYLOAD_FORMAT:
4040                 return "Bad Payload format";
4041         case AVDTP_NOT_SUPPORTED_COMMAND:
4042                 return "Command Not Supported";
4043         case AVDTP_INVALID_CAPABILITIES:
4044                 return "Invalid Capabilities";
4045         case AVDTP_BAD_RECOVERY_TYPE:
4046                 return "Bad Recovery Type";
4047         case AVDTP_BAD_MEDIA_TRANSPORT_FORMAT:
4048                 return "Bad Media Transport Format";
4049         case AVDTP_BAD_RECOVERY_FORMAT:
4050                 return "Bad Recovery Format";
4051         case AVDTP_BAD_ROHC_FORMAT:
4052                 return "Bad Header Compression Format";
4053         case AVDTP_BAD_CP_FORMAT:
4054                 return "Bad Content Protection Format";
4055         case AVDTP_BAD_MULTIPLEXING_FORMAT:
4056                 return "Bad Multiplexing Format";
4057         case AVDTP_UNSUPPORTED_CONFIGURATION:
4058                 return "Configuration not supported";
4059         case AVDTP_BAD_STATE:
4060                 return "Bad State";
4061         default:
4062                 return "Unknown error";
4063         }
4064 }
4065
4066 avdtp_state_t avdtp_sep_get_state(struct avdtp_local_sep *sep)
4067 {
4068         return sep->state;
4069 }
4070
4071 struct btd_adapter *avdtp_get_adapter(struct avdtp *session)
4072 {
4073         return device_get_adapter(session->device);
4074 }
4075
4076 struct btd_device *avdtp_get_device(struct avdtp *session)
4077 {
4078         return session->device;
4079 }
4080
4081 gboolean avdtp_has_stream(struct avdtp *session, struct avdtp_stream *stream)
4082 {
4083         return g_slist_find(session->streams, stream) ? TRUE : FALSE;
4084 }
4085
4086 unsigned int avdtp_add_state_cb(struct btd_device *dev,
4087                                 avdtp_session_state_cb cb, void *user_data)
4088 {
4089         struct avdtp_state_callback *state_cb;
4090         static unsigned int id = 0;
4091
4092         state_cb = g_new(struct avdtp_state_callback, 1);
4093         state_cb->cb = cb;
4094         state_cb->dev = dev;
4095         state_cb->id = ++id;
4096         state_cb->user_data = user_data;
4097
4098         state_callbacks = g_slist_append(state_callbacks, state_cb);
4099
4100         return state_cb->id;
4101 }
4102
4103 gboolean avdtp_remove_state_cb(unsigned int id)
4104 {
4105         GSList *l;
4106
4107         for (l = state_callbacks; l != NULL; l = l->next) {
4108                 struct avdtp_state_callback *cb = l->data;
4109                 if (cb && cb->id == id) {
4110                         state_callbacks = g_slist_remove(state_callbacks, cb);
4111                         g_free(cb);
4112                         return TRUE;
4113                 }
4114         }
4115
4116         return FALSE;
4117 }