xref: /btstack/src/classic/avrcp_controller.c (revision f968dcfc8a990aac2c0e0d8034f31d33e7dd05eb)
1 /*
2  * Copyright (C) 2016 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
24  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "avrcp_controller.c"
39 
40 #include <stdint.h>
41 #include <string.h>
42 #include <inttypes.h>
43 
44 #include "classic/avrcp.h"
45 #include "classic/avrcp_controller.h"
46 
47 #include "bluetooth_sdp.h"
48 #include "btstack_debug.h"
49 #include "btstack_event.h"
50 #include "btstack_util.h"
51 #include "l2cap.h"
52 
53 #define AVRCP_MAX_AV_C_MESSAGE_FRAME_SIZE 512
54 
55 // made public in avrcp_controller.h
56 avrcp_context_t avrcp_controller_context;
57 
58 static uint8_t avrcp_controller_calc_next_transaction_label(uint8_t current_transaction_label){
59     current_transaction_label++;
60     if (current_transaction_label == 16){
61         current_transaction_label = 1;
62     }
63     return current_transaction_label;
64 }
65 
66 static uint8_t avrcp_controller_get_next_transaction_label(avrcp_connection_t * connection){
67     connection->transaction_id_counter = avrcp_controller_calc_next_transaction_label(connection->transaction_id_counter);
68     return connection->transaction_id_counter;
69 }
70 
71 static bool avrcp_controller_is_transaction_id_valid(avrcp_connection_t * connection, uint8_t transaction_id){
72     uint8_t delta = ((int8_t) transaction_id - connection->last_confirmed_transaction_id) & 0x0f;
73     return delta < 15;
74 }
75 
76 static uint16_t avrcp_get_max_payload_size_for_avctp_packet_type(avrcp_connection_t * connection, avctp_packet_type_t avctp_packet_type){
77     uint16_t max_frame_size = btstack_min(l2cap_get_remote_mtu_for_local_cid(connection->l2cap_signaling_cid), AVRCP_MAX_AV_C_MESSAGE_FRAME_SIZE);
78 
79     switch (avctp_packet_type){
80         case AVCTP_SINGLE_PACKET:
81             return max_frame_size - 3;
82         case AVCTP_START_PACKET:
83             return max_frame_size - 4;
84         case AVCTP_CONTINUE_PACKET:
85         case AVCTP_END_PACKET:
86             return max_frame_size - 1;
87         default:
88             btstack_assert(false);
89             return 0;
90     }
91 }
92 
93 static int avrcp_controller_supports_browsing(uint16_t controller_supported_features){
94     return controller_supported_features & AVRCP_FEATURE_MASK_BROWSING;
95 }
96 
97 static void avrcp_controller_emit_notification_complete(avrcp_connection_t * connection, uint8_t status, uint8_t event_id, bool enabled){
98     uint8_t event[8];
99     uint8_t pos = 0;
100     event[pos++] = HCI_EVENT_AVRCP_META;
101     event[pos++] = sizeof(event) - 2;
102     event[pos++] = AVRCP_SUBEVENT_NOTIFICATION_STATE;
103     little_endian_store_16(event, pos, connection->avrcp_cid);
104     pos += 2;
105     event[pos++] = status;
106     event[pos++] = enabled ? 1 : 0;
107     event[pos++] = event_id;
108     UNUSED(pos);
109     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
110 }
111 
112 static void avrcp_controller_emit_supported_events(avrcp_connection_t * connection){
113     uint8_t ctype = (uint8_t) AVRCP_CTYPE_RESPONSE_CHANGED_STABLE;
114     uint8_t event_id;
115 
116     for (event_id = (uint8_t) AVRCP_NOTIFICATION_EVENT_FIRST_INDEX; event_id < (uint8_t) AVRCP_NOTIFICATION_EVENT_LAST_INDEX; event_id++){
117         if ( (connection->target_supported_notifications & (1<<event_id)) == 0){
118             continue;
119         }
120         uint8_t event[8];
121         uint8_t pos = 0;
122         event[pos++] = HCI_EVENT_AVRCP_META;
123         event[pos++] = sizeof(event) - 2;
124         event[pos++] = AVRCP_SUBEVENT_GET_CAPABILITY_EVENT_ID;
125         little_endian_store_16(event, pos, connection->avrcp_cid);
126         pos += 2;
127         event[pos++] = ctype;
128         event[pos++] = 0;
129         event[pos++] = event_id;
130         UNUSED(pos);
131         (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
132     }
133 
134     uint8_t event[7];
135     uint8_t pos = 0;
136     event[pos++] = HCI_EVENT_AVRCP_META;
137     event[pos++] = sizeof(event) - 2;
138     event[pos++] = AVRCP_SUBEVENT_GET_CAPABILITY_EVENT_ID_DONE;
139     little_endian_store_16(event, pos, connection->avrcp_cid);
140     pos += 2;
141     event[pos++] = ctype;
142     event[pos++] = 0;
143     UNUSED(pos);
144     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
145 }
146 
147 static void avrcp_controller_emit_notification_for_event_id(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id,
148                                                             avrcp_command_type_t ctype, const uint8_t *payload,
149                                                             uint16_t size) {
150     switch (event_id){
151         case AVRCP_NOTIFICATION_EVENT_PLAYBACK_POS_CHANGED:{
152             if (size < 4) break;
153             uint32_t song_position = big_endian_read_32(payload, 0);
154             uint16_t offset = 0;
155             uint8_t event[10];
156             event[offset++] = HCI_EVENT_AVRCP_META;
157             event[offset++] = sizeof(event) - 2;
158             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_PLAYBACK_POS_CHANGED;
159             little_endian_store_16(event, offset, avrcp_cid);
160             offset += 2;
161             event[offset++] = ctype;
162             little_endian_store_32(event, offset, song_position);
163             offset += 4;
164             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
165             break;
166         }
167         case AVRCP_NOTIFICATION_EVENT_PLAYBACK_STATUS_CHANGED:{
168             if (size < 1) break;
169             uint16_t offset = 0;
170             uint8_t event[7];
171             event[offset++] = HCI_EVENT_AVRCP_META;
172             event[offset++] = sizeof(event) - 2;
173             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_PLAYBACK_STATUS_CHANGED;
174             little_endian_store_16(event, offset, avrcp_cid);
175             offset += 2;
176             event[offset++] = ctype;
177             event[offset++] = payload[0];
178             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
179             break;
180         }
181         case AVRCP_NOTIFICATION_EVENT_TRACK_CHANGED:{
182             uint16_t offset = 0;
183             uint8_t event[6];
184             event[offset++] = HCI_EVENT_AVRCP_META;
185             event[offset++] = sizeof(event) - 2;
186             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_TRACK_CHANGED;
187             little_endian_store_16(event, offset, avrcp_cid);
188             offset += 2;
189             event[offset++] = ctype;
190             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
191             break;
192         }
193         case AVRCP_NOTIFICATION_EVENT_NOW_PLAYING_CONTENT_CHANGED:{
194             uint16_t offset = 0;
195             uint8_t event[6];
196             event[offset++] = HCI_EVENT_AVRCP_META;
197             event[offset++] = sizeof(event) - 2;
198             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_NOW_PLAYING_CONTENT_CHANGED;
199             little_endian_store_16(event, offset, avrcp_cid);
200             offset += 2;
201             event[offset++] = ctype;
202             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
203             break;
204         }
205         case AVRCP_NOTIFICATION_EVENT_AVAILABLE_PLAYERS_CHANGED:{
206             uint16_t offset = 0;
207             uint8_t event[6];
208             event[offset++] = HCI_EVENT_AVRCP_META;
209             event[offset++] = sizeof(event) - 2;
210             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_AVAILABLE_PLAYERS_CHANGED;
211             little_endian_store_16(event, offset, avrcp_cid);
212             offset += 2;
213             event[offset++] = ctype;
214             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
215             break;
216         }
217         case AVRCP_NOTIFICATION_EVENT_VOLUME_CHANGED:{
218             if (size < 1) break;
219             uint16_t offset = 0;
220             uint8_t event[7];
221             event[offset++] = HCI_EVENT_AVRCP_META;
222             event[offset++] = sizeof(event) - 2;
223             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_VOLUME_CHANGED;
224             little_endian_store_16(event, offset, avrcp_cid);
225             offset += 2;
226             event[offset++] = ctype;
227             event[offset++] = payload[0] & 0x7F;
228             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
229             break;
230         }
231         case AVRCP_NOTIFICATION_EVENT_UIDS_CHANGED:{
232             if (size < 2) break;
233             uint8_t event[8];
234             uint16_t offset = 0;
235             uint16_t uuid = big_endian_read_16(payload, 0);
236             event[offset++] = HCI_EVENT_AVRCP_META;
237             event[offset++] = sizeof(event) - 2;
238             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_UIDS_CHANGED;
239             little_endian_store_16(event, offset, avrcp_cid);
240             offset += 2;
241             event[offset++] = ctype;
242             little_endian_store_16(event, offset, uuid);
243             offset += 2;
244             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
245             break;
246         }
247 
248         case AVRCP_NOTIFICATION_EVENT_TRACK_REACHED_END:{
249             uint16_t offset = 0;
250             uint8_t event[6];
251             event[offset++] = HCI_EVENT_AVRCP_META;
252             event[offset++] = sizeof(event) - 2;
253             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_TRACK_REACHED_END;
254             little_endian_store_16(event, offset, avrcp_cid);
255             offset += 2;
256             event[offset++] = ctype;
257             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
258             break;
259         }
260         case AVRCP_NOTIFICATION_EVENT_TRACK_REACHED_START:{
261             uint16_t offset = 0;
262             uint8_t event[6];
263             event[offset++] = HCI_EVENT_AVRCP_META;
264             event[offset++] = sizeof(event) - 2;
265             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_TRACK_REACHED_START;
266             little_endian_store_16(event, offset, avrcp_cid);
267             offset += 2;
268             event[offset++] = ctype;
269             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
270             break;
271         }
272         case AVRCP_NOTIFICATION_EVENT_BATT_STATUS_CHANGED:{
273             if (size < 1) break;
274             uint16_t offset = 0;
275             uint8_t event[7];
276             event[offset++] = HCI_EVENT_AVRCP_META;
277             event[offset++] = sizeof(event) - 2;
278             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_BATT_STATUS_CHANGED;
279             little_endian_store_16(event, offset, avrcp_cid);
280             offset += 2;
281             event[offset++] = ctype;
282             event[offset++] = payload[0];
283             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
284             break;
285         }
286 
287         case AVRCP_NOTIFICATION_EVENT_SYSTEM_STATUS_CHANGED:{
288             if (size < 1) break;
289             uint16_t offset = 0;
290             uint8_t event[7];
291             event[offset++] = HCI_EVENT_AVRCP_META;
292             event[offset++] = sizeof(event) - 2;
293             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_SYSTEM_STATUS_CHANGED;
294             little_endian_store_16(event, offset, avrcp_cid);
295             offset += 2;
296             event[offset++] = ctype;
297             event[offset++] = payload[0];
298             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
299             break;
300         }
301 
302         case AVRCP_NOTIFICATION_EVENT_PLAYER_APPLICATION_SETTING_CHANGED:
303         default:
304             log_info("avrcp: not implemented");
305             break;
306     }
307 }
308 
309 static void avrcp_controller_emit_repeat_and_shuffle_mode(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t ctype, avrcp_repeat_mode_t repeat_mode, avrcp_shuffle_mode_t shuffle_mode){
310     btstack_assert(callback != NULL);
311 
312     uint8_t event[8];
313     int pos = 0;
314     event[pos++] = HCI_EVENT_AVRCP_META;
315     event[pos++] = sizeof(event) - 2;
316     event[pos++] = AVRCP_SUBEVENT_SHUFFLE_AND_REPEAT_MODE;
317     little_endian_store_16(event, pos, avrcp_cid);
318     pos += 2;
319     event[pos++] = ctype;
320     event[pos++] = repeat_mode;
321     event[pos++] = shuffle_mode;
322     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
323 }
324 
325 static void avrcp_controller_emit_now_playing_info_event_done(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t ctype, uint8_t status){
326     uint8_t event[7];
327     int pos = 0;
328     event[pos++] = HCI_EVENT_AVRCP_META;
329     event[pos++] = sizeof(event) - 2;
330     event[pos++] = AVRCP_SUBEVENT_NOW_PLAYING_INFO_DONE;
331     little_endian_store_16(event, pos, avrcp_cid);
332     pos += 2;
333     event[pos++] = ctype;
334     event[pos++] = status;
335     (*callback)(HCI_EVENT_PACKET, 0, event, pos);
336 }
337 
338 static void avrcp_controller_emit_now_playing_info_event(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t ctype, avrcp_media_attribute_id_t attr_id, uint8_t * value, uint16_t value_len){
339     uint8_t event[HCI_EVENT_BUFFER_SIZE];
340     int pos = 0;
341     event[pos++] = HCI_EVENT_AVRCP_META;
342     // reserve one byte for subevent type and data len
343     int data_len_pos = pos;
344     pos++;
345     int subevent_type_pos = pos;
346     pos++;
347     little_endian_store_16(event, pos, avrcp_cid);
348     pos += 2;
349     event[pos++] = ctype;
350 
351     switch (attr_id){
352         case AVRCP_MEDIA_ATTR_TITLE:
353             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_TITLE_INFO;
354             event[pos++] = value_len;
355             (void)memcpy(event + pos, value, value_len);
356             break;
357         case AVRCP_MEDIA_ATTR_ARTIST:
358             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_ARTIST_INFO;
359             event[pos++] = value_len;
360             (void)memcpy(event + pos, value, value_len);
361             break;
362         case AVRCP_MEDIA_ATTR_ALBUM:
363             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_ALBUM_INFO;
364             event[pos++] = value_len;
365             (void)memcpy(event + pos, value, value_len);
366             break;
367         case AVRCP_MEDIA_ATTR_GENRE:
368             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_GENRE_INFO;
369             event[pos++] = value_len;
370             (void)memcpy(event + pos, value, value_len);
371             break;
372         case AVRCP_MEDIA_ATTR_SONG_LENGTH_MS:
373             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_SONG_LENGTH_MS_INFO;
374             if (value){
375                 little_endian_store_32(event, pos, btstack_atoi((char *)value));
376             } else {
377                 little_endian_store_32(event, pos, 0);
378             }
379             pos += 4;
380             break;
381         case AVRCP_MEDIA_ATTR_TRACK:
382             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_TRACK_INFO;
383             if (value){
384                 event[pos++] = btstack_atoi((char *)value);
385             } else {
386                 event[pos++] = 0;
387             }
388             break;
389         case AVRCP_MEDIA_ATTR_TOTAL_NUM_ITEMS:
390             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_TOTAL_TRACKS_INFO;
391             if (value){
392                 event[pos++] = btstack_atoi((char *)value);
393             } else {
394                 event[pos++] = 0;
395             }
396             break;
397         default:
398             break;
399     }
400     event[data_len_pos] = pos - 2;
401     (*callback)(HCI_EVENT_PACKET, 0, event, pos);
402 }
403 
404 static void avrcp_controller_emit_operation_status(btstack_packet_handler_t callback, uint8_t subevent, uint16_t avrcp_cid, uint8_t ctype, uint8_t operation_id){
405     btstack_assert(callback != NULL);
406 
407     uint8_t event[7];
408     int pos = 0;
409     event[pos++] = HCI_EVENT_AVRCP_META;
410     event[pos++] = sizeof(event) - 2;
411     event[pos++] = subevent;
412     little_endian_store_16(event, pos, avrcp_cid);
413     pos += 2;
414     event[pos++] = ctype;
415     event[pos++] = operation_id;
416     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
417 }
418 
419 static void avrcp_parser_reset(avrcp_connection_t * connection){
420     connection->list_offset = 0;
421     connection->num_attributes = 0;
422     connection->num_parsed_attributes = 0;
423     connection->parser_attribute_header_pos = 0;
424     connection->num_received_fragments = 0;
425     connection->parser_state = AVRCP_PARSER_GET_ATTRIBUTE_HEADER;
426 }
427 
428 static void avrcp_parser_process_byte(uint8_t byte, avrcp_connection_t * connection, avrcp_command_type_t ctype){
429     uint16_t attribute_total_value_len;
430     uint32_t attribute_id;
431     switch(connection->parser_state){
432         case AVRCP_PARSER_GET_ATTRIBUTE_HEADER:
433             connection->parser_attribute_header[connection->parser_attribute_header_pos++] = byte;
434             connection->list_offset++;
435 
436             if (connection->parser_attribute_header_pos < AVRCP_ATTRIBUTE_HEADER_LEN) return;
437 
438             attribute_total_value_len = big_endian_read_16(connection->parser_attribute_header, 6);
439             connection->attribute_value_len = btstack_min(attribute_total_value_len, AVRCP_MAX_ATTRIBUTTE_SIZE);
440             if (connection->attribute_value_len > 0){
441                 // get ready for attribute value
442                 connection->parser_state = AVRCP_PARSER_GET_ATTRIBUTE_VALUE;
443                 return;
444             }
445 
446             // emit empty attribute
447             attribute_id = big_endian_read_32(connection->parser_attribute_header, 0);
448             avrcp_controller_emit_now_playing_info_event(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, (avrcp_media_attribute_id_t) attribute_id, connection->attribute_value, connection->attribute_value_len);
449 
450             // done, see below
451             break;
452 
453         case AVRCP_PARSER_GET_ATTRIBUTE_VALUE:
454             connection->attribute_value[connection->attribute_value_offset++] = byte;
455             connection->list_offset++;
456 
457             if (connection->attribute_value_offset < connection->attribute_value_len) return;
458 
459             // emit (potentially partial) attribute
460             attribute_id = big_endian_read_32(connection->parser_attribute_header, 0);
461             avrcp_controller_emit_now_playing_info_event(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, (avrcp_media_attribute_id_t) attribute_id, connection->attribute_value, connection->attribute_value_len);
462 
463             attribute_total_value_len = big_endian_read_16(connection->parser_attribute_header, 6);
464             if (connection->attribute_value_offset < attribute_total_value_len){
465                 // ignore rest of attribute
466                 connection->parser_state = AVRCP_PARSER_IGNORE_REST_OF_ATTRIBUTE_VALUE;
467                 return;
468             }
469 
470             // done, see below
471             break;
472 
473         case AVRCP_PARSER_IGNORE_REST_OF_ATTRIBUTE_VALUE:
474             connection->attribute_value_offset++;
475             connection->list_offset++;
476 
477             attribute_total_value_len = big_endian_read_16(connection->parser_attribute_header, 6);
478             if (connection->attribute_value_offset < attribute_total_value_len) return;
479 
480             // done, see below
481             break;
482 
483         default:
484             return;
485     }
486 
487     // attribute fully read, check if more to come
488     if (connection->list_offset < connection->list_size){
489         // more to come, reset parser
490         connection->parser_state = AVRCP_PARSER_GET_ATTRIBUTE_HEADER;
491         connection->parser_attribute_header_pos = 0;
492         connection->attribute_value_offset = 0;
493     } else {
494         // fully done
495         avrcp_parser_reset(connection);
496         avrcp_controller_emit_now_playing_info_event_done(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, 0);
497     }
498 }
499 
500 static void avrcp_controller_parse_and_emit_element_attrs(uint8_t * packet, uint16_t num_bytes_to_read, avrcp_connection_t * connection, avrcp_command_type_t ctype){
501     int i;
502     for (i=0;i<num_bytes_to_read;i++){
503         avrcp_parser_process_byte(packet[i], connection, ctype);
504     }
505 }
506 
507 
508 static int avrcp_send_cmd_with_avctp_fragmentation(avrcp_connection_t * connection, avctp_packet_type_t avctp_packet_type){
509     l2cap_reserve_packet_buffer();
510     uint8_t * command = l2cap_get_outgoing_buffer();
511     uint16_t pos = 0;
512     uint16_t max_frame_size = btstack_min(l2cap_get_remote_mtu_for_local_cid(connection->l2cap_signaling_cid), AVRCP_MAX_AV_C_MESSAGE_FRAME_SIZE);
513 
514     // non-fragmented: transport header (1) + PID (2)
515     // fragmented:     transport header (1) + num packets (1) + PID (2)
516 
517     // transport header : transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
518     command[pos++] = (connection->transaction_id << 4) | (avctp_packet_type << 2) | (AVRCP_COMMAND_FRAME << 1) | 0;
519 
520     if (avctp_packet_type == AVCTP_START_PACKET){
521         // num packets: (3 bytes overhead (PID, num packets) + command) / (MTU - transport header).
522         // to get number of packets using integer division, we subtract 1 from the data e.g. len = 5, packet size 5 => need 1 packet
523         command[pos++] = ((connection->cmd_operands_fragmented_len + 3 - 1) / (max_frame_size - 1)) + 1;
524     }
525 
526     if ((avctp_packet_type == AVCTP_START_PACKET) || (avctp_packet_type == AVCTP_START_PACKET)){
527         // Profile IDentifier (PID)
528         command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL >> 8;
529         command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL & 0x00FF;
530 
531         // command_type
532         command[pos++] = connection->command_type;
533         // subunit_type | subunit ID
534         command[pos++] = (connection->subunit_type << 3) | connection->subunit_id;
535         // opcode
536         command[pos++] = (uint8_t)connection->command_opcode;
537     }
538 
539     if (avctp_packet_type == AVCTP_SINGLE_PACKET){
540         // operands
541         (void)memcpy(command + pos, connection->cmd_operands,
542                      connection->cmd_operands_length);
543         pos += connection->cmd_operands_length;
544     } else {
545         uint16_t bytes_free = max_frame_size - pos;
546         uint16_t bytes_to_store = connection->cmd_operands_fragmented_len-connection->cmd_operands_fragmented_pos;
547         uint16_t bytes_to_copy = btstack_min(bytes_to_store, bytes_free);
548         (void)memcpy(command + pos,
549                      &connection->cmd_operands_fragmented_buffer[connection->cmd_operands_fragmented_pos],
550                      bytes_to_copy);
551         pos += bytes_to_copy;
552         connection->cmd_operands_fragmented_pos += bytes_to_copy;
553     }
554 
555     return l2cap_send_prepared(connection->l2cap_signaling_cid, pos);
556 }
557 
558 static int avrcp_send_register_notification(avrcp_connection_t * connection, uint8_t event_id){
559     uint8_t command[18];
560     uint16_t pos = 0;
561     // transport header : transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
562     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
563     command[pos++] = (connection->transaction_id << 4) | (AVRCP_SINGLE_PACKET << 2) | (AVRCP_COMMAND_FRAME << 1) | 0;
564 
565     command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL >> 8;
566     command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL & 0x00FF;
567     command[pos++] = AVRCP_CTYPE_NOTIFY;
568     command[pos++] = (AVRCP_SUBUNIT_TYPE_PANEL << 3) | AVRCP_SUBUNIT_ID;
569     command[pos++] = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
570 
571     big_endian_store_24(command, pos, BT_SIG_COMPANY_ID);
572     pos += 3;
573     command[pos++] = AVRCP_PDU_ID_REGISTER_NOTIFICATION;
574     command[pos++] = 0;                       // reserved(upper 6) | packet_type -> 0
575     big_endian_store_16(command, pos, 5);     // parameter length
576     pos += 2;
577     command[pos++] = event_id;
578     big_endian_store_32(command, pos, 1);     // send notification on playback position every second, for other notifications it is ignored
579     pos += 4;
580     return l2cap_send(connection->l2cap_signaling_cid, command, pos);
581 }
582 
583 static void avrcp_press_and_hold_timeout_handler(btstack_timer_source_t * timer){
584     UNUSED(timer);
585     avrcp_connection_t * connection = (avrcp_connection_t*) btstack_run_loop_get_timer_context(timer);
586     btstack_run_loop_set_timer(&connection->press_and_hold_cmd_timer, 2000); // 2 seconds timeout
587     btstack_run_loop_add_timer(&connection->press_and_hold_cmd_timer);
588     connection->state = AVCTP_W2_SEND_PRESS_COMMAND;
589     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
590 }
591 
592 static void avrcp_press_and_hold_timer_start(avrcp_connection_t * connection){
593     btstack_run_loop_remove_timer(&connection->press_and_hold_cmd_timer);
594     btstack_run_loop_set_timer_handler(&connection->press_and_hold_cmd_timer, avrcp_press_and_hold_timeout_handler);
595     btstack_run_loop_set_timer_context(&connection->press_and_hold_cmd_timer, connection);
596     btstack_run_loop_set_timer(&connection->press_and_hold_cmd_timer, 2000); // 2 seconds timeout
597     btstack_run_loop_add_timer(&connection->press_and_hold_cmd_timer);
598 }
599 
600 static void avrcp_press_and_hold_timer_stop(avrcp_connection_t * connection){
601     connection->press_and_hold_cmd_active = false;
602     btstack_run_loop_remove_timer(&connection->press_and_hold_cmd_timer);
603 }
604 
605 
606 static uint8_t avrcp_controller_request_pass_through_release_control_cmd(avrcp_connection_t * connection){
607     connection->state = AVCTP_W2_SEND_RELEASE_COMMAND;
608     if (connection->press_and_hold_cmd_active){
609         avrcp_press_and_hold_timer_stop(connection);
610     }
611     connection->cmd_operands[0] = 0x80 | connection->cmd_operands[0];
612     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
613     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
614     return ERROR_CODE_SUCCESS;
615 }
616 
617 static uint8_t avrcp_controller_request_pass_through_press_control_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint16_t playback_speed, bool continuous_cmd){
618     log_info("Send command %d", opid);
619     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
620     if (!connection){
621         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
622     }
623 
624     if (connection->state != AVCTP_CONNECTION_OPENED){
625         log_error("Connection in wrong state %d, expected %d. avrcp cid 0x%02x", connection->state, AVCTP_CONNECTION_OPENED, avrcp_cid);
626         return ERROR_CODE_COMMAND_DISALLOWED;
627     }
628     connection->state = AVCTP_W2_SEND_PRESS_COMMAND;
629     connection->command_opcode =  AVRCP_CMD_OPCODE_PASS_THROUGH;
630     connection->command_type = AVRCP_CTYPE_CONTROL;
631     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
632     connection->subunit_id =   AVRCP_SUBUNIT_ID;
633     connection->cmd_operands_length = 0;
634 
635     connection->press_and_hold_cmd_active = continuous_cmd;
636     connection->cmd_operands_length = 2;
637     connection->cmd_operands[0] = opid;
638     if (playback_speed > 0){
639         connection->cmd_operands[2] = playback_speed;
640         connection->cmd_operands_length++;
641     }
642     connection->cmd_operands[1] = connection->cmd_operands_length - 2;
643 
644     if (connection->press_and_hold_cmd_active){
645         avrcp_press_and_hold_timer_start(connection);
646     }
647 
648     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
649     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
650     return ERROR_CODE_SUCCESS;
651 }
652 
653 static uint8_t request_single_pass_through_press_control_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint16_t playback_speed){
654     return avrcp_controller_request_pass_through_press_control_cmd(avrcp_cid, opid, playback_speed, false);
655 }
656 
657 static uint8_t request_continuous_pass_through_press_control_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint16_t playback_speed){
658     return avrcp_controller_request_pass_through_press_control_cmd(avrcp_cid, opid, playback_speed, true);
659 }
660 
661 static void avrcp_controller_get_capabilities_for_connection(avrcp_connection_t * connection, uint8_t capability_id){
662     connection->state = AVCTP_W2_SEND_COMMAND;
663     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
664     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
665     connection->command_type = AVRCP_CTYPE_STATUS;
666     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
667     connection->subunit_id = AVRCP_SUBUNIT_ID;
668     big_endian_store_24(connection->cmd_operands, 0, BT_SIG_COMPANY_ID);
669     connection->cmd_operands[3] = AVRCP_PDU_ID_GET_CAPABILITIES; // PDU ID
670     connection->cmd_operands[4] = 0;
671     big_endian_store_16(connection->cmd_operands, 5, 1); // parameter length
672     connection->cmd_operands[7] = capability_id;                  // capability ID
673     connection->cmd_operands_length = 8;
674     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
675 }
676 
677 static uint8_t avrcp_controller_register_notification(avrcp_connection_t * connection, avrcp_notification_event_id_t event_id){
678     if (connection->target_supported_notifications_queried && (connection->target_supported_notifications & (1 << event_id)) == 0){
679         return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
680     }
681     if ( (connection->notifications_to_deregister & (1 << event_id)) != 0){
682         return ERROR_CODE_COMMAND_DISALLOWED;
683     }
684     if ( (connection->notifications_enabled & (1 << event_id)) != 0){
685         return ERROR_CODE_SUCCESS;
686     }
687     connection->notifications_to_register |= (1 << event_id);
688 
689     if (!connection->target_supported_notifications_queried){
690         connection->target_supported_notifications_suppress_emit_result = true;
691         avrcp_controller_get_capabilities_for_connection(connection, AVRCP_CAPABILITY_ID_EVENT);
692         return ERROR_CODE_SUCCESS;
693     }
694     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
695     return ERROR_CODE_SUCCESS;
696 }
697 
698 static uint8_t avrcp_controller_request_abort_continuation(avrcp_connection_t * connection){
699     connection->state = AVCTP_W2_SEND_COMMAND;
700     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
701     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
702     connection->command_type = AVRCP_CTYPE_CONTROL;
703     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
704     connection->subunit_id = AVRCP_SUBUNIT_ID;
705     int pos = 0;
706     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
707     pos += 3;
708     connection->cmd_operands[pos++] = AVRCP_PDU_ID_REQUEST_ABORT_CONTINUING_RESPONSE; // PDU ID
709     connection->cmd_operands[pos++] = 0;
710     // Parameter Length
711     connection->cmd_operands_length = 8;
712     big_endian_store_16(connection->cmd_operands, pos, 1);
713     pos += 2;
714     connection->cmd_operands[pos++] = AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES;
715     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
716     return ERROR_CODE_SUCCESS;
717 }
718 
719 
720 static uint8_t avrcp_controller_request_continue_response(avrcp_connection_t * connection){
721     connection->state = AVCTP_W2_SEND_COMMAND;
722     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
723     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
724     connection->command_type = AVRCP_CTYPE_CONTROL;
725     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
726     connection->subunit_id = AVRCP_SUBUNIT_ID;
727     int pos = 0;
728     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
729     pos += 3;
730     connection->cmd_operands[pos++] = AVRCP_PDU_ID_REQUEST_CONTINUING_RESPONSE; // PDU ID
731     connection->cmd_operands[pos++] = 0;
732     // Parameter Length
733     connection->cmd_operands_length = 8;
734     big_endian_store_16(connection->cmd_operands, pos, 1);
735     pos += 2;
736     connection->cmd_operands[pos++] = AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES;
737     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
738     return ERROR_CODE_SUCCESS;
739 }
740 
741 static void avrcp_controller_handle_notification(avrcp_connection_t *connection, avrcp_command_type_t ctype, uint8_t *payload, uint16_t size) {
742     if (size < 1) return;
743     uint16_t pos = 0;
744     avrcp_notification_event_id_t event_id = (avrcp_notification_event_id_t) payload[pos++];
745     if ( (event_id < AVRCP_NOTIFICATION_EVENT_FIRST_INDEX) || (event_id > AVRCP_NOTIFICATION_EVENT_LAST_INDEX)){
746         return;
747     }
748 
749     uint16_t event_mask = (1 << event_id);
750     uint16_t reset_event_mask = ~event_mask;
751 
752     switch (ctype){
753         case AVRCP_CTYPE_RESPONSE_REJECTED:
754             connection->notifications_to_deregister &= reset_event_mask;
755             connection->notifications_to_register   &= reset_event_mask;
756             connection->initial_status_reported     &= reset_event_mask;
757             avrcp_controller_emit_notification_complete(connection, ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE, event_id, false);
758             return;
759 
760         case AVRCP_CTYPE_RESPONSE_INTERIM:
761             // register as enabled
762             connection->notifications_enabled |= event_mask;
763 
764             // check if initial value is already sent
765             if ( (connection->initial_status_reported & event_mask) != 0 ){
766                 return;
767             }
768             // emit event only once, initially
769             avrcp_controller_emit_notification_complete(connection, ERROR_CODE_SUCCESS, event_id, true);
770             connection->initial_status_reported |= event_mask;
771             // emit initial value after this switch
772             break;
773 
774         case AVRCP_CTYPE_RESPONSE_CHANGED_STABLE:
775             // received change, event is considered de-registered
776             // we are re-enabling it automatically, if it is not
777             // explicitly disabled
778             connection->notifications_enabled &= reset_event_mask;
779             if ((connection->notifications_to_deregister & event_mask) == 0){
780                 avrcp_controller_register_notification(connection, event_id);
781             } else {
782                 connection->notifications_to_deregister &= reset_event_mask;
783                 connection->notifications_to_register   &= reset_event_mask;
784                 connection->initial_status_reported     &= reset_event_mask;
785                 avrcp_controller_emit_notification_complete(connection, ERROR_CODE_SUCCESS, event_id, false);
786             }
787             break;
788 
789         default:
790             return;
791     }
792 
793     avrcp_controller_emit_notification_for_event_id(connection->avrcp_cid, event_id, ctype, payload + pos, size - pos);
794 }
795 
796 #ifdef ENABLE_AVCTP_FRAGMENTATION
797 static void avctp_reassemble_message(avrcp_connection_t * connection, avctp_packet_type_t packet_type, uint8_t *packet, uint16_t size){
798     // after header (transaction label and packet type)
799     uint16_t pos;
800     uint16_t bytes_to_store;
801 
802     switch (packet_type){
803         case AVCTP_START_PACKET:
804             if (size < 2) return;
805 
806             // store header
807             pos = 0;
808             connection->avctp_reassembly_buffer[pos] = packet[pos];
809             pos++;
810             connection->avctp_reassembly_size = pos;
811 
812             // NOTE: num packets not needed for reassembly, ignoring it does not pose security risk -> no need to store it
813             pos++;
814 
815             // PID in reassembled packet is at offset 1, it will be read later after the avctp_reassemble_message with AVCTP_END_PACKET is called
816 
817             bytes_to_store = btstack_min(size - pos, sizeof(connection->avctp_reassembly_buffer) - connection->avctp_reassembly_size);
818             memcpy(&connection->avctp_reassembly_buffer[connection->avctp_reassembly_size], &packet[pos], bytes_to_store);
819             connection->avctp_reassembly_size += bytes_to_store;
820             break;
821 
822         case AVCTP_CONTINUE_PACKET:
823         case AVCTP_END_PACKET:
824             if (size < 1) return;
825 
826             // store remaining data, ignore header
827             pos = 1;
828             bytes_to_store = btstack_min(size - pos, sizeof(connection->avctp_reassembly_buffer) - connection->avctp_reassembly_size);
829             memcpy(&connection->avctp_reassembly_buffer[connection->avctp_reassembly_size], &packet[pos], bytes_to_store);
830             connection->avctp_reassembly_size += bytes_to_store;
831             break;
832 
833         default:
834             return;
835     }
836 }
837 #endif
838 
839 static void avrcp_handle_l2cap_data_packet_for_signaling_connection(avrcp_connection_t * connection, uint8_t *packet, uint16_t size){
840     if (size < 6u) return;
841     uint8_t  pdu_id;
842     avrcp_packet_type_t  vendor_dependent_packet_type;
843 
844     uint16_t pos = 0;
845     connection->last_confirmed_transaction_id = packet[pos] >> 4;
846     avrcp_frame_type_t  frame_type =  (avrcp_frame_type_t)((packet[pos] >> 1) & 0x01);
847     avctp_packet_type_t packet_type = (avctp_packet_type_t)((packet[pos] >> 2) & 0x03);
848     pos++;
849 
850     if (frame_type != AVRCP_RESPONSE_FRAME) return;
851 
852     switch (packet_type){
853         case AVCTP_SINGLE_PACKET:
854             break;
855 
856 #ifdef ENABLE_AVCTP_FRAGMENTATION
857         case AVCTP_START_PACKET:
858         case AVCTP_CONTINUE_PACKET:
859             avctp_reassemble_message(connection, packet_type, packet, size);
860             return;
861 
862         case AVCTP_END_PACKET:
863             avctp_reassemble_message(connection, packet_type, packet, size);
864 
865             packet = connection->avctp_reassembly_buffer;
866             size   = connection->avctp_reassembly_size;
867             break;
868 #endif
869 
870         default:
871             return;
872     }
873 
874     pos += 2; // PID
875 
876     avrcp_command_type_t ctype = (avrcp_command_type_t) packet[pos++];
877 
878 #ifdef ENABLE_LOG_INFO
879     uint8_t byte_value = packet[pos];
880     avrcp_subunit_type_t subunit_type = (avrcp_subunit_type_t) (byte_value >> 3);
881     avrcp_subunit_type_t subunit_id   = (avrcp_subunit_type_t) (byte_value & 0x07);
882 #endif
883     pos++;
884 
885     uint8_t opcode = packet[pos++];
886     uint16_t param_length;
887 
888     switch (opcode){
889         case AVRCP_CMD_OPCODE_SUBUNIT_INFO:{
890             if (connection->state != AVCTP_W2_RECEIVE_RESPONSE) return;
891             connection->state = AVCTP_CONNECTION_OPENED;
892 
893 #ifdef ENABLE_LOG_INFO
894             // page, extension code (1)
895             pos++;
896             uint8_t unit_type = packet[pos] >> 3;
897             uint8_t max_subunit_ID = packet[pos] & 0x07;
898             log_info("SUBUNIT INFO response: ctype 0x%02x (0C), subunit_type 0x%02x (1F), subunit_id 0x%02x (07), opcode 0x%02x (30), unit_type 0x%02x, max_subunit_ID %d", ctype, subunit_type, subunit_id, opcode, unit_type, max_subunit_ID);
899 #endif
900             break;
901         }
902         case AVRCP_CMD_OPCODE_UNIT_INFO:{
903             if (connection->state != AVCTP_W2_RECEIVE_RESPONSE) return;
904             connection->state = AVCTP_CONNECTION_OPENED;
905 
906 #ifdef ENABLE_LOG_INFO
907             // byte value 7 (1)
908             pos++;
909             uint8_t unit_type = packet[pos] >> 3;
910             uint8_t unit = packet[pos] & 0x07;
911             pos++;
912             uint32_t company_id = big_endian_read_24(packet, pos);
913             log_info("UNIT INFO response: ctype 0x%02x (0C), subunit_type 0x%02x (1F), subunit_id 0x%02x (07), opcode 0x%02x (30), unit_type 0x%02x, unit %d, company_id 0x%06" PRIx32,
914                 ctype, subunit_type, subunit_id, opcode, unit_type, unit, company_id);
915 #endif
916             break;
917         }
918         case AVRCP_CMD_OPCODE_VENDOR_DEPENDENT:
919 
920             if ((size - pos) < 7) return;
921 
922             // Company ID (3)
923             pos += 3;
924             pdu_id = packet[pos++];
925             vendor_dependent_packet_type = (avrcp_packet_type_t)(packet[pos++] & 0x03);
926             param_length = big_endian_read_16(packet, pos);
927             pos += 2;
928 
929             if ((size - pos) < param_length) return;
930 
931             // handle asynchronous notifications, without changing state
932             if (pdu_id == AVRCP_PDU_ID_REGISTER_NOTIFICATION){
933                 avrcp_controller_handle_notification(connection, ctype, packet + pos, size - pos);
934                 break;
935             }
936 
937             if (connection->state != AVCTP_W2_RECEIVE_RESPONSE){
938                 log_info("AVRCP_CMD_OPCODE_VENDOR_DEPENDENT state %d", connection->state);
939                 return;
940             }
941             connection->state = AVCTP_CONNECTION_OPENED;
942 
943             log_info("VENDOR DEPENDENT response: pdu id 0x%02x, param_length %d, status %s", pdu_id, param_length, avrcp_ctype2str(ctype));
944             switch (pdu_id){
945                 case AVRCP_PDU_ID_GET_CURRENT_PLAYER_APPLICATION_SETTING_VALUE:{
946                     uint8_t num_attributes = packet[pos++];
947                     int i;
948                     avrcp_repeat_mode_t  repeat_mode =  AVRCP_REPEAT_MODE_INVALID;
949                     avrcp_shuffle_mode_t shuffle_mode = AVRCP_SHUFFLE_MODE_INVALID;
950                     for (i = 0; i < num_attributes; i++){
951                         uint8_t attribute_id    = packet[pos++];
952                         uint8_t value = packet[pos++];
953                         switch (attribute_id){
954                             case 0x02:
955                                 repeat_mode = (avrcp_repeat_mode_t) value;
956                                 break;
957                             case 0x03:
958                                 shuffle_mode = (avrcp_shuffle_mode_t) value;
959                                 break;
960                             default:
961                                 break;
962                         }
963                     }
964                     avrcp_controller_emit_repeat_and_shuffle_mode(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, repeat_mode, shuffle_mode);
965                     break;
966                 }
967 
968                 case AVRCP_PDU_ID_SET_PLAYER_APPLICATION_SETTING_VALUE:{
969                     uint16_t offset = 0;
970                     uint8_t event[6];
971                     event[offset++] = HCI_EVENT_AVRCP_META;
972                     event[offset++] = sizeof(event) - 2;
973                     event[offset++] = AVRCP_SUBEVENT_PLAYER_APPLICATION_VALUE_RESPONSE;
974                     little_endian_store_16(event, offset, connection->avrcp_cid);
975                     offset += 2;
976                     event[offset++] = ctype;
977                     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
978                     break;
979                 }
980 
981                 case AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME:{
982                     uint16_t offset = 0;
983                     uint8_t event[7];
984                     event[offset++] = HCI_EVENT_AVRCP_META;
985                     event[offset++] = sizeof(event) - 2;
986                     event[offset++] = AVRCP_SUBEVENT_SET_ABSOLUTE_VOLUME_RESPONSE;
987                     little_endian_store_16(event, offset, connection->avrcp_cid);
988                     offset += 2;
989                     event[offset++] = ctype;
990                     event[offset++] = packet[pos++];
991                     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
992                     break;
993                 }
994 
995                 case AVRCP_PDU_ID_GET_CAPABILITIES:{
996                     avrcp_capability_id_t capability_id = (avrcp_capability_id_t) packet[pos++];
997                     uint8_t capability_count = 0;
998                     if (param_length > 1){
999                         capability_count = packet[pos++];
1000                     }
1001                     uint16_t i;
1002                     uint16_t offset = 0;
1003                     uint8_t event[10];
1004 
1005                     switch (capability_id){
1006 
1007                         case AVRCP_CAPABILITY_ID_COMPANY:
1008                             for (i = 0; (i < capability_count) && ((size - pos) >= 3); i++){
1009                                 uint32_t company_id = big_endian_read_24(packet, pos);
1010                                 pos += 3;
1011                                 log_info("  0x%06" PRIx32 ", ", company_id);
1012 
1013                                 offset = 0;
1014                                 event[offset++] = HCI_EVENT_AVRCP_META;
1015                                 event[offset++] = sizeof(event) - 2;
1016                                 event[offset++] = AVRCP_SUBEVENT_GET_CAPABILITY_COMPANY_ID;
1017                                 little_endian_store_16(event, offset, connection->avrcp_cid);
1018                                 offset += 2;
1019                                 event[offset++] = ctype;
1020                                 event[offset++] = 0;
1021                                 little_endian_store_24(event, offset, company_id);
1022                                 offset += 3;
1023                                 (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
1024                             }
1025 
1026                             offset = 0;
1027                             event[offset++] = HCI_EVENT_AVRCP_META;
1028                             event[offset++] = sizeof(event) - 2;
1029                             event[offset++] = AVRCP_SUBEVENT_GET_CAPABILITY_COMPANY_ID_DONE;
1030                             little_endian_store_16(event, offset, connection->avrcp_cid);
1031                             offset += 2;
1032                             event[offset++] = ctype;
1033                             event[offset++] = 0;
1034                             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
1035                             break;
1036 
1037                         case AVRCP_CAPABILITY_ID_EVENT:
1038                             for (i = 0; (i < capability_count) && ((size - pos) >= 1); i++){
1039                                 uint8_t event_id = packet[pos++];
1040                                 connection->target_supported_notifications |= (1 << event_id);
1041                             }
1042 
1043                             // if the get supported events query is triggered by avrcp_controller_enable_notification call,
1044                             // avrcp_controller_emit_supported_events should be suppressed
1045                             if (connection->target_supported_notifications_suppress_emit_result){
1046                                 connection->target_supported_notifications_suppress_emit_result = false;
1047                                 // also, notification might not be supported
1048                                 // if so, emit AVRCP_SUBEVENT_ENABLE_NOTIFICATION_COMPLETE event to app,
1049                                 // and update notifications_to_register bitmap
1050                                 for (i = (uint8_t)AVRCP_NOTIFICATION_EVENT_FIRST_INDEX; i < (uint8_t) AVRCP_NOTIFICATION_EVENT_LAST_INDEX; i++){
1051                                     if ((connection->notifications_to_register & (1<<i)) != 0){
1052                                         if ((connection->target_supported_notifications & (1<<i)) == 0){
1053                                             avrcp_controller_emit_notification_complete(connection, ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE, i, false);
1054                                             connection->notifications_to_register &= ~(1 << i);
1055                                         }
1056                                     }
1057                                 }
1058                                 break;
1059                             }
1060                             // supported events are emitted only if the get supported events query
1061                             // is triggered by avrcp_controller_get_supported_events call
1062                             avrcp_controller_emit_supported_events(connection);
1063                             break;
1064 
1065                         default:
1066                             // ignore
1067                             break;
1068                     }
1069                     break;
1070                 }
1071 
1072                 case AVRCP_PDU_ID_GET_PLAY_STATUS:{
1073                     uint32_t song_length = big_endian_read_32(packet, pos);
1074                     pos += 4;
1075                     uint32_t song_position = big_endian_read_32(packet, pos);
1076                     pos += 4;
1077                     uint8_t play_status = packet[pos];
1078 
1079                     uint8_t event[15];
1080                     int offset = 0;
1081                     event[offset++] = HCI_EVENT_AVRCP_META;
1082                     event[offset++] = sizeof(event) - 2;
1083                     event[offset++] = AVRCP_SUBEVENT_PLAY_STATUS;
1084                     little_endian_store_16(event, offset, connection->avrcp_cid);
1085                     offset += 2;
1086                     event[offset++] = ctype;
1087                     little_endian_store_32(event, offset, song_length);
1088                     offset += 4;
1089                     little_endian_store_32(event, offset, song_position);
1090                     offset += 4;
1091                     event[offset++] = play_status;
1092                     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
1093                     break;
1094                 }
1095 
1096                 case AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES:{
1097                     switch (vendor_dependent_packet_type){
1098                         case AVRCP_START_PACKET:
1099                         case AVRCP_SINGLE_PACKET:
1100                             avrcp_parser_reset(connection);
1101                             connection->list_size = param_length;
1102                             connection->num_attributes = packet[pos++];
1103 
1104                             avrcp_controller_parse_and_emit_element_attrs(packet+pos, size-pos, connection, ctype);
1105                             if (vendor_dependent_packet_type == AVRCP_START_PACKET){
1106                                 avrcp_controller_request_continue_response(connection);
1107                             }
1108                             break;
1109                         case AVRCP_CONTINUE_PACKET:
1110                         case AVRCP_END_PACKET:
1111                             connection->num_received_fragments++;
1112 
1113                             if (connection->num_received_fragments < connection->max_num_fragments){
1114                                 avrcp_controller_parse_and_emit_element_attrs(packet+pos, size-pos, connection, ctype);
1115 
1116                                 if (vendor_dependent_packet_type == AVRCP_CONTINUE_PACKET){
1117                                     avrcp_controller_request_continue_response(connection);
1118                                 }
1119                             } else {
1120                                 avrcp_controller_emit_now_playing_info_event_done(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, 1);
1121                                 avrcp_parser_reset(connection);
1122                                 avrcp_controller_request_abort_continuation(connection);
1123                             }
1124                             break;
1125                         default:
1126                             // TODO check
1127                             btstack_assert(false);
1128                             break;
1129                     }
1130                 }
1131                 default:
1132                     break;
1133             }
1134             break;
1135         case AVRCP_CMD_OPCODE_PASS_THROUGH:{
1136             if ((size - pos) < 1) return;
1137             uint8_t operation_id = packet[pos++];
1138             switch (connection->state){
1139                 case AVCTP_W2_RECEIVE_PRESS_RESPONSE:
1140                     // trigger release for simple command:
1141                     if (!connection->press_and_hold_cmd_active){
1142                         connection->state = AVCTP_W2_SEND_RELEASE_COMMAND;
1143                         break;
1144                     }
1145                     // for press and hold, send release if it just has been requested, otherwise, wait for next repeat
1146                     if (connection->press_and_hold_cmd_release){
1147                         connection->press_and_hold_cmd_release = false;
1148                         connection->state = AVCTP_W2_SEND_RELEASE_COMMAND;
1149                     } else {
1150                         connection->state = AVCTP_W4_STOP;
1151                     }
1152                     break;
1153                 case AVCTP_W2_RECEIVE_RESPONSE:
1154                     connection->state = AVCTP_CONNECTION_OPENED;
1155                     break;
1156                 default:
1157                     break;
1158             }
1159             if (connection->state == AVCTP_W4_STOP){
1160                 avrcp_controller_emit_operation_status(avrcp_controller_context.avrcp_callback, AVRCP_SUBEVENT_OPERATION_START, connection->avrcp_cid, ctype, operation_id);
1161             }
1162             if (connection->state == AVCTP_CONNECTION_OPENED) {
1163                 // RELEASE response
1164                 operation_id = operation_id & 0x7F;
1165                 avrcp_controller_emit_operation_status(avrcp_controller_context.avrcp_callback, AVRCP_SUBEVENT_OPERATION_COMPLETE, connection->avrcp_cid, ctype, operation_id);
1166             }
1167             if (connection->state == AVCTP_W2_SEND_RELEASE_COMMAND){
1168                 // PRESS response
1169                 avrcp_controller_request_pass_through_release_control_cmd(connection);
1170             }
1171             break;
1172         }
1173         default:
1174             break;
1175     }
1176 
1177     // trigger pending notification reqistrations
1178     if ((connection->state == AVCTP_CONNECTION_OPENED) && connection->notifications_to_register){
1179         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1180     }
1181 }
1182 
1183 static void avrcp_controller_handle_can_send_now(avrcp_connection_t * connection){
1184     switch (connection->state){
1185         case AVCTP_W2_SEND_PRESS_COMMAND:
1186             connection->state = AVCTP_W2_RECEIVE_PRESS_RESPONSE;
1187             avrcp_send_cmd_with_avctp_fragmentation(connection, AVCTP_SINGLE_PACKET);
1188             return;
1189         case AVCTP_W2_SEND_COMMAND:
1190         case AVCTP_W2_SEND_RELEASE_COMMAND:
1191             connection->state = AVCTP_W2_RECEIVE_RESPONSE;
1192             avrcp_send_cmd_with_avctp_fragmentation(connection, AVCTP_SINGLE_PACKET);
1193             return;
1194         case AVCTP_W2_SEND_AVCTP_FRAGMENTED_MESSAGE:
1195             if (connection->cmd_operands_fragmented_pos == 0){
1196                  avrcp_send_cmd_with_avctp_fragmentation(connection, AVCTP_START_PACKET);
1197                  avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1198             } else {
1199                 if ((connection->cmd_operands_fragmented_len - connection->cmd_operands_fragmented_pos) > avrcp_get_max_payload_size_for_avctp_packet_type(connection, AVCTP_CONTINUE_PACKET)){
1200                      avrcp_send_cmd_with_avctp_fragmentation(connection, AVCTP_CONTINUE_PACKET);
1201                      avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1202                  } else {
1203                     connection->state = AVCTP_W2_RECEIVE_RESPONSE;
1204                     avrcp_send_cmd_with_avctp_fragmentation(connection, AVCTP_END_PACKET);
1205                  }
1206             }
1207             return;
1208         default:
1209             break;
1210     }
1211     // send register notification if queued
1212     if (connection->notifications_to_register != 0){
1213         uint8_t event_id;
1214         for (event_id = (uint8_t)AVRCP_NOTIFICATION_EVENT_FIRST_INDEX; event_id < (uint8_t)AVRCP_NOTIFICATION_EVENT_LAST_INDEX; event_id++){
1215             if (connection->notifications_to_register & (1<<event_id)){
1216                 connection->notifications_to_register &= ~ (1 << event_id);
1217                 avrcp_send_register_notification(connection, event_id);
1218                 return;
1219             }
1220         }
1221     }
1222 }
1223 
1224 static void avrcp_controller_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1225     avrcp_connection_t * connection;
1226 
1227     switch (packet_type) {
1228         case L2CAP_DATA_PACKET:
1229             connection = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_CONTROLLER, channel);
1230             avrcp_handle_l2cap_data_packet_for_signaling_connection(connection, packet, size);
1231             break;
1232 
1233         case HCI_EVENT_PACKET:
1234             switch (hci_event_packet_get_type(packet)){
1235                 case L2CAP_EVENT_CAN_SEND_NOW:
1236                     connection = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_CONTROLLER, channel);
1237                     avrcp_controller_handle_can_send_now(connection);
1238                     break;
1239             default:
1240                 break;
1241         }
1242         default:
1243             break;
1244     }
1245 }
1246 
1247 void avrcp_controller_create_sdp_record(uint8_t * service, uint32_t service_record_handle, uint16_t supported_features, const char * service_name, const char * service_provider_name){
1248     avrcp_create_sdp_record(1, service, service_record_handle, avrcp_controller_supports_browsing(supported_features), supported_features, service_name, service_provider_name);
1249 }
1250 
1251 void avrcp_controller_init(void){
1252     avrcp_controller_context.role = AVRCP_CONTROLLER;
1253     avrcp_controller_context.packet_handler = avrcp_controller_packet_handler;
1254     avrcp_register_controller_packet_handler(&avrcp_controller_packet_handler);
1255 }
1256 
1257 void avrcp_controller_deinit(void){
1258     memset(&avrcp_controller_context, 0, sizeof(avrcp_context_t));
1259 }
1260 
1261 void avrcp_controller_register_packet_handler(btstack_packet_handler_t callback){
1262     btstack_assert(callback != NULL);
1263     avrcp_controller_context.avrcp_callback = callback;
1264 }
1265 
1266 
1267 uint8_t avrcp_controller_play(uint16_t avrcp_cid){
1268     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PLAY, 0);
1269 }
1270 
1271 uint8_t avrcp_controller_stop(uint16_t avrcp_cid){
1272     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_STOP, 0);
1273 }
1274 
1275 uint8_t avrcp_controller_pause(uint16_t avrcp_cid){
1276     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PAUSE, 0);
1277 }
1278 
1279 uint8_t avrcp_controller_forward(uint16_t avrcp_cid){
1280     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FORWARD, 0);
1281 }
1282 
1283 uint8_t avrcp_controller_backward(uint16_t avrcp_cid){
1284     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_BACKWARD, 0);
1285 }
1286 
1287 uint8_t avrcp_controller_volume_up(uint16_t avrcp_cid){
1288     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_UP, 0);
1289 }
1290 
1291 uint8_t avrcp_controller_volume_down(uint16_t avrcp_cid){
1292     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_DOWN, 0);
1293 }
1294 
1295 uint8_t avrcp_controller_mute(uint16_t avrcp_cid){
1296     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_MUTE, 0);
1297 }
1298 
1299 uint8_t avrcp_controller_skip(uint16_t avrcp_cid){
1300     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_SKIP, 0);
1301 }
1302 
1303 uint8_t avrcp_controller_fast_forward(uint16_t avrcp_cid){
1304     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FAST_FORWARD, 0);
1305 }
1306 
1307 uint8_t avrcp_controller_rewind(uint16_t avrcp_cid){
1308     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_REWIND, 0);
1309 }
1310 
1311 /* start continuous cmds */
1312 
1313 uint8_t avrcp_controller_start_press_and_hold_cmd(uint16_t avrcp_cid, avrcp_operation_id_t operation_id){
1314     return request_continuous_pass_through_press_control_cmd(avrcp_cid, operation_id, 0);
1315 }
1316 
1317 uint8_t avrcp_controller_press_and_hold_play(uint16_t avrcp_cid){
1318     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PLAY, 0);
1319 }
1320 uint8_t avrcp_controller_press_and_hold_stop(uint16_t avrcp_cid){
1321     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_STOP, 0);
1322 }
1323 uint8_t avrcp_controller_press_and_hold_pause(uint16_t avrcp_cid){
1324     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PAUSE, 0);
1325 }
1326 uint8_t avrcp_controller_press_and_hold_forward(uint16_t avrcp_cid){
1327     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FORWARD, 0);
1328 }
1329 uint8_t avrcp_controller_press_and_hold_backward(uint16_t avrcp_cid){
1330     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_BACKWARD, 0);
1331 }
1332 uint8_t avrcp_controller_press_and_hold_fast_forward(uint16_t avrcp_cid){
1333     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FAST_FORWARD, 0);
1334 }
1335 uint8_t avrcp_controller_press_and_hold_rewind(uint16_t avrcp_cid){
1336     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_REWIND, 0);
1337 }
1338 uint8_t avrcp_controller_press_and_hold_volume_up(uint16_t avrcp_cid){
1339     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_UP, 0);
1340 }
1341 uint8_t avrcp_controller_press_and_hold_volume_down(uint16_t avrcp_cid){
1342     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_DOWN, 0);
1343 }
1344 uint8_t avrcp_controller_press_and_hold_mute(uint16_t avrcp_cid){
1345     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_MUTE, 0);
1346 }
1347 
1348 /* stop continuous cmds */
1349 uint8_t avrcp_controller_release_press_and_hold_cmd(uint16_t avrcp_cid){
1350     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1351     if (!connection){
1352         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1353     }
1354 
1355     switch (connection->state){
1356         // respond when we receive response for (repeated) press command
1357         case AVCTP_W2_RECEIVE_PRESS_RESPONSE:
1358             connection->press_and_hold_cmd_release = true;
1359             break;
1360 
1361         // release already sent or on the way, nothing to do
1362         case AVCTP_W2_RECEIVE_RESPONSE:
1363         case AVCTP_W2_SEND_RELEASE_COMMAND:
1364             break;
1365 
1366         // about to send next repeated press command or wait for it -> release right away
1367         case AVCTP_W2_SEND_PRESS_COMMAND:
1368         case AVCTP_W4_STOP:
1369             return avrcp_controller_request_pass_through_release_control_cmd(connection);
1370 
1371         // otherwise reject request
1372         default:
1373             return ERROR_CODE_COMMAND_DISALLOWED;
1374     }
1375     return ERROR_CODE_SUCCESS;
1376 }
1377 
1378 uint8_t avrcp_controller_enable_notification(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id){
1379     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1380     if (!connection){
1381         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1382     }
1383     return avrcp_controller_register_notification(connection, event_id);
1384 }
1385 
1386 uint8_t avrcp_controller_disable_notification(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id){
1387     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1388     if (!connection){
1389         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1390     }
1391     if (!connection->target_supported_notifications_queried){
1392         return ERROR_CODE_COMMAND_DISALLOWED;
1393     }
1394 
1395     if ((connection->target_supported_notifications & (1 << event_id)) == 0){
1396         return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
1397     }
1398 
1399     if ((connection->notifications_enabled & (1 << event_id)) == 0){
1400         return ERROR_CODE_SUCCESS;
1401     }
1402 
1403     connection->notifications_to_deregister |= (1 << event_id);
1404     return ERROR_CODE_SUCCESS;
1405 }
1406 
1407 uint8_t avrcp_controller_unit_info(uint16_t avrcp_cid){
1408     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1409     if (!connection){
1410         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1411     }
1412     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1413     connection->state = AVCTP_W2_SEND_COMMAND;
1414 
1415     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1416     connection->command_opcode = AVRCP_CMD_OPCODE_UNIT_INFO;
1417     connection->command_type = AVRCP_CTYPE_STATUS;
1418     connection->subunit_type = AVRCP_SUBUNIT_TYPE_UNIT; //vendor unique
1419     connection->subunit_id =   AVRCP_SUBUNIT_ID_IGNORE;
1420     memset(connection->cmd_operands, 0xFF, connection->cmd_operands_length);
1421     connection->cmd_operands_length = 5;
1422     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1423     return ERROR_CODE_SUCCESS;
1424 }
1425 
1426 uint8_t avrcp_controller_subunit_info(uint16_t avrcp_cid){
1427     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1428     if (!connection){
1429         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1430     }
1431     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1432     connection->state = AVCTP_W2_SEND_COMMAND;
1433 
1434     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1435     connection->command_opcode = AVRCP_CMD_OPCODE_SUBUNIT_INFO;
1436     connection->command_type = AVRCP_CTYPE_STATUS;
1437     connection->subunit_type = AVRCP_SUBUNIT_TYPE_UNIT; //vendor unique
1438     connection->subunit_id =   AVRCP_SUBUNIT_ID_IGNORE;
1439     memset(connection->cmd_operands, 0xFF, connection->cmd_operands_length);
1440     connection->cmd_operands[0] = 7; // page: 0, extention_code: 7
1441     connection->cmd_operands_length = 5;
1442     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1443     return ERROR_CODE_SUCCESS;
1444 }
1445 
1446 uint8_t avrcp_controller_get_supported_company_ids(uint16_t avrcp_cid){
1447     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1448     if (!connection){
1449         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1450     }
1451     if (connection->state != AVCTP_CONNECTION_OPENED){
1452         return ERROR_CODE_COMMAND_DISALLOWED;
1453     }
1454     avrcp_controller_get_capabilities_for_connection(connection, AVRCP_CAPABILITY_ID_COMPANY);
1455     return ERROR_CODE_SUCCESS;
1456 }
1457 
1458 uint8_t avrcp_controller_get_supported_events(uint16_t avrcp_cid){
1459     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1460     if (!connection){
1461         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1462     }
1463     if (connection->state != AVCTP_CONNECTION_OPENED){
1464         return ERROR_CODE_COMMAND_DISALLOWED;
1465     }
1466 
1467     if (!connection->target_supported_notifications_queried){
1468         connection->target_supported_notifications_queried = true;
1469         avrcp_controller_get_capabilities_for_connection(connection, AVRCP_CAPABILITY_ID_EVENT);
1470         return ERROR_CODE_SUCCESS;
1471     }
1472 
1473     avrcp_controller_emit_supported_events(connection);
1474     return ERROR_CODE_SUCCESS;
1475 }
1476 
1477 uint8_t avrcp_controller_get_play_status(uint16_t avrcp_cid){
1478     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1479     if (!connection){
1480         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1481     }
1482     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1483     connection->state = AVCTP_W2_SEND_COMMAND;
1484     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1485     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1486     connection->command_type = AVRCP_CTYPE_STATUS;
1487     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1488     connection->subunit_id = AVRCP_SUBUNIT_ID;
1489     big_endian_store_24(connection->cmd_operands, 0, BT_SIG_COMPANY_ID);
1490     connection->cmd_operands[3] = AVRCP_PDU_ID_GET_PLAY_STATUS;
1491     connection->cmd_operands[4] = 0;                     // reserved(upper 6) | packet_type -> 0
1492     big_endian_store_16(connection->cmd_operands, 5, 0); // parameter length
1493     connection->cmd_operands_length = 7;
1494     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1495     return ERROR_CODE_SUCCESS;
1496 }
1497 
1498 uint8_t avrcp_controller_set_addressed_player(uint16_t avrcp_cid, uint16_t addressed_player_id){
1499     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1500     if (!connection){
1501         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1502     }
1503     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1504     connection->state = AVCTP_W2_SEND_COMMAND;
1505 
1506     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1507     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1508     connection->command_type = AVRCP_CTYPE_CONTROL;
1509     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1510     connection->subunit_id = AVRCP_SUBUNIT_ID;
1511     int pos = 0;
1512     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1513     pos += 3;
1514     connection->cmd_operands[pos++] = AVRCP_PDU_ID_SET_ADDRESSED_PLAYER; // PDU ID
1515     connection->cmd_operands[pos++] = 0;
1516 
1517     // Parameter Length
1518     big_endian_store_16(connection->cmd_operands, pos, 2);
1519     pos += 2;
1520 
1521     big_endian_store_16(connection->cmd_operands, pos, addressed_player_id);
1522     pos += 2;
1523 
1524     connection->cmd_operands_length = pos;
1525     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1526     return ERROR_CODE_SUCCESS;
1527 }
1528 
1529 uint8_t avrcp_controller_get_element_attributes(uint16_t avrcp_cid, uint8_t num_attributes, avrcp_media_attribute_id_t * attributes){
1530     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1531     if (!connection){
1532         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1533     }
1534 
1535     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1536 
1537     if (num_attributes >= AVRCP_MEDIA_ATTR_RESERVED) {
1538         return ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
1539     }
1540     connection->state = AVCTP_W2_SEND_COMMAND;
1541 
1542     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1543     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1544     connection->command_type = AVRCP_CTYPE_STATUS;
1545     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1546     connection->subunit_id = AVRCP_SUBUNIT_ID;
1547     int pos = 0;
1548     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1549     pos += 3;
1550     connection->cmd_operands[pos++] = AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES; // PDU ID
1551     connection->cmd_operands[pos++] = 0;
1552 
1553     // Parameter Length
1554     big_endian_store_16(connection->cmd_operands, pos, 9);
1555     pos += 2;
1556 
1557     // write 8 bytes value
1558     memset(connection->cmd_operands + pos, 0, 8); // identifier: PLAYING
1559     pos += 8;
1560 
1561     connection->cmd_operands[pos++] = num_attributes; // attribute count, if 0 get all attributes
1562 
1563     int i;
1564     for (i = 0; i < num_attributes; i++){
1565         // every attribute is 4 bytes long
1566         big_endian_store_32(connection->cmd_operands, pos, attributes[i]);
1567         pos += 4;
1568     }
1569 
1570     connection->cmd_operands_length = pos;
1571     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1572     return ERROR_CODE_SUCCESS;
1573 }
1574 
1575 uint8_t avrcp_controller_get_now_playing_info(uint16_t avrcp_cid){
1576     return avrcp_controller_get_element_attributes(avrcp_cid, 0, NULL);
1577 }
1578 
1579 uint8_t avrcp_controller_get_now_playing_info_for_media_attribute_id(uint16_t avrcp_cid, avrcp_media_attribute_id_t media_attribute_id){
1580     if (media_attribute_id == AVRCP_MEDIA_ATTR_ALL){
1581         return avrcp_controller_get_now_playing_info(avrcp_cid);
1582     }
1583     return avrcp_controller_get_element_attributes(avrcp_cid, 1, &media_attribute_id);
1584 }
1585 
1586 uint8_t avrcp_controller_set_absolute_volume(uint16_t avrcp_cid, uint8_t volume){
1587      avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1588     if (!connection){
1589         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1590     }
1591 
1592     //
1593     // allow sending of multiple set abs volume commands without waiting for response
1594     //
1595     uint8_t status = ERROR_CODE_COMMAND_DISALLOWED;
1596     switch (connection->state){
1597         case AVCTP_CONNECTION_OPENED:
1598             status = ERROR_CODE_SUCCESS;
1599             break;
1600         case AVCTP_W2_RECEIVE_RESPONSE:
1601             // - is pending response also set abs volume
1602             if (connection->command_opcode  != AVRCP_CMD_OPCODE_VENDOR_DEPENDENT) break;
1603             if (connection->command_type    != AVRCP_CTYPE_CONTROL)               break;
1604             if (connection->subunit_type    != AVRCP_SUBUNIT_TYPE_PANEL)          break;
1605             if (connection->subunit_id      != AVRCP_SUBUNIT_ID)                  break;
1606             if (connection->cmd_operands[3] != AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME)  break;
1607             // - is next transaction id valid in window
1608             if (avrcp_controller_is_transaction_id_valid(connection, avrcp_controller_calc_next_transaction_label(connection->transaction_id_counter)) == false) break;
1609             status = ERROR_CODE_SUCCESS;
1610             break;
1611         default:
1612             break;
1613     }
1614     if (status != ERROR_CODE_SUCCESS) return status;
1615 
1616     connection->state = AVCTP_W2_SEND_COMMAND;
1617 
1618     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1619     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1620     connection->command_type = AVRCP_CTYPE_CONTROL;
1621     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1622     connection->subunit_id = AVRCP_SUBUNIT_ID;
1623     int pos = 0;
1624     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1625     pos += 3;
1626     connection->cmd_operands[pos++] = AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME; // PDU ID
1627     connection->cmd_operands[pos++] = 0;
1628 
1629     // Parameter Length
1630     big_endian_store_16(connection->cmd_operands, pos, 1);
1631     pos += 2;
1632     connection->cmd_operands[pos++] = volume;
1633 
1634     connection->cmd_operands_length = pos;
1635     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1636     return ERROR_CODE_SUCCESS;
1637 }
1638 
1639 uint8_t avrcp_controller_query_shuffle_and_repeat_modes(uint16_t avrcp_cid){
1640     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1641     if (!connection){
1642         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1643     }
1644     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1645     connection->state = AVCTP_W2_SEND_COMMAND;
1646 
1647     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1648     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1649     connection->command_type = AVRCP_CTYPE_STATUS;
1650     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1651     connection->subunit_id = AVRCP_SUBUNIT_ID;
1652     big_endian_store_24(connection->cmd_operands, 0, BT_SIG_COMPANY_ID);
1653     connection->cmd_operands[3] = AVRCP_PDU_ID_GET_CURRENT_PLAYER_APPLICATION_SETTING_VALUE; // PDU ID
1654     connection->cmd_operands[4] = 0;
1655     big_endian_store_16(connection->cmd_operands, 5, 5); // parameter length
1656     connection->cmd_operands[7] = 4;                     // NumPlayerApplicationSettingAttributeID
1657     // PlayerApplicationSettingAttributeID1 AVRCP Spec, Appendix F, 133
1658     connection->cmd_operands[8]  = 0x01;    // equalizer  (1-OFF, 2-ON)
1659     connection->cmd_operands[9]  = 0x02;    // repeat     (1-off, 2-single track, 3-all tracks, 4-group repeat)
1660     connection->cmd_operands[10] = 0x03;    // shuffle    (1-off, 2-all tracks, 3-group shuffle)
1661     connection->cmd_operands[11] = 0x04;    // scan       (1-off, 2-all tracks, 3-group scan)
1662     connection->cmd_operands_length = 12;
1663     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1664     return ERROR_CODE_SUCCESS;
1665 }
1666 
1667 static uint8_t avrcp_controller_set_current_player_application_setting_value(uint16_t avrcp_cid, uint8_t attr_id, uint8_t attr_value){
1668     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1669     if (!connection){
1670         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1671     }
1672     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1673     connection->state = AVCTP_W2_SEND_COMMAND;
1674 
1675     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1676     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1677     connection->command_type = AVRCP_CTYPE_CONTROL;
1678     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1679     connection->subunit_id = AVRCP_SUBUNIT_ID;
1680     int pos = 0;
1681     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1682     pos += 3;
1683     connection->cmd_operands[pos++] = AVRCP_PDU_ID_SET_PLAYER_APPLICATION_SETTING_VALUE; // PDU ID
1684     connection->cmd_operands[pos++] = 0;
1685     // Parameter Length
1686     big_endian_store_16(connection->cmd_operands, pos, 3);
1687     pos += 2;
1688     connection->cmd_operands[pos++] = 2;
1689     connection->cmd_operands_length = pos;
1690     connection->cmd_operands[pos++]  = attr_id;
1691     connection->cmd_operands[pos++]  = attr_value;
1692     connection->cmd_operands_length = pos;
1693     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1694     return ERROR_CODE_SUCCESS;
1695 }
1696 
1697 uint8_t avrcp_controller_set_shuffle_mode(uint16_t avrcp_cid, avrcp_shuffle_mode_t mode){
1698     if ((mode < AVRCP_SHUFFLE_MODE_OFF) || (mode > AVRCP_SHUFFLE_MODE_GROUP)) return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
1699     return avrcp_controller_set_current_player_application_setting_value(avrcp_cid, 0x03, mode);
1700 }
1701 
1702 uint8_t avrcp_controller_set_repeat_mode(uint16_t avrcp_cid, avrcp_repeat_mode_t mode){
1703     if ((mode < AVRCP_REPEAT_MODE_OFF) || (mode > AVRCP_REPEAT_MODE_GROUP)) return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
1704     return avrcp_controller_set_current_player_application_setting_value(avrcp_cid, 0x02, mode);
1705 }
1706 
1707 uint8_t avrcp_controller_play_item_for_scope(uint16_t avrcp_cid, uint8_t * uid, uint16_t uid_counter, avrcp_browsing_scope_t scope){
1708     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1709     if (!connection){
1710         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1711     }
1712     if (connection->state != AVCTP_CONNECTION_OPENED){
1713         log_error("Connection in wrong state, expected %d, received %d", AVCTP_CONNECTION_OPENED, connection->state);
1714         return ERROR_CODE_COMMAND_DISALLOWED;
1715     }
1716     connection->state = AVCTP_W2_SEND_COMMAND;
1717 
1718     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1719     connection->command_type = AVRCP_CTYPE_CONTROL;
1720     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1721     connection->subunit_id = AVRCP_SUBUNIT_ID;
1722     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1723     int pos = 0;
1724     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1725     pos += 3;
1726     connection->cmd_operands[pos++] = AVRCP_PDU_ID_PLAY_ITEM; // PDU ID
1727     // reserved
1728     connection->cmd_operands[pos++] = 0;
1729     // Parameter Length
1730     big_endian_store_16(connection->cmd_operands, pos, 11);
1731     pos += 2;
1732     connection->cmd_operands[pos++]  = scope;
1733     memset(&connection->cmd_operands[pos], 0, 8);
1734     if (uid){
1735         (void)memcpy(&connection->cmd_operands[pos], uid, 8);
1736     }
1737     pos += 8;
1738     big_endian_store_16(connection->cmd_operands, pos, uid_counter);
1739     pos += 2;
1740     connection->cmd_operands_length = pos;
1741 
1742     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1743     return ERROR_CODE_SUCCESS;
1744 }
1745 
1746 uint8_t avrcp_controller_add_item_from_scope_to_now_playing_list(uint16_t avrcp_cid, uint8_t * uid, uint16_t uid_counter, avrcp_browsing_scope_t scope){
1747     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1748     if (!connection){
1749         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1750     }
1751     if (connection->state != AVCTP_CONNECTION_OPENED){
1752         log_error("Connection in wrong state, expected %d, received %d", AVCTP_CONNECTION_OPENED, connection->state);
1753         return ERROR_CODE_COMMAND_DISALLOWED;
1754     }
1755     connection->state = AVCTP_W2_SEND_COMMAND;
1756 
1757     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1758     connection->command_type = AVRCP_CTYPE_CONTROL;
1759     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1760     connection->subunit_id = AVRCP_SUBUNIT_ID;
1761     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1762     int pos = 0;
1763     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1764     pos += 3;
1765     connection->cmd_operands[pos++] = AVRCP_PDU_ID_ADD_TO_NOW_PLAYING; // PDU ID
1766     // reserved
1767     connection->cmd_operands[pos++] = 0;
1768     // Parameter Length
1769     big_endian_store_16(connection->cmd_operands, pos, 11);
1770     pos += 2;
1771     connection->cmd_operands[pos++]  = scope;
1772     memset(&connection->cmd_operands[pos], 0, 8);
1773     if (uid){
1774         (void)memcpy(&connection->cmd_operands[pos], uid, 8);
1775     }
1776     pos += 8;
1777     big_endian_store_16(connection->cmd_operands, pos, uid_counter);
1778     pos += 2;
1779     connection->cmd_operands_length = pos;
1780 
1781     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1782     return ERROR_CODE_SUCCESS;
1783 }
1784 
1785 uint8_t avrcp_controller_set_max_num_fragments(uint16_t avrcp_cid, uint8_t max_num_fragments){
1786     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1787     if (!connection){
1788         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1789     }
1790     connection->max_num_fragments = max_num_fragments;
1791     return ERROR_CODE_SUCCESS;
1792 }
1793 
1794 uint8_t avrcp_controller_send_custom_command(uint16_t avrcp_cid, avrcp_command_type_t command_type, avrcp_subunit_type_t subunit_type, avrcp_subunit_id_t subunit_id, avrcp_command_opcode_t command_opcode, const uint8_t * command_buffer, uint16_t command_len){
1795     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1796     if (!connection){
1797         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1798     }
1799 
1800     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1801     connection->state = AVCTP_W2_SEND_AVCTP_FRAGMENTED_MESSAGE;
1802 
1803     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1804     connection->command_opcode = command_opcode;
1805     connection->command_type = command_type;
1806     connection->subunit_type = subunit_type;
1807     connection->subunit_id = subunit_id;
1808     connection->cmd_operands_fragmented_buffer = command_buffer;
1809     connection->cmd_operands_fragmented_pos = 0;
1810     connection->cmd_operands_fragmented_len = command_len;
1811 
1812     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1813     return ERROR_CODE_SUCCESS;
1814 }
1815