1 /******************************************************************************
2  *
3  *  Copyright 2003-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /******************************************************************************
20  *
21  *  This file contains the audio gateway functions performing SDP
22  *  operations.
23  *
24  ******************************************************************************/
25 
26 #include <base/functional/bind.h>
27 #include <base/location.h>
28 #include <bluetooth/log.h>
29 
30 #include <cstdint>
31 #include <cstring>
32 
33 #include "bta/ag/bta_ag_int.h"
34 #include "bta/include/bta_hfp_api.h"
35 #include "bta/include/bta_rfcomm_scn.h"
36 #include "bta_ag_api.h"
37 #include "bta_api.h"
38 #include "bta_sys.h"
39 #include "btif/include/btif_config.h"
40 #include "btm_api_types.h"
41 #include "device/include/interop.h"
42 #include "device/include/interop_config.h"
43 #include "internal_include/bt_target.h"
44 #include "osi/include/allocator.h"
45 #include "sdp_callback.h"
46 #include "sdp_status.h"
47 #include "sdpdefs.h"
48 #include "stack/btm/btm_sco_hfp_hal.h"
49 #include "stack/include/bt_types.h"
50 #include "stack/include/bt_uuid16.h"
51 #include "stack/include/main_thread.h"
52 #include "stack/include/sdp_api.h"
53 #include "stack/sdp/sdp_discovery_db.h"
54 #include "storage/config_keys.h"
55 #include "types/bluetooth/uuid.h"
56 #include "types/raw_address.h"
57 
58 using namespace bluetooth::legacy::stack::sdp;
59 using namespace bluetooth;
60 using bluetooth::Uuid;
61 
62 /* Number of protocol elements in protocol element list. */
63 #define BTA_AG_NUM_PROTO_ELEMS 2
64 
65 /* Number of elements in service class id list. */
66 #define BTA_AG_NUM_SVC_ELEMS 2
67 
68 /* size of database for service discovery */
69 #ifndef BTA_AG_DISC_BUF_SIZE
70 #define BTA_AG_DISC_BUF_SIZE BT_DEFAULT_BUFFER_SIZE
71 #endif
72 
73 /* declare sdp callback functions */
74 void bta_ag_sdp_cback_1(const RawAddress& bd_addr, tSDP_RESULT);
75 void bta_ag_sdp_cback_2(const RawAddress& bd_addr, tSDP_RESULT);
76 void bta_ag_sdp_cback_3(const RawAddress& bd_addr, tSDP_RESULT);
77 void bta_ag_sdp_cback_4(const RawAddress& bd_addr, tSDP_RESULT);
78 void bta_ag_sdp_cback_5(const RawAddress& bd_addr, tSDP_RESULT);
79 void bta_ag_sdp_cback_6(const RawAddress& bd_addr, tSDP_RESULT);
80 
81 /* SDP callback function table */
82 typedef tSDP_DISC_CMPL_CB* tBTA_AG_SDP_CBACK;
83 const tBTA_AG_SDP_CBACK bta_ag_sdp_cback_tbl[] = {bta_ag_sdp_cback_1, bta_ag_sdp_cback_2,
84                                                   bta_ag_sdp_cback_3, bta_ag_sdp_cback_4,
85                                                   bta_ag_sdp_cback_5, bta_ag_sdp_cback_6};
86 
87 /*******************************************************************************
88  *
89  * Function         bta_ag_sdp_cback
90  *
91  * Description      SDP callback function.
92  *
93  *
94  * Returns          void
95  *
96  ******************************************************************************/
bta_ag_sdp_cback(tSDP_STATUS status,uint8_t idx)97 static void bta_ag_sdp_cback(tSDP_STATUS status, uint8_t idx) {
98   log::verbose("status:0x{:x}", status);
99   tBTA_AG_SCB* p_scb = bta_ag_scb_by_idx(idx);
100   if (p_scb) {
101     uint16_t event;
102     /* set event according to int/acp */
103     if (p_scb->role == BTA_AG_ACP) {
104       event = BTA_AG_DISC_ACP_RES_EVT;
105     } else {
106       event = BTA_AG_DISC_INT_RES_EVT;
107     }
108     tBTA_AG_DATA disc_result = {.disc_result = {.status = status}};
109     do_in_main_thread(base::BindOnce(&bta_ag_sm_execute_by_handle, idx, event, disc_result));
110   }
111 }
112 
113 /*******************************************************************************
114  *
115  * Function         bta_ag_sdp_cback_1 to 6
116  *
117  * Description      SDP callback functions.  Since there is no way to
118  *                  distinguish scb from the callback we need separate
119  *                  callbacks for each scb.
120  *
121  *
122  * Returns          void
123  *
124  ******************************************************************************/
bta_ag_sdp_cback_1(const RawAddress &,tSDP_STATUS status)125 void bta_ag_sdp_cback_1(const RawAddress& /* bd_addr */, tSDP_STATUS status) {
126   bta_ag_sdp_cback(status, 1);
127 }
bta_ag_sdp_cback_2(const RawAddress &,tSDP_STATUS status)128 void bta_ag_sdp_cback_2(const RawAddress& /* bd_addr */, tSDP_STATUS status) {
129   bta_ag_sdp_cback(status, 2);
130 }
bta_ag_sdp_cback_3(const RawAddress &,tSDP_STATUS status)131 void bta_ag_sdp_cback_3(const RawAddress& /* bd_addr */, tSDP_STATUS status) {
132   bta_ag_sdp_cback(status, 3);
133 }
bta_ag_sdp_cback_4(const RawAddress &,tSDP_STATUS status)134 void bta_ag_sdp_cback_4(const RawAddress& /* bd_addr */, tSDP_STATUS status) {
135   bta_ag_sdp_cback(status, 4);
136 }
bta_ag_sdp_cback_5(const RawAddress &,tSDP_STATUS status)137 void bta_ag_sdp_cback_5(const RawAddress& /* bd_addr */, tSDP_STATUS status) {
138   bta_ag_sdp_cback(status, 5);
139 }
bta_ag_sdp_cback_6(const RawAddress &,tSDP_STATUS status)140 void bta_ag_sdp_cback_6(const RawAddress& /* bd_addr */, tSDP_STATUS status) {
141   bta_ag_sdp_cback(status, 6);
142 }
143 
144 /******************************************************************************
145  *
146  * Function         bta_ag_add_record
147  *
148  * Description      This function is called by a server application to add
149  *                  HSP or HFP information to an SDP record.  Prior to
150  *                  calling this function the application must call
151  *                  SDP_CreateRecord() to create an SDP record.
152  *
153  * Returns          true if function execution succeeded,
154  *                  false if function execution failed.
155  *
156  *****************************************************************************/
bta_ag_add_record(uint16_t service_uuid,const char * p_service_name,uint8_t scn,tBTA_AG_FEAT features,uint32_t sdp_handle)157 bool bta_ag_add_record(uint16_t service_uuid, const char* p_service_name, uint8_t scn,
158                        tBTA_AG_FEAT features, uint32_t sdp_handle) {
159   tSDP_PROTOCOL_ELEM proto_elem_list[BTA_AG_NUM_PROTO_ELEMS];
160   uint16_t svc_class_id_list[BTA_AG_NUM_SVC_ELEMS];
161   uint16_t browse_list[] = {UUID_SERVCLASS_PUBLIC_BROWSE_GROUP};
162   uint16_t version;
163   uint16_t profile_uuid;
164   uint8_t network;
165   bool result = true;
166   bool codec_supported = false;
167   uint8_t buf[2];
168 
169   log::verbose("uuid: {:x}", service_uuid);
170   log::info("features: {}", features);
171 
172   for (auto& proto_element : proto_elem_list) {
173     proto_element = {};
174   }
175 
176   /* add the protocol element sequence */
177   proto_elem_list[0].protocol_uuid = UUID_PROTOCOL_L2CAP;
178   proto_elem_list[0].num_params = 0;
179   proto_elem_list[1].protocol_uuid = UUID_PROTOCOL_RFCOMM;
180   proto_elem_list[1].num_params = 1;
181   proto_elem_list[1].params[0] = scn;
182   result &= get_legacy_stack_sdp_api()->handle.SDP_AddProtocolList(
183           sdp_handle, BTA_AG_NUM_PROTO_ELEMS, proto_elem_list);
184 
185   /* add service class id list */
186   svc_class_id_list[0] = service_uuid;
187   svc_class_id_list[1] = UUID_SERVCLASS_GENERIC_AUDIO;
188   result &= get_legacy_stack_sdp_api()->handle.SDP_AddServiceClassIdList(
189           sdp_handle, BTA_AG_NUM_SVC_ELEMS, svc_class_id_list);
190 
191   /* add profile descriptor list */
192   if (service_uuid == UUID_SERVCLASS_AG_HANDSFREE) {
193     profile_uuid = UUID_SERVCLASS_HF_HANDSFREE;
194     version = HFP_VERSION_1_6;
195   } else {
196     profile_uuid = UUID_SERVCLASS_HEADSET;
197     version = HSP_VERSION_1_2;
198   }
199   result &= get_legacy_stack_sdp_api()->handle.SDP_AddProfileDescriptorList(sdp_handle,
200                                                                             profile_uuid, version);
201 
202   /* add service name */
203   if (p_service_name != nullptr && p_service_name[0] != 0) {
204     result &= get_legacy_stack_sdp_api()->handle.SDP_AddAttribute(
205             sdp_handle, ATTR_ID_SERVICE_NAME, TEXT_STR_DESC_TYPE,
206             (uint32_t)(strlen(p_service_name) + 1), (uint8_t*)p_service_name);
207   }
208 
209   /* add features and network */
210   if (service_uuid == UUID_SERVCLASS_AG_HANDSFREE) {
211     network = (features & BTA_AG_FEAT_REJECT) ? 1 : 0;
212     result &= get_legacy_stack_sdp_api()->handle.SDP_AddAttribute(
213             sdp_handle, ATTR_ID_DATA_STORES_OR_NETWORK, UINT_DESC_TYPE, 1, &network);
214 
215     if (features & BTA_AG_FEAT_CODEC) {
216       codec_supported = true;
217     }
218 
219     features &= BTA_AG_SDP_FEAT_SPEC;
220 
221     /* Codec bit position is different in SDP and in BRSF */
222     if (codec_supported) {
223       features |= BTA_AG_FEAT_WBS_SUPPORT;
224     }
225     // check property for SWB support
226     if (hfp_hal_interface::get_swb_supported()) {
227       features |= BTA_AG_FEAT_SWB_SUPPORT;
228     }
229 
230     UINT16_TO_BE_FIELD(buf, features);
231     result &= get_legacy_stack_sdp_api()->handle.SDP_AddAttribute(
232             sdp_handle, ATTR_ID_SUPPORTED_FEATURES, UINT_DESC_TYPE, 2, buf);
233   }
234 
235   /* add browse group list */
236   result &= get_legacy_stack_sdp_api()->handle.SDP_AddUuidSequence(
237           sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, browse_list);
238 
239   return result;
240 }
241 
242 /*******************************************************************************
243  *
244  * Function         bta_ag_create_records
245  *
246  * Description      Create SDP records for registered services.
247  *
248  *
249  * Returns          void
250  *
251  ******************************************************************************/
bta_ag_create_records(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA & data)252 void bta_ag_create_records(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& data) {
253   int i;
254   tBTA_SERVICE_MASK services;
255 
256   services = p_scb->reg_services >> BTA_HSP_SERVICE_ID;
257   for (i = 0; i < BTA_AG_NUM_IDX && services != 0; i++, services >>= 1) {
258     /* if service is set in mask */
259     if (services & 1) {
260       /* add sdp record if not already registered */
261       if (bta_ag_cb.profile[i].sdp_handle == 0) {
262         bta_ag_cb.profile[i].sdp_handle = get_legacy_stack_sdp_api()->handle.SDP_CreateRecord();
263         bta_ag_cb.profile[i].scn = BTA_AllocateSCN();
264         bta_ag_add_record(bta_ag_uuid[i], data.api_register.p_name[i], bta_ag_cb.profile[i].scn,
265                           data.api_register.features, bta_ag_cb.profile[i].sdp_handle);
266         bta_sys_add_uuid(bta_ag_uuid[i]);
267       }
268     }
269   }
270 }
271 
272 /*******************************************************************************
273  *
274  * Function         bta_ag_del_records
275  *
276  * Description      Delete SDP records for any registered services.
277  *
278  *
279  * Returns          void
280  *
281  ******************************************************************************/
bta_ag_del_records(tBTA_AG_SCB * p_scb)282 void bta_ag_del_records(tBTA_AG_SCB* p_scb) {
283   tBTA_AG_SCB* p = &bta_ag_cb.scb[0];
284   tBTA_SERVICE_MASK services;
285   tBTA_SERVICE_MASK others = 0;
286   int i;
287 
288   /* get services of all other registered servers */
289   for (i = 0; i < BTA_AG_NUM_IDX; i++, p++) {
290     if (p_scb == p) {
291       continue;
292     }
293 
294     if (p->in_use && !p->dealloc) {
295       others |= p->reg_services;
296     }
297   }
298 
299   others >>= BTA_HSP_SERVICE_ID;
300   services = p_scb->reg_services >> BTA_HSP_SERVICE_ID;
301   for (i = 0; i < BTA_AG_NUM_IDX && services != 0; i++, services >>= 1, others >>= 1) {
302     /* if service registered for this scb and not registered for any other scb
303      */
304     if (((services & 1) == 1) && ((others & 1) == 0)) {
305       log::verbose("bta_ag_del_records {}", i);
306       if (bta_ag_cb.profile[i].sdp_handle != 0) {
307         if (!get_legacy_stack_sdp_api()->handle.SDP_DeleteRecord(bta_ag_cb.profile[i].sdp_handle)) {
308           log::warn("Unable to delete record sdp_handle:{}", bta_ag_cb.profile[i].sdp_handle);
309         }
310         bta_ag_cb.profile[i].sdp_handle = 0;
311       }
312       BTA_FreeSCN(bta_ag_cb.profile[i].scn);
313       bta_sys_remove_uuid(bta_ag_uuid[i]);
314     }
315   }
316 }
317 
318 /*******************************************************************************
319  *
320  * Function         bta_ag_sdp_find_attr
321  *
322  * Description      Process SDP discovery results to find requested attributes
323  *                  for requested service.
324  *
325  *
326  * Returns          true if results found, false otherwise.
327  *
328  ******************************************************************************/
bta_ag_sdp_find_attr(tBTA_AG_SCB * p_scb,tBTA_SERVICE_MASK service)329 bool bta_ag_sdp_find_attr(tBTA_AG_SCB* p_scb, tBTA_SERVICE_MASK service) {
330   tSDP_DISC_REC* p_rec = nullptr;
331   tSDP_DISC_ATTR* p_attr;
332   tSDP_PROTOCOL_ELEM pe;
333   uint16_t uuid;
334   bool result = false;
335 
336   if (service & BTA_HFP_SERVICE_MASK) {
337     uuid = UUID_SERVCLASS_HF_HANDSFREE;
338     /* If there is no cached peer version, use default one */
339     if (p_scb->peer_version == HFP_HSP_VERSION_UNKNOWN) {
340       p_scb->peer_version = HFP_VERSION_1_1; /* Default version */
341     }
342   } else if (service & BTA_HSP_SERVICE_MASK && p_scb->role == BTA_AG_INT) {
343     uuid = UUID_SERVCLASS_HEADSET_HS;
344     p_scb->peer_version = HSP_VERSION_1_2; /* Default version */
345   } else {
346     uuid = UUID_SERVCLASS_HEADSET_HS;
347     p_scb->peer_version = HSP_VERSION_1_0;
348   }
349 
350   /* loop through all records we found */
351   while (true) {
352     /* get next record; if none found, we're done */
353     p_rec = get_legacy_stack_sdp_api()->db.SDP_FindServiceInDb(p_scb->p_disc_db, uuid, p_rec);
354     if (p_rec == nullptr) {
355       if (uuid == UUID_SERVCLASS_HEADSET_HS) {
356         /* Search again in case the peer device uses the old HSP UUID */
357         uuid = UUID_SERVCLASS_HEADSET;
358         p_scb->peer_version = HSP_VERSION_1_0;
359         p_rec = get_legacy_stack_sdp_api()->db.SDP_FindServiceInDb(p_scb->p_disc_db, uuid, p_rec);
360         if (p_rec == nullptr) {
361           break;
362         }
363       } else {
364         break;
365       }
366     }
367 
368     /* get scn from proto desc list if initiator */
369     if (p_scb->role == BTA_AG_INT) {
370       if (get_legacy_stack_sdp_api()->record.SDP_FindProtocolListElemInRec(
371                   p_rec, UUID_PROTOCOL_RFCOMM, &pe)) {
372         p_scb->peer_scn = (uint8_t)pe.params[0];
373       } else {
374         continue;
375       }
376     }
377 
378     /* get profile version (if failure, version parameter is not updated) */
379     uint16_t peer_version = HFP_HSP_VERSION_UNKNOWN;
380     if (!get_legacy_stack_sdp_api()->record.SDP_FindProfileVersionInRec(p_rec, uuid,
381                                                                         &peer_version)) {
382       log::warn("Get peer_version failed, using default 0x{:04x}", p_scb->peer_version);
383       peer_version = p_scb->peer_version;
384     }
385 
386     if (service & BTA_HFP_SERVICE_MASK) {
387       /* Update cached peer version if the new one is different */
388       if (peer_version != p_scb->peer_version) {
389         p_scb->peer_version = peer_version;
390         if (btif_config_set_bin(p_scb->peer_addr.ToString(), BTIF_STORAGE_KEY_HFP_VERSION,
391                                 (const uint8_t*)&peer_version, sizeof(peer_version))) {
392         } else {
393           log::warn("Failed to store peer HFP version for {}", p_scb->peer_addr);
394         }
395       }
396       /* get features if HFP */
397       p_attr = get_legacy_stack_sdp_api()->record.SDP_FindAttributeInRec(
398               p_rec, ATTR_ID_SUPPORTED_FEATURES);
399       if (p_attr != nullptr && SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == UINT_DESC_TYPE &&
400           SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 2) {
401         /* Found attribute. Get value. */
402         /* There might be race condition between SDP and BRSF.  */
403         /* Do not update if we already received BRSF.           */
404         uint16_t sdp_features = p_attr->attr_value.v.u16;
405         bool sdp_wbs_support = sdp_features & BTA_AG_FEAT_WBS_SUPPORT;
406         if (!p_scb->received_at_bac && sdp_wbs_support) {
407           // Workaround for misbehaving HFs (e.g. some Hyundai car kit) that:
408           // 1. Indicate WBS support in SDP and codec negotiation in BRSF
409           // 2. But do not send required AT+BAC command
410           // Will assume mSBC is enabled and try codec negotiation by default
411           p_scb->codec_updated = true;
412           p_scb->peer_codecs = BTM_SCO_CODEC_CVSD | BTM_SCO_CODEC_MSBC;
413           p_scb->sco_codec = BTM_SCO_CODEC_MSBC;
414         }
415         if (sdp_features != p_scb->peer_sdp_features) {
416           p_scb->peer_sdp_features = sdp_features;
417           if (btif_config_set_bin(p_scb->peer_addr.ToString(), BTIF_STORAGE_KEY_HFP_SDP_FEATURES,
418                                   (const uint8_t*)&sdp_features, sizeof(sdp_features))) {
419           } else {
420             log::warn("Failed to store peer HFP SDP Features for {}", p_scb->peer_addr);
421           }
422         }
423         if (p_scb->peer_features == 0) {
424           p_scb->peer_features = sdp_features & HFP_SDP_BRSF_FEATURES_MASK;
425         }
426         /* Remote supports 1.7, store it in HFP 1.7 BL file */
427         if (p_scb->peer_version >= HFP_VERSION_1_9) {
428           interop_database_add_addr(INTEROP_HFP_1_9_ALLOWLIST, &p_scb->peer_addr, 3);
429         } else if (p_scb->peer_version >= HFP_VERSION_1_7) {
430           interop_database_add_addr(INTEROP_HFP_1_7_ALLOWLIST, &p_scb->peer_addr, 3);
431         }
432       }
433     } else {
434       /* No peer version caching for HSP, use discovered one directly */
435       p_scb->peer_version = peer_version;
436       /* get features if HSP */
437       p_attr = get_legacy_stack_sdp_api()->record.SDP_FindAttributeInRec(
438               p_rec, ATTR_ID_REMOTE_AUDIO_VOLUME_CONTROL);
439       if (p_attr != nullptr && SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == BOOLEAN_DESC_TYPE &&
440           SDP_DISC_ATTR_LEN(p_attr->attr_len_type) >= 1) {
441         /* Remote volume control of HSP */
442         if (p_attr->attr_value.v.u8) {
443           p_scb->peer_features |= BTA_AG_PEER_FEAT_VOL;
444         } else {
445           p_scb->peer_features &= ~BTA_AG_PEER_FEAT_VOL;
446         }
447       }
448     }
449 
450     /* found what we needed */
451     result = true;
452     break;
453   }
454   return result;
455 }
456 
457 /*******************************************************************************
458  *
459  * Function         bta_ag_do_disc
460  *
461  * Description      Do service discovery.
462  *
463  *
464  * Returns          void
465  *
466  ******************************************************************************/
bta_ag_do_disc(tBTA_AG_SCB * p_scb,tBTA_SERVICE_MASK service)467 void bta_ag_do_disc(tBTA_AG_SCB* p_scb, tBTA_SERVICE_MASK service) {
468   Uuid uuid_list[1];
469   uint16_t num_uuid = 1;
470   uint16_t attr_list[4];
471   uint8_t num_attr;
472 
473   /* HFP initiator; get proto list and features */
474   if (service & BTA_HFP_SERVICE_MASK && p_scb->role == BTA_AG_INT) {
475     attr_list[0] = ATTR_ID_SERVICE_CLASS_ID_LIST;
476     attr_list[1] = ATTR_ID_PROTOCOL_DESC_LIST;
477     attr_list[2] = ATTR_ID_BT_PROFILE_DESC_LIST;
478     attr_list[3] = ATTR_ID_SUPPORTED_FEATURES;
479     num_attr = 4;
480     uuid_list[0] = Uuid::From16Bit(UUID_SERVCLASS_HF_HANDSFREE);
481   } else if (service & BTA_HFP_SERVICE_MASK && p_scb->role == BTA_AG_ACP) {
482     /* HFP acceptor; get features */
483     attr_list[0] = ATTR_ID_SERVICE_CLASS_ID_LIST;
484     attr_list[1] = ATTR_ID_BT_PROFILE_DESC_LIST;
485     attr_list[2] = ATTR_ID_SUPPORTED_FEATURES;
486     num_attr = 3;
487     uuid_list[0] = Uuid::From16Bit(UUID_SERVCLASS_HF_HANDSFREE);
488   } else if (service & BTA_HSP_SERVICE_MASK && p_scb->role == BTA_AG_INT) {
489     /* HSP initiator; get proto list */
490     attr_list[0] = ATTR_ID_SERVICE_CLASS_ID_LIST;
491     attr_list[1] = ATTR_ID_PROTOCOL_DESC_LIST;
492     attr_list[2] = ATTR_ID_BT_PROFILE_DESC_LIST;
493     attr_list[3] = ATTR_ID_REMOTE_AUDIO_VOLUME_CONTROL;
494     num_attr = 4;
495     // Although UUID_SERVCLASS_HEADSET_HS (0x1131) is to be used in HSP 1.2,
496     // some HSP 1.2 implementations, such as PTS, still use
497     // UUID_SERVCLASS_HEADSET (0x1108) to store its service record. However,
498     // most of such devices are HSP 1.0 devices.
499     if (p_scb->hsp_version >= HSP_VERSION_1_2) {
500       uuid_list[0] = Uuid::From16Bit(UUID_SERVCLASS_HEADSET_HS);
501     } else {
502       uuid_list[0] = Uuid::From16Bit(UUID_SERVCLASS_HEADSET);
503     }
504   } else {
505     /* HSP acceptor; get features */
506     attr_list[0] = ATTR_ID_SERVICE_CLASS_ID_LIST;
507     attr_list[1] = ATTR_ID_PROTOCOL_DESC_LIST;
508     attr_list[2] = ATTR_ID_BT_PROFILE_DESC_LIST;
509     attr_list[3] = ATTR_ID_REMOTE_AUDIO_VOLUME_CONTROL;
510     num_attr = 4;
511 
512     if (p_scb->hsp_version >= HSP_VERSION_1_2) {
513       uuid_list[0] = Uuid::From16Bit(UUID_SERVCLASS_HEADSET_HS);
514     } else {
515       /* Legacy from HSP v1.0 */
516       uuid_list[0] = Uuid::From16Bit(UUID_SERVCLASS_HEADSET);
517     }
518   }
519 
520   if (p_scb->p_disc_db != nullptr) {
521     log::error("Discovery already in progress... returning.");
522     return;
523   }
524 
525   /* allocate buffer for sdp database */
526   p_scb->p_disc_db = (tSDP_DISCOVERY_DB*)osi_malloc(BTA_AG_DISC_BUF_SIZE);
527   /* set up service discovery database; attr happens to be attr_list len */
528   if (get_legacy_stack_sdp_api()->service.SDP_InitDiscoveryDb(
529               p_scb->p_disc_db, BTA_AG_DISC_BUF_SIZE, num_uuid, uuid_list, num_attr, attr_list)) {
530     if (get_legacy_stack_sdp_api()->service.SDP_ServiceSearchAttributeRequest(
531                 p_scb->peer_addr, p_scb->p_disc_db,
532                 bta_ag_sdp_cback_tbl[bta_ag_scb_to_idx(p_scb) - 1])) {
533       return;
534     } else {
535       log::error("failed to start SDP discovery for {}", p_scb->peer_addr);
536     }
537   } else {
538     log::error("failed to init SDP discovery database for {}", p_scb->peer_addr);
539   }
540   // Failure actions
541   bta_ag_free_db(p_scb, tBTA_AG_DATA::kEmpty);
542   bta_ag_sm_execute(p_scb, BTA_AG_DISC_FAIL_EVT, tBTA_AG_DATA::kEmpty);
543 }
544 
545 /*******************************************************************************
546  *
547  * Function         bta_ag_free_db
548  *
549  * Description      Free discovery database.
550  *
551  *
552  * Returns          void
553  *
554  ******************************************************************************/
bta_ag_free_db(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA &)555 void bta_ag_free_db(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& /*data*/) {
556   osi_free_and_reset((void**)&p_scb->p_disc_db);
557 }
558