audio/avdtp.c

   1 /*
   2  *
   3  *  BlueZ - Bluetooth protocol stack for Linux
   4  *
   5  *  Copyright (C) 2006-2010  Nokia Corporation
   6  *  Copyright (C) 2004-2010  Marcel Holtmann <marcel@holtmann.org>
   7  *
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  22  *
  23  */
  24
  25 #ifdef HAVE_CONFIG_H
  26 #include <config.h>
  27 #endif
  28
  29 #include <stdlib.h>
  30 #include <stdio.h>
  31 #include <stdint.h>
  32 #include <errno.h>
  33 #include <unistd.h>
  34 #include <assert.h>
  35 #include <signal.h>
  36 #include <netinet/in.h>
  37
  38 #include <bluetooth/bluetooth.h>
  39 #include <bluetooth/sdp.h>
  40 #include <bluetooth/sdp_lib.h>
  41 #include <bluetooth/uuid.h>
  42
  43 #include <glib.h>
  44 #include <dbus/dbus.h>
  45
  46 #include "log.h"
  47
  48 #include "../src/adapter.h"
  49 #include "../src/manager.h"
  50 #include "../src/device.h"
  51
  52 #include "device.h"
  53 #include "manager.h"
  54 #include "control.h"
  55 #include "avdtp.h"
  56 #include "btio.h"
  57 #include "sink.h"
  58 #include "source.h"
  59
  60 #define AVDTP_PSM 25
  61
  62 #define MAX_SEID 0x3E
  63
  64 #ifndef MAX
  65 # define MAX(x, y) ((x) > (y) ? (x) : (y))
  66 #endif
  67
  68 #define AVDTP_DISCOVER                          0x01
  69 #define AVDTP_GET_CAPABILITIES                  0x02
  70 #define AVDTP_SET_CONFIGURATION                 0x03
  71 #define AVDTP_GET_CONFIGURATION                 0x04
  72 #define AVDTP_RECONFIGURE                       0x05
  73 #define AVDTP_OPEN                              0x06
  74 #define AVDTP_START                             0x07
  75 #define AVDTP_CLOSE                             0x08
  76 #define AVDTP_SUSPEND                           0x09
  77 #define AVDTP_ABORT                             0x0A
  78 #define AVDTP_SECURITY_CONTROL                  0x0B
  79 #define AVDTP_GET_ALL_CAPABILITIES              0x0C
  80 #define AVDTP_DELAY_REPORT                      0x0D
  81
  82 #define AVDTP_PKT_TYPE_SINGLE                   0x00
  83 #define AVDTP_PKT_TYPE_START                    0x01
  84 #define AVDTP_PKT_TYPE_CONTINUE                 0x02
  85 #define AVDTP_PKT_TYPE_END                      0x03
  86
  87 #define AVDTP_MSG_TYPE_COMMAND                  0x00
  88 #define AVDTP_MSG_TYPE_GEN_REJECT               0x01
  89 #define AVDTP_MSG_TYPE_ACCEPT                   0x02
  90 #define AVDTP_MSG_TYPE_REJECT                   0x03
  91
  92 #ifdef __TIZEN_PATCH__
  93 #define REQ_TIMEOUT 10
  94 #else
  95 #define REQ_TIMEOUT 6
  96 #endif
  97 #define ABORT_TIMEOUT 2
  98 #define DISCONNECT_TIMEOUT 1
  99 #define STREAM_TIMEOUT 20
 100
 101 #if __BYTE_ORDER == __LITTLE_ENDIAN
 102
 103 struct avdtp_common_header {
 104         uint8_t message_type:2;
 105         uint8_t packet_type:2;
 106         uint8_t transaction:4;
 107 } __attribute__ ((packed));
 108
 109 struct avdtp_single_header {
 110         uint8_t message_type:2;
 111         uint8_t packet_type:2;
 112         uint8_t transaction:4;
 113         uint8_t signal_id:6;
 114         uint8_t rfa0:2;
 115 } __attribute__ ((packed));
 116
 117 struct avdtp_start_header {
 118         uint8_t message_type:2;
 119         uint8_t packet_type:2;
 120         uint8_t transaction:4;
 121         uint8_t no_of_packets;
 122         uint8_t signal_id:6;
 123         uint8_t rfa0:2;
 124 } __attribute__ ((packed));
 125
 126 struct avdtp_continue_header {
 127         uint8_t message_type:2;
 128         uint8_t packet_type:2;
 129         uint8_t transaction:4;
 130 } __attribute__ ((packed));
 131
 132 struct seid_info {
 133         uint8_t rfa0:1;
 134         uint8_t inuse:1;
 135         uint8_t seid:6;
 136         uint8_t rfa2:3;
 137         uint8_t type:1;
 138         uint8_t media_type:4;
 139 } __attribute__ ((packed));
 140
 141 struct seid {
 142         uint8_t rfa0:2;
 143         uint8_t seid:6;
 144 } __attribute__ ((packed));
 145
 146 #elif __BYTE_ORDER == __BIG_ENDIAN
 147
 148 struct avdtp_common_header {
 149         uint8_t transaction:4;
 150         uint8_t packet_type:2;
 151         uint8_t message_type:2;
 152 } __attribute__ ((packed));
 153
 154 struct avdtp_single_header {
 155         uint8_t transaction:4;
 156         uint8_t packet_type:2;
 157         uint8_t message_type:2;
 158         uint8_t rfa0:2;
 159         uint8_t signal_id:6;
 160 } __attribute__ ((packed));
 161
 162 struct avdtp_start_header {
 163         uint8_t transaction:4;
 164         uint8_t packet_type:2;
 165         uint8_t message_type:2;
 166         uint8_t no_of_packets;
 167         uint8_t rfa0:2;
 168         uint8_t signal_id:6;
 169 } __attribute__ ((packed));
 170
 171 struct avdtp_continue_header {
 172         uint8_t transaction:4;
 173         uint8_t packet_type:2;
 174         uint8_t message_type:2;
 175 } __attribute__ ((packed));
 176
 177 struct seid_info {
 178         uint8_t seid:6;
 179         uint8_t inuse:1;
 180         uint8_t rfa0:1;
 181         uint8_t media_type:4;
 182         uint8_t type:1;
 183         uint8_t rfa2:3;
 184 } __attribute__ ((packed));
 185
 186 struct seid {
 187         uint8_t seid:6;
 188         uint8_t rfa0:2;
 189 } __attribute__ ((packed));
 190
 191 #else
 192 #error "Unknown byte order"
 193 #endif
 194
 195 /* packets */
 196
 197 struct discover_resp {
 198         struct seid_info seps[0];
 199 } __attribute__ ((packed));
 200
 201 struct getcap_resp {
 202         uint8_t caps[0];
 203 } __attribute__ ((packed));
 204
 205 struct start_req {
 206         struct seid first_seid;
 207         struct seid other_seids[0];
 208 } __attribute__ ((packed));
 209
 210 struct suspend_req {
 211         struct seid first_seid;
 212         struct seid other_seids[0];
 213 } __attribute__ ((packed));
 214
 215 struct seid_rej {
 216         uint8_t error;
 217 } __attribute__ ((packed));
 218
 219 struct conf_rej {
 220         uint8_t category;
 221         uint8_t error;
 222 } __attribute__ ((packed));
 223
 224 #if __BYTE_ORDER == __LITTLE_ENDIAN
 225
 226 struct seid_req {
 227         uint8_t rfa0:2;
 228         uint8_t acp_seid:6;
 229 } __attribute__ ((packed));
 230
 231 struct setconf_req {
 232         uint8_t rfa0:2;
 233         uint8_t acp_seid:6;
 234         uint8_t rfa1:2;
 235         uint8_t int_seid:6;
 236
 237         uint8_t caps[0];
 238 } __attribute__ ((packed));
 239
 240 struct stream_rej {
 241         uint8_t rfa0:2;
 242         uint8_t acp_seid:6;
 243         uint8_t error;
 244 } __attribute__ ((packed));
 245
 246 struct reconf_req {
 247         uint8_t rfa0:2;
 248         uint8_t acp_seid:6;
 249
 250         uint8_t serv_cap;
 251         uint8_t serv_cap_len;
 252
 253         uint8_t caps[0];
 254 } __attribute__ ((packed));
 255
 256 struct delay_req {
 257         uint8_t rfa0:2;
 258         uint8_t acp_seid:6;
 259         uint16_t delay;
 260 } __attribute__ ((packed));
 261
 262 #elif __BYTE_ORDER == __BIG_ENDIAN
 263
 264 struct seid_req {
 265         uint8_t acp_seid:6;
 266         uint8_t rfa0:2;
 267 } __attribute__ ((packed));
 268
 269 struct setconf_req {
 270         uint8_t acp_seid:6;
 271         uint8_t rfa0:2;
 272         uint8_t int_seid:6;
 273         uint8_t rfa1:2;
 274
 275         uint8_t caps[0];
 276 } __attribute__ ((packed));
 277
 278 struct stream_rej {
 279         uint8_t acp_seid:6;
 280         uint8_t rfa0:2;
 281         uint8_t error;
 282 } __attribute__ ((packed));
 283
 284 struct reconf_req {
 285         uint8_t acp_seid:6;
 286         uint8_t rfa0:2;
 287
 288         uint8_t serv_cap;
 289         uint8_t serv_cap_len;
 290
 291         uint8_t caps[0];
 292 } __attribute__ ((packed));
 293
 294 struct delay_req {
 295         uint8_t acp_seid:6;
 296         uint8_t rfa0:2;
 297         uint16_t delay;
 298 } __attribute__ ((packed));
 299
 300 #else
 301 #error "Unknown byte order"
 302 #endif
 303
 304 struct in_buf {
 305         gboolean active;
 306         int no_of_packets;
 307         uint8_t transaction;
 308         uint8_t message_type;
 309         uint8_t signal_id;
 310         uint8_t buf[1024];
 311         uint8_t data_size;
 312 };
 313
 314 struct pending_req {
 315         uint8_t transaction;
 316         uint8_t signal_id;
 317         void *data;
 318         size_t data_size;
 319         struct avdtp_stream *stream; /* Set if the request targeted a stream */
 320         guint timeout;
 321         gboolean collided;
 322 };
 323
 324 struct avdtp_remote_sep {
 325         uint8_t seid;
 326         uint8_t type;
 327         uint8_t media_type;
 328         struct avdtp_service_capability *codec;
 329         gboolean delay_reporting;
 330         GSList *caps; /* of type struct avdtp_service_capability */
 331         struct avdtp_stream *stream;
 332 };
 333
 334 struct avdtp_server {
 335         bdaddr_t src;
 336         uint16_t version;
 337         GIOChannel *io;
 338         GSList *seps;
 339         GSList *sessions;
 340 };
 341
 342 struct avdtp_local_sep {
 343         avdtp_state_t state;
 344         struct avdtp_stream *stream;
 345         struct seid_info info;
 346         uint8_t codec;
 347         gboolean delay_reporting;
 348         GSList *caps;
 349         struct avdtp_sep_ind *ind;
 350         struct avdtp_sep_cfm *cfm;
 351         void *user_data;
 352         struct avdtp_server *server;
 353 };
 354
 355 struct stream_callback {
 356         avdtp_stream_state_cb cb;
 357         void *user_data;
 358         unsigned int id;
 359 };
 360
 361 struct avdtp_state_callback {
 362         avdtp_session_state_cb cb;
 363         void *user_data;
 364         unsigned int id;
 365 };
 366
 367 struct avdtp_stream {
 368         GIOChannel *io;
 369         uint16_t imtu;
 370         uint16_t omtu;
 371         struct avdtp *session;
 372         struct avdtp_local_sep *lsep;
 373         uint8_t rseid;
 374         GSList *caps;
 375         GSList *callbacks;
 376         struct avdtp_service_capability *codec;
 377         guint io_id;            /* Transport GSource ID */
 378         guint timer;            /* Waiting for other side to close or open
 379                                  * the transport channel */
 380         gboolean open_acp;      /* If we are in ACT role for Open */
 381         gboolean close_int;     /* If we are in INT role for Close */
 382         gboolean abort_int;     /* If we are in INT role for Abort */
 383         guint idle_timer;
 384         gboolean delay_reporting;
 385         uint16_t delay;         /* AVDTP 1.3 Delay Reporting feature */
 386         gboolean starting;      /* only valid while sep state == OPEN */
 387 };
 388
 389 /* Structure describing an AVDTP connection between two devices */
 390
 391 struct avdtp {
 392         int ref;
 393         int free_lock;
 394
 395         uint16_t version;
 396
 397         struct avdtp_server *server;
 398         bdaddr_t dst;
 399
 400         avdtp_session_state_t state;
 401
 402         /* True if the session should be automatically disconnected */
 403         gboolean auto_dc;
 404
 405         /* True if the entire device is being disconnected */
 406         gboolean device_disconnect;
 407
 408         GIOChannel *io;
 409         guint io_id;
 410
 411         GSList *seps; /* Elements of type struct avdtp_remote_sep * */
 412
 413         GSList *streams; /* Elements of type struct avdtp_stream * */
 414
 415         GSList *req_queue; /* Elements of type struct pending_req * */
 416         GSList *prio_queue; /* Same as req_queue but is processed before it */
 417
 418         struct avdtp_stream *pending_open;
 419
 420         uint16_t imtu;
 421         uint16_t omtu;
 422
 423         struct in_buf in;
 424
 425         char *buf;
 426
 427         avdtp_discover_cb_t discov_cb;
 428         void *user_data;
 429
 430         struct pending_req *req;
 431
 432         guint dc_timer;
 433
 434         /* Attempt stream setup instead of disconnecting */
 435         gboolean stream_setup;
 436
 437         DBusPendingCall *pending_auth;
 438 };
 439
 440 static GSList *servers = NULL;
 441
 442 static GSList *avdtp_callbacks = NULL;
 443
 444 static gboolean auto_connect = TRUE;
 445
 446 static int send_request(struct avdtp *session, gboolean priority,
 447                         struct avdtp_stream *stream, uint8_t signal_id,
 448                         void *buffer, size_t size);
 449 static gboolean avdtp_parse_resp(struct avdtp *session,
 450                                         struct avdtp_stream *stream,
 451                                         uint8_t transaction, uint8_t signal_id,
 452                                         void *buf, int size);
 453 static gboolean avdtp_parse_rej(struct avdtp *session,
 454                                         struct avdtp_stream *stream,
 455                                         uint8_t transaction, uint8_t signal_id,
 456                                         void *buf, int size);
 457 static int process_queue(struct avdtp *session);
 458 static void connection_lost(struct avdtp *session, int err);
 459 static void avdtp_sep_set_state(struct avdtp *session,
 460                                 struct avdtp_local_sep *sep,
 461                                 avdtp_state_t state);
 462 static void auth_cb(DBusError *derr, void *user_data);
 463
 464 static struct avdtp_server *find_server(GSList *list, const bdaddr_t *src)
 465 {
 466         for (; list; list = list->next) {
 467                 struct avdtp_server *server = list->data;
 468
 469                 if (bacmp(&server->src, src) == 0)
 470                         return server;
 471         }
 472
 473         return NULL;
 474 }
 475
 476 static const char *avdtp_statestr(avdtp_state_t state)
 477 {
 478         switch (state) {
 479         case AVDTP_STATE_IDLE:
 480                 return "IDLE";
 481         case AVDTP_STATE_CONFIGURED:
 482                 return "CONFIGURED";
 483         case AVDTP_STATE_OPEN:
 484                 return "OPEN";
 485         case AVDTP_STATE_STREAMING:
 486                 return "STREAMING";
 487         case AVDTP_STATE_CLOSING:
 488                 return "CLOSING";
 489         case AVDTP_STATE_ABORTING:
 490                 return "ABORTING";
 491         default:
 492                 return "<unknown state>";
 493         }
 494 }
 495
 496 static gboolean try_send(int sk, void *data, size_t len)
 497 {
 498         int err;
 499
 500         do {
 501                 err = send(sk, data, len, 0);
 502         } while (err < 0 && errno == EINTR);
 503
 504         if (err < 0) {
 505                 error("send: %s (%d)", strerror(errno), errno);
 506                 return FALSE;
 507         } else if ((size_t) err != len) {
 508                 error("try_send: complete buffer not sent (%d/%zu bytes)",
 509                                                                 err, len);
 510                 return FALSE;
 511         }
 512
 513         return TRUE;
 514 }
 515
 516 static gboolean avdtp_send(struct avdtp *session, uint8_t transaction,
 517                                 uint8_t message_type, uint8_t signal_id,
 518                                 void *data, size_t len)
 519 {
 520         unsigned int cont_fragments, sent;
 521         struct avdtp_start_header start;
 522         struct avdtp_continue_header cont;
 523         int sock;
 524
 525         if (session->io == NULL) {
 526                 error("avdtp_send: session is closed");
 527                 return FALSE;
 528         }
 529
 530         sock = g_io_channel_unix_get_fd(session->io);
 531
 532         /* Single packet - no fragmentation */
 533         if (sizeof(struct avdtp_single_header) + len <= session->omtu) {
 534                 struct avdtp_single_header single;
 535
 536                 memset(&single, 0, sizeof(single));
 537
 538                 single.transaction = transaction;
 539                 single.packet_type = AVDTP_PKT_TYPE_SINGLE;
 540                 single.message_type = message_type;
 541                 single.signal_id = signal_id;
 542
 543                 memcpy(session->buf, &single, sizeof(single));
 544                 memcpy(session->buf + sizeof(single), data, len);
 545
 546                 return try_send(sock, session->buf, sizeof(single) + len);
 547         }
 548
 549         /* Check if there is enough space to start packet */
 550         if (session->omtu < sizeof(start)) {
 551                 error("No enough space to fragment packet");
 552                 return FALSE;
 553         }
 554
 555         /* Count the number of needed fragments */
 556         cont_fragments = (len - (session->omtu - sizeof(start))) /
 557                                         (session->omtu - sizeof(cont)) + 1;
 558
 559         DBG("%zu bytes split into %d fragments", len, cont_fragments + 1);
 560
 561         /* Send the start packet */
 562         memset(&start, 0, sizeof(start));
 563         start.transaction = transaction;
 564         start.packet_type = AVDTP_PKT_TYPE_START;
 565         start.message_type = message_type;
 566         start.no_of_packets = cont_fragments + 1;
 567         start.signal_id = signal_id;
 568
 569         memcpy(session->buf, &start, sizeof(start));
 570         memcpy(session->buf + sizeof(start), data,
 571                                         session->omtu - sizeof(start));
 572
 573         if (!try_send(sock, session->buf, session->omtu))
 574                 return FALSE;
 575
 576         DBG("first packet with %zu bytes sent", session->omtu - sizeof(start));
 577
 578         sent = session->omtu - sizeof(start);
 579
 580         /* Send the continue fragments and the end packet */
 581         while (sent < len) {
 582                 int left, to_copy;
 583
 584                 left = len - sent;
 585                 if (left + sizeof(cont) > session->omtu) {
 586                         cont.packet_type = AVDTP_PKT_TYPE_CONTINUE;
 587                         to_copy = session->omtu - sizeof(cont);
 588                         DBG("sending continue with %d bytes", to_copy);
 589                 } else {
 590                         cont.packet_type = AVDTP_PKT_TYPE_END;
 591                         to_copy = left;
 592                         DBG("sending end with %d bytes", to_copy);
 593                 }
 594
 595                 cont.transaction = transaction;
 596                 cont.message_type = message_type;
 597
 598                 memcpy(session->buf, &cont, sizeof(cont));
 599                 memcpy(session->buf + sizeof(cont), data + sent, to_copy);
 600
 601                 if (!try_send(sock, session->buf, to_copy + sizeof(cont)))
 602                         return FALSE;
 603
 604                 sent += to_copy;
 605         }
 606
 607         return TRUE;
 608 }
 609
 610 static void pending_req_free(struct pending_req *req)
 611 {
 612         if (req->timeout)
 613                 g_source_remove(req->timeout);
 614         g_free(req->data);
 615         g_free(req);
 616 }
 617
 618 static void close_stream(struct avdtp_stream *stream)
 619 {
 620         int sock;
 621
 622         if (stream->io == NULL)
 623                 return;
 624
 625         sock = g_io_channel_unix_get_fd(stream->io);
 626
 627         shutdown(sock, SHUT_RDWR);
 628
 629         g_io_channel_shutdown(stream->io, FALSE, NULL);
 630
 631         g_io_channel_unref(stream->io);
 632         stream->io = NULL;
 633 }
 634
 635 static gboolean stream_close_timeout(gpointer user_data)
 636 {
 637         struct avdtp_stream *stream = user_data;
 638
 639         DBG("Timed out waiting for peer to close the transport channel");
 640
 641         stream->timer = 0;
 642
 643         close_stream(stream);
 644
 645         return FALSE;
 646 }
 647
 648 static gboolean stream_open_timeout(gpointer user_data)
 649 {
 650         struct avdtp_stream *stream = user_data;
 651
 652         DBG("Timed out waiting for peer to open the transport channel");
 653
 654         stream->timer = 0;
 655
 656         stream->session->pending_open = NULL;
 657
 658         avdtp_abort(stream->session, stream);
 659
 660         return FALSE;
 661 }
 662
 663 static gboolean disconnect_timeout(gpointer user_data)
 664 {
 665         struct avdtp *session = user_data;
 666         struct audio_device *dev;
 667         gboolean stream_setup;
 668
 669         session->dc_timer = 0;
 670         stream_setup = session->stream_setup;
 671         session->stream_setup = FALSE;
 672
 673         dev = manager_get_device(&session->server->src, &session->dst, FALSE);
 674
 675         if (dev && dev->sink && stream_setup)
 676                 sink_setup_stream(dev->sink, session);
 677         else if (dev && dev->source && stream_setup)
 678                 source_setup_stream(dev->source, session);
 679         else
 680                 connection_lost(session, ETIMEDOUT);
 681
 682         return FALSE;
 683 }
 684
 685 static void remove_disconnect_timer(struct avdtp *session)
 686 {
 687         g_source_remove(session->dc_timer);
 688         session->dc_timer = 0;
 689         session->stream_setup = FALSE;
 690 }
 691
 692 static void set_disconnect_timer(struct avdtp *session)
 693 {
 694         if (session->dc_timer)
 695                 remove_disconnect_timer(session);
 696
 697         if (session->device_disconnect) {
 698                 session->dc_timer = g_idle_add(disconnect_timeout, session);
 699                 return;
 700         }
 701
 702         session->dc_timer = g_timeout_add_seconds(DISCONNECT_TIMEOUT,
 703                                                 disconnect_timeout,
 704                                                 session);
 705 }
 706
 707 void avdtp_error_init(struct avdtp_error *err, uint8_t category, int id)
 708 {
 709         err->category = category;
 710
 711         if (category == AVDTP_ERRNO)
 712                 err->err.posix_errno = id;
 713         else
 714                 err->err.error_code = id;
 715 }
 716
 717 uint8_t avdtp_error_category(struct avdtp_error *err)
 718 {
 719         return err->category;
 720 }
 721
 722 int avdtp_error_error_code(struct avdtp_error *err)
 723 {
 724         assert(err->category != AVDTP_ERRNO);
 725         return err->err.error_code;
 726 }
 727
 728 int avdtp_error_posix_errno(struct avdtp_error *err)
 729 {
 730         assert(err->category == AVDTP_ERRNO);
 731         return err->err.posix_errno;
 732 }
 733
 734 static struct avdtp_stream *find_stream_by_rseid(struct avdtp *session,
 735                                                         uint8_t rseid)
 736 {
 737         GSList *l;
 738
 739         for (l = session->streams; l != NULL; l = g_slist_next(l)) {
 740                 struct avdtp_stream *stream = l->data;
 741
 742                 if (stream->rseid == rseid)
 743                         return stream;
 744         }
 745
 746         return NULL;
 747 }
 748
 749 static struct avdtp_remote_sep *find_remote_sep(GSList *seps, uint8_t seid)
 750 {
 751         GSList *l;
 752
 753         for (l = seps; l != NULL; l = g_slist_next(l)) {
 754                 struct avdtp_remote_sep *sep = l->data;
 755
 756                 if (sep->seid == seid)
 757                         return sep;
 758         }
 759
 760         return NULL;
 761 }
 762
 763 static void avdtp_set_state(struct avdtp *session,
 764                                         avdtp_session_state_t new_state)
 765 {
 766         GSList *l;
 767         struct audio_device *dev;
 768         bdaddr_t src, dst;
 769         avdtp_session_state_t old_state = session->state;
 770
 771         session->state = new_state;
 772
 773         avdtp_get_peers(session, &src, &dst);
 774         dev = manager_get_device(&src, &dst, FALSE);
 775         if (dev == NULL) {
 776                 error("avdtp_set_state(): no matching audio device");
 777                 return;
 778         }
 779
 780         for (l = avdtp_callbacks; l != NULL; l = l->next) {
 781                 struct avdtp_state_callback *cb = l->data;
 782                 cb->cb(dev, session, old_state, new_state, cb->user_data);
 783         }
 784 }
 785
 786 static void stream_free(struct avdtp_stream *stream)
 787 {
 788         struct avdtp_remote_sep *rsep;
 789
 790         stream->lsep->info.inuse = 0;
 791         stream->lsep->stream = NULL;
 792
 793         rsep = find_remote_sep(stream->session->seps, stream->rseid);
 794         if (rsep)
 795                 rsep->stream = NULL;
 796
 797         if (stream->timer)
 798                 g_source_remove(stream->timer);
 799
 800         if (stream->io)
 801                 close_stream(stream);
 802
 803         if (stream->io_id)
 804                 g_source_remove(stream->io_id);
 805
 806         g_slist_free_full(stream->callbacks, g_free);
 807         g_slist_free_full(stream->caps, g_free);
 808
 809         g_free(stream);
 810 }
 811
 812 static gboolean stream_timeout(gpointer user_data)
 813 {
 814         struct avdtp_stream *stream = user_data;
 815         struct avdtp *session = stream->session;
 816
 817         if (avdtp_close(session, stream, FALSE) < 0)
 818                 error("stream_timeout: closing AVDTP stream failed");
 819
 820         stream->idle_timer = 0;
 821
 822         return FALSE;
 823 }
 824
 825 static gboolean transport_cb(GIOChannel *chan, GIOCondition cond,
 826                                 gpointer data)
 827 {
 828         struct avdtp_stream *stream = data;
 829         struct avdtp_local_sep *sep = stream->lsep;
 830
 831         if (stream->close_int && sep->cfm && sep->cfm->close)
 832                 sep->cfm->close(stream->session, sep, stream, NULL,
 833                                 sep->user_data);
 834
 835         if (!(cond & G_IO_NVAL))
 836                 close_stream(stream);
 837
 838         stream->io_id = 0;
 839
 840         if (!stream->abort_int)
 841                 avdtp_sep_set_state(stream->session, sep, AVDTP_STATE_IDLE);
 842
 843         return FALSE;
 844 }
 845
 846 static int get_send_buffer_size(int sk)
 847 {
 848         int size;
 849         socklen_t optlen = sizeof(size);
 850
 851         if (getsockopt(sk, SOL_SOCKET, SO_SNDBUF, &size, &optlen) < 0) {
 852                 int err = -errno;
 853                 error("getsockopt(SO_SNDBUF) failed: %s (%d)", strerror(-err),
 854                                                                         -err);
 855                 return err;
 856         }
 857
 858         /*
 859          * Doubled value is returned by getsockopt since kernel uses that
 860          * space for its own purposes (see man 7 socket, bookkeeping overhead
 861          * for SO_SNDBUF).
 862          */
 863         return size / 2;
 864 }
 865
 866 static int set_send_buffer_size(int sk, int size)
 867 {
 868         socklen_t optlen = sizeof(size);
 869
 870         if (setsockopt(sk, SOL_SOCKET, SO_SNDBUF, &size, optlen) < 0) {
 871                 int err = -errno;
 872                 error("setsockopt(SO_SNDBUF) failed: %s (%d)", strerror(-err),
 873                                                                         -err);
 874                 return err;
 875         }
 876
 877         return 0;
 878 }
 879
 880 static void handle_transport_connect(struct avdtp *session, GIOChannel *io,
 881                                         uint16_t imtu, uint16_t omtu)
 882 {
 883         struct avdtp_stream *stream = session->pending_open;
 884         struct avdtp_local_sep *sep = stream->lsep;
 885         int sk, buf_size, min_buf_size;
 886         GError *err = NULL;
 887
 888         session->pending_open = NULL;
 889
 890         if (stream->timer) {
 891                 g_source_remove(stream->timer);
 892                 stream->timer = 0;
 893         }
 894
 895         if (io == NULL) {
 896                 if (!stream->open_acp && sep->cfm && sep->cfm->open) {
 897                         struct avdtp_error err;
 898                         avdtp_error_init(&err, AVDTP_ERRNO, EIO);
 899                         sep->cfm->open(session, sep, NULL, &err,
 900                                         sep->user_data);
 901                 }
 902                 return;
 903         }
 904
 905         if (stream->io == NULL)
 906                 stream->io = g_io_channel_ref(io);
 907
 908         stream->omtu = omtu;
 909         stream->imtu = imtu;
 910
 911         /* Apply special settings only if local SEP is of type SRC */
 912         if (sep->info.type != AVDTP_SEP_TYPE_SOURCE)
 913                 goto proceed;
 914
 915         bt_io_set(stream->io, BT_IO_L2CAP, &err,
 916                                         BT_IO_OPT_FLUSHABLE, TRUE,
 917                                         BT_IO_OPT_INVALID);
 918         if (err != NULL) {
 919                 error("Enabling flushable packets failed: %s", err->message);
 920                 g_error_free(err);
 921         } else
 922                 DBG("Flushable packets enabled");
 923
 924         sk = g_io_channel_unix_get_fd(stream->io);
 925         buf_size = get_send_buffer_size(sk);
 926         if (buf_size < 0)
 927                 goto proceed;
 928
 929         DBG("sk %d, omtu %d, send buffer size %d", sk, omtu, buf_size);
 930         min_buf_size = omtu * 2;
 931         if (buf_size < min_buf_size) {
 932                 DBG("send buffer size to be increassed to %d",
 933                                 min_buf_size);
 934                 set_send_buffer_size(sk, min_buf_size);
 935         }
 936
 937 proceed:
 938         if (!stream->open_acp && sep->cfm && sep->cfm->open)
 939                 sep->cfm->open(session, sep, stream, NULL, sep->user_data);
 940
 941         avdtp_sep_set_state(session, sep, AVDTP_STATE_OPEN);
 942
 943         stream->io_id = g_io_add_watch(io, G_IO_ERR | G_IO_HUP | G_IO_NVAL,
 944                                         (GIOFunc) transport_cb, stream);
 945 }
 946
 947 static int pending_req_cmp(gconstpointer a, gconstpointer b)
 948 {
 949         const struct pending_req *req = a;
 950         const struct avdtp_stream *stream = b;
 951
 952         if (req->stream == stream)
 953                 return 0;
 954
 955         return -1;
 956 }
 957
 958 static void cleanup_queue(struct avdtp *session, struct avdtp_stream *stream)
 959 {
 960         GSList *l;
 961         struct pending_req *req;
 962
 963         while ((l = g_slist_find_custom(session->prio_queue, stream,
 964                                                         pending_req_cmp))) {
 965                 req = l->data;
 966                 pending_req_free(req);
 967                 session->prio_queue = g_slist_remove(session->prio_queue, req);
 968         }
 969
 970         while ((l = g_slist_find_custom(session->req_queue, stream,
 971                                                         pending_req_cmp))) {
 972                 req = l->data;
 973                 pending_req_free(req);
 974                 session->req_queue = g_slist_remove(session->req_queue, req);
 975         }
 976 }
 977
 978 static void handle_unanswered_req(struct avdtp *session,
 979                                                 struct avdtp_stream *stream)
 980 {
 981         struct pending_req *req;
 982         struct avdtp_local_sep *lsep;
 983         struct avdtp_error err;
 984
 985         if (session->req->signal_id == AVDTP_ABORT) {
 986                 /* Avoid freeing the Abort request here */
 987                 DBG("handle_unanswered_req: Abort req, returning");
 988                 session->req->stream = NULL;
 989                 return;
 990         }
 991
 992         req = session->req;
 993         session->req = NULL;
 994
 995         avdtp_error_init(&err, AVDTP_ERRNO, EIO);
 996
 997         lsep = stream->lsep;
 998
 999         switch (req->signal_id) {
1000         case AVDTP_RECONFIGURE:
1001                 error("No reply to Reconfigure request");
1002                 if (lsep && lsep->cfm && lsep->cfm->reconfigure)
1003                         lsep->cfm->reconfigure(session, lsep, stream, &err,
1004                                                 lsep->user_data);
1005                 break;
1006         case AVDTP_OPEN:
1007                 error("No reply to Open request");
1008                 if (lsep && lsep->cfm && lsep->cfm->open)
1009                         lsep->cfm->open(session, lsep, stream, &err,
1010                                         lsep->user_data);
1011                 break;
1012         case AVDTP_START:
1013                 error("No reply to Start request");
1014                 if (lsep && lsep->cfm && lsep->cfm->start)
1015                         lsep->cfm->start(session, lsep, stream, &err,
1016                                                 lsep->user_data);
1017                 break;
1018         case AVDTP_SUSPEND:
1019                 error("No reply to Suspend request");
1020                 if (lsep && lsep->cfm && lsep->cfm->suspend)
1021                         lsep->cfm->suspend(session, lsep, stream, &err,
1022                                                 lsep->user_data);
1023                 break;
1024         case AVDTP_CLOSE:
1025                 error("No reply to Close request");
1026                 if (lsep && lsep->cfm && lsep->cfm->close)
1027                         lsep->cfm->close(session, lsep, stream, &err,
1028                                                 lsep->user_data);
1029                 break;
1030         case AVDTP_SET_CONFIGURATION:
1031                 error("No reply to SetConfiguration request");
1032                 if (lsep && lsep->cfm && lsep->cfm->set_configuration)
1033                         lsep->cfm->set_configuration(session, lsep, stream,
1034                                                         &err, lsep->user_data);
1035         }
1036
1037         pending_req_free(req);
1038 }
1039
1040 static void avdtp_sep_set_state(struct avdtp *session,
1041                                 struct avdtp_local_sep *sep,
1042                                 avdtp_state_t state)
1043 {
1044         struct avdtp_stream *stream = sep->stream;
1045         avdtp_state_t old_state;
1046         struct avdtp_error err, *err_ptr = NULL;
1047         GSList *l;
1048
1049         if (!stream) {
1050                 error("Error changing sep state: stream not available");
1051                 return;
1052         }
1053
1054         if (sep->state == state) {
1055                 avdtp_error_init(&err, AVDTP_ERRNO, EIO);
1056                 DBG("stream state change failed: %s", avdtp_strerror(&err));
1057                 err_ptr = &err;
1058         } else {
1059                 err_ptr = NULL;
1060                 DBG("stream state changed: %s -> %s",
1061                                 avdtp_statestr(sep->state),
1062                                 avdtp_statestr(state));
1063         }
1064
1065         old_state = sep->state;
1066         sep->state = state;
1067
1068         switch (state) {
1069         case AVDTP_STATE_CONFIGURED:
1070                 if (sep->info.type == AVDTP_SEP_TYPE_SINK)
1071                         avdtp_delay_report(session, stream, stream->delay);
1072                 break;
1073         case AVDTP_STATE_OPEN:
1074                 stream->starting = FALSE;
1075                 if ((old_state > AVDTP_STATE_OPEN && session->auto_dc) ||
1076                                                         stream->open_acp)
1077                         stream->idle_timer = g_timeout_add_seconds(STREAM_TIMEOUT,
1078                                                                 stream_timeout,
1079                                                                 stream);
1080                 break;
1081         case AVDTP_STATE_STREAMING:
1082                 if (stream->idle_timer) {
1083                         g_source_remove(stream->idle_timer);
1084                         stream->idle_timer = 0;
1085                 }
1086                 stream->open_acp = FALSE;
1087                 break;
1088         case AVDTP_STATE_CLOSING:
1089         case AVDTP_STATE_ABORTING:
1090                 if (stream->idle_timer) {
1091                         g_source_remove(stream->idle_timer);
1092                         stream->idle_timer = 0;
1093                 }
1094                 break;
1095         case AVDTP_STATE_IDLE:
1096                 if (stream->idle_timer) {
1097                         g_source_remove(stream->idle_timer);
1098                         stream->idle_timer = 0;
1099                 }
1100                 if (session->pending_open == stream)
1101                         handle_transport_connect(session, NULL, 0, 0);
1102                 if (session->req && session->req->stream == stream)
1103                         handle_unanswered_req(session, stream);
1104                 /* Remove pending commands for this stream from the queue */
1105                 cleanup_queue(session, stream);
1106                 break;
1107         default:
1108                 break;
1109         }
1110
1111         l = stream->callbacks;
1112         while (l != NULL) {
1113                 struct stream_callback *cb = l->data;
1114                 l = g_slist_next(l);
1115                 cb->cb(stream, old_state, state, err_ptr, cb->user_data);
1116         }
1117
1118         if (state == AVDTP_STATE_IDLE &&
1119                                 g_slist_find(session->streams, stream)) {
1120                 session->streams = g_slist_remove(session->streams, stream);
1121                 stream_free(stream);
1122         }
1123 }
1124
1125 static void finalize_discovery(struct avdtp *session, int err)
1126 {
1127         struct avdtp_error avdtp_err;
1128
1129         avdtp_error_init(&avdtp_err, AVDTP_ERRNO, err);
1130
1131         if (!session->discov_cb)
1132                 return;
1133
1134         session->discov_cb(session, session->seps,
1135                                 err ? &avdtp_err : NULL,
1136                                 session->user_data);
1137
1138         session->discov_cb = NULL;
1139         session->user_data = NULL;
1140 }
1141
1142 static void release_stream(struct avdtp_stream *stream, struct avdtp *session)
1143 {
1144         struct avdtp_local_sep *sep = stream->lsep;
1145
1146         if (sep->cfm && sep->cfm->abort &&
1147                                 (sep->state != AVDTP_STATE_ABORTING ||
1148                                                         stream->abort_int))
1149                 sep->cfm->abort(session, sep, stream, NULL, sep->user_data);
1150
1151         avdtp_sep_set_state(session, sep, AVDTP_STATE_IDLE);
1152 }
1153
1154 static int avdtp_cancel_authorization(struct avdtp *session)
1155 {
1156         struct audio_device *dev;
1157
1158         if (session->state != AVDTP_SESSION_STATE_CONNECTING)
1159                 return 0;
1160
1161         dev = manager_get_device(&session->server->src, &session->dst, FALSE);
1162         if (dev == NULL)
1163                 return -ENODEV;
1164
1165         return audio_device_cancel_authorization(dev, auth_cb, session);
1166 }
1167
1168 static void connection_lost(struct avdtp *session, int err)
1169 {
1170         char address[18];
1171
1172         ba2str(&session->dst, address);
1173         DBG("Disconnected from %s", address);
1174
1175         if (err != EACCES)
1176                 avdtp_cancel_authorization(session);
1177
1178         session->free_lock = 1;
1179
1180         finalize_discovery(session, err);
1181
1182         g_slist_foreach(session->streams, (GFunc) release_stream, session);
1183         session->streams = NULL;
1184
1185         session->free_lock = 0;
1186
1187         if (session->io) {
1188                 g_io_channel_shutdown(session->io, FALSE, NULL);
1189                 g_io_channel_unref(session->io);
1190                 session->io = NULL;
1191         }
1192
1193         avdtp_set_state(session, AVDTP_SESSION_STATE_DISCONNECTED);
1194
1195         if (session->io_id) {
1196                 g_source_remove(session->io_id);
1197                 session->io_id = 0;
1198         }
1199
1200         if (session->dc_timer)
1201                 remove_disconnect_timer(session);
1202
1203         session->auto_dc = TRUE;
1204
1205         if (session->ref != 1)
1206                 error("connection_lost: ref count not 1 after all callbacks");
1207         else
1208                 avdtp_unref(session);
1209 }
1210
1211 void avdtp_unref(struct avdtp *session)
1212 {
1213         struct avdtp_server *server;
1214
1215         if (!session)
1216                 return;
1217
1218         session->ref--;
1219
1220         DBG("%p: ref=%d", session, session->ref);
1221
1222         if (session->ref == 1) {
1223                 if (session->state == AVDTP_SESSION_STATE_CONNECTING &&
1224                                                                 session->io) {
1225                         avdtp_cancel_authorization(session);
1226                         g_io_channel_shutdown(session->io, TRUE, NULL);
1227                         g_io_channel_unref(session->io);
1228                         session->io = NULL;
1229                         avdtp_set_state(session,
1230                                         AVDTP_SESSION_STATE_DISCONNECTED);
1231                 }
1232
1233                 if (session->io)
1234                         set_disconnect_timer(session);
1235                 else if (!session->free_lock) /* Drop the local ref if we
1236                                                  aren't connected */
1237                         session->ref--;
1238         }
1239
1240         if (session->ref > 0)
1241                 return;
1242
1243         server = session->server;
1244
1245         DBG("%p: freeing session and removing from list", session);
1246
1247         if (session->dc_timer)
1248                 remove_disconnect_timer(session);
1249
1250         server->sessions = g_slist_remove(server->sessions, session);
1251
1252         if (session->req)
1253                 pending_req_free(session->req);
1254
1255         g_slist_free_full(session->seps, g_free);
1256
1257         g_free(session->buf);
1258
1259         g_free(session);
1260 }
1261
1262 struct avdtp *avdtp_ref(struct avdtp *session)
1263 {
1264         session->ref++;
1265         DBG("%p: ref=%d", session, session->ref);
1266         if (session->dc_timer)
1267                 remove_disconnect_timer(session);
1268         return session;
1269 }
1270
1271 static struct avdtp_local_sep *find_local_sep_by_seid(struct avdtp_server *server,
1272                                                         uint8_t seid)
1273 {
1274         GSList *l;
1275
1276         for (l = server->seps; l != NULL; l = g_slist_next(l)) {
1277                 struct avdtp_local_sep *sep = l->data;
1278
1279                 if (sep->info.seid == seid)
1280                         return sep;
1281         }
1282
1283         return NULL;
1284 }
1285
1286 struct avdtp_remote_sep *avdtp_find_remote_sep(struct avdtp *session,
1287                                                 struct avdtp_local_sep *lsep)
1288 {
1289         GSList *l;
1290
1291         if (lsep->info.inuse)
1292                 return NULL;
1293
1294         for (l = session->seps; l != NULL; l = g_slist_next(l)) {
1295                 struct avdtp_remote_sep *sep = l->data;
1296                 struct avdtp_service_capability *cap;
1297                 struct avdtp_media_codec_capability *codec_data;
1298
1299                 /* Type must be different: source <-> sink */
1300                 if (sep->type == lsep->info.type)
1301                         continue;
1302
1303                 if (sep->media_type != lsep->info.media_type)
1304                         continue;
1305
1306                 if (!sep->codec)
1307                         continue;
1308
1309                 cap = sep->codec;
1310                 codec_data = (void *) cap->data;
1311
1312                 if (codec_data->media_codec_type != lsep->codec)
1313                         continue;
1314
1315                 if (sep->stream == NULL)
1316                         return sep;
1317         }
1318
1319         return NULL;
1320 }
1321
1322 static GSList *caps_to_list(uint8_t *data, int size,
1323                                 struct avdtp_service_capability **codec,
1324                                 gboolean *delay_reporting)
1325 {
1326         GSList *caps;
1327         int processed;
1328
1329         if (delay_reporting)
1330                 *delay_reporting = FALSE;
1331
1332         for (processed = 0, caps = NULL; processed + 2 <= size;) {
1333                 struct avdtp_service_capability *cap;
1334                 uint8_t length, category;
1335
1336                 category = data[0];
1337                 length = data[1];
1338
1339                 if (processed + 2 + length > size) {
1340                         error("Invalid capability data in getcap resp");
1341                         break;
1342                 }
1343
1344                 cap = g_malloc(sizeof(struct avdtp_service_capability) +
1345                                         length);
1346                 memcpy(cap, data, 2 + length);
1347
1348                 processed += 2 + length;
1349                 data += 2 + length;
1350
1351                 caps = g_slist_append(caps, cap);
1352
1353                 if (category == AVDTP_MEDIA_CODEC &&
1354                                 length >=
1355                                 sizeof(struct avdtp_media_codec_capability))
1356                         *codec = cap;
1357                 else if (category == AVDTP_DELAY_REPORTING && delay_reporting)
1358                         *delay_reporting = TRUE;
1359         }
1360
1361         return caps;
1362 }
1363
1364 static gboolean avdtp_unknown_cmd(struct avdtp *session, uint8_t transaction,
1365                                                         uint8_t signal_id)
1366 {
1367         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_GEN_REJECT,
1368                                                         signal_id, NULL, 0);
1369 }
1370
1371 static gboolean avdtp_discover_cmd(struct avdtp *session, uint8_t transaction,
1372                                                         void *buf, int size)
1373 {
1374         GSList *l;
1375         unsigned int rsp_size, sep_count, i;
1376         struct seid_info *seps;
1377         gboolean ret;
1378
1379         sep_count = g_slist_length(session->server->seps);
1380
1381         if (sep_count == 0) {
1382                 uint8_t err = AVDTP_NOT_SUPPORTED_COMMAND;
1383                 return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
1384                                         AVDTP_DISCOVER, &err, sizeof(err));
1385         }
1386
1387         rsp_size = sep_count * sizeof(struct seid_info);
1388
1389         seps = g_new0(struct seid_info, sep_count);
1390
1391         for (l = session->server->seps, i = 0; l != NULL; l = l->next, i++) {
1392                 struct avdtp_local_sep *sep = l->data;
1393
1394                 memcpy(&seps[i], &sep->info, sizeof(struct seid_info));
1395         }
1396
1397         ret = avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
1398                                 AVDTP_DISCOVER, seps, rsp_size);
1399         g_free(seps);
1400
1401         return ret;
1402 }
1403
1404 static gboolean avdtp_getcap_cmd(struct avdtp *session, uint8_t transaction,
1405                                         struct seid_req *req, unsigned int size,
1406                                         gboolean get_all)
1407 {
1408         GSList *l, *caps;
1409         struct avdtp_local_sep *sep = NULL;
1410         unsigned int rsp_size;
1411         uint8_t err, buf[1024], *ptr = buf;
1412         uint8_t cmd;
1413
1414         cmd = get_all ? AVDTP_GET_ALL_CAPABILITIES : AVDTP_GET_CAPABILITIES;
1415
1416         if (size < sizeof(struct seid_req)) {
1417                 err = AVDTP_BAD_LENGTH;
1418                 goto failed;
1419         }
1420
1421         sep = find_local_sep_by_seid(session->server, req->acp_seid);
1422         if (!sep) {
1423                 err = AVDTP_BAD_ACP_SEID;
1424                 goto failed;
1425         }
1426
1427         if (get_all && session->server->version < 0x0103)
1428                 return avdtp_unknown_cmd(session, transaction, cmd);
1429
1430         if (!sep->ind->get_capability(session, sep, get_all, &caps,
1431                                                         &err, sep->user_data))
1432                 goto failed;
1433
1434         for (l = caps, rsp_size = 0; l != NULL; l = g_slist_next(l)) {
1435                 struct avdtp_service_capability *cap = l->data;
1436
1437                 if (rsp_size + cap->length + 2 > sizeof(buf))
1438                         break;
1439
1440                 memcpy(ptr, cap, cap->length + 2);
1441                 rsp_size += cap->length + 2;
1442                 ptr += cap->length + 2;
1443
1444                 g_free(cap);
1445         }
1446
1447         g_slist_free(caps);
1448
1449         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT, cmd,
1450                                                                 buf, rsp_size);
1451
1452 failed:
1453         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT, cmd,
1454                                                         &err, sizeof(err));
1455 }
1456
1457 static void setconf_cb(struct avdtp *session, struct avdtp_stream *stream,
1458                                                 struct avdtp_error *err)
1459 {
1460         struct conf_rej rej;
1461         struct avdtp_local_sep *sep;
1462
1463         if (err != NULL) {
1464                 rej.error = AVDTP_UNSUPPORTED_CONFIGURATION;
1465                 rej.category = err->err.error_code;
1466                 avdtp_send(session, session->in.transaction,
1467                                 AVDTP_MSG_TYPE_REJECT, AVDTP_SET_CONFIGURATION,
1468                                 &rej, sizeof(rej));
1469                 return;
1470         }
1471
1472         if (!avdtp_send(session, session->in.transaction, AVDTP_MSG_TYPE_ACCEPT,
1473                                         AVDTP_SET_CONFIGURATION, NULL, 0)) {
1474                 stream_free(stream);
1475                 return;
1476         }
1477
1478         sep = stream->lsep;
1479         sep->stream = stream;
1480         sep->info.inuse = 1;
1481         session->streams = g_slist_append(session->streams, stream);
1482
1483         avdtp_sep_set_state(session, sep, AVDTP_STATE_CONFIGURED);
1484 }
1485
1486 static gboolean avdtp_setconf_cmd(struct avdtp *session, uint8_t transaction,
1487                                 struct setconf_req *req, unsigned int size)
1488 {
1489         struct conf_rej rej;
1490         struct avdtp_local_sep *sep;
1491         struct avdtp_stream *stream;
1492         uint8_t err, category = 0x00;
1493         struct audio_device *dev;
1494         bdaddr_t src, dst;
1495         GSList *l;
1496
1497         if (size < sizeof(struct setconf_req)) {
1498                 error("Too short getcap request");
1499                 return FALSE;
1500         }
1501
1502         sep = find_local_sep_by_seid(session->server, req->acp_seid);
1503         if (!sep) {
1504                 err = AVDTP_BAD_ACP_SEID;
1505                 goto failed;
1506         }
1507
1508         if (sep->stream) {
1509                 err = AVDTP_SEP_IN_USE;
1510                 goto failed;
1511         }
1512
1513         avdtp_get_peers(session, &src, &dst);
1514         dev = manager_get_device(&src, &dst, FALSE);
1515         if (!dev) {
1516                 error("Unable to get a audio device object");
1517                 err = AVDTP_BAD_STATE;
1518                 goto failed;
1519         }
1520
1521         switch (sep->info.type) {
1522         case AVDTP_SEP_TYPE_SOURCE:
1523                 if (!dev->sink) {
1524                         btd_device_add_uuid(dev->btd_dev, A2DP_SINK_UUID);
1525                         if (!dev->sink) {
1526                                 error("Unable to get a audio sink object");
1527                                 err = AVDTP_BAD_STATE;
1528                                 goto failed;
1529                         }
1530                 }
1531                 break;
1532         case AVDTP_SEP_TYPE_SINK:
1533                 if (!dev->source) {
1534                         btd_device_add_uuid(dev->btd_dev, A2DP_SOURCE_UUID);
1535                         if (!dev->source) {
1536                                 error("Unable to get a audio source object");
1537                                 err = AVDTP_BAD_STATE;
1538                                 goto failed;
1539                         }
1540                 }
1541                 break;
1542         }
1543
1544         stream = g_new0(struct avdtp_stream, 1);
1545         stream->session = session;
1546         stream->lsep = sep;
1547         stream->rseid = req->int_seid;
1548         stream->caps = caps_to_list(req->caps,
1549                                         size - sizeof(struct setconf_req),
1550                                         &stream->codec,
1551                                         &stream->delay_reporting);
1552
1553         /* Verify that the Media Transport capability's length = 0. Reject otherwise */
1554         for (l = stream->caps; l != NULL; l = g_slist_next(l)) {
1555                 struct avdtp_service_capability *cap = l->data;
1556
1557                 if (cap->category == AVDTP_MEDIA_TRANSPORT && cap->length != 0) {
1558                         err = AVDTP_BAD_MEDIA_TRANSPORT_FORMAT;
1559                         goto failed_stream;
1560                 }
1561         }
1562
1563         if (stream->delay_reporting && session->version < 0x0103)
1564                 session->version = 0x0103;
1565
1566         if (sep->ind && sep->ind->set_configuration) {
1567                 if (!sep->ind->set_configuration(session, sep, stream,
1568                                                         stream->caps,
1569                                                         setconf_cb,
1570                                                         sep->user_data)) {
1571                         err = AVDTP_UNSUPPORTED_CONFIGURATION;
1572                         category = 0x00;
1573                         goto failed_stream;
1574                 }
1575         } else {
1576                 if (!avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
1577                                         AVDTP_SET_CONFIGURATION, NULL, 0)) {
1578                         stream_free(stream);
1579                         return FALSE;
1580                 }
1581
1582                 sep->stream = stream;
1583                 sep->info.inuse = 1;
1584                 session->streams = g_slist_append(session->streams, stream);
1585
1586                 avdtp_sep_set_state(session, sep, AVDTP_STATE_CONFIGURED);
1587         }
1588
1589         return TRUE;
1590
1591 failed_stream:
1592         stream_free(stream);
1593 failed:
1594         rej.error = err;
1595         rej.category = category;
1596         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
1597                                 AVDTP_SET_CONFIGURATION, &rej, sizeof(rej));
1598 }
1599
1600 static gboolean avdtp_getconf_cmd(struct avdtp *session, uint8_t transaction,
1601                                         struct seid_req *req, int size)
1602 {
1603         GSList *l;
1604         struct avdtp_local_sep *sep = NULL;
1605         int rsp_size;
1606         uint8_t err;
1607         uint8_t buf[1024];
1608         uint8_t *ptr = buf;
1609
1610         if (size < (int) sizeof(struct seid_req)) {
1611                 error("Too short getconf request");
1612                 return FALSE;
1613         }
1614
1615         memset(buf, 0, sizeof(buf));
1616
1617         sep = find_local_sep_by_seid(session->server, req->acp_seid);
1618         if (!sep) {
1619                 err = AVDTP_BAD_ACP_SEID;
1620                 goto failed;
1621         }
1622         if (!sep->stream || !sep->stream->caps) {
1623                 err = AVDTP_UNSUPPORTED_CONFIGURATION;
1624                 goto failed;
1625         }
1626
1627         for (l = sep->stream->caps, rsp_size = 0; l != NULL; l = g_slist_next(l)) {
1628                 struct avdtp_service_capability *cap = l->data;
1629
1630                 if (rsp_size + cap->length + 2 > (int) sizeof(buf))
1631                         break;
1632
1633                 memcpy(ptr, cap, cap->length + 2);
1634                 rsp_size += cap->length + 2;
1635                 ptr += cap->length + 2;
1636         }
1637
1638         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
1639                                 AVDTP_GET_CONFIGURATION, buf, rsp_size);
1640
1641 failed:
1642         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
1643                                 AVDTP_GET_CONFIGURATION, &err, sizeof(err));
1644 }
1645
1646 static gboolean avdtp_reconf_cmd(struct avdtp *session, uint8_t transaction,
1647                                         struct seid_req *req, int size)
1648 {
1649         struct conf_rej rej;
1650
1651         rej.error = AVDTP_NOT_SUPPORTED_COMMAND;
1652         rej.category = 0x00;
1653
1654         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
1655                                         AVDTP_RECONFIGURE, &rej, sizeof(rej));
1656 }
1657
1658 static void check_seid_collision(struct pending_req *req, uint8_t id)
1659 {
1660         struct seid_req *seid = req->data;
1661
1662         if (seid->acp_seid == id)
1663                 req->collided = TRUE;
1664 }
1665
1666 static void check_start_collision(struct pending_req *req, uint8_t id)
1667 {
1668         struct start_req *start = req->data;
1669         struct seid *seid = &start->first_seid;
1670         int count = 1 + req->data_size - sizeof(struct start_req);
1671         int i;
1672
1673         for (i = 0; i < count; i++, seid++) {
1674                 if (seid->seid == id) {
1675                         req->collided = TRUE;
1676                         return;
1677                 }
1678         }
1679 }
1680
1681 static void check_suspend_collision(struct pending_req *req, uint8_t id)
1682 {
1683         struct suspend_req *suspend = req->data;
1684         struct seid *seid = &suspend->first_seid;
1685         int count = 1 + req->data_size - sizeof(struct suspend_req);
1686         int i;
1687
1688         for (i = 0; i < count; i++, seid++) {
1689                 if (seid->seid == id) {
1690                         req->collided = TRUE;
1691                         return;
1692                 }
1693         }
1694 }
1695
1696 static void avdtp_check_collision(struct avdtp *session, uint8_t cmd,
1697                                         struct avdtp_stream *stream)
1698 {
1699         struct pending_req *req = session->req;
1700
1701         if (req == NULL || (req->signal_id != cmd && cmd != AVDTP_ABORT))
1702                 return;
1703
1704         if (cmd == AVDTP_ABORT)
1705                 cmd = req->signal_id;
1706
1707         switch (cmd) {
1708         case AVDTP_OPEN:
1709         case AVDTP_CLOSE:
1710                 check_seid_collision(req, stream->rseid);
1711                 break;
1712         case AVDTP_START:
1713                 check_start_collision(req, stream->rseid);
1714                 break;
1715         case AVDTP_SUSPEND:
1716                 check_suspend_collision(req, stream->rseid);
1717                 break;
1718         }
1719 }
1720
1721 static gboolean avdtp_open_cmd(struct avdtp *session, uint8_t transaction,
1722                                 struct seid_req *req, unsigned int size)
1723 {
1724         struct avdtp_local_sep *sep;
1725         struct avdtp_stream *stream;
1726         uint8_t err;
1727
1728         if (size < sizeof(struct seid_req)) {
1729                 error("Too short abort request");
1730                 return FALSE;
1731         }
1732
1733         sep = find_local_sep_by_seid(session->server, req->acp_seid);
1734         if (!sep) {
1735                 err = AVDTP_BAD_ACP_SEID;
1736                 goto failed;
1737         }
1738
1739         if (sep->state != AVDTP_STATE_CONFIGURED) {
1740                 err = AVDTP_BAD_STATE;
1741                 goto failed;
1742         }
1743
1744         stream = sep->stream;
1745
1746         if (sep->ind && sep->ind->open) {
1747                 if (!sep->ind->open(session, sep, stream, &err,
1748                                         sep->user_data))
1749                         goto failed;
1750         }
1751
1752         avdtp_check_collision(session, AVDTP_OPEN, stream);
1753
1754         if (!avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
1755                                                 AVDTP_OPEN, NULL, 0))
1756                 return FALSE;
1757
1758         stream->open_acp = TRUE;
1759         session->pending_open = stream;
1760         stream->timer = g_timeout_add_seconds(REQ_TIMEOUT,
1761                                                 stream_open_timeout,
1762                                                 stream);
1763
1764         return TRUE;
1765
1766 failed:
1767         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
1768                                 AVDTP_OPEN, &err, sizeof(err));
1769 }
1770
1771 static gboolean avdtp_start_cmd(struct avdtp *session, uint8_t transaction,
1772                                 struct start_req *req, unsigned int size)
1773 {
1774         struct avdtp_local_sep *sep;
1775         struct avdtp_stream *stream;
1776         struct stream_rej rej;
1777         struct seid *seid;
1778         uint8_t err, failed_seid;
1779         int seid_count, i;
1780
1781         if (size < sizeof(struct start_req)) {
1782                 error("Too short start request");
1783                 return FALSE;
1784         }
1785
1786         seid_count = 1 + size - sizeof(struct start_req);
1787
1788         seid = &req->first_seid;
1789
1790         for (i = 0; i < seid_count; i++, seid++) {
1791                 failed_seid = seid->seid;
1792
1793                 sep = find_local_sep_by_seid(session->server,
1794                                         req->first_seid.seid);
1795                 if (!sep || !sep->stream) {
1796                         err = AVDTP_BAD_ACP_SEID;
1797                         goto failed;
1798                 }
1799
1800                 stream = sep->stream;
1801
1802                 /* Also reject start cmd if state is not open */
1803                 if (sep->state != AVDTP_STATE_OPEN) {
1804                         err = AVDTP_BAD_STATE;
1805                         goto failed;
1806                 }
1807                 stream->starting = TRUE;
1808
1809                 if (sep->ind && sep->ind->start) {
1810                         if (!sep->ind->start(session, sep, stream, &err,
1811                                                 sep->user_data))
1812                                 goto failed;
1813                 }
1814
1815                 avdtp_check_collision(session, AVDTP_START, stream);
1816
1817                 avdtp_sep_set_state(session, sep, AVDTP_STATE_STREAMING);
1818         }
1819
1820         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
1821                                                 AVDTP_START, NULL, 0);
1822
1823 failed:
1824         DBG("Rejecting (%d)", err);
1825         memset(&rej, 0, sizeof(rej));
1826         rej.acp_seid = failed_seid;
1827         rej.error = err;
1828         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
1829                                 AVDTP_START, &rej, sizeof(rej));
1830 }
1831
1832 static gboolean avdtp_close_cmd(struct avdtp *session, uint8_t transaction,
1833                                 struct seid_req *req, unsigned int size)
1834 {
1835         struct avdtp_local_sep *sep;
1836         struct avdtp_stream *stream;
1837         uint8_t err;
1838
1839         if (size < sizeof(struct seid_req)) {
1840                 error("Too short close request");
1841                 return FALSE;
1842         }
1843
1844         sep = find_local_sep_by_seid(session->server, req->acp_seid);
1845         if (!sep || !sep->stream) {
1846                 err = AVDTP_BAD_ACP_SEID;
1847                 goto failed;
1848         }
1849
1850         if (sep->state != AVDTP_STATE_OPEN &&
1851                         sep->state != AVDTP_STATE_STREAMING) {
1852                 err = AVDTP_BAD_STATE;
1853                 goto failed;
1854         }
1855
1856         stream = sep->stream;
1857
1858         if (sep->ind && sep->ind->close) {
1859                 if (!sep->ind->close(session, sep, stream, &err,
1860                                         sep->user_data))
1861                         goto failed;
1862         }
1863
1864         avdtp_check_collision(session, AVDTP_CLOSE, stream);
1865
1866         avdtp_sep_set_state(session, sep, AVDTP_STATE_CLOSING);
1867
1868         if (!avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
1869                                                 AVDTP_CLOSE, NULL, 0))
1870                 return FALSE;
1871
1872         stream->timer = g_timeout_add_seconds(REQ_TIMEOUT,
1873                                         stream_close_timeout,
1874                                         stream);
1875
1876         return TRUE;
1877
1878 failed:
1879         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
1880                                         AVDTP_CLOSE, &err, sizeof(err));
1881 }
1882
1883 static gboolean avdtp_suspend_cmd(struct avdtp *session, uint8_t transaction,
1884                                 struct suspend_req *req, unsigned int size)
1885 {
1886         struct avdtp_local_sep *sep;
1887         struct avdtp_stream *stream;
1888         struct stream_rej rej;
1889         struct seid *seid;
1890         uint8_t err, failed_seid;
1891         int seid_count, i;
1892
1893         if (size < sizeof(struct suspend_req)) {
1894                 error("Too short suspend request");
1895                 return FALSE;
1896         }
1897
1898         seid_count = 1 + size - sizeof(struct suspend_req);
1899
1900         seid = &req->first_seid;
1901
1902         for (i = 0; i < seid_count; i++, seid++) {
1903                 failed_seid = seid->seid;
1904
1905                 sep = find_local_sep_by_seid(session->server,
1906                                         req->first_seid.seid);
1907                 if (!sep || !sep->stream) {
1908                         err = AVDTP_BAD_ACP_SEID;
1909                         goto failed;
1910                 }
1911
1912                 stream = sep->stream;
1913
1914                 if (sep->state != AVDTP_STATE_STREAMING) {
1915                         err = AVDTP_BAD_STATE;
1916                         goto failed;
1917                 }
1918
1919                 if (sep->ind && sep->ind->suspend) {
1920                         if (!sep->ind->suspend(session, sep, stream, &err,
1921                                                 sep->user_data))
1922                                 goto failed;
1923                 }
1924
1925                 avdtp_check_collision(session, AVDTP_SUSPEND, stream);
1926
1927                 avdtp_sep_set_state(session, sep, AVDTP_STATE_OPEN);
1928         }
1929
1930         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
1931                                                 AVDTP_SUSPEND, NULL, 0);
1932
1933 failed:
1934         memset(&rej, 0, sizeof(rej));
1935         rej.acp_seid = failed_seid;
1936         rej.error = err;
1937         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
1938                                 AVDTP_SUSPEND, &rej, sizeof(rej));
1939 }
1940
1941 static gboolean avdtp_abort_cmd(struct avdtp *session, uint8_t transaction,
1942                                 struct seid_req *req, unsigned int size)
1943 {
1944         struct avdtp_local_sep *sep;
1945         uint8_t err;
1946         gboolean ret;
1947
1948         if (size < sizeof(struct seid_req)) {
1949                 error("Too short abort request");
1950                 return FALSE;
1951         }
1952
1953         sep = find_local_sep_by_seid(session->server, req->acp_seid);
1954         if (!sep || !sep->stream)
1955                 return TRUE;
1956
1957         if (sep->ind && sep->ind->abort)
1958                 sep->ind->abort(session, sep, sep->stream, &err,
1959                                                         sep->user_data);
1960
1961         avdtp_check_collision(session, AVDTP_ABORT, sep->stream);
1962
1963         ret = avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
1964                                                 AVDTP_ABORT, NULL, 0);
1965         if (ret)
1966                 avdtp_sep_set_state(session, sep, AVDTP_STATE_ABORTING);
1967
1968         return ret;
1969 }
1970
1971 static gboolean avdtp_secctl_cmd(struct avdtp *session, uint8_t transaction,
1972                                         struct seid_req *req, int size)
1973 {
1974         return avdtp_unknown_cmd(session, transaction, AVDTP_SECURITY_CONTROL);
1975 }
1976
1977 static gboolean avdtp_delayreport_cmd(struct avdtp *session,
1978                                         uint8_t transaction,
1979                                         struct delay_req *req,
1980                                         unsigned int size)
1981 {
1982         struct avdtp_local_sep *sep;
1983         struct avdtp_stream *stream;
1984         uint8_t err;
1985
1986         if (size < sizeof(struct delay_req)) {
1987                 error("Too short delay report request");
1988                 return FALSE;
1989         }
1990
1991         sep = find_local_sep_by_seid(session->server, req->acp_seid);
1992         if (!sep || !sep->stream) {
1993                 err = AVDTP_BAD_ACP_SEID;
1994                 goto failed;
1995         }
1996
1997         stream = sep->stream;
1998
1999         if (sep->state != AVDTP_STATE_CONFIGURED &&
2000                                         sep->state != AVDTP_STATE_STREAMING) {
2001                 err = AVDTP_BAD_STATE;
2002                 goto failed;
2003         }
2004
2005         stream->delay = ntohs(req->delay);
2006
2007         if (sep->ind && sep->ind->delayreport) {
2008                 if (!sep->ind->delayreport(session, sep, stream->rseid,
2009                                                 stream->delay, &err,
2010                                                 sep->user_data))
2011                         goto failed;
2012         }
2013
2014         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_ACCEPT,
2015                                                 AVDTP_DELAY_REPORT, NULL, 0);
2016
2017 failed:
2018         return avdtp_send(session, transaction, AVDTP_MSG_TYPE_REJECT,
2019                                         AVDTP_DELAY_REPORT, &err, sizeof(err));
2020 }
2021
2022 static gboolean avdtp_parse_cmd(struct avdtp *session, uint8_t transaction,
2023                                 uint8_t signal_id, void *buf, int size)
2024 {
2025         switch (signal_id) {
2026         case AVDTP_DISCOVER:
2027                 DBG("Received DISCOVER_CMD");
2028                 return avdtp_discover_cmd(session, transaction, buf, size);
2029         case AVDTP_GET_CAPABILITIES:
2030                 DBG("Received  GET_CAPABILITIES_CMD");
2031                 return avdtp_getcap_cmd(session, transaction, buf, size,
2032                                                                         FALSE);
2033         case AVDTP_GET_ALL_CAPABILITIES:
2034                 DBG("Received  GET_ALL_CAPABILITIES_CMD");
2035                 return avdtp_getcap_cmd(session, transaction, buf, size, TRUE);
2036         case AVDTP_SET_CONFIGURATION:
2037                 DBG("Received SET_CONFIGURATION_CMD");
2038                 return avdtp_setconf_cmd(session, transaction, buf, size);
2039         case AVDTP_GET_CONFIGURATION:
2040                 DBG("Received GET_CONFIGURATION_CMD");
2041                 return avdtp_getconf_cmd(session, transaction, buf, size);
2042         case AVDTP_RECONFIGURE:
2043                 DBG("Received RECONFIGURE_CMD");
2044                 return avdtp_reconf_cmd(session, transaction, buf, size);
2045         case AVDTP_OPEN:
2046                 DBG("Received OPEN_CMD");
2047                 return avdtp_open_cmd(session, transaction, buf, size);
2048         case AVDTP_START:
2049                 DBG("Received START_CMD");
2050                 return avdtp_start_cmd(session, transaction, buf, size);
2051         case AVDTP_CLOSE:
2052                 DBG("Received CLOSE_CMD");
2053                 return avdtp_close_cmd(session, transaction, buf, size);
2054         case AVDTP_SUSPEND:
2055                 DBG("Received SUSPEND_CMD");
2056                 return avdtp_suspend_cmd(session, transaction, buf, size);
2057         case AVDTP_ABORT:
2058                 DBG("Received ABORT_CMD");
2059                 return avdtp_abort_cmd(session, transaction, buf, size);
2060         case AVDTP_SECURITY_CONTROL:
2061                 DBG("Received SECURITY_CONTROL_CMD");
2062                 return avdtp_secctl_cmd(session, transaction, buf, size);
2063         case AVDTP_DELAY_REPORT:
2064                 DBG("Received DELAY_REPORT_CMD");
2065                 return avdtp_delayreport_cmd(session, transaction, buf, size);
2066         default:
2067                 DBG("Received unknown request id %u", signal_id);
2068                 return avdtp_unknown_cmd(session, transaction, signal_id);
2069         }
2070 }
2071
2072 enum avdtp_parse_result { PARSE_ERROR, PARSE_FRAGMENT, PARSE_SUCCESS };
2073
2074 static enum avdtp_parse_result avdtp_parse_data(struct avdtp *session,
2075                                                         void *buf, size_t size)
2076 {
2077         struct avdtp_common_header *header = buf;
2078         struct avdtp_single_header *single = (void *) session->buf;
2079         struct avdtp_start_header *start = (void *) session->buf;
2080         void *payload;
2081         gsize payload_size;
2082
2083         switch (header->packet_type) {
2084         case AVDTP_PKT_TYPE_SINGLE:
2085                 if (size < sizeof(*single)) {
2086                         error("Received too small single packet (%zu bytes)", size);
2087                         return PARSE_ERROR;
2088                 }
2089                 if (session->in.active) {
2090                         error("SINGLE: Invalid AVDTP packet fragmentation");
2091                         return PARSE_ERROR;
2092                 }
2093
2094                 payload = session->buf + sizeof(*single);
2095                 payload_size = size - sizeof(*single);
2096
2097                 session->in.active = TRUE;
2098                 session->in.data_size = 0;
2099                 session->in.no_of_packets = 1;
2100                 session->in.transaction = header->transaction;
2101                 session->in.message_type = header->message_type;
2102                 session->in.signal_id = single->signal_id;
2103
2104                 break;
2105         case AVDTP_PKT_TYPE_START:
2106                 if (size < sizeof(*start)) {
2107                         error("Received too small start packet (%zu bytes)", size);
2108                         return PARSE_ERROR;
2109                 }
2110                 if (session->in.active) {
2111                         error("START: Invalid AVDTP packet fragmentation");
2112                         return PARSE_ERROR;
2113                 }
2114
2115                 session->in.active = TRUE;
2116                 session->in.data_size = 0;
2117                 session->in.transaction = header->transaction;
2118                 session->in.message_type = header->message_type;
2119                 session->in.no_of_packets = start->no_of_packets;
2120                 session->in.signal_id = start->signal_id;
2121
2122                 payload = session->buf + sizeof(*start);
2123                 payload_size = size - sizeof(*start);
2124
2125                 break;
2126         case AVDTP_PKT_TYPE_CONTINUE:
2127                 if (size < sizeof(struct avdtp_continue_header)) {
2128                         error("Received too small continue packet (%zu bytes)",
2129                                                                         size);
2130                         return PARSE_ERROR;
2131                 }
2132                 if (!session->in.active) {
2133                         error("CONTINUE: Invalid AVDTP packet fragmentation");
2134                         return PARSE_ERROR;
2135                 }
2136                 if (session->in.transaction != header->transaction) {
2137                         error("Continue transaction id doesn't match");
2138                         return PARSE_ERROR;
2139                 }
2140                 if (session->in.no_of_packets <= 1) {
2141                         error("Too few continue packets");
2142                         return PARSE_ERROR;
2143                 }
2144
2145                 payload = session->buf + sizeof(struct avdtp_continue_header);
2146                 payload_size = size - sizeof(struct avdtp_continue_header);
2147
2148                 break;
2149         case AVDTP_PKT_TYPE_END:
2150                 if (size < sizeof(struct avdtp_continue_header)) {
2151                         error("Received too small end packet (%zu bytes)", size);
2152                         return PARSE_ERROR;
2153                 }
2154                 if (!session->in.active) {
2155                         error("END: Invalid AVDTP packet fragmentation");
2156                         return PARSE_ERROR;
2157                 }
2158                 if (session->in.transaction != header->transaction) {
2159                         error("End transaction id doesn't match");
2160                         return PARSE_ERROR;
2161                 }
2162                 if (session->in.no_of_packets > 1) {
2163                         error("Got an end packet too early");
2164                         return PARSE_ERROR;
2165                 }
2166
2167                 payload = session->buf + sizeof(struct avdtp_continue_header);
2168                 payload_size = size - sizeof(struct avdtp_continue_header);
2169
2170                 break;
2171         default:
2172                 error("Invalid AVDTP packet type 0x%02X", header->packet_type);
2173                 return PARSE_ERROR;
2174         }
2175
2176         if (session->in.data_size + payload_size >
2177                                         sizeof(session->in.buf)) {
2178                 error("Not enough incoming buffer space!");
2179                 return PARSE_ERROR;
2180         }
2181
2182         memcpy(session->in.buf + session->in.data_size, payload, payload_size);
2183         session->in.data_size += payload_size;
2184
2185         if (session->in.no_of_packets > 1) {
2186                 session->in.no_of_packets--;
2187                 DBG("Received AVDTP fragment. %d to go",
2188                                                 session->in.no_of_packets);
2189                 return PARSE_FRAGMENT;
2190         }
2191
2192         session->in.active = FALSE;
2193
2194         return PARSE_SUCCESS;
2195 }
2196
2197 static gboolean session_cb(GIOChannel *chan, GIOCondition cond,
2198                                 gpointer data)
2199 {
2200         struct avdtp *session = data;
2201         struct avdtp_common_header *header;
2202         ssize_t size;
2203         int fd;
2204
2205         DBG("");
2206
2207         if (cond & G_IO_NVAL)
2208                 return FALSE;
2209
2210         header = (void *) session->buf;
2211
2212         if (cond & (G_IO_HUP | G_IO_ERR))
2213                 goto failed;
2214
2215         fd = g_io_channel_unix_get_fd(chan);
2216         size = read(fd, session->buf, session->imtu);
2217         if (size < 0) {
2218                 error("IO Channel read error");
2219                 goto failed;
2220         }
2221
2222         if ((size_t) size < sizeof(struct avdtp_common_header)) {
2223                 error("Received too small packet (%zu bytes)", size);
2224                 goto failed;
2225         }
2226
2227         switch (avdtp_parse_data(session, session->buf, size)) {
2228         case PARSE_ERROR:
2229                 goto failed;
2230         case PARSE_FRAGMENT:
2231                 return TRUE;
2232         case PARSE_SUCCESS:
2233                 break;
2234         }
2235
2236         if (session->in.message_type == AVDTP_MSG_TYPE_COMMAND) {
2237                 if (!avdtp_parse_cmd(session, session->in.transaction,
2238                                         session->in.signal_id,
2239                                         session->in.buf,
2240                                         session->in.data_size)) {
2241                         error("Unable to handle command. Disconnecting");
2242                         goto failed;
2243                 }
2244
2245                 if (session->ref == 1 && !session->streams && !session->req)
2246                         set_disconnect_timer(session);
2247
2248                 if (session->streams && session->dc_timer)
2249                         remove_disconnect_timer(session);
2250
2251                 if (session->req && session->req->collided) {
2252                         DBG("Collision detected");
2253                         goto next;
2254                 }
2255
2256                 return TRUE;
2257         }
2258
2259         if (session->req == NULL) {
2260                 error("No pending request, ignoring message");
2261                 return TRUE;
2262         }
2263
2264         if (header->transaction != session->req->transaction) {
2265                 error("Transaction label doesn't match");
2266                 return TRUE;
2267         }
2268
2269         if (session->in.signal_id != session->req->signal_id) {
2270                 error("Response signal doesn't match");
2271                 return TRUE;
2272         }
2273
2274         g_source_remove(session->req->timeout);
2275         session->req->timeout = 0;
2276
2277         switch (header->message_type) {
2278         case AVDTP_MSG_TYPE_ACCEPT:
2279                 if (!avdtp_parse_resp(session, session->req->stream,
2280                                                 session->in.transaction,
2281                                                 session->in.signal_id,
2282                                                 session->in.buf,
2283                                                 session->in.data_size)) {
2284                         error("Unable to parse accept response");
2285                         goto failed;
2286                 }
2287                 break;
2288         case AVDTP_MSG_TYPE_REJECT:
2289                 if (!avdtp_parse_rej(session, session->req->stream,
2290                                                 session->in.transaction,
2291                                                 session->in.signal_id,
2292                                                 session->in.buf,
2293                                                 session->in.data_size)) {
2294                         error("Unable to parse reject response");
2295                         goto failed;
2296                 }
2297                 break;
2298         case AVDTP_MSG_TYPE_GEN_REJECT:
2299                 error("Received a General Reject message");
2300                 break;
2301         default:
2302                 error("Unknown message type 0x%02X", header->message_type);
2303                 break;
2304         }
2305
2306 next:
2307         pending_req_free(session->req);
2308         session->req = NULL;
2309
2310         process_queue(session);
2311
2312         return TRUE;
2313
2314 failed:
2315         connection_lost(session, EIO);
2316
2317         return FALSE;
2318 }
2319
2320 static struct avdtp *find_session(GSList *list, const bdaddr_t *dst)
2321 {
2322         for (; list != NULL; list = g_slist_next(list)) {
2323                 struct avdtp *s = list->data;
2324
2325                 if (bacmp(dst, &s->dst))
2326                         continue;
2327
2328                 return s;
2329         }
2330
2331         return NULL;
2332 }
2333
2334 static uint16_t get_version(struct avdtp *session)
2335 {
2336         struct btd_adapter *adapter;
2337         struct btd_device *device;
2338         const sdp_record_t *rec;
2339         sdp_list_t *protos;
2340         sdp_data_t *proto_desc;
2341         char addr[18];
2342         uint16_t ver = 0x0100;
2343
2344         adapter = manager_find_adapter(&session->server->src);
2345         if (!adapter)
2346                 return ver;
2347
2348         ba2str(&session->dst, addr);
2349         device = adapter_find_device(adapter, addr);
2350         if (!device)
2351                 return ver;
2352
2353         rec = btd_device_get_record(device, A2DP_SINK_UUID);
2354         if (!rec)
2355                 rec = btd_device_get_record(device, A2DP_SOURCE_UUID);
2356
2357         if (!rec)
2358                 return ver;
2359
2360         if (sdp_get_access_protos(rec, &protos) < 0)
2361                 return ver;
2362
2363         proto_desc = sdp_get_proto_desc(protos, AVDTP_UUID);
2364         if (proto_desc && proto_desc->dtd == SDP_UINT16)
2365                 ver = proto_desc->val.uint16;
2366
2367         sdp_list_foreach(protos, (sdp_list_func_t) sdp_list_free, NULL);
2368         sdp_list_free(protos, NULL);
2369
2370         return ver;
2371 }
2372
2373 static struct avdtp *avdtp_get_internal(const bdaddr_t *src, const bdaddr_t *dst)
2374 {
2375         struct avdtp_server *server;
2376         struct avdtp *session;
2377
2378         assert(src != NULL);
2379         assert(dst != NULL);
2380
2381         server = find_server(servers, src);
2382         if (server == NULL)
2383                 return NULL;
2384
2385         session = find_session(server->sessions, dst);
2386         if (session) {
2387                 if (session->pending_auth)
2388                         return NULL;
2389                 else
2390                         return session;
2391         }
2392
2393         session = g_new0(struct avdtp, 1);
2394
2395         session->server = server;
2396         bacpy(&session->dst, dst);
2397         session->ref = 1;
2398         /* We don't use avdtp_set_state() here since this isn't a state change
2399          * but just setting of the initial state */
2400         session->state = AVDTP_SESSION_STATE_DISCONNECTED;
2401         session->auto_dc = TRUE;
2402
2403         session->version = get_version(session);
2404
2405         server->sessions = g_slist_append(server->sessions, session);
2406
2407         return session;
2408 }
2409
2410 struct avdtp *avdtp_get(bdaddr_t *src, bdaddr_t *dst)
2411 {
2412         struct avdtp *session;
2413
2414         session = avdtp_get_internal(src, dst);
2415
2416         if (!session)
2417                 return NULL;
2418
2419         return avdtp_ref(session);
2420 }
2421
2422 static void avdtp_connect_cb(GIOChannel *chan, GError *err, gpointer user_data)
2423 {
2424         struct avdtp *session = user_data;
2425         char address[18];
2426         GError *gerr = NULL;
2427
2428         if (err) {
2429                 error("%s", err->message);
2430                 goto failed;
2431         }
2432
2433         if (!session->io)
2434                 session->io = g_io_channel_ref(chan);
2435
2436         bt_io_get(chan, BT_IO_L2CAP, &gerr,
2437                         BT_IO_OPT_OMTU, &session->omtu,
2438                         BT_IO_OPT_IMTU, &session->imtu,
2439                         BT_IO_OPT_INVALID);
2440         if (gerr) {
2441                 error("%s", gerr->message);
2442                 g_error_free(gerr);
2443                 goto failed;
2444         }
2445
2446         ba2str(&session->dst, address);
2447         DBG("AVDTP: connected %s channel to %s",
2448                         session->pending_open ? "transport" : "signaling",
2449                         address);
2450
2451         if (session->state == AVDTP_SESSION_STATE_CONNECTING) {
2452                 DBG("AVDTP imtu=%u, omtu=%u", session->imtu, session->omtu);
2453
2454                 session->buf = g_malloc0(MAX(session->imtu, session->omtu));
2455                 avdtp_set_state(session, AVDTP_SESSION_STATE_CONNECTED);
2456
2457                 if (session->io_id)
2458                         g_source_remove(session->io_id);
2459
2460                 /* This watch should be low priority since otherwise the
2461                  * connect callback might be dispatched before the session
2462                  * callback if the kernel wakes us up at the same time for
2463                  * them. This could happen if a headset is very quick in
2464                  * sending the Start command after connecting the stream
2465                  * transport channel.
2466                  */
2467                 session->io_id = g_io_add_watch_full(chan,
2468                                                 G_PRIORITY_LOW,
2469                                                 G_IO_IN | G_IO_ERR | G_IO_HUP
2470                                                 | G_IO_NVAL,
2471                                                 (GIOFunc) session_cb, session,
2472                                                 NULL);
2473
2474                 if (session->stream_setup) {
2475                         set_disconnect_timer(session);
2476                         avdtp_set_auto_disconnect(session, FALSE);
2477                 }
2478         } else if (session->pending_open)
2479                 handle_transport_connect(session, chan, session->imtu,
2480                                                                 session->omtu);
2481         else
2482                 goto failed;
2483
2484         process_queue(session);
2485
2486         return;
2487
2488 failed:
2489         if (session->pending_open) {
2490                 struct avdtp_stream *stream = session->pending_open;
2491
2492                 handle_transport_connect(session, NULL, 0, 0);
2493
2494                 if (avdtp_abort(session, stream) < 0)
2495                         avdtp_sep_set_state(session, stream->lsep,
2496                                                 AVDTP_STATE_IDLE);
2497         } else
2498                 connection_lost(session, EIO);
2499 }
2500
2501 static void auth_cb(DBusError *derr, void *user_data)
2502 {
2503         struct avdtp *session = user_data;
2504         GError *err = NULL;
2505
2506         if (derr && dbus_error_is_set(derr)) {
2507                 error("Access denied: %s", derr->message);
2508                 connection_lost(session, EACCES);
2509                 return;
2510         }
2511
2512         if (!bt_io_accept(session->io, avdtp_connect_cb, session, NULL,
2513                                                                 &err)) {
2514                 error("bt_io_accept: %s", err->message);
2515                 connection_lost(session, EACCES);
2516                 g_error_free(err);
2517                 return;
2518         }
2519
2520         /* This is so that avdtp_connect_cb will know to do the right thing
2521          * with respect to the disconnect timer */
2522         session->stream_setup = TRUE;
2523 }
2524
2525 static void avdtp_confirm_cb(GIOChannel *chan, gpointer data)
2526 {
2527         struct avdtp *session;
2528         struct audio_device *dev;
2529         char address[18];
2530         bdaddr_t src, dst;
2531         int perr;
2532         GError *err = NULL;
2533
2534         bt_io_get(chan, BT_IO_L2CAP, &err,
2535                         BT_IO_OPT_SOURCE_BDADDR, &src,
2536                         BT_IO_OPT_DEST_BDADDR, &dst,
2537                         BT_IO_OPT_DEST, address,
2538                         BT_IO_OPT_INVALID);
2539         if (err) {
2540                 error("%s", err->message);
2541                 g_error_free(err);
2542                 goto drop;
2543         }
2544
2545         DBG("AVDTP: incoming connect from %s", address);
2546
2547         session = avdtp_get_internal(&src, &dst);
2548         if (!session)
2549                 goto drop;
2550
2551         /* This state (ie, session is already *connecting*) happens when the
2552          * device initiates a connect (really a config'd L2CAP channel) even
2553          * though there is a connect we initiated in progress. In sink.c &
2554          * source.c, this state is referred to as XCASE connect:connect.
2555          * Abort the device's channel in favor of our own.
2556          */
2557         if (session->state == AVDTP_SESSION_STATE_CONNECTING) {
2558                 DBG("connect already in progress (XCASE connect:connect)");
2559                 goto drop;
2560         }
2561
2562         if (session->pending_open && session->pending_open->open_acp) {
2563                 if (!bt_io_accept(chan, avdtp_connect_cb, session, NULL, NULL))
2564                         goto drop;
2565                 return;
2566         }
2567
2568         if (session->io) {
2569                 error("Refusing unexpected connect from %s", address);
2570                 goto drop;
2571         }
2572
2573         dev = manager_get_device(&src, &dst, FALSE);
2574         if (!dev) {
2575                 dev = manager_get_device(&src, &dst, TRUE);
2576                 if (!dev) {
2577                         error("Unable to get audio device object for %s",
2578                                         address);
2579                         goto drop;
2580                 }
2581                 btd_device_add_uuid(dev->btd_dev, ADVANCED_AUDIO_UUID);
2582         }
2583
2584         session->io = g_io_channel_ref(chan);
2585         avdtp_set_state(session, AVDTP_SESSION_STATE_CONNECTING);
2586
2587         session->io_id = g_io_add_watch(chan, G_IO_ERR | G_IO_HUP | G_IO_NVAL,
2588                                         (GIOFunc) session_cb, session);
2589
2590         perr = audio_device_request_authorization(dev, ADVANCED_AUDIO_UUID,
2591                                                         auth_cb, session);
2592         if (perr < 0) {
2593                 avdtp_set_state(session, AVDTP_SESSION_STATE_DISCONNECTED);
2594                 avdtp_unref(session);
2595                 goto drop;
2596         }
2597
2598         dev->auto_connect = auto_connect;
2599
2600         return;
2601
2602 drop:
2603         g_io_channel_shutdown(chan, TRUE, NULL);
2604 }
2605
2606 static GIOChannel *l2cap_connect(struct avdtp *session)
2607 {
2608         GError *err = NULL;
2609         GIOChannel *io;
2610
2611         io = bt_io_connect(BT_IO_L2CAP, avdtp_connect_cb, session,
2612                                 NULL, &err,
2613                                 BT_IO_OPT_SOURCE_BDADDR, &session->server->src,
2614                                 BT_IO_OPT_DEST_BDADDR, &session->dst,
2615                                 BT_IO_OPT_PSM, AVDTP_PSM,
2616                                 BT_IO_OPT_SEC_LEVEL, BT_IO_SEC_MEDIUM,
2617                                 BT_IO_OPT_INVALID);
2618         if (!io) {
2619                 error("%s", err->message);
2620                 g_error_free(err);
2621                 return NULL;
2622         }
2623
2624         return io;
2625 }
2626
2627 static void queue_request(struct avdtp *session, struct pending_req *req,
2628                         gboolean priority)
2629 {
2630         if (priority)
2631                 session->prio_queue = g_slist_append(session->prio_queue, req);
2632         else
2633                 session->req_queue = g_slist_append(session->req_queue, req);
2634 }
2635
2636 static uint8_t req_get_seid(struct pending_req *req)
2637 {
2638         if (req->signal_id == AVDTP_DISCOVER)
2639                 return 0;
2640
2641         return ((struct seid_req *) (req->data))->acp_seid;
2642 }
2643
2644 static int cancel_request(struct avdtp *session, int err)
2645 {
2646         struct pending_req *req;
2647         struct seid_req sreq;
2648         struct avdtp_local_sep *lsep;
2649         struct avdtp_stream *stream;
2650         uint8_t seid;
2651         struct avdtp_error averr;
2652
2653         req = session->req;
2654         session->req = NULL;
2655
2656         avdtp_error_init(&averr, AVDTP_ERRNO, err);
2657
2658         seid = req_get_seid(req);
2659         if (seid)
2660                 stream = find_stream_by_rseid(session, seid);
2661         else
2662                 stream = NULL;
2663
2664         if (stream) {
2665                 stream->abort_int = TRUE;
2666                 lsep = stream->lsep;
2667         } else
2668                 lsep = NULL;
2669
2670         switch (req->signal_id) {
2671         case AVDTP_RECONFIGURE:
2672                 error("Reconfigure: %s (%d)", strerror(err), err);
2673                 if (lsep && lsep->cfm && lsep->cfm->reconfigure)
2674                         lsep->cfm->reconfigure(session, lsep, stream, &averr,
2675                                                 lsep->user_data);
2676                 break;
2677         case AVDTP_OPEN:
2678                 error("Open: %s (%d)", strerror(err), err);
2679                 if (lsep && lsep->cfm && lsep->cfm->open)
2680                         lsep->cfm->open(session, lsep, stream, &averr,
2681                                         lsep->user_data);
2682                 break;
2683         case AVDTP_START:
2684                 error("Start: %s (%d)", strerror(err), err);
2685                 if (lsep && lsep->cfm && lsep->cfm->start) {
2686                         lsep->cfm->start(session, lsep, stream, &averr,
2687                                                 lsep->user_data);
2688                         if (stream)
2689                                 stream->starting = FALSE;
2690                 }
2691                 break;
2692         case AVDTP_SUSPEND:
2693                 error("Suspend: %s (%d)", strerror(err), err);
2694                 if (lsep && lsep->cfm && lsep->cfm->suspend)
2695                         lsep->cfm->suspend(session, lsep, stream, &averr,
2696                                                 lsep->user_data);
2697                 break;
2698         case AVDTP_CLOSE:
2699                 error("Close: %s (%d)", strerror(err), err);
2700                 if (lsep && lsep->cfm && lsep->cfm->close) {
2701                         lsep->cfm->close(session, lsep, stream, &averr,
2702                                                 lsep->user_data);
2703                         if (stream)
2704                                 stream->close_int = FALSE;
2705                 }
2706                 break;
2707         case AVDTP_SET_CONFIGURATION:
2708                 error("SetConfiguration: %s (%d)", strerror(err), err);
2709                 if (lsep && lsep->cfm && lsep->cfm->set_configuration)
2710                         lsep->cfm->set_configuration(session, lsep, stream,
2711                                                         &averr, lsep->user_data);
2712                 goto failed;
2713         case AVDTP_DISCOVER:
2714                 error("Discover: %s (%d)", strerror(err), err);
2715                 goto failed;
2716         case AVDTP_GET_CAPABILITIES:
2717                 error("GetCapabilities: %s (%d)", strerror(err), err);
2718                 goto failed;
2719         case AVDTP_ABORT:
2720                 error("Abort: %s (%d)", strerror(err), err);
2721                 goto failed;
2722         }
2723
2724         if (!stream)
2725                 goto failed;
2726
2727         memset(&sreq, 0, sizeof(sreq));
2728         sreq.acp_seid = seid;
2729
2730         err = send_request(session, TRUE, stream, AVDTP_ABORT, &sreq,
2731                                 sizeof(sreq));
2732         if (err < 0) {
2733                 error("Unable to send abort request");
2734                 goto failed;
2735         }
2736
2737         goto done;
2738
2739 failed:
2740         connection_lost(session, err);
2741 done:
2742         pending_req_free(req);
2743         return err;
2744 }
2745
2746 static gboolean request_timeout(gpointer user_data)
2747 {
2748         struct avdtp *session = user_data;
2749
2750         cancel_request(session, ETIMEDOUT);
2751
2752         return FALSE;
2753 }
2754
2755 static int send_req(struct avdtp *session, gboolean priority,
2756                         struct pending_req *req)
2757 {
2758         static int transaction = 0;
2759         int err;
2760
2761         if (session->state == AVDTP_SESSION_STATE_DISCONNECTED) {
2762                 session->io = l2cap_connect(session);
2763                 if (!session->io) {
2764                         err = -EIO;
2765                         goto failed;
2766                 }
2767                 avdtp_set_state(session, AVDTP_SESSION_STATE_CONNECTING);
2768         }
2769
2770         if (session->state < AVDTP_SESSION_STATE_CONNECTED ||
2771                         session->req != NULL) {
2772                 queue_request(session, req, priority);
2773                 return 0;
2774         }
2775
2776         req->transaction = transaction++;
2777         transaction %= 16;
2778
2779         /* FIXME: Should we retry to send if the buffer
2780         was not totally sent or in case of EINTR? */
2781         if (!avdtp_send(session, req->transaction, AVDTP_MSG_TYPE_COMMAND,
2782                                 req->signal_id, req->data, req->data_size)) {
2783                 err = -EIO;
2784                 goto failed;
2785         }
2786
2787         session->req = req;
2788
2789         req->timeout = g_timeout_add_seconds(req->signal_id == AVDTP_ABORT ?
2790                                         ABORT_TIMEOUT : REQ_TIMEOUT,
2791                                         request_timeout,
2792                                         session);
2793         return 0;
2794
2795 failed:
2796         g_free(req->data);
2797         g_free(req);
2798         return err;
2799 }
2800
2801 static int send_request(struct avdtp *session, gboolean priority,
2802                         struct avdtp_stream *stream, uint8_t signal_id,
2803                         void *buffer, size_t size)
2804 {
2805         struct pending_req *req;
2806
2807         if (stream && stream->abort_int && signal_id != AVDTP_ABORT) {
2808                 DBG("Unable to send requests while aborting");
2809                 return -EINVAL;
2810         }
2811
2812         req = g_new0(struct pending_req, 1);
2813         req->signal_id = signal_id;
2814         req->data = g_malloc(size);
2815         memcpy(req->data, buffer, size);
2816         req->data_size = size;
2817         req->stream = stream;
2818
2819         return send_req(session, priority, req);
2820 }
2821
2822 static gboolean avdtp_discover_resp(struct avdtp *session,
2823                                         struct discover_resp *resp, int size)
2824 {
2825         int sep_count, i;
2826         uint8_t getcap_cmd;
2827         int ret = 0;
2828         gboolean getcap_pending = FALSE;
2829
2830         if (session->version >= 0x0103 && session->server->version >= 0x0103)
2831                 getcap_cmd = AVDTP_GET_ALL_CAPABILITIES;
2832         else
2833                 getcap_cmd = AVDTP_GET_CAPABILITIES;
2834
2835         sep_count = size / sizeof(struct seid_info);
2836
2837         for (i = 0; i < sep_count; i++) {
2838                 struct avdtp_remote_sep *sep;
2839                 struct avdtp_stream *stream;
2840                 struct seid_req req;
2841
2842                 DBG("seid %d type %d media %d in use %d",
2843                                 resp->seps[i].seid, resp->seps[i].type,
2844                                 resp->seps[i].media_type, resp->seps[i].inuse);
2845
2846                 stream = find_stream_by_rseid(session, resp->seps[i].seid);
2847
2848                 sep = find_remote_sep(session->seps, resp->seps[i].seid);
2849                 if (!sep) {
2850                         if (resp->seps[i].inuse && !stream)
2851                                 continue;
2852                         sep = g_new0(struct avdtp_remote_sep, 1);
2853                         session->seps = g_slist_append(session->seps, sep);
2854                 }
2855
2856                 sep->stream = stream;
2857                 sep->seid = resp->seps[i].seid;
2858                 sep->type = resp->seps[i].type;
2859                 sep->media_type = resp->seps[i].media_type;
2860
2861                 memset(&req, 0, sizeof(req));
2862                 req.acp_seid = sep->seid;
2863
2864                 ret = send_request(session, TRUE, NULL, getcap_cmd,
2865                                                         &req, sizeof(req));
2866                 if (ret < 0)
2867                         break;
2868                 getcap_pending = TRUE;
2869         }
2870
2871         if (!getcap_pending)
2872                 finalize_discovery(session, -ret);
2873
2874         return TRUE;
2875 }
2876
2877 static gboolean avdtp_get_capabilities_resp(struct avdtp *session,
2878                                                 struct getcap_resp *resp,
2879                                                 unsigned int size)
2880 {
2881         struct avdtp_remote_sep *sep;
2882         uint8_t seid;
2883
2884         /* Check for minimum required packet size includes:
2885          *   1. getcap resp header
2886          *   2. media transport capability (2 bytes)
2887          *   3. media codec capability type + length (2 bytes)
2888          *   4. the actual media codec elements
2889          * */
2890         if (size < (sizeof(struct getcap_resp) + 4 +
2891                                 sizeof(struct avdtp_media_codec_capability))) {
2892                 error("Too short getcap resp packet");
2893                 return FALSE;
2894         }
2895
2896         seid = ((struct seid_req *) session->req->data)->acp_seid;
2897
2898         sep = find_remote_sep(session->seps, seid);
2899
2900         DBG("seid %d type %d media %d", sep->seid,
2901                                         sep->type, sep->media_type);
2902
2903         if (sep->caps) {
2904                 g_slist_free_full(sep->caps, g_free);
2905                 sep->caps = NULL;
2906                 sep->codec = NULL;
2907                 sep->delay_reporting = FALSE;
2908         }
2909
2910         sep->caps = caps_to_list(resp->caps, size - sizeof(struct getcap_resp),
2911                                         &sep->codec, &sep->delay_reporting);
2912
2913         return TRUE;
2914 }
2915
2916 static gboolean avdtp_set_configuration_resp(struct avdtp *session,
2917                                                 struct avdtp_stream *stream,
2918                                                 struct avdtp_single_header *resp,
2919                                                 int size)
2920 {
2921         struct avdtp_local_sep *sep = stream->lsep;
2922
2923         if (sep->cfm && sep->cfm->set_configuration)
2924                 sep->cfm->set_configuration(session, sep, stream, NULL,
2925                                                 sep->user_data);
2926
2927         avdtp_sep_set_state(session, sep, AVDTP_STATE_CONFIGURED);
2928
2929         return TRUE;
2930 }
2931
2932 static gboolean avdtp_reconfigure_resp(struct avdtp *session,
2933                                         struct avdtp_stream *stream,
2934                                         struct avdtp_single_header *resp, int size)
2935 {
2936         return TRUE;
2937 }
2938
2939 static gboolean avdtp_open_resp(struct avdtp *session, struct avdtp_stream *stream,
2940                                 struct seid_rej *resp, int size)
2941 {
2942         struct avdtp_local_sep *sep = stream->lsep;
2943
2944         stream->io = l2cap_connect(session);
2945         if (!stream->io) {
2946                 avdtp_sep_set_state(session, sep, AVDTP_STATE_IDLE);
2947                 return FALSE;
2948         }
2949
2950         session->pending_open = stream;
2951
2952         return TRUE;
2953 }
2954
2955 static gboolean avdtp_start_resp(struct avdtp *session,
2956                                         struct avdtp_stream *stream,
2957                                         struct seid_rej *resp, int size)
2958 {
2959         struct avdtp_local_sep *sep = stream->lsep;
2960
2961         if (sep->cfm && sep->cfm->start)
2962                 sep->cfm->start(session, sep, stream, NULL, sep->user_data);
2963
2964         /* We might be in STREAMING already if both sides send START_CMD at the
2965          * same time and the one in SNK role doesn't reject it as it should */
2966         if (sep->state != AVDTP_STATE_STREAMING)
2967                 avdtp_sep_set_state(session, sep, AVDTP_STATE_STREAMING);
2968
2969         return TRUE;
2970 }
2971
2972 static gboolean avdtp_close_resp(struct avdtp *session,
2973                                         struct avdtp_stream *stream,
2974                                         struct seid_rej *resp, int size)
2975 {
2976         struct avdtp_local_sep *sep = stream->lsep;
2977
2978         avdtp_sep_set_state(session, sep, AVDTP_STATE_CLOSING);
2979
2980         close_stream(stream);
2981
2982         return TRUE;
2983 }
2984
2985 static gboolean avdtp_suspend_resp(struct avdtp *session,
2986                                         struct avdtp_stream *stream,
2987                                         void *data, int size)
2988 {
2989         struct avdtp_local_sep *sep = stream->lsep;
2990
2991         avdtp_sep_set_state(session, sep, AVDTP_STATE_OPEN);
2992
2993         if (sep->cfm && sep->cfm->suspend)
2994                 sep->cfm->suspend(session, sep, stream, NULL, sep->user_data);
2995
2996         return TRUE;
2997 }
2998
2999 static gboolean avdtp_abort_resp(struct avdtp *session,
3000                                         struct avdtp_stream *stream,
3001                                         struct seid_rej *resp, int size)
3002 {
3003         struct avdtp_local_sep *sep = stream->lsep;
3004
3005         avdtp_sep_set_state(session, sep, AVDTP_STATE_ABORTING);
3006
3007         if (sep->cfm && sep->cfm->abort)
3008                 sep->cfm->abort(session, sep, stream, NULL, sep->user_data);
3009
3010         avdtp_sep_set_state(session, sep, AVDTP_STATE_IDLE);
3011
3012         return TRUE;
3013 }
3014
3015 static gboolean avdtp_delay_report_resp(struct avdtp *session,
3016                                         struct avdtp_stream *stream,
3017                                         void *data, int size)
3018 {
3019         struct avdtp_local_sep *sep = stream->lsep;
3020
3021         if (sep->cfm && sep->cfm->delay_report)
3022                 sep->cfm->delay_report(session, sep, stream, NULL, sep->user_data);
3023
3024         return TRUE;
3025 }
3026
3027 static gboolean avdtp_parse_resp(struct avdtp *session,
3028                                         struct avdtp_stream *stream,
3029                                         uint8_t transaction, uint8_t signal_id,
3030                                         void *buf, int size)
3031 {
3032         struct pending_req *next;
3033         const char *get_all = "";
3034
3035         if (session->prio_queue)
3036                 next = session->prio_queue->data;
3037         else if (session->req_queue)
3038                 next = session->req_queue->data;
3039         else
3040                 next = NULL;
3041
3042         switch (signal_id) {
3043         case AVDTP_DISCOVER:
3044                 DBG("DISCOVER request succeeded");
3045                 return avdtp_discover_resp(session, buf, size);
3046         case AVDTP_GET_ALL_CAPABILITIES:
3047                 get_all = "ALL_";
3048         case AVDTP_GET_CAPABILITIES:
3049                 DBG("GET_%sCAPABILITIES request succeeded", get_all);
3050                 if (!avdtp_get_capabilities_resp(session, buf, size))
3051                         return FALSE;
3052                 if (!(next && (next->signal_id == AVDTP_GET_CAPABILITIES ||
3053                                 next->signal_id == AVDTP_GET_ALL_CAPABILITIES)))
3054                         finalize_discovery(session, 0);
3055                 return TRUE;
3056         }
3057
3058         /* The remaining commands require an existing stream so bail out
3059          * here if the stream got unexpectedly disconnected */
3060         if (!stream) {
3061                 DBG("AVDTP: stream was closed while waiting for reply");
3062                 return TRUE;
3063         }
3064
3065         switch (signal_id) {
3066         case AVDTP_SET_CONFIGURATION:
3067                 DBG("SET_CONFIGURATION request succeeded");
3068                 return avdtp_set_configuration_resp(session, stream,
3069                                                                 buf, size);
3070         case AVDTP_RECONFIGURE:
3071                 DBG("RECONFIGURE request succeeded");
3072                 return avdtp_reconfigure_resp(session, stream, buf, size);
3073         case AVDTP_OPEN:
3074                 DBG("OPEN request succeeded");
3075                 return avdtp_open_resp(session, stream, buf, size);
3076         case AVDTP_SUSPEND:
3077                 DBG("SUSPEND request succeeded");
3078                 return avdtp_suspend_resp(session, stream, buf, size);
3079         case AVDTP_START:
3080                 DBG("START request succeeded");
3081                 return avdtp_start_resp(session, stream, buf, size);
3082         case AVDTP_CLOSE:
3083                 DBG("CLOSE request succeeded");
3084                 return avdtp_close_resp(session, stream, buf, size);
3085         case AVDTP_ABORT:
3086                 DBG("ABORT request succeeded");
3087                 return avdtp_abort_resp(session, stream, buf, size);
3088         case AVDTP_DELAY_REPORT:
3089                 DBG("DELAY_REPORT request succeeded");
3090                 return avdtp_delay_report_resp(session, stream, buf, size);
3091         }
3092
3093         error("Unknown signal id in accept response: %u", signal_id);
3094         return TRUE;
3095 }
3096
3097 static gboolean seid_rej_to_err(struct seid_rej *rej, unsigned int size,
3098                                         struct avdtp_error *err)
3099 {
3100         if (size < sizeof(struct seid_rej)) {
3101                 error("Too small packet for seid_rej");
3102                 return FALSE;
3103         }
3104
3105         avdtp_error_init(err, 0x00, rej->error);
3106
3107         return TRUE;
3108 }
3109
3110 static gboolean conf_rej_to_err(struct conf_rej *rej, unsigned int size,
3111                                 struct avdtp_error *err)
3112 {
3113         if (size < sizeof(struct conf_rej)) {
3114                 error("Too small packet for conf_rej");
3115                 return FALSE;
3116         }
3117
3118         avdtp_error_init(err, rej->category, rej->error);
3119
3120         return TRUE;
3121 }
3122
3123 static gboolean stream_rej_to_err(struct stream_rej *rej, unsigned int size,
3124                                         struct avdtp_error *err,
3125                                         uint8_t *acp_seid)
3126 {
3127         if (size < sizeof(struct stream_rej)) {
3128                 error("Too small packet for stream_rej");
3129                 return FALSE;
3130         }
3131
3132         avdtp_error_init(err, 0x00, rej->error);
3133
3134         if (acp_seid)
3135                 *acp_seid = rej->acp_seid;
3136
3137         return TRUE;
3138 }
3139
3140 static gboolean avdtp_parse_rej(struct avdtp *session,
3141                                         struct avdtp_stream *stream,
3142                                         uint8_t transaction, uint8_t signal_id,
3143                                         void *buf, int size)
3144 {
3145         struct avdtp_error err;
3146         uint8_t acp_seid;
3147         struct avdtp_local_sep *sep = stream ? stream->lsep : NULL;
3148
3149         switch (signal_id) {
3150         case AVDTP_DISCOVER:
3151                 if (!seid_rej_to_err(buf, size, &err))
3152                         return FALSE;
3153                 error("DISCOVER request rejected: %s (%d)",
3154                                 avdtp_strerror(&err), err.err.error_code);
3155                 return TRUE;
3156         case AVDTP_GET_CAPABILITIES:
3157         case AVDTP_GET_ALL_CAPABILITIES:
3158                 if (!seid_rej_to_err(buf, size, &err))
3159                         return FALSE;
3160                 error("GET_CAPABILITIES request rejected: %s (%d)",
3161                                 avdtp_strerror(&err), err.err.error_code);
3162                 return TRUE;
3163         case AVDTP_OPEN:
3164                 if (!seid_rej_to_err(buf, size, &err))
3165                         return FALSE;
3166                 error("OPEN request rejected: %s (%d)",
3167                                 avdtp_strerror(&err), err.err.error_code);
3168                 if (sep && sep->cfm && sep->cfm->open)
3169                         sep->cfm->open(session, sep, stream, &err,
3170                                         sep->user_data);
3171                 return TRUE;
3172         case AVDTP_SET_CONFIGURATION:
3173                 if (!conf_rej_to_err(buf, size, &err))
3174                         return FALSE;
3175                 error("SET_CONFIGURATION request rejected: %s (%d)",
3176                                 avdtp_strerror(&err), err.err.error_code);
3177                 if (sep && sep->cfm && sep->cfm->set_configuration)
3178                         sep->cfm->set_configuration(session, sep, stream,
3179                                                         &err, sep->user_data);
3180                 return TRUE;
3181         case AVDTP_RECONFIGURE:
3182                 if (!conf_rej_to_err(buf, size, &err))
3183                         return FALSE;
3184                 error("RECONFIGURE request rejected: %s (%d)",
3185                                 avdtp_strerror(&err), err.err.error_code);
3186                 if (sep && sep->cfm && sep->cfm->reconfigure)
3187                         sep->cfm->reconfigure(session, sep, stream, &err,
3188                                                 sep->user_data);
3189                 return TRUE;
3190         case AVDTP_START:
3191                 if (!stream_rej_to_err(buf, size, &err, &acp_seid))
3192                         return FALSE;
3193                 error("START request rejected: %s (%d)",
3194                                 avdtp_strerror(&err), err.err.error_code);
3195                 if (sep && sep->cfm && sep->cfm->start) {
3196                         sep->cfm->start(session, sep, stream, &err,
3197                                         sep->user_data);
3198                         stream->starting = FALSE;
3199                 }
3200                 return TRUE;
3201         case AVDTP_SUSPEND:
3202                 if (!stream_rej_to_err(buf, size, &err, &acp_seid))
3203                         return FALSE;
3204                 error("SUSPEND request rejected: %s (%d)",
3205                                 avdtp_strerror(&err), err.err.error_code);
3206                 if (sep && sep->cfm && sep->cfm->suspend)
3207                         sep->cfm->suspend(session, sep, stream, &err,
3208                                                 sep->user_data);
3209                 return TRUE;
3210         case AVDTP_CLOSE:
3211                 if (!stream_rej_to_err(buf, size, &err, &acp_seid))
3212                         return FALSE;
3213                 error("CLOSE request rejected: %s (%d)",
3214                                 avdtp_strerror(&err), err.err.error_code);
3215                 if (sep && sep->cfm && sep->cfm->close) {
3216                         sep->cfm->close(session, sep, stream, &err,
3217                                         sep->user_data);
3218                         stream->close_int = FALSE;
3219                 }
3220                 return TRUE;
3221         case AVDTP_ABORT:
3222                 if (!stream_rej_to_err(buf, size, &err, &acp_seid))
3223                         return FALSE;
3224                 error("ABORT request rejected: %s (%d)",
3225                                 avdtp_strerror(&err), err.err.error_code);
3226                 if (sep && sep->cfm && sep->cfm->abort)
3227                         sep->cfm->abort(session, sep, stream, &err,
3228                                         sep->user_data);
3229                 return FALSE;
3230         case AVDTP_DELAY_REPORT:
3231                 if (!stream_rej_to_err(buf, size, &err, &acp_seid))
3232                         return FALSE;
3233                 error("DELAY_REPORT request rejected: %s (%d)",
3234                                 avdtp_strerror(&err), err.err.error_code);
3235                 if (sep && sep->cfm && sep->cfm->delay_report)
3236                         sep->cfm->delay_report(session, sep, stream, &err,
3237                                                         sep->user_data);
3238                 return TRUE;
3239         default:
3240                 error("Unknown reject response signal id: %u", signal_id);
3241                 return TRUE;
3242         }
3243 }
3244
3245 gboolean avdtp_is_connected(const bdaddr_t *src, const bdaddr_t *dst)
3246 {
3247         struct avdtp_server *server;
3248         struct avdtp *session;
3249
3250         server = find_server(servers, src);
3251         if (!server)
3252                 return FALSE;
3253
3254         session = find_session(server->sessions, dst);
3255         if (!session)
3256                 return FALSE;
3257
3258         if (session->state != AVDTP_SESSION_STATE_DISCONNECTED)
3259                 return TRUE;
3260
3261         return FALSE;
3262 }
3263
3264 struct avdtp_service_capability *avdtp_stream_get_codec(
3265                                                 struct avdtp_stream *stream)
3266 {
3267         GSList *l;
3268
3269         for (l = stream->caps; l; l = l->next) {
3270                 struct avdtp_service_capability *cap = l->data;
3271
3272                 if (cap->category == AVDTP_MEDIA_CODEC)
3273                         return cap;
3274         }
3275
3276         return NULL;
3277 }
3278
3279 gboolean avdtp_stream_has_capability(struct avdtp_stream *stream,
3280                                 struct avdtp_service_capability *cap)
3281 {
3282         GSList *l;
3283         struct avdtp_service_capability *stream_cap;
3284
3285         for (l = stream->caps; l; l = g_slist_next(l)) {
3286                 stream_cap = l->data;
3287
3288                 if (stream_cap->category != cap->category ||
3289                         stream_cap->length != cap->length)
3290                         continue;
3291
3292                 if (memcmp(stream_cap->data, cap->data, cap->length) == 0)
3293                         return TRUE;
3294         }
3295
3296         return FALSE;
3297 }
3298
3299 gboolean avdtp_stream_has_capabilities(struct avdtp_stream *stream,
3300                                         GSList *caps)
3301 {
3302         for (; caps; caps = g_slist_next(caps)) {
3303                 struct avdtp_service_capability *cap = caps->data;
3304
3305                 if (!avdtp_stream_has_capability(stream, cap))
3306                         return FALSE;
3307         }
3308
3309         return TRUE;
3310 }
3311
3312 struct avdtp_remote_sep *avdtp_stream_get_remote_sep(
3313                                                 struct avdtp_stream *stream)
3314 {
3315         return avdtp_get_remote_sep(stream->session, stream->rseid);
3316 }
3317
3318 gboolean avdtp_stream_get_transport(struct avdtp_stream *stream, int *sock,
3319                                         uint16_t *imtu, uint16_t *omtu,
3320                                         GSList **caps)
3321 {
3322         if (stream->io == NULL)
3323                 return FALSE;
3324
3325         if (sock)
3326                 *sock = g_io_channel_unix_get_fd(stream->io);
3327
3328         if (omtu)
3329                 *omtu = stream->omtu;
3330
3331         if (imtu)
3332                 *imtu = stream->imtu;
3333
3334         if (caps)
3335                 *caps = stream->caps;
3336
3337         return TRUE;
3338 }
3339
3340 static int process_queue(struct avdtp *session)
3341 {
3342         GSList **queue, *l;
3343         struct pending_req *req;
3344
3345         if (session->req)
3346                 return 0;
3347
3348         if (session->prio_queue)
3349                 queue = &session->prio_queue;
3350         else
3351                 queue = &session->req_queue;
3352
3353         if (!*queue)
3354                 return 0;
3355
3356         l = *queue;
3357         req = l->data;
3358
3359         *queue = g_slist_remove(*queue, req);
3360
3361         return send_req(session, FALSE, req);
3362 }
3363
3364 struct avdtp_remote_sep *avdtp_get_remote_sep(struct avdtp *session,
3365                                                 uint8_t seid)
3366 {
3367         GSList *l;
3368
3369         for (l = session->seps; l; l = l->next) {
3370                 struct avdtp_remote_sep *sep = l->data;
3371
3372                 if (sep->seid == seid)
3373                         return sep;
3374         }
3375
3376         return NULL;
3377 }
3378
3379 uint8_t avdtp_get_seid(struct avdtp_remote_sep *sep)
3380 {
3381         return sep->seid;
3382 }
3383
3384 uint8_t avdtp_get_type(struct avdtp_remote_sep *sep)
3385 {
3386         return sep->type;
3387 }
3388
3389 struct avdtp_service_capability *avdtp_get_codec(struct avdtp_remote_sep *sep)
3390 {
3391         return sep->codec;
3392 }
3393
3394 gboolean avdtp_get_delay_reporting(struct avdtp_remote_sep *sep)
3395 {
3396         return sep->delay_reporting;
3397 }
3398
3399 struct avdtp_stream *avdtp_get_stream(struct avdtp_remote_sep *sep)
3400 {
3401         return sep->stream;
3402 }
3403
3404 struct avdtp_service_capability *avdtp_service_cap_new(uint8_t category,
3405                                                         void *data, int length)
3406 {
3407         struct avdtp_service_capability *cap;
3408
3409         if (category < AVDTP_MEDIA_TRANSPORT || category > AVDTP_DELAY_REPORTING)
3410                 return NULL;
3411
3412         cap = g_malloc(sizeof(struct avdtp_service_capability) + length);
3413         cap->category = category;
3414         cap->length = length;
3415         memcpy(cap->data, data, length);
3416
3417         return cap;
3418 }
3419
3420 static gboolean process_discover(gpointer data)
3421 {
3422         struct avdtp *session = data;
3423
3424         finalize_discovery(session, 0);
3425
3426         return FALSE;
3427 }
3428
3429 int avdtp_discover(struct avdtp *session, avdtp_discover_cb_t cb,
3430                         void *user_data)
3431 {
3432         int err;
3433
3434         if (session->discov_cb)
3435                 return -EBUSY;
3436
3437         if (session->seps) {
3438                 session->discov_cb = cb;
3439                 session->user_data = user_data;
3440                 g_idle_add(process_discover, session);
3441                 return 0;
3442         }
3443
3444         err = send_request(session, FALSE, NULL, AVDTP_DISCOVER, NULL, 0);
3445         if (err == 0) {
3446                 session->discov_cb = cb;
3447                 session->user_data = user_data;
3448         }
3449
3450         return err;
3451 }
3452
3453 gboolean avdtp_stream_remove_cb(struct avdtp *session,
3454                                 struct avdtp_stream *stream,
3455                                 unsigned int id)
3456 {
3457         GSList *l;
3458         struct stream_callback *cb;
3459
3460         if (!stream)
3461                 return FALSE;
3462
3463         for (cb = NULL, l = stream->callbacks; l != NULL; l = l->next) {
3464                 struct stream_callback *tmp = l->data;
3465                 if (tmp && tmp->id == id) {
3466                         cb = tmp;
3467                         break;
3468                 }
3469         }
3470
3471         if (!cb)
3472                 return FALSE;
3473
3474         stream->callbacks = g_slist_remove(stream->callbacks, cb);
3475         g_free(cb);
3476
3477         return TRUE;
3478 }
3479
3480 unsigned int avdtp_stream_add_cb(struct avdtp *session,
3481                                         struct avdtp_stream *stream,
3482                                         avdtp_stream_state_cb cb, void *data)
3483 {
3484         struct stream_callback *stream_cb;
3485         static unsigned int id = 0;
3486
3487         stream_cb = g_new(struct stream_callback, 1);
3488         stream_cb->cb = cb;
3489         stream_cb->user_data = data;
3490         stream_cb->id = ++id;
3491
3492         stream->callbacks = g_slist_append(stream->callbacks, stream_cb);
3493
3494         return stream_cb->id;
3495 }
3496
3497 int avdtp_get_configuration(struct avdtp *session, struct avdtp_stream *stream)
3498 {
3499         struct seid_req req;
3500
3501         if (session->state < AVDTP_SESSION_STATE_CONNECTED)
3502                 return -EINVAL;
3503
3504         memset(&req, 0, sizeof(req));
3505         req.acp_seid = stream->rseid;
3506
3507         return send_request(session, FALSE, stream, AVDTP_GET_CONFIGURATION,
3508                                                         &req, sizeof(req));
3509 }
3510
3511 static void copy_capabilities(gpointer data, gpointer user_data)
3512 {
3513         struct avdtp_service_capability *src_cap = data;
3514         struct avdtp_service_capability *dst_cap;
3515         GSList **l = user_data;
3516
3517         dst_cap = avdtp_service_cap_new(src_cap->category, src_cap->data,
3518                                         src_cap->length);
3519
3520         *l = g_slist_append(*l, dst_cap);
3521 }
3522
3523 int avdtp_set_configuration(struct avdtp *session,
3524                                 struct avdtp_remote_sep *rsep,
3525                                 struct avdtp_local_sep *lsep,
3526                                 GSList *caps,
3527                                 struct avdtp_stream **stream)
3528 {
3529         struct setconf_req *req;
3530         struct avdtp_stream *new_stream;
3531         unsigned char *ptr;
3532         int err, caps_len;
3533         struct avdtp_service_capability *cap;
3534         GSList *l;
3535
3536         if (session->state != AVDTP_SESSION_STATE_CONNECTED)
3537                 return -ENOTCONN;
3538
3539         if (!(lsep && rsep))
3540                 return -EINVAL;
3541
3542         DBG("%p: int_seid=%u, acp_seid=%u", session,
3543                         lsep->info.seid, rsep->seid);
3544
3545         new_stream = g_new0(struct avdtp_stream, 1);
3546         new_stream->session = session;
3547         new_stream->lsep = lsep;
3548         new_stream->rseid = rsep->seid;
3549
3550         if (rsep->delay_reporting && lsep->delay_reporting) {
3551                 struct avdtp_service_capability *delay_reporting;
3552
3553                 delay_reporting = avdtp_service_cap_new(AVDTP_DELAY_REPORTING,
3554                                                                 NULL, 0);
3555                 caps = g_slist_append(caps, delay_reporting);
3556                 new_stream->delay_reporting = TRUE;
3557         }
3558
3559         g_slist_foreach(caps, copy_capabilities, &new_stream->caps);
3560
3561         /* Calculate total size of request */
3562         for (l = caps, caps_len = 0; l != NULL; l = g_slist_next(l)) {
3563                 cap = l->data;
3564                 caps_len += cap->length + 2;
3565         }
3566
3567         req = g_malloc0(sizeof(struct setconf_req) + caps_len);
3568
3569         req->int_seid = lsep->info.seid;
3570         req->acp_seid = rsep->seid;
3571
3572         /* Copy the capabilities into the request */
3573         for (l = caps, ptr = req->caps; l != NULL; l = g_slist_next(l)) {
3574                 cap = l->data;
3575                 memcpy(ptr, cap, cap->length + 2);
3576                 ptr += cap->length + 2;
3577         }
3578
3579         err = send_request(session, FALSE, new_stream,
3580                                 AVDTP_SET_CONFIGURATION, req,
3581                                 sizeof(struct setconf_req) + caps_len);
3582         if (err < 0)
3583                 stream_free(new_stream);
3584         else {
3585                 lsep->info.inuse = 1;
3586                 lsep->stream = new_stream;
3587                 rsep->stream = new_stream;
3588                 session->streams = g_slist_append(session->streams, new_stream);
3589                 if (stream)
3590                         *stream = new_stream;
3591         }
3592
3593         g_free(req);
3594
3595         return err;
3596 }
3597
3598 int avdtp_reconfigure(struct avdtp *session, GSList *caps,
3599                         struct avdtp_stream *stream)
3600 {
3601         struct reconf_req *req;
3602         unsigned char *ptr;
3603         int caps_len, err;
3604         GSList *l;
3605         struct avdtp_service_capability *cap;
3606
3607         if (!g_slist_find(session->streams, stream))
3608                 return -EINVAL;
3609
3610         if (stream->lsep->state != AVDTP_STATE_OPEN)
3611                 return -EINVAL;
3612
3613         /* Calculate total size of request */
3614         for (l = caps, caps_len = 0; l != NULL; l = g_slist_next(l)) {
3615                 cap = l->data;
3616                 caps_len += cap->length + 2;
3617         }
3618
3619         req = g_malloc0(sizeof(struct reconf_req) + caps_len);
3620
3621         req->acp_seid = stream->rseid;
3622
3623         /* Copy the capabilities into the request */
3624         for (l = caps, ptr = req->caps; l != NULL; l = g_slist_next(l)) {
3625                 cap = l->data;
3626                 memcpy(ptr, cap, cap->length + 2);
3627                 ptr += cap->length + 2;
3628         }
3629
3630         err = send_request(session, FALSE, stream, AVDTP_RECONFIGURE, req,
3631                                                 sizeof(*req) + caps_len);
3632         g_free(req);
3633
3634         return err;
3635 }
3636
3637 int avdtp_open(struct avdtp *session, struct avdtp_stream *stream)
3638 {
3639         struct seid_req req;
3640
3641         if (!g_slist_find(session->streams, stream))
3642                 return -EINVAL;
3643
3644         if (stream->lsep->state > AVDTP_STATE_CONFIGURED)
3645                 return -EINVAL;
3646
3647         memset(&req, 0, sizeof(req));
3648         req.acp_seid = stream->rseid;
3649
3650         return send_request(session, FALSE, stream, AVDTP_OPEN,
3651                                                         &req, sizeof(req));
3652 }
3653
3654 int avdtp_start(struct avdtp *session, struct avdtp_stream *stream)
3655 {
3656         struct start_req req;
3657         int ret;
3658
3659         if (!g_slist_find(session->streams, stream))
3660                 return -EINVAL;
3661
3662         if (stream->lsep->state != AVDTP_STATE_OPEN)
3663                 return -EINVAL;
3664
3665         /* Recommendation 12:
3666          *  If the RD has configured and opened a stream it is also responsible
3667          *  to start the streaming via GAVDP_START.
3668          */
3669         if (stream->open_acp) {
3670                 stream->starting = TRUE;
3671                 return 0;
3672         }
3673
3674         if (stream->close_int == TRUE) {
3675                 error("avdtp_start: rejecting start since close is initiated");
3676                 return -EINVAL;
3677         }
3678
3679         if (stream->starting == TRUE) {
3680                 DBG("stream already started");
3681                 return -EINPROGRESS;
3682         }
3683
3684         memset(&req, 0, sizeof(req));
3685         req.first_seid.seid = stream->rseid;
3686
3687         ret = send_request(session, FALSE, stream, AVDTP_START,
3688                                                         &req, sizeof(req));
3689         if (ret == 0)
3690                 stream->starting = TRUE;
3691
3692         return ret;
3693 }
3694
3695 int avdtp_close(struct avdtp *session, struct avdtp_stream *stream,
3696                 gboolean immediate)
3697 {
3698         struct seid_req req;
3699         int ret;
3700
3701         if (!g_slist_find(session->streams, stream))
3702                 return -EINVAL;
3703
3704         if (stream->lsep->state < AVDTP_STATE_OPEN)
3705                 return -EINVAL;
3706
3707         if (stream->close_int == TRUE) {
3708                 error("avdtp_close: rejecting since close is already initiated");
3709                 return -EINVAL;
3710         }
3711
3712         if (immediate && session->req && stream == session->req->stream)
3713                 return avdtp_abort(session, stream);
3714
3715         memset(&req, 0, sizeof(req));
3716         req.acp_seid = stream->rseid;
3717
3718         ret = send_request(session, FALSE, stream, AVDTP_CLOSE,
3719                                                         &req, sizeof(req));
3720         if (ret == 0)
3721                 stream->close_int = TRUE;
3722
3723         return ret;
3724 }
3725
3726 int avdtp_suspend(struct avdtp *session, struct avdtp_stream *stream)
3727 {
3728         struct seid_req req;
3729
3730         if (!g_slist_find(session->streams, stream))
3731                 return -EINVAL;
3732
3733         if (stream->lsep->state <= AVDTP_STATE_OPEN || stream->close_int)
3734                 return -EINVAL;
3735
3736         memset(&req, 0, sizeof(req));
3737         req.acp_seid = stream->rseid;
3738
3739         return send_request(session, FALSE, stream, AVDTP_SUSPEND,
3740                                                         &req, sizeof(req));
3741 }
3742
3743 int avdtp_abort(struct avdtp *session, struct avdtp_stream *stream)
3744 {
3745         struct seid_req req;
3746         int ret;
3747
3748         if (!g_slist_find(session->streams, stream))
3749                 return -EINVAL;
3750
3751         if (stream->lsep->state == AVDTP_STATE_ABORTING)
3752                 return -EINVAL;
3753
3754         if (session->req && stream == session->req->stream)
3755                 return cancel_request(session, ECANCELED);
3756
3757         memset(&req, 0, sizeof(req));
3758         req.acp_seid = stream->rseid;
3759
3760         ret = send_request(session, TRUE, stream, AVDTP_ABORT,
3761                                                         &req, sizeof(req));
3762         if (ret == 0)
3763                 stream->abort_int = TRUE;
3764
3765         return ret;
3766 }
3767
3768 int avdtp_delay_report(struct avdtp *session, struct avdtp_stream *stream,
3769                                                         uint16_t delay)
3770 {
3771         struct delay_req req;
3772
3773         if (!g_slist_find(session->streams, stream))
3774                 return -EINVAL;
3775
3776         if (stream->lsep->state != AVDTP_STATE_CONFIGURED &&
3777                                 stream->lsep->state != AVDTP_STATE_STREAMING)
3778                 return -EINVAL;
3779
3780         if (!stream->delay_reporting || session->version < 0x0103 ||
3781                                         session->server->version < 0x0103)
3782                 return -EINVAL;
3783
3784         stream->delay = delay;
3785
3786         memset(&req, 0, sizeof(req));
3787         req.acp_seid = stream->rseid;
3788         req.delay = htons(delay);
3789
3790         return send_request(session, TRUE, stream, AVDTP_DELAY_REPORT,
3791                                                         &req, sizeof(req));
3792 }
3793
3794 struct avdtp_local_sep *avdtp_register_sep(const bdaddr_t *src, uint8_t type,
3795                                                 uint8_t media_type,
3796                                                 uint8_t codec_type,
3797                                                 gboolean delay_reporting,
3798                                                 struct avdtp_sep_ind *ind,
3799                                                 struct avdtp_sep_cfm *cfm,
3800                                                 void *user_data)
3801 {
3802         struct avdtp_server *server;
3803         struct avdtp_local_sep *sep;
3804
3805         server = find_server(servers, src);
3806         if (!server)
3807                 return NULL;
3808
3809         if (g_slist_length(server->seps) > MAX_SEID)
3810                 return NULL;
3811
3812         sep = g_new0(struct avdtp_local_sep, 1);
3813
3814         sep->state = AVDTP_STATE_IDLE;
3815         sep->info.seid = g_slist_length(server->seps) + 1;
3816         sep->info.type = type;
3817         sep->info.media_type = media_type;
3818         sep->codec = codec_type;
3819         sep->ind = ind;
3820         sep->cfm = cfm;
3821         sep->user_data = user_data;
3822         sep->server = server;
3823         sep->delay_reporting = TRUE;
3824
3825         DBG("SEP %p registered: type:%d codec:%d seid:%d", sep,
3826                         sep->info.type, sep->codec, sep->info.seid);
3827         server->seps = g_slist_append(server->seps, sep);
3828
3829         return sep;
3830 }
3831
3832 int avdtp_unregister_sep(struct avdtp_local_sep *sep)
3833 {
3834         struct avdtp_server *server;
3835
3836         if (!sep)
3837                 return -EINVAL;
3838
3839         server = sep->server;
3840         server->seps = g_slist_remove(server->seps, sep);
3841
3842         if (sep->stream)
3843                 release_stream(sep->stream, sep->stream->session);
3844
3845         DBG("SEP %p unregistered: type:%d codec:%d seid:%d", sep,
3846                         sep->info.type, sep->codec, sep->info.seid);
3847
3848         g_free(sep);
3849
3850         return 0;
3851 }
3852
3853 static GIOChannel *avdtp_server_socket(const bdaddr_t *src, gboolean master)
3854 {
3855         GError *err = NULL;
3856         GIOChannel *io;
3857
3858         io = bt_io_listen(BT_IO_L2CAP, NULL, avdtp_confirm_cb,
3859                                 NULL, NULL, &err,
3860                                 BT_IO_OPT_SOURCE_BDADDR, src,
3861                                 BT_IO_OPT_PSM, AVDTP_PSM,
3862                                 BT_IO_OPT_SEC_LEVEL, BT_IO_SEC_MEDIUM,
3863                                 BT_IO_OPT_MASTER, master,
3864                                 BT_IO_OPT_INVALID);
3865         if (!io) {
3866                 error("%s", err->message);
3867                 g_error_free(err);
3868         }
3869
3870         return io;
3871 }
3872
3873 const char *avdtp_strerror(struct avdtp_error *err)
3874 {
3875         if (err->category == AVDTP_ERRNO)
3876                 return strerror(err->err.posix_errno);
3877
3878         switch(err->err.error_code) {
3879         case AVDTP_BAD_HEADER_FORMAT:
3880                 return "Bad Header Format";
3881         case AVDTP_BAD_LENGTH:
3882                 return "Bad Packet Length";
3883         case AVDTP_BAD_ACP_SEID:
3884                 return "Bad Acceptor SEID";
3885         case AVDTP_SEP_IN_USE:
3886                 return "Stream End Point in Use";
3887         case AVDTP_SEP_NOT_IN_USE:
3888                 return "Stream End Point Not in Use";
3889         case AVDTP_BAD_SERV_CATEGORY:
3890                 return "Bad Service Category";
3891         case AVDTP_BAD_PAYLOAD_FORMAT:
3892                 return "Bad Payload format";
3893         case AVDTP_NOT_SUPPORTED_COMMAND:
3894                 return "Command Not Supported";
3895         case AVDTP_INVALID_CAPABILITIES:
3896                 return "Invalid Capabilities";
3897         case AVDTP_BAD_RECOVERY_TYPE:
3898                 return "Bad Recovery Type";
3899         case AVDTP_BAD_MEDIA_TRANSPORT_FORMAT:
3900                 return "Bad Media Transport Format";
3901         case AVDTP_BAD_RECOVERY_FORMAT:
3902                 return "Bad Recovery Format";
3903         case AVDTP_BAD_ROHC_FORMAT:
3904                 return "Bad Header Compression Format";
3905         case AVDTP_BAD_CP_FORMAT:
3906                 return "Bad Content Protetion Format";
3907         case AVDTP_BAD_MULTIPLEXING_FORMAT:
3908                 return "Bad Multiplexing Format";
3909         case AVDTP_UNSUPPORTED_CONFIGURATION:
3910                 return "Configuration not supported";
3911         case AVDTP_BAD_STATE:
3912                 return "Bad State";
3913         default:
3914                 return "Unknow error";
3915         }
3916 }
3917
3918 avdtp_state_t avdtp_sep_get_state(struct avdtp_local_sep *sep)
3919 {
3920         return sep->state;
3921 }
3922
3923 void avdtp_get_peers(struct avdtp *session, bdaddr_t *src, bdaddr_t *dst)
3924 {
3925         if (src)
3926                 bacpy(src, &session->server->src);
3927         if (dst)
3928                 bacpy(dst, &session->dst);
3929 }
3930
3931 int avdtp_init(const bdaddr_t *src, GKeyFile *config, uint16_t *version)
3932 {
3933         GError *err = NULL;
3934         gboolean tmp, master = TRUE;
3935         struct avdtp_server *server;
3936         uint16_t ver = 0x0102;
3937
3938         if (!config)
3939                 goto proceed;
3940
3941         tmp = g_key_file_get_boolean(config, "General",
3942                         "Master", &err);
3943         if (err) {
3944                 DBG("audio.conf: %s", err->message);
3945                 g_clear_error(&err);
3946         } else
3947                 master = tmp;
3948
3949         tmp = g_key_file_get_boolean(config, "General", "AutoConnect",
3950                         &err);
3951         if (err)
3952                 g_clear_error(&err);
3953         else
3954                 auto_connect = tmp;
3955
3956         if (g_key_file_get_boolean(config, "A2DP", "DelayReporting", NULL))
3957                 ver = 0x0103;
3958
3959 proceed:
3960         server = g_new0(struct avdtp_server, 1);
3961         if (!server)
3962                 return -ENOMEM;
3963
3964         server->version = ver;
3965
3966         if (version)
3967                 *version = server->version;
3968
3969         server->io = avdtp_server_socket(src, master);
3970         if (!server->io) {
3971                 g_free(server);
3972                 return -1;
3973         }
3974
3975         bacpy(&server->src, src);
3976
3977         servers = g_slist_append(servers, server);
3978
3979         return 0;
3980 }
3981
3982 void avdtp_exit(const bdaddr_t *src)
3983 {
3984         struct avdtp_server *server;
3985         GSList *l;
3986
3987         server = find_server(servers, src);
3988         if (!server)
3989                 return;
3990
3991         l = server->sessions;
3992         while (l) {
3993                 struct avdtp *session = l->data;
3994
3995                 l = l->next;
3996                 /* value of l pointer should be updated before invoking
3997                  * connection_lost since it internally uses avdtp_unref
3998                  * which operates on server->session list as well
3999                  */
4000                 connection_lost(session, -ECONNABORTED);
4001         }
4002
4003         servers = g_slist_remove(servers, server);
4004
4005         g_io_channel_shutdown(server->io, TRUE, NULL);
4006         g_io_channel_unref(server->io);
4007         g_free(server);
4008 }
4009
4010 gboolean avdtp_has_stream(struct avdtp *session, struct avdtp_stream *stream)
4011 {
4012         return g_slist_find(session->streams, stream) ? TRUE : FALSE;
4013 }
4014
4015 void avdtp_set_auto_disconnect(struct avdtp *session, gboolean auto_dc)
4016 {
4017         session->auto_dc = auto_dc;
4018 }
4019
4020 gboolean avdtp_stream_setup_active(struct avdtp *session)
4021 {
4022         return session->stream_setup;
4023 }
4024
4025 void avdtp_set_device_disconnect(struct avdtp *session, gboolean dev_dc)
4026 {
4027         session->device_disconnect = dev_dc;
4028 }
4029
4030 unsigned int avdtp_add_state_cb(avdtp_session_state_cb cb, void *user_data)
4031 {
4032         struct avdtp_state_callback *state_cb;
4033         static unsigned int id = 0;
4034
4035         state_cb = g_new(struct avdtp_state_callback, 1);
4036         state_cb->cb = cb;
4037         state_cb->user_data = user_data;
4038         state_cb->id = ++id;
4039
4040         avdtp_callbacks = g_slist_append(avdtp_callbacks, state_cb);
4041
4042         return state_cb->id;
4043 }
4044
4045 gboolean avdtp_remove_state_cb(unsigned int id)
4046 {
4047         GSList *l;
4048
4049         for (l = avdtp_callbacks; l != NULL; l = l->next) {
4050                 struct avdtp_state_callback *cb = l->data;
4051                 if (cb && cb->id == id) {
4052                         avdtp_callbacks = g_slist_remove(avdtp_callbacks, cb);
4053                         g_free(cb);
4054                         return TRUE;
4055                 }
4056         }
4057
4058         return FALSE;
4059 }