xref: /btstack/src/classic/avrcp.c (revision f0af2234e6fbab0b8742ba30f1ae8aa909a18e9b)
1 /*
2  * Copyright (C) 2016 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "avrcp.c"
39 
40 #include <stdint.h>
41 #include <string.h>
42 // snprintf
43 #include <stdio.h>
44 
45 #include "bluetooth_psm.h"
46 #include "bluetooth_sdp.h"
47 #include "btstack_debug.h"
48 #include "btstack_event.h"
49 #include "btstack_memory.h"
50 #include "classic/sdp_client.h"
51 #include "classic/sdp_util.h"
52 #include "classic/avrcp.h"
53 
54 
55 typedef struct {
56     uint8_t  parse_sdp_record;
57     uint32_t record_id;
58     uint16_t avrcp_cid;
59     uint16_t avrcp_l2cap_psm;
60     uint16_t avrcp_version;
61 
62     uint16_t browsing_l2cap_psm;
63     uint16_t browsing_version;
64 } avrcp_sdp_query_context_t;
65 
66 
67 static void avrcp_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size);
68 
69 static const char * default_avrcp_controller_service_name = "BTstack AVRCP Controller Service";
70 static const char * default_avrcp_controller_service_provider_name = "BTstack AVRCP Controller Service Provider";
71 static const char * default_avrcp_target_service_name = "BTstack AVRCP Target Service";
72 static const char * default_avrcp_target_service_provider_name = "BTstack AVRCP Target Service Provider";
73 
74 // default subunit info: single PANEL subunit
75 static const uint8_t avrcp_default_subunit_info[] = { AVRCP_SUBUNIT_TYPE_PANEL << 3};
76 
77 static uint16_t  avrcp_cid_counter;
78 
79 static btstack_context_callback_registration_t avrcp_handle_sdp_client_query_request;
80 
81 static avrcp_sdp_query_context_t sdp_query_context;
82 
83 static btstack_packet_handler_t avrcp_callback;
84 
85 static uint8_t   attribute_value[45];
86 static const unsigned int attribute_value_buffer_size = sizeof(attribute_value);
87 
88 static btstack_linked_list_t connections;
89 static btstack_packet_handler_t avrcp_controller_packet_handler;
90 static btstack_packet_handler_t avrcp_target_packet_handler;
91 static bool l2cap_service_registered = false;
92 
93 static const char * avrcp_subunit_type_name[] = {
94     "MONITOR", "AUDIO", "PRINTER", "DISC", "TAPE_RECORDER_PLAYER", "TUNER",
95     "CA", "CAMERA", "RESERVED", "PANEL", "BULLETIN_BOARD", "CAMERA_STORAGE",
96     "VENDOR_UNIQUE", "RESERVED_FOR_ALL_SUBUNIT_TYPES",
97     "EXTENDED_TO_NEXT_BYTE", "UNIT", "ERROR"
98 };
99 
100 const char * avrcp_subunit2str(uint16_t index){
101     if (index <= 11) return avrcp_subunit_type_name[index];
102     if ((index >= 0x1C) && (index <= 0x1F)) return avrcp_subunit_type_name[index - 0x10];
103     return avrcp_subunit_type_name[16];
104 }
105 
106 static const char * avrcp_event_name[] = {
107     "ERROR", "PLAYBACK_STATUS_CHANGED",
108     "TRACK_CHANGED", "TRACK_REACHED_END", "TRACK_REACHED_START",
109     "PLAYBACK_POS_CHANGED", "BATT_STATUS_CHANGED", "SYSTEM_STATUS_CHANGED",
110     "PLAYER_APPLICATION_SETTING_CHANGED", "NOW_PLAYING_CONTENT_CHANGED",
111     "AVAILABLE_PLAYERS_CHANGED", "ADDRESSED_PLAYER_CHANGED", "UIDS_CHANGED", "VOLUME_CHANGED"
112 };
113 const char * avrcp_event2str(uint16_t index){
114     if (index <= 0x0d) return avrcp_event_name[index];
115     return avrcp_event_name[0];
116 }
117 
118 static const char * avrcp_operation_name[] = {
119     "SKIP", NULL, NULL, NULL, NULL,
120     "VOLUME_UP", "VOLUME_DOWN", "MUTE", "PLAY", "STOP", "PAUSE", NULL,
121     "REWIND", "FAST_FORWARD", NULL, "FORWARD", "BACKWARD" // 0x4C
122 };
123 
124 const char * avrcp_operation2str(uint8_t operation_id){
125     char * name = NULL;
126     if ((operation_id >= AVRCP_OPERATION_ID_SKIP) && (operation_id <= AVRCP_OPERATION_ID_BACKWARD)){
127         name = (char *)avrcp_operation_name[operation_id - AVRCP_OPERATION_ID_SKIP];
128     }
129     if (name == NULL){
130         static char buffer[13];
131         snprintf(buffer, sizeof(buffer), "Unknown 0x%02x", operation_id);
132         buffer[sizeof(buffer)-1] = 0;
133         return buffer;
134     } else {
135         return name;
136     }
137 }
138 
139 static const char * avrcp_media_attribute_id_name[] = {
140     "NONE", "TITLE", "ARTIST", "ALBUM", "TRACK", "TOTAL TRACKS", "GENRE", "SONG LENGTH"
141 };
142 const char * avrcp_attribute2str(uint8_t index){
143     if ((index >= 1) && (index <= 7)) return avrcp_media_attribute_id_name[index];
144     return avrcp_media_attribute_id_name[0];
145 }
146 
147 static const char * avrcp_play_status_name[] = {
148     "STOPPED", "PLAYING", "PAUSED", "FORWARD SEEK", "REVERSE SEEK",
149     "ERROR" // 0xFF
150 };
151 const char * avrcp_play_status2str(uint8_t index){
152     if ((index >= 1) && (index <= 4)) return avrcp_play_status_name[index];
153     return avrcp_play_status_name[5];
154 }
155 
156 static const char * avrcp_ctype_name[] = {
157     "CONTROL",
158     "STATUS",
159     "SPECIFIC_INQUIRY",
160     "NOTIFY",
161     "GENERAL_INQUIRY",
162     "RESERVED5",
163     "RESERVED6",
164     "RESERVED7",
165     "NOT IMPLEMENTED IN REMOTE",
166     "ACCEPTED BY REMOTE",
167     "REJECTED BY REMOTE",
168     "IN_TRANSITION",
169     "IMPLEMENTED_STABLE",
170     "CHANGED_STABLE",
171     "RESERVED",
172     "INTERIM"
173 };
174 const char * avrcp_ctype2str(uint8_t index){
175     if (index < sizeof(avrcp_ctype_name)){
176         return avrcp_ctype_name[index];
177     }
178     return "NONE";
179 }
180 
181 static const char * avrcp_shuffle_mode_name[] = {
182     "SHUFFLE OFF",
183     "SHUFFLE ALL TRACKS",
184     "SHUFFLE GROUP"
185 };
186 
187 const char * avrcp_shuffle2str(uint8_t index){
188     if ((index >= 1) && (index <= 3)) return avrcp_shuffle_mode_name[index-1];
189     return "NONE";
190 }
191 
192 static const char * avrcp_repeat_mode_name[] = {
193     "REPEAT OFF",
194     "REPEAT SINGLE TRACK",
195     "REPEAT ALL TRACKS",
196     "REPEAT GROUP"
197 };
198 
199 const char * avrcp_repeat2str(uint8_t index){
200     if ((index >= 1) && (index <= 4)) return avrcp_repeat_mode_name[index-1];
201     return "NONE";
202 }
203 
204 btstack_linked_list_t avrcp_get_connections(void){
205     return connections;
206 }
207 
208 uint8_t avrcp_cmd_opcode(uint8_t *packet, uint16_t size){
209     uint8_t cmd_opcode_index = 5;
210     if (cmd_opcode_index > size) return AVRCP_CMD_OPCODE_UNDEFINED;
211     return packet[cmd_opcode_index];
212 }
213 
214 void avrcp_create_sdp_record(uint8_t controller, uint8_t * service, uint32_t service_record_handle, uint8_t browsing, uint16_t supported_features,
215     const char * service_name, const char * service_provider_name){
216     uint8_t* attribute;
217     de_create_sequence(service);
218 
219     // 0x0000 "Service Record Handle"
220     de_add_number(service, DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_SERVICE_RECORD_HANDLE);
221     de_add_number(service, DE_UINT, DE_SIZE_32, service_record_handle);
222 
223     // 0x0001 "Service Class ID List"
224     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_SERVICE_CLASS_ID_LIST);
225     attribute = de_push_sequence(service);
226     {
227         if (controller){
228             de_add_number(attribute, DE_UUID, DE_SIZE_16, BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL);
229             de_add_number(attribute, DE_UUID, DE_SIZE_16, BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL_CONTROLLER);
230         } else {
231             de_add_number(attribute, DE_UUID, DE_SIZE_16, BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL_TARGET);
232         }
233     }
234     de_pop_sequence(service, attribute);
235 
236     // 0x0004 "Protocol Descriptor List"
237     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_PROTOCOL_DESCRIPTOR_LIST);
238     attribute = de_push_sequence(service);
239     {
240         uint8_t* l2cpProtocol = de_push_sequence(attribute);
241         {
242             de_add_number(l2cpProtocol,  DE_UUID, DE_SIZE_16, BLUETOOTH_PROTOCOL_L2CAP);
243             de_add_number(l2cpProtocol,  DE_UINT, DE_SIZE_16, BLUETOOTH_PSM_AVCTP);
244         }
245         de_pop_sequence(attribute, l2cpProtocol);
246 
247         uint8_t* avctpProtocol = de_push_sequence(attribute);
248         {
249             de_add_number(avctpProtocol,  DE_UUID, DE_SIZE_16, BLUETOOTH_PROTOCOL_AVCTP);  // avctpProtocol_service
250             de_add_number(avctpProtocol,  DE_UINT, DE_SIZE_16,  0x0104);    // version
251         }
252         de_pop_sequence(attribute, avctpProtocol);
253     }
254     de_pop_sequence(service, attribute);
255 
256     // 0x0005 "Public Browse Group"
257     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_BROWSE_GROUP_LIST); // public browse group
258     attribute = de_push_sequence(service);
259     {
260         de_add_number(attribute,  DE_UUID, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_PUBLIC_BROWSE_ROOT);
261     }
262     de_pop_sequence(service, attribute);
263 
264     // 0x0009 "Bluetooth Profile Descriptor List"
265     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_BLUETOOTH_PROFILE_DESCRIPTOR_LIST);
266     attribute = de_push_sequence(service);
267     {
268         uint8_t *avrcProfile = de_push_sequence(attribute);
269         {
270             de_add_number(avrcProfile,  DE_UUID, DE_SIZE_16, BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL);
271             de_add_number(avrcProfile,  DE_UINT, DE_SIZE_16, 0x0106);
272         }
273         de_pop_sequence(attribute, avrcProfile);
274     }
275     de_pop_sequence(service, attribute);
276 
277     // 0x000d "Additional Bluetooth Profile Descriptor List"
278     if (browsing){
279         de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_ADDITIONAL_PROTOCOL_DESCRIPTOR_LISTS);
280         attribute = de_push_sequence(service);
281         {
282             uint8_t * des = de_push_sequence(attribute);
283             {
284                 uint8_t* browsing_l2cpProtocol = de_push_sequence(des);
285                 {
286                     de_add_number(browsing_l2cpProtocol,  DE_UUID, DE_SIZE_16, BLUETOOTH_PROTOCOL_L2CAP);
287                     de_add_number(browsing_l2cpProtocol,  DE_UINT, DE_SIZE_16, BLUETOOTH_PSM_AVCTP_BROWSING);
288                 }
289                 de_pop_sequence(des, browsing_l2cpProtocol);
290 
291                 uint8_t* browsing_avctpProtocol = de_push_sequence(des);
292                 {
293                     de_add_number(browsing_avctpProtocol,  DE_UUID, DE_SIZE_16, BLUETOOTH_PROTOCOL_AVCTP);  // browsing_avctpProtocol_service
294                     de_add_number(browsing_avctpProtocol,  DE_UINT, DE_SIZE_16, 0x0104);                   // version
295                 }
296                 de_pop_sequence(des, browsing_avctpProtocol);
297             }
298             de_pop_sequence(attribute, des);
299         }
300         de_pop_sequence(service, attribute);
301     }
302 
303 
304     // 0x0100 "Service Name"
305     de_add_number(service,  DE_UINT, DE_SIZE_16, 0x0100);
306     if (service_name){
307         de_add_data(service,  DE_STRING, strlen(service_name), (uint8_t *) service_name);
308     } else {
309         if (controller){
310             de_add_data(service,  DE_STRING, strlen(default_avrcp_controller_service_name), (uint8_t *) default_avrcp_controller_service_name);
311         } else {
312             de_add_data(service,  DE_STRING, strlen(default_avrcp_target_service_name), (uint8_t *) default_avrcp_target_service_name);
313         }
314     }
315 
316     // 0x0100 "Provider Name"
317     de_add_number(service,  DE_UINT, DE_SIZE_16, 0x0102);
318     if (service_provider_name){
319         de_add_data(service,  DE_STRING, strlen(service_provider_name), (uint8_t *) service_provider_name);
320     } else {
321         if (controller){
322             de_add_data(service,  DE_STRING, strlen(default_avrcp_controller_service_provider_name), (uint8_t *) default_avrcp_controller_service_provider_name);
323         } else {
324             de_add_data(service,  DE_STRING, strlen(default_avrcp_target_service_provider_name), (uint8_t *) default_avrcp_target_service_provider_name);
325         }
326     }
327 
328     // 0x0311 "Supported Features"
329     de_add_number(service, DE_UINT, DE_SIZE_16, 0x0311);
330     de_add_number(service, DE_UINT, DE_SIZE_16, supported_features);
331 }
332 
333 avrcp_connection_t * avrcp_get_connection_for_bd_addr_for_role(avrcp_role_t role, bd_addr_t addr){
334     btstack_linked_list_iterator_t it;
335     btstack_linked_list_iterator_init(&it, (btstack_linked_list_t *) &connections);
336     while (btstack_linked_list_iterator_has_next(&it)){
337         avrcp_connection_t * connection = (avrcp_connection_t *)btstack_linked_list_iterator_next(&it);
338         if (connection->role != role) continue;
339         if (memcmp(addr, connection->remote_addr, 6) != 0) continue;
340         return connection;
341     }
342     return NULL;
343 }
344 
345 avrcp_connection_t * avrcp_get_connection_for_l2cap_signaling_cid_for_role(avrcp_role_t role, uint16_t l2cap_cid){
346     btstack_linked_list_iterator_t it;
347     btstack_linked_list_iterator_init(&it, (btstack_linked_list_t *) &connections);
348     while (btstack_linked_list_iterator_has_next(&it)){
349         avrcp_connection_t * connection = (avrcp_connection_t *)btstack_linked_list_iterator_next(&it);
350         if (connection->role != role) continue;
351         if (connection->l2cap_signaling_cid != l2cap_cid) continue;
352         return connection;
353     }
354     return NULL;
355 }
356 
357 avrcp_connection_t * avrcp_get_connection_for_avrcp_cid_for_role(avrcp_role_t role, uint16_t avrcp_cid){
358     btstack_linked_list_iterator_t it;
359     btstack_linked_list_iterator_init(&it, (btstack_linked_list_t *) &connections);
360     while (btstack_linked_list_iterator_has_next(&it)){
361         avrcp_connection_t * connection = (avrcp_connection_t *)btstack_linked_list_iterator_next(&it);
362         if (connection->role != role) continue;
363         if (connection->avrcp_cid != avrcp_cid) continue;
364         return connection;
365     }
366     return NULL;
367 }
368 
369 avrcp_connection_t * avrcp_get_connection_for_browsing_cid_for_role(avrcp_role_t role, uint16_t browsing_cid){
370     btstack_linked_list_iterator_t it;
371     btstack_linked_list_iterator_init(&it, (btstack_linked_list_t *) &connections);
372     while (btstack_linked_list_iterator_has_next(&it)){
373         avrcp_connection_t * connection = (avrcp_connection_t *)btstack_linked_list_iterator_next(&it);
374         if (connection->role != role) continue;
375         if (connection->avrcp_browsing_cid != browsing_cid) continue;
376         return connection;
377     }
378     return NULL;
379 }
380 
381 avrcp_connection_t * avrcp_get_connection_for_browsing_l2cap_cid_for_role(avrcp_role_t role, uint16_t browsing_l2cap_cid){
382     btstack_linked_list_iterator_t it;
383     btstack_linked_list_iterator_init(&it, (btstack_linked_list_t *) &connections);
384     while (btstack_linked_list_iterator_has_next(&it)){
385         avrcp_connection_t * connection = (avrcp_connection_t *)btstack_linked_list_iterator_next(&it);
386         if (connection->role != role) continue;
387         if (connection->browsing_connection &&  (connection->browsing_connection->l2cap_browsing_cid != browsing_l2cap_cid)) continue;
388         return connection;
389     }
390     return NULL;
391 }
392 
393 avrcp_browsing_connection_t * avrcp_get_browsing_connection_for_l2cap_cid_for_role(avrcp_role_t role, uint16_t l2cap_cid){
394     btstack_linked_list_iterator_t it;
395     btstack_linked_list_iterator_init(&it, (btstack_linked_list_t *) &connections);
396     while (btstack_linked_list_iterator_has_next(&it)){
397         avrcp_connection_t * connection = (avrcp_connection_t *)btstack_linked_list_iterator_next(&it);
398         if (connection->role != role) continue;
399         if (connection->browsing_connection && (connection->browsing_connection->l2cap_browsing_cid != l2cap_cid)) continue;
400         return connection->browsing_connection;
401     }
402     return NULL;
403 }
404 
405 void avrcp_request_can_send_now(avrcp_connection_t * connection, uint16_t l2cap_cid){
406     connection->wait_to_send = true;
407     l2cap_request_can_send_now_event(l2cap_cid);
408 }
409 
410 uint16_t avrcp_get_next_cid(avrcp_role_t role){
411     do {
412         if (avrcp_cid_counter == 0xffff) {
413             avrcp_cid_counter = 1;
414         } else {
415             avrcp_cid_counter++;
416         }
417     } while (avrcp_get_connection_for_avrcp_cid_for_role(role, avrcp_cid_counter) !=  NULL) ;
418     return avrcp_cid_counter;
419 }
420 
421 static avrcp_connection_t * avrcp_create_connection(avrcp_role_t role, bd_addr_t remote_addr){
422     avrcp_connection_t * connection = btstack_memory_avrcp_connection_get();
423     if (!connection){
424         log_error("Not enough memory to create connection for role %d", role);
425         return NULL;
426     }
427 
428     connection->state = AVCTP_CONNECTION_IDLE;
429     connection->role = role;
430 
431     connection->transaction_id = 0xFF;
432     connection->transaction_id_counter = 0;
433 
434     connection->max_num_fragments = 0xFF;
435 
436     // setup default unit / subunit info
437     connection->company_id = 0xffffff;
438     connection->unit_type = AVRCP_SUBUNIT_TYPE_PANEL;
439     connection->subunit_info_data_size = sizeof(avrcp_default_subunit_info);
440     connection->subunit_info_data = avrcp_default_subunit_info;
441 
442     log_info("avrcp_create_connection, role %d", role);
443     (void)memcpy(connection->remote_addr, remote_addr, 6);
444     btstack_linked_list_add(&connections, (btstack_linked_item_t *) connection);
445     return connection;
446 }
447 
448 static void avrcp_finalize_connection(avrcp_connection_t * connection){
449     btstack_run_loop_remove_timer(&connection->retry_timer);
450     btstack_linked_list_remove(&connections, (btstack_linked_item_t*) connection);
451     btstack_memory_avrcp_connection_free(connection);
452 }
453 
454 static void avrcp_emit_connection_established(uint16_t avrcp_cid, bd_addr_t addr, hci_con_handle_t con_handle, uint8_t status){
455     btstack_assert(avrcp_callback != NULL);
456 
457     uint8_t event[14];
458     int pos = 0;
459     event[pos++] = HCI_EVENT_AVRCP_META;
460     event[pos++] = sizeof(event) - 2;
461     event[pos++] = AVRCP_SUBEVENT_CONNECTION_ESTABLISHED;
462     event[pos++] = status;
463     little_endian_store_16(event, pos, avrcp_cid);
464     pos += 2;
465     reverse_bd_addr(addr,&event[pos]);
466     pos += 6;
467     little_endian_store_16(event, pos, con_handle);
468     pos += 2;
469     (*avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
470 }
471 
472 static void avrcp_emit_connection_closed(uint16_t avrcp_cid){
473     btstack_assert(avrcp_callback != NULL);
474 
475     uint8_t event[5];
476     int pos = 0;
477     event[pos++] = HCI_EVENT_AVRCP_META;
478     event[pos++] = sizeof(event) - 2;
479     event[pos++] = AVRCP_SUBEVENT_CONNECTION_RELEASED;
480     little_endian_store_16(event, pos, avrcp_cid);
481     pos += 2;
482     (*avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
483 }
484 
485 uint16_t avrcp_sdp_query_browsing_l2cap_psm(void){
486     return sdp_query_context.browsing_l2cap_psm;
487 }
488 
489 void avrcp_handle_sdp_client_query_attribute_value(uint8_t *packet){
490     des_iterator_t des_list_it;
491     des_iterator_t prot_it;
492 
493     // Handle new SDP record
494     if (sdp_event_query_attribute_byte_get_record_id(packet) != sdp_query_context.record_id) {
495         sdp_query_context.record_id = sdp_event_query_attribute_byte_get_record_id(packet);
496         sdp_query_context.parse_sdp_record = 0;
497         // log_info("SDP Record: Nr: %d", record_id);
498     }
499 
500     if (sdp_event_query_attribute_byte_get_attribute_length(packet) <= attribute_value_buffer_size) {
501         attribute_value[sdp_event_query_attribute_byte_get_data_offset(packet)] = sdp_event_query_attribute_byte_get_data(packet);
502 
503         if ((uint16_t)(sdp_event_query_attribute_byte_get_data_offset(packet)+1) == sdp_event_query_attribute_byte_get_attribute_length(packet)) {
504             switch(sdp_event_query_attribute_byte_get_attribute_id(packet)) {
505                 case BLUETOOTH_ATTRIBUTE_SERVICE_CLASS_ID_LIST:
506                     if (de_get_element_type(attribute_value) != DE_DES) break;
507                     for (des_iterator_init(&des_list_it, attribute_value); des_iterator_has_more(&des_list_it); des_iterator_next(&des_list_it)) {
508                         uint8_t * element = des_iterator_get_element(&des_list_it);
509                         if (de_get_element_type(element) != DE_UUID) continue;
510                         uint32_t uuid = de_get_uuid32(element);
511                         switch (uuid){
512                             case BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL_TARGET:
513                             case BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL:
514                             case BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL_CONTROLLER:
515                                 sdp_query_context.parse_sdp_record = 1;
516                                 break;
517                             default:
518                                 break;
519                         }
520                     }
521                     break;
522 
523                 case BLUETOOTH_ATTRIBUTE_PROTOCOL_DESCRIPTOR_LIST: {
524                     if (!sdp_query_context.parse_sdp_record) break;
525                     // log_info("SDP Attribute: 0x%04x", sdp_event_query_attribute_byte_get_attribute_id(packet));
526                     for (des_iterator_init(&des_list_it, attribute_value); des_iterator_has_more(&des_list_it); des_iterator_next(&des_list_it)) {
527                         uint8_t       *des_element;
528                         uint8_t       *element;
529                         uint32_t       uuid;
530 
531                         if (des_iterator_get_type(&des_list_it) != DE_DES) continue;
532 
533                         des_element = des_iterator_get_element(&des_list_it);
534                         des_iterator_init(&prot_it, des_element);
535                         element = des_iterator_get_element(&prot_it);
536 
537                         if (de_get_element_type(element) != DE_UUID) continue;
538 
539                         uuid = de_get_uuid32(element);
540                         des_iterator_next(&prot_it);
541                         switch (uuid){
542                             case BLUETOOTH_PROTOCOL_L2CAP:
543                                 if (!des_iterator_has_more(&prot_it)) continue;
544                                 de_element_get_uint16(des_iterator_get_element(&prot_it), &sdp_query_context.avrcp_l2cap_psm);
545                                 break;
546                             case BLUETOOTH_PROTOCOL_AVCTP:
547                                 if (!des_iterator_has_more(&prot_it)) continue;
548                                 de_element_get_uint16(des_iterator_get_element(&prot_it), &sdp_query_context.avrcp_version);
549                                 break;
550                             default:
551                                 break;
552                         }
553                     }
554                 }
555                     break;
556                 case BLUETOOTH_ATTRIBUTE_ADDITIONAL_PROTOCOL_DESCRIPTOR_LISTS: {
557                     // log_info("SDP Attribute: 0x%04x", sdp_event_query_attribute_byte_get_attribute_id(packet));
558                     if (!sdp_query_context.parse_sdp_record) break;
559                     if (de_get_element_type(attribute_value) != DE_DES) break;
560 
561                     des_iterator_t des_list_0_it;
562                     uint8_t       *element_0;
563 
564                     des_iterator_init(&des_list_0_it, attribute_value);
565                     element_0 = des_iterator_get_element(&des_list_0_it);
566 
567                     for (des_iterator_init(&des_list_it, element_0); des_iterator_has_more(&des_list_it); des_iterator_next(&des_list_it)) {
568                         uint8_t       *des_element;
569                         uint8_t       *element;
570                         uint32_t       uuid;
571 
572                         if (des_iterator_get_type(&des_list_it) != DE_DES) continue;
573 
574                         des_element = des_iterator_get_element(&des_list_it);
575                         des_iterator_init(&prot_it, des_element);
576                         element = des_iterator_get_element(&prot_it);
577 
578                         if (de_get_element_type(element) != DE_UUID) continue;
579 
580                         uuid = de_get_uuid32(element);
581                         des_iterator_next(&prot_it);
582                         switch (uuid){
583                             case BLUETOOTH_PROTOCOL_L2CAP:
584                                 if (!des_iterator_has_more(&prot_it)) continue;
585                                 de_element_get_uint16(des_iterator_get_element(&prot_it), &sdp_query_context.browsing_l2cap_psm);
586                                 break;
587                             case BLUETOOTH_PROTOCOL_AVCTP:
588                                 if (!des_iterator_has_more(&prot_it)) continue;
589                                 de_element_get_uint16(des_iterator_get_element(&prot_it), &sdp_query_context.browsing_version);
590                                 break;
591                             default:
592                                 break;
593                         }
594                     }
595                 }
596                     break;
597                 default:
598                     break;
599             }
600         }
601     } else {
602         log_error("SDP attribute value buffer size exceeded: available %d, required %d", attribute_value_buffer_size, sdp_event_query_attribute_byte_get_attribute_length(packet));
603     }
604 }
605 
606 static void avrcp_handle_sdp_query_failed(avrcp_connection_t * connection, uint8_t status){
607     if (connection == NULL) return;
608     log_info("AVRCP: SDP query failed with status 0x%02x.", status);
609     avrcp_emit_connection_established(connection->avrcp_cid, connection->remote_addr, connection->con_handle, status);
610     avrcp_finalize_connection(connection);
611 }
612 
613 static void avrcp_handle_sdp_query_succeeded(avrcp_connection_t * connection){
614     if (connection == NULL) return;
615     connection->state = AVCTP_CONNECTION_W4_L2CAP_CONNECTED;
616     connection->avrcp_l2cap_psm = sdp_query_context.avrcp_l2cap_psm;
617     connection->browsing_version = sdp_query_context.browsing_version;
618     connection->browsing_l2cap_psm = sdp_query_context.browsing_l2cap_psm;
619 }
620 
621 static void avrcp_handle_sdp_client_query_result(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
622     UNUSED(packet_type);
623     UNUSED(channel);
624     UNUSED(size);
625 
626     bool state_ok = true;
627     avrcp_connection_t * avrcp_target_connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, sdp_query_context.avrcp_cid);
628     if (!avrcp_target_connection || avrcp_target_connection->state != AVCTP_CONNECTION_W4_SDP_QUERY_COMPLETE) {
629         state_ok = false;
630     }
631     avrcp_connection_t * avrcp_controller_connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, sdp_query_context.avrcp_cid);
632     if (!avrcp_controller_connection || avrcp_controller_connection->state != AVCTP_CONNECTION_W4_SDP_QUERY_COMPLETE) {
633         state_ok = false;
634     }
635     if (!state_ok){
636         // something wrong, nevertheless, start next sdp query if this one is complete
637         if (hci_event_packet_get_type(packet) == SDP_EVENT_QUERY_COMPLETE){
638             (void) sdp_client_register_query_callback(&avrcp_handle_sdp_client_query_request);
639         }
640         return;
641     }
642 
643     uint8_t status;
644 
645     switch (hci_event_packet_get_type(packet)){
646         case SDP_EVENT_QUERY_ATTRIBUTE_VALUE:
647             avrcp_handle_sdp_client_query_attribute_value(packet);
648             return;
649 
650         case SDP_EVENT_QUERY_COMPLETE:
651             status = sdp_event_query_complete_get_status(packet);
652 
653             if (status != ERROR_CODE_SUCCESS){
654                 avrcp_handle_sdp_query_failed(avrcp_controller_connection, status);
655                 avrcp_handle_sdp_query_failed(avrcp_target_connection, status);
656                 break;
657             }
658 
659             if (!sdp_query_context.avrcp_l2cap_psm){
660                 avrcp_handle_sdp_query_failed(avrcp_controller_connection, SDP_SERVICE_NOT_FOUND);
661                 avrcp_handle_sdp_query_failed(avrcp_target_connection, SDP_SERVICE_NOT_FOUND);
662                 break;
663             }
664 
665             avrcp_handle_sdp_query_succeeded(avrcp_controller_connection);
666             avrcp_handle_sdp_query_succeeded(avrcp_target_connection);
667 
668             l2cap_create_channel(&avrcp_packet_handler, avrcp_target_connection->remote_addr, sdp_query_context.avrcp_l2cap_psm, l2cap_max_mtu(), NULL);
669             break;
670 
671         default:
672             return;
673     }
674 
675     // register the SDP Query request to check if there is another connection waiting for the query
676     // ignore ERROR_CODE_COMMAND_DISALLOWED because in that case, we already have requested an SDP callback
677     (void) sdp_client_register_query_callback(&avrcp_handle_sdp_client_query_request);
678 }
679 
680 
681 static avrcp_connection_t * avrcp_handle_incoming_connection_for_role(avrcp_role_t role, avrcp_connection_t * connection, bd_addr_t event_addr, hci_con_handle_t con_handle, uint16_t local_cid, uint16_t avrcp_cid){
682     if (connection == NULL){
683         connection = avrcp_create_connection(role, event_addr);
684     }
685     if (connection) {
686         connection->state = AVCTP_CONNECTION_W4_L2CAP_CONNECTED;
687         connection->l2cap_signaling_cid = local_cid;
688         connection->avrcp_cid = avrcp_cid;
689         connection->con_handle = con_handle;
690         btstack_run_loop_remove_timer(&connection->retry_timer);
691     }
692     return connection;
693 }
694 
695 static void avrcp_handle_open_connection(avrcp_connection_t * connection, hci_con_handle_t con_handle, uint16_t local_cid, uint16_t l2cap_mtu){
696     connection->l2cap_signaling_cid = local_cid;
697     connection->l2cap_mtu = l2cap_mtu;
698     connection->con_handle = con_handle;
699     connection->incoming_declined = false;
700     connection->song_length_ms = 0xFFFFFFFF;
701     connection->song_position_ms = 0xFFFFFFFF;
702     connection->playback_status = AVRCP_PLAYBACK_STATUS_ERROR;
703     connection->state = AVCTP_CONNECTION_OPENED;
704 
705     log_info("L2CAP_EVENT_CHANNEL_OPENED avrcp_cid 0x%02x, l2cap_signaling_cid 0x%02x, role %d, state %d", connection->avrcp_cid, connection->l2cap_signaling_cid, connection->role, connection->state);
706 }
707 
708 static void avrcp_retry_timer_timeout_handler(btstack_timer_source_t * timer){
709     uint16_t avrcp_cid = (uint16_t)(uintptr_t) btstack_run_loop_get_timer_context(timer);
710     avrcp_connection_t * connection_controller = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
711     if (connection_controller == NULL) return;
712     avrcp_connection_t * connection_target = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
713     if (connection_target == NULL) return;
714 
715     if (connection_controller->state == AVCTP_CONNECTION_W2_L2CAP_RETRY){
716         connection_controller->state = AVCTP_CONNECTION_W4_L2CAP_CONNECTED;
717         connection_target->state = AVCTP_CONNECTION_W4_L2CAP_CONNECTED;
718         l2cap_create_channel(&avrcp_packet_handler, connection_controller->remote_addr, connection_controller->avrcp_l2cap_psm, l2cap_max_mtu(), NULL);
719     }
720 }
721 
722 static void avrcp_retry_timer_start(avrcp_connection_t * connection){
723     btstack_run_loop_set_timer_handler(&connection->retry_timer, avrcp_retry_timer_timeout_handler);
724     btstack_run_loop_set_timer_context(&connection->retry_timer, (void *)(uintptr_t)connection->avrcp_cid);
725 
726     // add some jitter/randomness to reconnect delay
727     uint32_t timeout = 100 + (btstack_run_loop_get_time_ms() & 0x7F);
728     btstack_run_loop_set_timer(&connection->retry_timer, timeout);
729 
730     btstack_run_loop_add_timer(&connection->retry_timer);
731 }
732 
733 static avrcp_frame_type_t avrcp_get_frame_type(uint8_t header){
734     return (avrcp_frame_type_t)((header & 0x02) >> 1);
735 }
736 
737 static void avrcp_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
738     UNUSED(channel);
739     UNUSED(size);
740     bd_addr_t event_addr;
741     uint16_t local_cid;
742     uint16_t l2cap_mtu;
743     uint8_t  status;
744     bool decline_connection;
745     bool outoing_active;
746     hci_con_handle_t con_handle;
747 
748     avrcp_connection_t * connection_controller;
749     avrcp_connection_t * connection_target;
750     bool can_send;
751 
752     switch (packet_type) {
753         case HCI_EVENT_PACKET:
754             switch (hci_event_packet_get_type(packet)) {
755 
756                 case L2CAP_EVENT_INCOMING_CONNECTION:
757                     btstack_assert(avrcp_controller_packet_handler != NULL);
758                     btstack_assert(avrcp_target_packet_handler != NULL);
759 
760                     l2cap_event_incoming_connection_get_address(packet, event_addr);
761                     local_cid = l2cap_event_incoming_connection_get_local_cid(packet);
762                     con_handle = l2cap_event_incoming_connection_get_handle(packet);
763 
764                     outoing_active = false;
765                     connection_target = avrcp_get_connection_for_bd_addr_for_role(AVRCP_TARGET, event_addr);
766                     if (connection_target != NULL){
767                         if (connection_target->state == AVCTP_CONNECTION_W4_L2CAP_CONNECTED){
768                             outoing_active = true;
769                             connection_target->incoming_declined = true;
770                         }
771                     }
772 
773                     connection_controller = avrcp_get_connection_for_bd_addr_for_role(AVRCP_CONTROLLER, event_addr);
774                     if (connection_controller != NULL){
775                         if (connection_controller->state == AVCTP_CONNECTION_W4_L2CAP_CONNECTED) {
776                             outoing_active = true;
777                             connection_controller->incoming_declined = true;
778                         }
779                     }
780 
781                     decline_connection = outoing_active;
782                     if (decline_connection == false){
783                         uint16_t avrcp_cid;
784                         if ((connection_controller == NULL) || (connection_target == NULL)){
785                             avrcp_cid = avrcp_get_next_cid(AVRCP_CONTROLLER);
786                         } else {
787                             avrcp_cid = connection_controller->avrcp_cid;
788                         }
789                         // create two connection objects (both)
790                         connection_target     = avrcp_handle_incoming_connection_for_role(AVRCP_TARGET, connection_target, event_addr, con_handle, local_cid, avrcp_cid);
791                         connection_controller = avrcp_handle_incoming_connection_for_role(AVRCP_CONTROLLER, connection_controller, event_addr, con_handle, local_cid, avrcp_cid);
792                         if ((connection_target == NULL) || (connection_controller == NULL)){
793                             decline_connection = true;
794                             if (connection_target) {
795                                 avrcp_finalize_connection(connection_target);
796                             }
797                             if (connection_controller) {
798                                 avrcp_finalize_connection(connection_controller);
799                             }
800                         }
801                     }
802                     if (decline_connection){
803                         l2cap_decline_connection(local_cid);
804                     } else {
805                         log_info("AVRCP: L2CAP_EVENT_INCOMING_CONNECTION local cid 0x%02x, state %d", local_cid, connection_controller->state);
806                         l2cap_accept_connection(local_cid);
807                     }
808                     break;
809 
810                 case L2CAP_EVENT_CHANNEL_OPENED:
811                     l2cap_event_channel_opened_get_address(packet, event_addr);
812                     status = l2cap_event_channel_opened_get_status(packet);
813                     local_cid = l2cap_event_channel_opened_get_local_cid(packet);
814                     l2cap_mtu = l2cap_event_channel_opened_get_remote_mtu(packet);
815                     con_handle = l2cap_event_channel_opened_get_handle(packet);
816 
817                     connection_controller = avrcp_get_connection_for_bd_addr_for_role(AVRCP_CONTROLLER, event_addr);
818                     connection_target = avrcp_get_connection_for_bd_addr_for_role(AVRCP_TARGET, event_addr);
819 
820                     // incoming: structs are already created in L2CAP_EVENT_INCOMING_CONNECTION
821                     // outgoing: structs are cteated in avrcp_connect()
822                     if ((connection_controller == NULL) || (connection_target == NULL)) {
823                         break;
824                     }
825 
826                     switch (status){
827                         case ERROR_CODE_SUCCESS:
828                             avrcp_handle_open_connection(connection_target, con_handle, local_cid, l2cap_mtu);
829                             avrcp_handle_open_connection(connection_controller, con_handle, local_cid, l2cap_mtu);
830                             avrcp_emit_connection_established(connection_controller->avrcp_cid, event_addr, con_handle, status);
831                             return;
832                         case L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_RESOURCES:
833                             if (connection_controller->incoming_declined == true){
834                                 log_info("Incoming connection was declined, and the outgoing failed");
835                                 connection_controller->state = AVCTP_CONNECTION_W2_L2CAP_RETRY;
836                                 connection_controller->incoming_declined = false;
837                                 connection_target->state = AVCTP_CONNECTION_W2_L2CAP_RETRY;
838                                 connection_target->incoming_declined = false;
839                                 avrcp_retry_timer_start(connection_controller);
840                                 return;
841                             }
842                             break;
843                         default:
844                             break;
845                     }
846                     log_info("L2CAP connection to connection %s failed. status code 0x%02x", bd_addr_to_str(event_addr), status);
847                     avrcp_emit_connection_established(connection_controller->avrcp_cid, event_addr, con_handle, status);
848                     avrcp_finalize_connection(connection_controller);
849                     avrcp_finalize_connection(connection_target);
850 
851                     break;
852 
853                 case L2CAP_EVENT_CHANNEL_CLOSED:
854                     local_cid = l2cap_event_channel_closed_get_local_cid(packet);
855 
856                     connection_controller = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_CONTROLLER, local_cid);
857                     connection_target = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_TARGET, local_cid);
858                     if ((connection_controller == NULL) || (connection_target == NULL)) {
859                         break;
860                     }
861                     avrcp_emit_connection_closed(connection_controller->avrcp_cid);
862                     avrcp_finalize_connection(connection_controller);
863                     avrcp_finalize_connection(connection_target);
864                     break;
865 
866                 case L2CAP_EVENT_CAN_SEND_NOW:
867                     local_cid = l2cap_event_can_send_now_get_local_cid(packet);
868                     can_send = true;
869 
870                     connection_target = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_TARGET, local_cid);
871                     if ((connection_target != NULL) && connection_target->wait_to_send){
872                         connection_target->wait_to_send = false;
873                         (*avrcp_target_packet_handler)(HCI_EVENT_PACKET, channel, packet, size);
874                         can_send = false;
875                     }
876 
877                     connection_controller = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_CONTROLLER, local_cid);
878                     if ((connection_controller != NULL) && connection_controller->wait_to_send){
879                         if (can_send){
880                             connection_controller->wait_to_send = false;
881                             (*avrcp_controller_packet_handler)(HCI_EVENT_PACKET, channel, packet, size);
882                         } else {
883                             l2cap_request_can_send_now_event(local_cid);
884                         }
885                     }
886                     break;
887 
888                 default:
889                     break;
890             }
891             break;
892 
893         case L2CAP_DATA_PACKET:
894             switch (avrcp_get_frame_type(packet[0])){
895                 case AVRCP_RESPONSE_FRAME:
896                     (*avrcp_controller_packet_handler)(packet_type, channel, packet, size);
897                     break;
898                 case AVRCP_COMMAND_FRAME:
899                 default:    // make compiler happy
900                     (*avrcp_target_packet_handler)(packet_type, channel, packet, size);
901                     break;
902             }
903             break;
904 
905         default:
906             break;
907     }
908 }
909 
910 uint8_t avrcp_disconnect(uint16_t avrcp_cid){
911     avrcp_connection_t * connection_controller = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
912     if (!connection_controller){
913         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
914     }
915     avrcp_connection_t * connection_target = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
916     if (!connection_target){
917         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
918     }
919     if (connection_controller->browsing_connection){
920         l2cap_disconnect(connection_controller->browsing_connection->l2cap_browsing_cid, 0);
921     }
922     l2cap_disconnect(connection_controller->l2cap_signaling_cid, 0);
923     return ERROR_CODE_SUCCESS;
924 }
925 
926 static void avrcp_handle_start_sdp_client_query(void * context){
927     UNUSED(context);
928 
929     btstack_linked_list_iterator_t it;
930     btstack_linked_list_iterator_init(&it, &connections);
931     while (btstack_linked_list_iterator_has_next(&it)){
932         avrcp_connection_t * connection = (avrcp_connection_t *)btstack_linked_list_iterator_next(&it);
933 
934         if (connection->state != AVCTP_CONNECTION_W2_SEND_SDP_QUERY) continue;
935         connection->state = AVCTP_CONNECTION_W4_SDP_QUERY_COMPLETE;
936 
937         // prevent triggering SDP query twice (for each role once)
938         avrcp_connection_t * connection_with_opposite_role;
939         switch (connection->role){
940             case AVRCP_CONTROLLER:
941                 connection_with_opposite_role = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, connection->avrcp_cid);
942                 break;
943             case AVRCP_TARGET:
944                 connection_with_opposite_role = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, connection->avrcp_cid);
945                 break;
946             default:
947                 btstack_assert(false);
948                 return;
949         }
950         connection_with_opposite_role->state = AVCTP_CONNECTION_W4_SDP_QUERY_COMPLETE;
951 
952         sdp_query_context.avrcp_l2cap_psm = 0;
953         sdp_query_context.avrcp_version  = 0;
954         sdp_query_context.avrcp_cid = connection->avrcp_cid;
955         sdp_client_query_uuid16(&avrcp_handle_sdp_client_query_result, (uint8_t *) connection->remote_addr, BLUETOOTH_PROTOCOL_AVCTP);
956         return;
957     }
958 }
959 
960 uint8_t avrcp_connect(bd_addr_t remote_addr, uint16_t * avrcp_cid){
961     btstack_assert(avrcp_controller_packet_handler != NULL);
962     btstack_assert(avrcp_target_packet_handler != NULL);
963 
964     avrcp_connection_t * connection_controller = avrcp_get_connection_for_bd_addr_for_role(AVRCP_CONTROLLER, remote_addr);
965     if (connection_controller){
966         return ERROR_CODE_COMMAND_DISALLOWED;
967     }
968     avrcp_connection_t * connection_target = avrcp_get_connection_for_bd_addr_for_role(AVRCP_TARGET, remote_addr);
969     if (connection_target){
970         return ERROR_CODE_COMMAND_DISALLOWED;
971     }
972 
973     uint16_t cid = avrcp_get_next_cid(AVRCP_CONTROLLER);
974 
975     connection_controller = avrcp_create_connection(AVRCP_CONTROLLER, remote_addr);
976     if (!connection_controller) return BTSTACK_MEMORY_ALLOC_FAILED;
977 
978     connection_target = avrcp_create_connection(AVRCP_TARGET, remote_addr);
979     if (!connection_target){
980         avrcp_finalize_connection(connection_controller);
981         return BTSTACK_MEMORY_ALLOC_FAILED;
982     }
983 
984     if (avrcp_cid != NULL){
985         *avrcp_cid = cid;
986     }
987 
988     connection_controller->state = AVCTP_CONNECTION_W2_SEND_SDP_QUERY;
989     connection_controller->avrcp_cid = cid;
990 
991     connection_target->state     = AVCTP_CONNECTION_W2_SEND_SDP_QUERY;
992     connection_target->avrcp_cid = cid;
993 
994     avrcp_handle_sdp_client_query_request.callback = &avrcp_handle_start_sdp_client_query;
995     // ignore ERROR_CODE_COMMAND_DISALLOWED because in that case, we already have requested an SDP callback
996     (void) sdp_client_register_query_callback(&avrcp_handle_sdp_client_query_request);
997     return ERROR_CODE_SUCCESS;
998 }
999 
1000 void avrcp_init(void){
1001     connections = NULL;
1002     if (l2cap_service_registered) return;
1003 
1004     int status = l2cap_register_service(&avrcp_packet_handler, BLUETOOTH_PSM_AVCTP, 0xffff, gap_get_security_level());
1005     if (status != ERROR_CODE_SUCCESS) return;
1006     l2cap_service_registered = true;
1007 }
1008 
1009 void avrcp_deinit(void){
1010     avrcp_cid_counter = 0;
1011     l2cap_service_registered = false;
1012 
1013     (void) memset(&sdp_query_context, 0, sizeof(avrcp_sdp_query_context_t));
1014     (void) memset(attribute_value,0, sizeof(attribute_value));
1015 
1016     avrcp_callback = NULL;
1017     connections = NULL;
1018     avrcp_controller_packet_handler = NULL;
1019     avrcp_target_packet_handler = NULL;
1020 }
1021 
1022 void avrcp_register_controller_packet_handler(btstack_packet_handler_t callback){
1023     avrcp_controller_packet_handler = callback;
1024 }
1025 
1026 void avrcp_register_target_packet_handler(btstack_packet_handler_t callback){
1027     avrcp_target_packet_handler = callback;
1028 }
1029 
1030 void avrcp_register_packet_handler(btstack_packet_handler_t callback){
1031     btstack_assert(callback != NULL);
1032     avrcp_callback = callback;
1033 }
1034 
1035 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
1036 #define FUZZ_CID 0x44
1037 #define FUZZ_CON_HANDLE 0x0001
1038 static bd_addr_t remote_addr = { 0x33, 0x33, 0x33, 0x33, 0x33, 0x33 };
1039 void avrcp_init_fuzz(void){
1040     // setup avrcp connections for cid
1041     avrcp_connection_t * connection_controller = avrcp_create_connection(AVRCP_CONTROLLER, remote_addr);
1042     avrcp_connection_t * connection_target     = avrcp_create_connection(AVRCP_TARGET, remote_addr);
1043     avrcp_handle_open_connection(connection_controller, FUZZ_CON_HANDLE, FUZZ_CID, 999);
1044     avrcp_handle_open_connection(connection_target, FUZZ_CON_HANDLE, FUZZ_CID, 999);
1045 }
1046 void avrcp_packet_handler_fuzz(uint8_t *packet, uint16_t size){
1047     avrcp_packet_handler(L2CAP_DATA_PACKET, FUZZ_CID, packet, size);
1048 }
1049 #endif