xref: /btstack/src/classic/avrcp_controller.c (revision 08a78038ba366a6a2a2df8fea05d5123880fdff2)
1 /*
2  * Copyright (C) 2016 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
24  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "avrcp_controller.c"
39 
40 #include <stdint.h>
41 #include <string.h>
42 #include <inttypes.h>
43 
44 #include "classic/avrcp.h"
45 #include "classic/avrcp_controller.h"
46 
47 #include "bluetooth_sdp.h"
48 #include "btstack_debug.h"
49 #include "btstack_event.h"
50 #include "btstack_util.h"
51 #include "l2cap.h"
52 
53 // made public in avrcp_controller.h
54 avrcp_context_t avrcp_controller_context;
55 
56 static uint8_t avrcp_controller_calc_next_transaction_label(uint8_t current_transaction_label){
57     current_transaction_label++;
58     if (current_transaction_label == 16){
59         current_transaction_label = 1;
60     }
61     return current_transaction_label;
62 }
63 
64 static uint8_t avrcp_controller_get_next_transaction_label(avrcp_connection_t * connection){
65     connection->transaction_id_counter = avrcp_controller_calc_next_transaction_label(connection->transaction_id_counter);
66     return connection->transaction_id_counter;
67 }
68 
69 static bool avrcp_controller_is_transaction_id_valid(avrcp_connection_t * connection, uint8_t transaction_id){
70     uint8_t delta = ((int8_t) transaction_id - connection->controller_last_confirmed_transaction_id) & 0x0f;
71     return delta < 15;
72 }
73 
74 static void avrcp_controller_custom_command_data_init(avrcp_connection_t * connection,
75                                                       avrcp_command_opcode_t opcode, avrcp_command_type_t command_type,
76                                                       avrcp_subunit_type_t subunit_type, avrcp_subunit_id_t subunit_id,
77                                                       avrcp_pdu_id_t pdu_id, uint32_t company_id){
78 
79     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
80     connection->command_opcode = opcode;
81     connection->command_type = command_type;
82     connection->subunit_type = subunit_type;
83     connection->subunit_id = subunit_id;
84     connection->company_id = company_id;
85     connection->pdu_id = pdu_id;
86     connection->data = NULL;
87     connection->data_offset = 0;
88     connection->data_len = 0;
89 }
90 
91 static void avrcp_controller_vendor_dependent_command_data_init(avrcp_connection_t * connection, avrcp_command_type_t command_type, avrcp_pdu_id_t pdu_id, bool get_next_transaction_label){
92     if (get_next_transaction_label){
93         connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
94     }
95     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
96     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
97     connection->subunit_id = AVRCP_SUBUNIT_ID;
98     connection->company_id = BT_SIG_COMPANY_ID;
99 
100     connection->command_type = command_type;
101     connection->pdu_id = pdu_id;
102     connection->data = connection->message_body;
103     connection->data_offset = 0;
104     connection->data_len = 0;
105 }
106 
107 static void avrcp_controller_pass_through_command_data_init(avrcp_connection_t * connection, avrcp_operation_id_t opid){
108     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
109     connection->command_opcode =  AVRCP_CMD_OPCODE_PASS_THROUGH;
110     connection->command_type = AVRCP_CTYPE_CONTROL;
111     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
112     connection->subunit_id =   AVRCP_SUBUNIT_ID;
113 
114     connection->company_id = 0;
115     connection->pdu_id = AVRCP_PDU_ID_UNDEFINED;
116     connection->operation_id = opid;
117 
118     connection->data = connection->message_body;
119     connection->data_offset = 0;
120     connection->data_len = 0;
121 }
122 
123 static int avrcp_controller_supports_browsing(uint16_t controller_supported_features){
124     return controller_supported_features & AVRCP_FEATURE_MASK_BROWSING;
125 }
126 
127 static void avrcp_controller_prepare_custom_command_response(avrcp_connection_t * connection, uint16_t response_len, uint8_t * in_place_buffer){
128     uint8_t pos = 0;
129     in_place_buffer[pos++] = HCI_EVENT_AVRCP_META;
130     // skip len
131     pos++;
132     in_place_buffer[pos++] = AVRCP_SUBEVENT_CUSTOM_COMMAND_RESPONSE;
133     little_endian_store_16(in_place_buffer, pos, connection->avrcp_cid);
134     pos += 2;
135     in_place_buffer[pos++] = (uint8_t)connection->command_type;
136     in_place_buffer[pos++] = (uint8_t)connection->pdu_id;
137     little_endian_store_16(in_place_buffer, pos, response_len);
138     pos += 2;
139     in_place_buffer[1] = pos + response_len - 2;
140 }
141 
142 static void avrcp_controller_emit_notification_complete(avrcp_connection_t * connection, uint8_t status, uint8_t event_id, bool enabled){
143     uint8_t event[8];
144     uint8_t pos = 0;
145     event[pos++] = HCI_EVENT_AVRCP_META;
146     event[pos++] = sizeof(event) - 2;
147     event[pos++] = AVRCP_SUBEVENT_NOTIFICATION_STATE;
148     little_endian_store_16(event, pos, connection->avrcp_cid);
149     pos += 2;
150     event[pos++] = status;
151     event[pos++] = enabled ? 1 : 0;
152     event[pos++] = event_id;
153     UNUSED(pos);
154     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
155 }
156 
157 static void avrcp_controller_emit_supported_events(avrcp_connection_t * connection){
158     uint8_t ctype = (uint8_t) AVRCP_CTYPE_RESPONSE_CHANGED_STABLE;
159     uint8_t event_id;
160 
161     for (event_id = (uint8_t) AVRCP_NOTIFICATION_EVENT_FIRST_INDEX; event_id < (uint8_t) AVRCP_NOTIFICATION_EVENT_LAST_INDEX; event_id++){
162         if ((connection->notifications_supported_by_target & (1 << event_id)) == 0){
163             continue;
164         }
165         uint8_t event[8];
166         uint8_t pos = 0;
167         event[pos++] = HCI_EVENT_AVRCP_META;
168         event[pos++] = sizeof(event) - 2;
169         event[pos++] = AVRCP_SUBEVENT_GET_CAPABILITY_EVENT_ID;
170         little_endian_store_16(event, pos, connection->avrcp_cid);
171         pos += 2;
172         event[pos++] = ctype;
173         event[pos++] = 0;
174         event[pos++] = event_id;
175         UNUSED(pos);
176         (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
177     }
178 
179     uint8_t event[7];
180     uint8_t pos = 0;
181     event[pos++] = HCI_EVENT_AVRCP_META;
182     event[pos++] = sizeof(event) - 2;
183     event[pos++] = AVRCP_SUBEVENT_GET_CAPABILITY_EVENT_ID_DONE;
184     little_endian_store_16(event, pos, connection->avrcp_cid);
185     pos += 2;
186     event[pos++] = ctype;
187     event[pos++] = 0;
188     UNUSED(pos);
189     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
190 }
191 
192 static void avrcp_controller_emit_notification_for_event_id(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id,
193                                                             avrcp_command_type_t ctype, const uint8_t *payload,
194                                                             uint16_t size) {
195     switch (event_id){
196         case AVRCP_NOTIFICATION_EVENT_PLAYBACK_POS_CHANGED:{
197             if (size < 4) break;
198             uint32_t song_position = big_endian_read_32(payload, 0);
199             uint16_t offset = 0;
200             uint8_t event[10];
201             event[offset++] = HCI_EVENT_AVRCP_META;
202             event[offset++] = sizeof(event) - 2;
203             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_PLAYBACK_POS_CHANGED;
204             little_endian_store_16(event, offset, avrcp_cid);
205             offset += 2;
206             event[offset++] = ctype;
207             little_endian_store_32(event, offset, song_position);
208             offset += 4;
209             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
210             break;
211         }
212         case AVRCP_NOTIFICATION_EVENT_PLAYBACK_STATUS_CHANGED:{
213             if (size < 1) break;
214             uint16_t offset = 0;
215             uint8_t event[7];
216             event[offset++] = HCI_EVENT_AVRCP_META;
217             event[offset++] = sizeof(event) - 2;
218             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_PLAYBACK_STATUS_CHANGED;
219             little_endian_store_16(event, offset, avrcp_cid);
220             offset += 2;
221             event[offset++] = ctype;
222             event[offset++] = payload[0];
223             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
224             break;
225         }
226         case AVRCP_NOTIFICATION_EVENT_TRACK_CHANGED:{
227             uint16_t offset = 0;
228             uint8_t event[6];
229             event[offset++] = HCI_EVENT_AVRCP_META;
230             event[offset++] = sizeof(event) - 2;
231             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_TRACK_CHANGED;
232             little_endian_store_16(event, offset, avrcp_cid);
233             offset += 2;
234             event[offset++] = ctype;
235             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
236             break;
237         }
238         case AVRCP_NOTIFICATION_EVENT_NOW_PLAYING_CONTENT_CHANGED:{
239             uint16_t offset = 0;
240             uint8_t event[6];
241             event[offset++] = HCI_EVENT_AVRCP_META;
242             event[offset++] = sizeof(event) - 2;
243             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_NOW_PLAYING_CONTENT_CHANGED;
244             little_endian_store_16(event, offset, avrcp_cid);
245             offset += 2;
246             event[offset++] = ctype;
247             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
248             break;
249         }
250         case AVRCP_NOTIFICATION_EVENT_AVAILABLE_PLAYERS_CHANGED:{
251             uint16_t offset = 0;
252             uint8_t event[6];
253             event[offset++] = HCI_EVENT_AVRCP_META;
254             event[offset++] = sizeof(event) - 2;
255             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_AVAILABLE_PLAYERS_CHANGED;
256             little_endian_store_16(event, offset, avrcp_cid);
257             offset += 2;
258             event[offset++] = ctype;
259             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
260             break;
261         }
262         case AVRCP_NOTIFICATION_EVENT_VOLUME_CHANGED:{
263             if (size < 1) break;
264             uint16_t offset = 0;
265             uint8_t event[7];
266             event[offset++] = HCI_EVENT_AVRCP_META;
267             event[offset++] = sizeof(event) - 2;
268             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_VOLUME_CHANGED;
269             little_endian_store_16(event, offset, avrcp_cid);
270             offset += 2;
271             event[offset++] = ctype;
272             event[offset++] = payload[0] & 0x7F;
273             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
274             break;
275         }
276         case AVRCP_NOTIFICATION_EVENT_UIDS_CHANGED:{
277             if (size < 2) break;
278             uint8_t event[8];
279             uint16_t offset = 0;
280             uint16_t uuid = big_endian_read_16(payload, 0);
281             event[offset++] = HCI_EVENT_AVRCP_META;
282             event[offset++] = sizeof(event) - 2;
283             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_UIDS_CHANGED;
284             little_endian_store_16(event, offset, avrcp_cid);
285             offset += 2;
286             event[offset++] = ctype;
287             little_endian_store_16(event, offset, uuid);
288             offset += 2;
289             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
290             break;
291         }
292 
293         case AVRCP_NOTIFICATION_EVENT_TRACK_REACHED_END:{
294             uint16_t offset = 0;
295             uint8_t event[6];
296             event[offset++] = HCI_EVENT_AVRCP_META;
297             event[offset++] = sizeof(event) - 2;
298             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_TRACK_REACHED_END;
299             little_endian_store_16(event, offset, avrcp_cid);
300             offset += 2;
301             event[offset++] = ctype;
302             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
303             break;
304         }
305         case AVRCP_NOTIFICATION_EVENT_TRACK_REACHED_START:{
306             uint16_t offset = 0;
307             uint8_t event[6];
308             event[offset++] = HCI_EVENT_AVRCP_META;
309             event[offset++] = sizeof(event) - 2;
310             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_TRACK_REACHED_START;
311             little_endian_store_16(event, offset, avrcp_cid);
312             offset += 2;
313             event[offset++] = ctype;
314             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
315             break;
316         }
317         case AVRCP_NOTIFICATION_EVENT_BATT_STATUS_CHANGED:{
318             if (size < 1) break;
319             uint16_t offset = 0;
320             uint8_t event[7];
321             event[offset++] = HCI_EVENT_AVRCP_META;
322             event[offset++] = sizeof(event) - 2;
323             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_BATT_STATUS_CHANGED;
324             little_endian_store_16(event, offset, avrcp_cid);
325             offset += 2;
326             event[offset++] = ctype;
327             event[offset++] = payload[0];
328             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
329             break;
330         }
331 
332         case AVRCP_NOTIFICATION_EVENT_SYSTEM_STATUS_CHANGED:{
333             if (size < 1) break;
334             uint16_t offset = 0;
335             uint8_t event[7];
336             event[offset++] = HCI_EVENT_AVRCP_META;
337             event[offset++] = sizeof(event) - 2;
338             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_SYSTEM_STATUS_CHANGED;
339             little_endian_store_16(event, offset, avrcp_cid);
340             offset += 2;
341             event[offset++] = ctype;
342             event[offset++] = payload[0];
343             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
344             break;
345         }
346 
347         case AVRCP_NOTIFICATION_EVENT_PLAYER_APPLICATION_SETTING_CHANGED:
348         default:
349             log_info("avrcp: not implemented");
350             break;
351     }
352 }
353 
354 static void avrcp_controller_emit_repeat_and_shuffle_mode(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t ctype, avrcp_repeat_mode_t repeat_mode, avrcp_shuffle_mode_t shuffle_mode){
355     btstack_assert(callback != NULL);
356 
357     uint8_t event[8];
358     int pos = 0;
359     event[pos++] = HCI_EVENT_AVRCP_META;
360     event[pos++] = sizeof(event) - 2;
361     event[pos++] = AVRCP_SUBEVENT_SHUFFLE_AND_REPEAT_MODE;
362     little_endian_store_16(event, pos, avrcp_cid);
363     pos += 2;
364     event[pos++] = ctype;
365     event[pos++] = repeat_mode;
366     event[pos++] = shuffle_mode;
367     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
368 }
369 
370 static void avrcp_controller_emit_now_playing_info_event_done(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t ctype, uint8_t status){
371     uint8_t event[7];
372     int pos = 0;
373     event[pos++] = HCI_EVENT_AVRCP_META;
374     event[pos++] = sizeof(event) - 2;
375     event[pos++] = AVRCP_SUBEVENT_NOW_PLAYING_INFO_DONE;
376     little_endian_store_16(event, pos, avrcp_cid);
377     pos += 2;
378     event[pos++] = ctype;
379     event[pos++] = status;
380     (*callback)(HCI_EVENT_PACKET, 0, event, pos);
381 }
382 
383 static void avrcp_controller_emit_now_playing_info_event(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t ctype, avrcp_media_attribute_id_t attr_id, uint8_t * value, uint16_t value_len){
384     uint8_t event[HCI_EVENT_BUFFER_SIZE];
385     uint16_t pos = 0;
386     event[pos++] = HCI_EVENT_AVRCP_META;
387     // reserve one byte for subevent type and data len
388 	uint16_t data_len_pos = pos;
389     pos++;
390 	uint16_t subevent_type_pos = pos;
391     pos++;
392     little_endian_store_16(event, pos, avrcp_cid);
393     pos += 2;
394     event[pos++] = ctype;
395 
396     switch (attr_id){
397         case AVRCP_MEDIA_ATTR_TITLE:
398             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_TITLE_INFO;
399 			btstack_assert(value_len <= 255);
400             event[pos++] = (uint8_t) value_len;
401             (void)memcpy(event + pos, value, value_len);
402             break;
403         case AVRCP_MEDIA_ATTR_ARTIST:
404             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_ARTIST_INFO;
405 			btstack_assert(value_len <= 255);
406 			event[pos++] = (uint8_t) value_len;
407             (void)memcpy(event + pos, value, value_len);
408             break;
409         case AVRCP_MEDIA_ATTR_ALBUM:
410             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_ALBUM_INFO;
411 			btstack_assert(value_len <= 255);
412 			event[pos++] = (uint8_t) value_len;
413             (void)memcpy(event + pos, value, value_len);
414             break;
415         case AVRCP_MEDIA_ATTR_GENRE:
416             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_GENRE_INFO;
417 			btstack_assert(value_len <= 255);
418 			event[pos++] = (uint8_t) value_len;
419             (void)memcpy(event + pos, value, value_len);
420             break;
421 #ifdef ENABLE_AVRCP_COVER_ART
422         case AVRCP_MEDIA_ATTR_DEFAULT_COVER_ART:
423             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_COVER_ART_INFO;
424             btstack_assert(value_len <= 255);
425             event[pos++] = (uint8_t) value_len;
426             (void)memcpy(event + pos, value, value_len);
427             break;
428 #endif
429         case AVRCP_MEDIA_ATTR_SONG_LENGTH_MS:
430             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_SONG_LENGTH_MS_INFO;
431             if (value){
432                 little_endian_store_32(event, pos, btstack_atoi((char *)value));
433             } else {
434                 little_endian_store_32(event, pos, 0);
435             }
436             pos += 4;
437             break;
438         case AVRCP_MEDIA_ATTR_TRACK:
439             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_TRACK_INFO;
440             if (value){
441                 event[pos++] = btstack_atoi((char *)value);
442             } else {
443                 event[pos++] = 0;
444             }
445             break;
446         case AVRCP_MEDIA_ATTR_TOTAL_NUM_ITEMS:
447             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_TOTAL_TRACKS_INFO;
448             if (value){
449                 event[pos++] = btstack_atoi((char *)value);
450             } else {
451                 event[pos++] = 0;
452             }
453             break;
454         default:
455             break;
456     }
457     event[data_len_pos] = pos - 2;
458     (*callback)(HCI_EVENT_PACKET, 0, event, pos);
459 }
460 
461 static void avrcp_controller_emit_operation_status(btstack_packet_handler_t callback, uint8_t subevent, uint16_t avrcp_cid, uint8_t ctype, uint8_t operation_id){
462     btstack_assert(callback != NULL);
463 
464     uint8_t event[7];
465     int pos = 0;
466     event[pos++] = HCI_EVENT_AVRCP_META;
467     event[pos++] = sizeof(event) - 2;
468     event[pos++] = subevent;
469     little_endian_store_16(event, pos, avrcp_cid);
470     pos += 2;
471     event[pos++] = ctype;
472     event[pos++] = operation_id;
473     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
474 }
475 
476 static void avrcp_parser_reset(avrcp_connection_t * connection){
477     connection->list_offset = 0;
478     connection->parser_attribute_header_pos = 0;
479     connection->controller_num_received_fragments = 0;
480     connection->parser_state = AVRCP_PARSER_GET_ATTRIBUTE_HEADER;
481 }
482 
483 static void avrcp_parser_process_byte(uint8_t byte, avrcp_connection_t * connection, avrcp_command_type_t ctype){
484     uint16_t attribute_total_value_len;
485     uint32_t attribute_id;
486     switch(connection->parser_state){
487         case AVRCP_PARSER_GET_ATTRIBUTE_HEADER:
488             connection->parser_attribute_header[connection->parser_attribute_header_pos++] = byte;
489             connection->list_offset++;
490 
491             if (connection->parser_attribute_header_pos < AVRCP_ATTRIBUTE_HEADER_LEN) return;
492 
493             attribute_total_value_len = big_endian_read_16(connection->parser_attribute_header, 6);
494             connection->attribute_value_len = btstack_min(attribute_total_value_len, AVRCP_MAX_ATTRIBUTE_SIZE);
495             if (connection->attribute_value_len > 0){
496                 // get ready for attribute value
497                 connection->parser_state = AVRCP_PARSER_GET_ATTRIBUTE_VALUE;
498                 return;
499             }
500 
501             // emit empty attribute
502             attribute_id = big_endian_read_32(connection->parser_attribute_header, 0);
503             avrcp_controller_emit_now_playing_info_event(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, (avrcp_media_attribute_id_t) attribute_id, connection->attribute_value, connection->attribute_value_len);
504 
505             // done, see below
506             break;
507 
508         case AVRCP_PARSER_GET_ATTRIBUTE_VALUE:
509             connection->attribute_value[connection->attribute_value_offset++] = byte;
510             connection->list_offset++;
511 
512             if (connection->attribute_value_offset < connection->attribute_value_len) return;
513 
514             // emit (potentially partial) attribute
515             attribute_id = big_endian_read_32(connection->parser_attribute_header, 0);
516             avrcp_controller_emit_now_playing_info_event(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, (avrcp_media_attribute_id_t) attribute_id, connection->attribute_value, connection->attribute_value_len);
517 
518             attribute_total_value_len = big_endian_read_16(connection->parser_attribute_header, 6);
519             if (connection->attribute_value_offset < attribute_total_value_len){
520                 // ignore rest of attribute
521                 connection->parser_state = AVRCP_PARSER_IGNORE_REST_OF_ATTRIBUTE_VALUE;
522                 return;
523             }
524 
525             // done, see below
526             break;
527 
528         case AVRCP_PARSER_IGNORE_REST_OF_ATTRIBUTE_VALUE:
529             connection->attribute_value_offset++;
530             connection->list_offset++;
531 
532             attribute_total_value_len = big_endian_read_16(connection->parser_attribute_header, 6);
533             if (connection->attribute_value_offset < attribute_total_value_len) return;
534 
535             // done, see below
536             break;
537 
538         default:
539             return;
540     }
541 
542     // attribute fully read, check if more to come
543     if (connection->list_offset < connection->list_size){
544         // more to come, reset parser
545         connection->parser_state = AVRCP_PARSER_GET_ATTRIBUTE_HEADER;
546         connection->parser_attribute_header_pos = 0;
547         connection->attribute_value_offset = 0;
548     } else {
549         // fully done
550         avrcp_parser_reset(connection);
551         avrcp_controller_emit_now_playing_info_event_done(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, 0);
552     }
553 }
554 
555 static void avrcp_controller_parse_and_emit_element_attrs(uint8_t * packet, uint16_t num_bytes_to_read, avrcp_connection_t * connection, avrcp_command_type_t ctype){
556     int i;
557     for (i=0;i<num_bytes_to_read;i++){
558         avrcp_parser_process_byte(packet[i], connection, ctype);
559     }
560 }
561 
562 static void avrcp_send_cmd_with_avctp_fragmentation(avrcp_connection_t * connection){
563     l2cap_reserve_packet_buffer();
564     uint8_t * packet = l2cap_get_outgoing_buffer();
565 
566     uint16_t max_payload_size;
567     connection->avctp_packet_type = avctp_get_packet_type(connection, &max_payload_size);
568     connection->avrcp_packet_type = avrcp_get_packet_type(connection);
569 
570     // non-fragmented: transport header (1) + PID (2)
571     // fragmented:     transport header (1) + num packets (1) + PID (2)
572 
573     uint16_t param_len = connection->data_len;
574     // AVCTP header
575     // transport header : transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
576     uint16_t pos = 0;
577     packet[pos++] = (connection->transaction_id << 4) | (connection->avctp_packet_type << 2) | (AVRCP_COMMAND_FRAME << 1) | 0;
578 
579     if (connection->avctp_packet_type == AVCTP_START_PACKET){
580         uint16_t max_frame_size = btstack_min(connection->l2cap_mtu, AVRCP_MAX_AV_C_MESSAGE_FRAME_SIZE);
581         // first packet: max_payload_size
582         // rest packets
583         uint16_t num_payload_bytes = param_len - max_payload_size;
584         uint16_t frame_size_for_continue_packet = max_frame_size - avctp_get_num_bytes_for_header(AVCTP_CONTINUE_PACKET);
585         uint16_t num_avctp_packets = (num_payload_bytes + frame_size_for_continue_packet - 1)/frame_size_for_continue_packet + 1;
586 		btstack_assert(num_avctp_packets <= 255);
587         packet[pos++] = (uint8_t) num_avctp_packets;
588     }
589 
590     switch (connection->avctp_packet_type){
591         case AVCTP_SINGLE_PACKET:
592         case AVCTP_START_PACKET:
593             // Profile IDentifier (PID)
594             packet[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL >> 8;
595             packet[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL & 0x00FF;
596 
597             // command_type
598             packet[pos++] = connection->command_type;
599             // subunit_type | subunit ID
600             packet[pos++] = (connection->subunit_type << 3) | connection->subunit_id;
601             // opcode
602             packet[pos++] = (uint8_t)connection->command_opcode;
603 
604             switch (connection->command_opcode){
605                 case AVRCP_CMD_OPCODE_VENDOR_DEPENDENT:
606                     big_endian_store_24(packet, pos, connection->company_id);
607                     pos += 3;
608                     packet[pos++] = connection->pdu_id;
609                     packet[pos++] = connection->avrcp_packet_type;              // reserved(upper 6) | AVRCP packet_type
610                     big_endian_store_16(packet, pos, connection->data_len);     // parameter length
611                     pos += 2;
612                     break;
613                 case AVRCP_CMD_OPCODE_PASS_THROUGH:
614                     packet[pos++] = connection->operation_id;
615                     packet[pos++] = (uint8_t)connection->data_len;     // parameter length
616                     pos += 2;
617                     break;
618                 case AVRCP_CMD_OPCODE_UNIT_INFO:
619                     break;
620                 case AVRCP_CMD_OPCODE_SUBUNIT_INFO:
621                     break;
622                 default:
623                     btstack_assert(false);
624                     return;
625             }
626             break;
627         case AVCTP_CONTINUE_PACKET:
628         case AVCTP_END_PACKET:
629             break;
630         default:
631             btstack_assert(false);
632             return;
633     }
634     // compare number of bytes to store with the remaining buffer size
635     uint16_t bytes_to_copy = btstack_min(connection->data_len - connection->data_offset, max_payload_size - pos);
636 
637     (void)memcpy(packet + pos, &connection->data[connection->data_offset], bytes_to_copy);
638     pos += bytes_to_copy;
639     connection->data_offset += bytes_to_copy;
640 
641     l2cap_send_prepared(connection->l2cap_signaling_cid, pos);
642 }
643 
644 static int avrcp_send_register_notification(avrcp_connection_t * connection, uint8_t event_id){
645     uint8_t command[18];
646     uint16_t pos = 0;
647     // transport header : transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
648     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
649     command[pos++] = (connection->transaction_id << 4) | (AVRCP_SINGLE_PACKET << 2) | (AVRCP_COMMAND_FRAME << 1) | 0;
650 
651     command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL >> 8;
652     command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL & 0x00FF;
653     command[pos++] = AVRCP_CTYPE_NOTIFY;
654     command[pos++] = (AVRCP_SUBUNIT_TYPE_PANEL << 3) | AVRCP_SUBUNIT_ID;
655     command[pos++] = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
656 
657     big_endian_store_24(command, pos, BT_SIG_COMPANY_ID);
658     pos += 3;
659     command[pos++] = AVRCP_PDU_ID_REGISTER_NOTIFICATION;
660     command[pos++] = 0;                       // reserved(upper 6) | packet_type -> 0
661     big_endian_store_16(command, pos, 5);     // parameter length
662     pos += 2;
663     command[pos++] = event_id;
664     big_endian_store_32(command, pos, 1);     // send notification on playback position every second, for other notifications it is ignored
665     pos += 4;
666     return l2cap_send(connection->l2cap_signaling_cid, command, pos);
667 }
668 
669 static void avrcp_press_and_hold_timeout_handler(btstack_timer_source_t * timer){
670     UNUSED(timer);
671     avrcp_connection_t * connection = (avrcp_connection_t*) btstack_run_loop_get_timer_context(timer);
672     btstack_run_loop_set_timer(&connection->controller_press_and_hold_cmd_timer, 2000); // 2 seconds timeout
673     btstack_run_loop_add_timer(&connection->controller_press_and_hold_cmd_timer);
674     connection->state = AVCTP_W2_SEND_PRESS_COMMAND;
675     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
676 }
677 
678 static void avrcp_press_and_hold_timer_start(avrcp_connection_t * connection){
679     btstack_run_loop_remove_timer(&connection->controller_press_and_hold_cmd_timer);
680     btstack_run_loop_set_timer_handler(&connection->controller_press_and_hold_cmd_timer, avrcp_press_and_hold_timeout_handler);
681     btstack_run_loop_set_timer_context(&connection->controller_press_and_hold_cmd_timer, connection);
682     btstack_run_loop_set_timer(&connection->controller_press_and_hold_cmd_timer, 2000); // 2 seconds timeout
683     btstack_run_loop_add_timer(&connection->controller_press_and_hold_cmd_timer);
684 }
685 
686 static void avrcp_press_and_hold_timer_stop(avrcp_connection_t * connection){
687     connection->controller_press_and_hold_cmd_active = false;
688     btstack_run_loop_remove_timer(&connection->controller_press_and_hold_cmd_timer);
689 }
690 
691 
692 static uint8_t avrcp_controller_request_pass_through_release_control_cmd(avrcp_connection_t * connection){
693     connection->state = AVCTP_W2_SEND_RELEASE_COMMAND;
694     if (connection->controller_press_and_hold_cmd_active){
695         avrcp_press_and_hold_timer_stop(connection);
696     }
697     connection->operation_id = (avrcp_operation_id_t)(0x80 | connection->operation_id);
698     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
699     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
700     return ERROR_CODE_SUCCESS;
701 }
702 
703 static uint8_t avrcp_controller_request_pass_through_press_control_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint16_t playback_speed, bool continuous_cmd){
704 	UNUSED(playback_speed);
705 
706 	log_info("Send command %d", opid);
707     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
708     if (!connection){
709         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
710     }
711 
712     if (connection->state != AVCTP_CONNECTION_OPENED){
713         log_error("Connection in wrong state %d, expected %d. avrcp cid 0x%02x", connection->state, AVCTP_CONNECTION_OPENED, avrcp_cid);
714         return ERROR_CODE_COMMAND_DISALLOWED;
715     }
716     connection->state = AVCTP_W2_SEND_PRESS_COMMAND;
717     avrcp_controller_pass_through_command_data_init(connection, opid);
718 
719     connection->controller_press_and_hold_cmd_active = continuous_cmd;
720     if (connection->controller_press_and_hold_cmd_active){
721         avrcp_press_and_hold_timer_start(connection);
722     }
723 
724     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
725     return ERROR_CODE_SUCCESS;
726 }
727 
728 static uint8_t request_single_pass_through_press_control_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint16_t playback_speed){
729     return avrcp_controller_request_pass_through_press_control_cmd(avrcp_cid, opid, playback_speed, false);
730 }
731 
732 static uint8_t request_continuous_pass_through_press_control_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint16_t playback_speed){
733     return avrcp_controller_request_pass_through_press_control_cmd(avrcp_cid, opid, playback_speed, true);
734 }
735 
736 static void avrcp_controller_get_capabilities_for_connection(avrcp_connection_t * connection, uint8_t capability_id){
737     connection->state = AVCTP_W2_SEND_COMMAND;
738     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_STATUS, AVRCP_PDU_ID_GET_CAPABILITIES, true);
739 
740     // Parameter Length
741     connection->data_len = 1;
742     connection->data[0] = capability_id;  // capability ID
743 
744     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
745 }
746 
747 static uint8_t avrcp_controller_register_notification(avrcp_connection_t * connection, avrcp_notification_event_id_t event_id){
748     if ((connection->remote_capabilities_state == AVRCP_REMOTE_CAPABILITIES_KNOWN) && (connection->notifications_supported_by_target & (1 << event_id)) == 0){
749         return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
750     }
751     if ((connection->controller_notifications_to_deregister & (1 << event_id)) != 0){
752         return ERROR_CODE_COMMAND_DISALLOWED;
753     }
754     if ( (connection->notifications_enabled & (1 << event_id)) != 0){
755         return ERROR_CODE_SUCCESS;
756     }
757     connection->controller_notifications_to_register |= (1 << event_id);
758 
759     switch (connection->remote_capabilities_state){
760         case AVRCP_REMOTE_CAPABILITIES_NONE:
761             connection->remote_capabilities_state = AVRCP_REMOTE_CAPABILITIES_W4_QUERY_RESULT;
762             connection->controller_notifications_supported_by_target_suppress_emit_result = true;
763             avrcp_controller_get_capabilities_for_connection(connection, AVRCP_CAPABILITY_ID_EVENT);
764             break;
765         case AVRCP_REMOTE_CAPABILITIES_KNOWN:
766             avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
767             break;
768         default:
769             break;
770     }
771     return ERROR_CODE_SUCCESS;
772 }
773 
774 static uint8_t avrcp_controller_request_continuation(avrcp_connection_t * connection, avrcp_pdu_id_t pdu_id){
775     connection->state = AVCTP_W2_SEND_COMMAND;
776     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, pdu_id, false);
777 
778     // Parameter Length
779     connection->data_len = 3;
780     big_endian_store_16(connection->data, 0, 1);
781     connection->data[2] = AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES;
782 
783     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
784     return ERROR_CODE_SUCCESS;
785 }
786 
787 static uint8_t avrcp_controller_request_abort_continuation(avrcp_connection_t * connection){
788     return avrcp_controller_request_continuation(connection, AVRCP_PDU_ID_REQUEST_ABORT_CONTINUING_RESPONSE);
789 }
790 
791 static uint8_t avrcp_controller_request_continue_response(avrcp_connection_t * connection){
792     return avrcp_controller_request_continuation(connection, AVRCP_PDU_ID_REQUEST_CONTINUING_RESPONSE);
793 }
794 
795 static void avrcp_controller_handle_notification(avrcp_connection_t *connection, avrcp_command_type_t ctype, uint8_t *payload, uint16_t size) {
796     if (size < 1) return;
797     uint16_t pos = 0;
798     avrcp_notification_event_id_t event_id = (avrcp_notification_event_id_t) payload[pos++];
799     if ( (event_id < AVRCP_NOTIFICATION_EVENT_FIRST_INDEX) || (event_id > AVRCP_NOTIFICATION_EVENT_LAST_INDEX)){
800         return;
801     }
802 
803     uint16_t event_mask = (1 << event_id);
804     uint16_t reset_event_mask = ~event_mask;
805 
806     switch (ctype){
807         case AVRCP_CTYPE_RESPONSE_REJECTED:
808             connection->controller_notifications_to_deregister &= reset_event_mask;
809             connection->controller_notifications_to_register   &= reset_event_mask;
810             connection->controller_initial_status_reported     &= reset_event_mask;
811             avrcp_controller_emit_notification_complete(connection, ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE, event_id, false);
812             return;
813 
814         case AVRCP_CTYPE_RESPONSE_INTERIM:
815             // register as enabled
816             connection->notifications_enabled |= event_mask;
817 
818             // check if initial value is already sent
819             if ((connection->controller_initial_status_reported & event_mask) != 0 ){
820                 return;
821             }
822             // emit event only once, initially
823             avrcp_controller_emit_notification_complete(connection, ERROR_CODE_SUCCESS, event_id, true);
824             connection->controller_initial_status_reported |= event_mask;
825             // emit initial value after this switch
826             break;
827 
828         case AVRCP_CTYPE_RESPONSE_CHANGED_STABLE:
829             // received change, event is considered de-registered
830             // we are re-enabling it automatically, if it is not
831             // explicitly disabled
832             connection->notifications_enabled &= reset_event_mask;
833             if ((connection->controller_notifications_to_deregister & event_mask) == 0){
834                 avrcp_controller_register_notification(connection, event_id);
835             } else {
836                 connection->controller_notifications_to_deregister &= reset_event_mask;
837                 connection->controller_notifications_to_register   &= reset_event_mask;
838                 connection->controller_initial_status_reported     &= reset_event_mask;
839                 avrcp_controller_emit_notification_complete(connection, ERROR_CODE_SUCCESS, event_id, false);
840             }
841             break;
842 
843         default:
844             return;
845     }
846 
847     avrcp_controller_emit_notification_for_event_id(connection->avrcp_cid, event_id, ctype, payload + pos, size - pos);
848 }
849 
850 #ifdef ENABLE_AVCTP_FRAGMENTATION
851 static void avctp_reassemble_message(avrcp_connection_t * connection, avctp_packet_type_t packet_type, uint8_t *packet, uint16_t size){
852     // after header (transaction label and packet type)
853     uint16_t pos;
854     uint16_t bytes_to_store;
855 
856     switch (packet_type){
857         case AVCTP_START_PACKET:
858             if (size < 2) return;
859 
860             // store header
861             pos = 0;
862             connection->avctp_reassembly_buffer[pos] = packet[pos];
863             pos++;
864             connection->avctp_reassembly_size = pos;
865 
866             // NOTE: num packets not needed for reassembly, ignoring it does not pose security risk -> no need to store it
867             pos++;
868 
869             // PID in reassembled packet is at offset 1, it will be read later after the avctp_reassemble_message with AVCTP_END_PACKET is called
870 
871             bytes_to_store = btstack_min(size - pos, sizeof(connection->avctp_reassembly_buffer) - connection->avctp_reassembly_size);
872             memcpy(&connection->avctp_reassembly_buffer[connection->avctp_reassembly_size], &packet[pos], bytes_to_store);
873             connection->avctp_reassembly_size += bytes_to_store;
874             break;
875 
876         case AVCTP_CONTINUE_PACKET:
877         case AVCTP_END_PACKET:
878             if (size < 1) return;
879 
880             // store remaining data, ignore header
881             pos = 1;
882             bytes_to_store = btstack_min(size - pos, sizeof(connection->avctp_reassembly_buffer) - connection->avctp_reassembly_size);
883             memcpy(&connection->avctp_reassembly_buffer[connection->avctp_reassembly_size], &packet[pos], bytes_to_store);
884             connection->avctp_reassembly_size += bytes_to_store;
885             break;
886 
887         default:
888             return;
889     }
890 }
891 #endif
892 
893 static void avrcp_handle_l2cap_data_packet_for_signaling_connection(avrcp_connection_t * connection, uint8_t *packet, uint16_t size){
894     if (size < 6u) return;
895     uint8_t  pdu_id;
896     avrcp_packet_type_t  vendor_dependent_avrcp_packet_type;
897 
898     uint16_t pos = 0;
899     connection->controller_last_confirmed_transaction_id = packet[pos] >> 4;
900     avrcp_frame_type_t  frame_type =  (avrcp_frame_type_t)((packet[pos] >> 1) & 0x01);
901     avctp_packet_type_t packet_type = (avctp_packet_type_t)((packet[pos] >> 2) & 0x03);
902     pos++;
903 
904     if (frame_type != AVRCP_RESPONSE_FRAME) return;
905 
906     switch (packet_type){
907         case AVCTP_SINGLE_PACKET:
908             break;
909 
910 #ifdef ENABLE_AVCTP_FRAGMENTATION
911         case AVCTP_START_PACKET:
912         case AVCTP_CONTINUE_PACKET:
913             avctp_reassemble_message(connection, packet_type, packet, size);
914             return;
915 
916         case AVCTP_END_PACKET:
917             avctp_reassemble_message(connection, packet_type, packet, size);
918 
919             packet = connection->avctp_reassembly_buffer;
920             size   = connection->avctp_reassembly_size;
921             break;
922 #endif
923 
924         default:
925             return;
926     }
927 
928     pos += 2; // PID
929 
930     avrcp_command_type_t ctype = (avrcp_command_type_t) packet[pos++];
931 
932 #ifdef ENABLE_LOG_INFO
933     uint8_t byte_value = packet[pos];
934     avrcp_subunit_type_t subunit_type = (avrcp_subunit_type_t) (byte_value >> 3);
935     avrcp_subunit_type_t subunit_id   = (avrcp_subunit_type_t) (byte_value & 0x07);
936 #endif
937     pos++;
938 
939     uint8_t opcode = packet[pos++];
940     uint16_t param_length;
941 
942     switch (opcode){
943         case AVRCP_CMD_OPCODE_SUBUNIT_INFO:{
944             if (connection->state != AVCTP_W2_RECEIVE_RESPONSE) return;
945             connection->state = AVCTP_CONNECTION_OPENED;
946 
947 #ifdef ENABLE_LOG_INFO
948             // page, extension code (1)
949             pos++;
950             uint8_t unit_type = packet[pos] >> 3;
951             uint8_t max_subunit_ID = packet[pos] & 0x07;
952             log_info("SUBUNIT INFO response: ctype 0x%02x (0C), subunit_type 0x%02x (1F), subunit_id 0x%02x (07), opcode 0x%02x (30), target_unit_type 0x%02x, max_subunit_ID %d", ctype, subunit_type, subunit_id, opcode, unit_type, max_subunit_ID);
953 #endif
954             break;
955         }
956         case AVRCP_CMD_OPCODE_UNIT_INFO:{
957             if (connection->state != AVCTP_W2_RECEIVE_RESPONSE) return;
958             connection->state = AVCTP_CONNECTION_OPENED;
959 
960 #ifdef ENABLE_LOG_INFO
961             // byte value 7 (1)
962             pos++;
963             uint8_t unit_type = packet[pos] >> 3;
964             uint8_t unit = packet[pos] & 0x07;
965             pos++;
966             uint32_t company_id = big_endian_read_24(packet, pos);
967             log_info("UNIT INFO response: ctype 0x%02x (0C), subunit_type 0x%02x (1F), subunit_id 0x%02x (07), opcode 0x%02x (30), target_unit_type 0x%02x, unit %d, company_id 0x%06" PRIx32,
968                 ctype, subunit_type, subunit_id, opcode, unit_type, unit, company_id);
969 #endif
970             break;
971         }
972         case AVRCP_CMD_OPCODE_VENDOR_DEPENDENT:
973             if ((size - pos) < 7){
974                 return;
975             }
976             // Company ID (3)
977             pos += 3;
978             pdu_id = packet[pos++];
979             vendor_dependent_avrcp_packet_type = (avrcp_packet_type_t)(packet[pos++] & 0x03);
980             param_length = big_endian_read_16(packet, pos);
981             pos += 2;
982 
983             if ((size - pos) < param_length) {
984                 return;
985             }
986 
987             // handle asynchronous notifications, without changing state
988             if (pdu_id == AVRCP_PDU_ID_REGISTER_NOTIFICATION){
989                 avrcp_controller_handle_notification(connection, ctype, packet + pos, size - pos);
990                 break;
991             }
992             if (connection->state != AVCTP_W2_RECEIVE_RESPONSE) return;
993             connection->state = AVCTP_CONNECTION_OPENED;
994 
995             log_info("VENDOR DEPENDENT response: pdu id 0x%02x, param_length %d, status %s", pdu_id, param_length, avrcp_ctype2str(ctype));
996             switch (pdu_id){
997                 case AVRCP_PDU_ID_GET_CURRENT_PLAYER_APPLICATION_SETTING_VALUE:{
998                     uint8_t num_attributes = packet[pos++];
999                     int i;
1000                     avrcp_repeat_mode_t  repeat_mode =  AVRCP_REPEAT_MODE_INVALID;
1001                     avrcp_shuffle_mode_t shuffle_mode = AVRCP_SHUFFLE_MODE_INVALID;
1002                     for (i = 0; i < num_attributes; i++){
1003                         uint8_t attribute_id    = packet[pos++];
1004                         uint8_t value = packet[pos++];
1005                         switch (attribute_id){
1006                             case 0x02:
1007                                 repeat_mode = (avrcp_repeat_mode_t) value;
1008                                 break;
1009                             case 0x03:
1010                                 shuffle_mode = (avrcp_shuffle_mode_t) value;
1011                                 break;
1012                             default:
1013                                 break;
1014                         }
1015                     }
1016                     avrcp_controller_emit_repeat_and_shuffle_mode(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, repeat_mode, shuffle_mode);
1017                     break;
1018                 }
1019 
1020                 case AVRCP_PDU_ID_SET_PLAYER_APPLICATION_SETTING_VALUE:{
1021                     uint16_t offset = 0;
1022                     uint8_t event[6];
1023                     event[offset++] = HCI_EVENT_AVRCP_META;
1024                     event[offset++] = sizeof(event) - 2;
1025                     event[offset++] = AVRCP_SUBEVENT_PLAYER_APPLICATION_VALUE_RESPONSE;
1026                     little_endian_store_16(event, offset, connection->avrcp_cid);
1027                     offset += 2;
1028                     event[offset++] = ctype;
1029                     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
1030                     break;
1031                 }
1032 
1033                 case AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME:{
1034                     uint16_t offset = 0;
1035                     uint8_t event[7];
1036                     event[offset++] = HCI_EVENT_AVRCP_META;
1037                     event[offset++] = sizeof(event) - 2;
1038                     event[offset++] = AVRCP_SUBEVENT_SET_ABSOLUTE_VOLUME_RESPONSE;
1039                     little_endian_store_16(event, offset, connection->avrcp_cid);
1040                     offset += 2;
1041                     event[offset++] = ctype;
1042                     event[offset++] = packet[pos++];
1043                     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
1044                     break;
1045                 }
1046 
1047                 case AVRCP_PDU_ID_GET_CAPABILITIES:{
1048                     avrcp_capability_id_t capability_id = (avrcp_capability_id_t) packet[pos++];
1049                     uint8_t capability_count = 0;
1050                     if (param_length > 1){
1051                         capability_count = packet[pos++];
1052                     }
1053                     uint16_t i;
1054                     uint16_t offset = 0;
1055                     uint8_t event[10];
1056 
1057                     switch (capability_id){
1058 
1059                         case AVRCP_CAPABILITY_ID_COMPANY:
1060                             for (i = 0; (i < capability_count) && ((size - pos) >= 3); i++){
1061                                 uint32_t company_id = big_endian_read_24(packet, pos);
1062                                 pos += 3;
1063                                 log_info("  0x%06" PRIx32 ", ", company_id);
1064 
1065                                 offset = 0;
1066                                 event[offset++] = HCI_EVENT_AVRCP_META;
1067                                 event[offset++] = sizeof(event) - 2;
1068                                 event[offset++] = AVRCP_SUBEVENT_GET_CAPABILITY_COMPANY_ID;
1069                                 little_endian_store_16(event, offset, connection->avrcp_cid);
1070                                 offset += 2;
1071                                 event[offset++] = ctype;
1072                                 event[offset++] = 0;
1073                                 little_endian_store_24(event, offset, company_id);
1074                                 offset += 3;
1075                                 (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
1076                             }
1077 
1078                             offset = 0;
1079                             event[offset++] = HCI_EVENT_AVRCP_META;
1080                             event[offset++] = sizeof(event) - 2;
1081                             event[offset++] = AVRCP_SUBEVENT_GET_CAPABILITY_COMPANY_ID_DONE;
1082                             little_endian_store_16(event, offset, connection->avrcp_cid);
1083                             offset += 2;
1084                             event[offset++] = ctype;
1085                             event[offset++] = 0;
1086                             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
1087                             break;
1088 
1089                         case AVRCP_CAPABILITY_ID_EVENT:
1090                             for (i = 0; (i < capability_count) && ((size - pos) >= 1); i++){
1091                                 uint8_t event_id = packet[pos++];
1092                                 connection->notifications_supported_by_target |= (1 << event_id);
1093                             }
1094 
1095                             connection->remote_capabilities_state = AVRCP_REMOTE_CAPABILITIES_KNOWN;
1096 
1097                             // if the get supported events query is triggered by avrcp_controller_enable_notification call,
1098                             // avrcp_controller_emit_supported_events should be suppressed
1099                             if (connection->controller_notifications_supported_by_target_suppress_emit_result){
1100                                 connection->controller_notifications_supported_by_target_suppress_emit_result = false;
1101                                 // also, notification might not be supported
1102                                 // if so, emit AVRCP_SUBEVENT_ENABLE_NOTIFICATION_COMPLETE event to app,
1103                                 // and update controller_notifications_to_register bitmap
1104                                 for (i = (uint8_t)AVRCP_NOTIFICATION_EVENT_FIRST_INDEX; i < (uint8_t) AVRCP_NOTIFICATION_EVENT_LAST_INDEX; i++){
1105                                     if ((connection->controller_notifications_to_register & (1 << i)) != 0){
1106                                         if ((connection->notifications_supported_by_target & (1 << i)) == 0){
1107                                             avrcp_controller_emit_notification_complete(connection, ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE, (uint8_t) i, false);
1108                                             connection->controller_notifications_to_register &= ~(1 << i);
1109                                         }
1110                                     }
1111                                 }
1112                                 break;
1113                             }
1114                             // supported events are emitted only if the get supported events query
1115                             // is triggered by avrcp_controller_get_supported_events call
1116                             avrcp_controller_emit_supported_events(connection);
1117                             break;
1118 
1119                         default:
1120                             // ignore
1121                             break;
1122                     }
1123                     break;
1124                 }
1125 
1126                 case AVRCP_PDU_ID_GET_PLAY_STATUS:{
1127                     uint32_t song_length = big_endian_read_32(packet, pos);
1128                     pos += 4;
1129                     uint32_t song_position = big_endian_read_32(packet, pos);
1130                     pos += 4;
1131                     uint8_t play_status = packet[pos];
1132 
1133                     uint8_t event[15];
1134                     int offset = 0;
1135                     event[offset++] = HCI_EVENT_AVRCP_META;
1136                     event[offset++] = sizeof(event) - 2;
1137                     event[offset++] = AVRCP_SUBEVENT_PLAY_STATUS;
1138                     little_endian_store_16(event, offset, connection->avrcp_cid);
1139                     offset += 2;
1140                     event[offset++] = ctype;
1141                     little_endian_store_32(event, offset, song_length);
1142                     offset += 4;
1143                     little_endian_store_32(event, offset, song_position);
1144                     offset += 4;
1145                     event[offset++] = play_status;
1146                     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
1147                     break;
1148                 }
1149 
1150                 case AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES:
1151                     switch (vendor_dependent_avrcp_packet_type){
1152                         case AVRCP_START_PACKET:
1153                         case AVRCP_SINGLE_PACKET:
1154                             avrcp_parser_reset(connection);
1155                             connection->list_size = param_length;
1156                             // num_attributes
1157                             pos++;
1158 
1159                             avrcp_controller_parse_and_emit_element_attrs(packet+pos, size-pos, connection, ctype);
1160                             if (vendor_dependent_avrcp_packet_type == AVRCP_START_PACKET){
1161                                 avrcp_controller_request_continue_response(connection);
1162                                 return;
1163                             }
1164                             break;
1165                         case AVRCP_CONTINUE_PACKET:
1166                         case AVRCP_END_PACKET:
1167                             connection->controller_num_received_fragments++;
1168 
1169                             if (connection->controller_num_received_fragments < connection->controller_max_num_fragments){
1170                                 avrcp_controller_parse_and_emit_element_attrs(packet+pos, size-pos, connection, ctype);
1171 
1172                                 if (vendor_dependent_avrcp_packet_type == AVRCP_CONTINUE_PACKET){
1173                                     avrcp_controller_request_continue_response(connection);
1174                                     return;
1175                                 }
1176                             } else {
1177                                 avrcp_controller_emit_now_playing_info_event_done(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, 1);
1178                                 avrcp_parser_reset(connection);
1179                                 avrcp_controller_request_abort_continuation(connection);
1180                                 return;
1181                             }
1182                             break;
1183                         default:
1184                             btstack_assert(false);
1185                             break;
1186                     }
1187                     break;
1188 
1189                 default:
1190                     // custom command response comes here
1191                     switch (pdu_id){
1192                         case AVRCP_PDU_ID_REQUEST_ABORT_CONTINUING_RESPONSE:
1193                             avrcp_controller_emit_now_playing_info_event_done(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, 0);
1194                             break;
1195                         default:
1196                             if (pdu_id != connection->pdu_id) {
1197                                 break;
1198                             }
1199                             uint8_t *in_place_buffer = packet + pos - 9;
1200                             avrcp_controller_prepare_custom_command_response(connection, param_length,
1201                                                                              in_place_buffer);
1202                             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, in_place_buffer,
1203                                                                        param_length + 9);
1204 
1205                             break;
1206                     }
1207                     break;
1208             }
1209             break;
1210         case AVRCP_CMD_OPCODE_PASS_THROUGH:{
1211             if ((size - pos) < 1) return;
1212             uint8_t operation_id = packet[pos++];
1213             switch (connection->state){
1214                 case AVCTP_W2_RECEIVE_PRESS_RESPONSE:
1215                     // trigger release for simple command:
1216                     if (!connection->controller_press_and_hold_cmd_active){
1217                         connection->state = AVCTP_W2_SEND_RELEASE_COMMAND;
1218                         break;
1219                     }
1220                     // for press and hold, send release if it just has been requested, otherwise, wait for next repeat
1221                     if (connection->controller_press_and_hold_cmd_release){
1222                         connection->controller_press_and_hold_cmd_release = false;
1223                         connection->state = AVCTP_W2_SEND_RELEASE_COMMAND;
1224                     } else {
1225                         connection->state = AVCTP_W4_STOP;
1226                     }
1227                     break;
1228                 case AVCTP_W2_RECEIVE_RESPONSE:
1229                     connection->state = AVCTP_CONNECTION_OPENED;
1230                     break;
1231                 default:
1232                     break;
1233             }
1234             if (connection->state == AVCTP_W4_STOP){
1235                 avrcp_controller_emit_operation_status(avrcp_controller_context.avrcp_callback, AVRCP_SUBEVENT_OPERATION_START, connection->avrcp_cid, ctype, operation_id);
1236             }
1237             if (connection->state == AVCTP_CONNECTION_OPENED) {
1238                 // RELEASE response
1239                 operation_id = operation_id & 0x7F;
1240                 avrcp_controller_emit_operation_status(avrcp_controller_context.avrcp_callback, AVRCP_SUBEVENT_OPERATION_COMPLETE, connection->avrcp_cid, ctype, operation_id);
1241             }
1242             if (connection->state == AVCTP_W2_SEND_RELEASE_COMMAND){
1243                 // PRESS response
1244                 avrcp_controller_request_pass_through_release_control_cmd(connection);
1245             }
1246             break;
1247         }
1248         default:
1249             break;
1250     }
1251 
1252     // trigger pending notification reqistrations
1253     if ((connection->state == AVCTP_CONNECTION_OPENED) && connection->controller_notifications_to_register){
1254         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1255     }
1256 }
1257 
1258 static void avrcp_controller_handle_can_send_now(avrcp_connection_t * connection){
1259     // identifier (9) + num attributes (1) + attributes (4 * num attributes)
1260     uint8_t get_element_attributes_command[9+8*((AVRCP_MEDIA_ATTR_RESERVED-AVRCP_MEDIA_ATTR_TITLE) + 1)];
1261     uint16_t pos;
1262     uint16_t num_attributes_index;
1263     uint8_t i;
1264 
1265     switch (connection->state){
1266         case AVCTP_W2_SEND_PRESS_COMMAND:
1267             avrcp_send_cmd_with_avctp_fragmentation(connection);
1268             connection->state = AVCTP_W2_RECEIVE_PRESS_RESPONSE;
1269             return;
1270 
1271         case AVCTP_W2_SEND_RELEASE_COMMAND:
1272             avrcp_send_cmd_with_avctp_fragmentation(connection);
1273             connection->state = AVCTP_W2_RECEIVE_RESPONSE;
1274             return;
1275 
1276         case AVCTP_W2_SEND_COMMAND:
1277             avrcp_send_cmd_with_avctp_fragmentation(connection);
1278             if (connection->data_offset < connection->data_len){
1279                 // continue AVCTP fragmentation
1280                 avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1281                 return;
1282             }
1283             connection->state = AVCTP_W2_RECEIVE_RESPONSE;
1284             return;
1285         case AVCTP_W2_SEND_GET_ELEMENT_ATTRIBUTES_REQUEST:
1286             // build command in local buffer
1287             pos = 0;
1288             connection->data = get_element_attributes_command;
1289             // write identifier
1290             memset(connection->data, 0, 8);
1291             pos += 8;
1292             num_attributes_index = pos;
1293             // If num_attributes is set to zero, all attribute information shall be returned,
1294             // and the AttributeID field is omitted
1295             connection->data[num_attributes_index] = 0;
1296             pos++;
1297             for (i = 0; i < AVRCP_MEDIA_ATTR_RESERVED-AVRCP_MEDIA_ATTR_TITLE; i++){
1298                 if ((connection->controller_element_attributes & (1<<i)) != 0){
1299                     // every attribute is 4 bytes long
1300                     big_endian_store_32(connection->data, pos, AVRCP_MEDIA_ATTR_TITLE + i);
1301                     pos += 4;
1302                     connection->data[num_attributes_index]++;
1303                 }
1304             }
1305 
1306             // Parameter Length
1307             connection->data_len = pos;
1308 
1309             log_info("AVCTP_W2_SEND_GET_ELEMENT_ATTRIBUTES_REQUEST, len %u", connection->data_len);
1310 
1311             // send data - assume it will fit into one packet
1312             avrcp_send_cmd_with_avctp_fragmentation(connection);
1313             connection->state = AVCTP_W2_RECEIVE_RESPONSE;
1314             return;
1315         default:
1316             break;
1317     }
1318 
1319     // send register notification if queued,
1320     // avrcp_handle_l2cap_data_packet_for_signaling_connection will trigger next one
1321     if (connection->controller_notifications_to_register != 0){
1322         uint8_t event_id;
1323         for (event_id = (uint8_t)AVRCP_NOTIFICATION_EVENT_FIRST_INDEX; event_id < (uint8_t)AVRCP_NOTIFICATION_EVENT_LAST_INDEX; event_id++){
1324             if (connection->controller_notifications_to_register & (1 << event_id)){
1325                 connection->controller_notifications_to_register &= ~ (1 << event_id);
1326                 avrcp_send_register_notification(connection, event_id);
1327                 return;
1328             }
1329         }
1330     }
1331 }
1332 
1333 static void avrcp_controller_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1334     avrcp_connection_t * connection;
1335 
1336     switch (packet_type) {
1337         case L2CAP_DATA_PACKET:
1338             connection = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_CONTROLLER, channel);
1339             avrcp_handle_l2cap_data_packet_for_signaling_connection(connection, packet, size);
1340             break;
1341 
1342         case HCI_EVENT_PACKET:
1343             switch (hci_event_packet_get_type(packet)){
1344                 case L2CAP_EVENT_CAN_SEND_NOW:
1345                     connection = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_CONTROLLER, channel);
1346                     avrcp_controller_handle_can_send_now(connection);
1347                     break;
1348             default:
1349                 break;
1350         }
1351         default:
1352             break;
1353     }
1354 }
1355 
1356 void avrcp_controller_create_sdp_record(uint8_t * service, uint32_t service_record_handle, uint16_t supported_features, const char * service_name, const char * service_provider_name){
1357     avrcp_create_sdp_record(true, service, service_record_handle, avrcp_controller_supports_browsing(supported_features), supported_features, service_name, service_provider_name);
1358 }
1359 
1360 void avrcp_controller_init(void){
1361     avrcp_controller_context.role = AVRCP_CONTROLLER;
1362     avrcp_controller_context.packet_handler = avrcp_controller_packet_handler;
1363     avrcp_register_controller_packet_handler(&avrcp_controller_packet_handler);
1364 }
1365 
1366 void avrcp_controller_deinit(void){
1367     memset(&avrcp_controller_context, 0, sizeof(avrcp_context_t));
1368 }
1369 
1370 void avrcp_controller_register_packet_handler(btstack_packet_handler_t callback){
1371     btstack_assert(callback != NULL);
1372     avrcp_controller_context.avrcp_callback = callback;
1373 }
1374 
1375 
1376 uint8_t avrcp_controller_play(uint16_t avrcp_cid){
1377     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PLAY, 0);
1378 }
1379 
1380 uint8_t avrcp_controller_stop(uint16_t avrcp_cid){
1381     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_STOP, 0);
1382 }
1383 
1384 uint8_t avrcp_controller_pause(uint16_t avrcp_cid){
1385     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PAUSE, 0);
1386 }
1387 
1388 uint8_t avrcp_controller_forward(uint16_t avrcp_cid){
1389     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FORWARD, 0);
1390 }
1391 
1392 uint8_t avrcp_controller_backward(uint16_t avrcp_cid){
1393     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_BACKWARD, 0);
1394 }
1395 
1396 uint8_t avrcp_controller_volume_up(uint16_t avrcp_cid){
1397     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_UP, 0);
1398 }
1399 
1400 uint8_t avrcp_controller_volume_down(uint16_t avrcp_cid){
1401     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_DOWN, 0);
1402 }
1403 
1404 uint8_t avrcp_controller_mute(uint16_t avrcp_cid){
1405     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_MUTE, 0);
1406 }
1407 
1408 uint8_t avrcp_controller_skip(uint16_t avrcp_cid){
1409     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_SKIP, 0);
1410 }
1411 
1412 uint8_t avrcp_controller_fast_forward(uint16_t avrcp_cid){
1413     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FAST_FORWARD, 0);
1414 }
1415 
1416 uint8_t avrcp_controller_rewind(uint16_t avrcp_cid){
1417     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_REWIND, 0);
1418 }
1419 
1420 /* start continuous cmds */
1421 
1422 uint8_t avrcp_controller_start_press_and_hold_cmd(uint16_t avrcp_cid, avrcp_operation_id_t operation_id){
1423     return request_continuous_pass_through_press_control_cmd(avrcp_cid, operation_id, 0);
1424 }
1425 
1426 uint8_t avrcp_controller_press_and_hold_play(uint16_t avrcp_cid){
1427     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PLAY, 0);
1428 }
1429 uint8_t avrcp_controller_press_and_hold_stop(uint16_t avrcp_cid){
1430     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_STOP, 0);
1431 }
1432 uint8_t avrcp_controller_press_and_hold_pause(uint16_t avrcp_cid){
1433     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PAUSE, 0);
1434 }
1435 uint8_t avrcp_controller_press_and_hold_forward(uint16_t avrcp_cid){
1436     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FORWARD, 0);
1437 }
1438 uint8_t avrcp_controller_press_and_hold_backward(uint16_t avrcp_cid){
1439     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_BACKWARD, 0);
1440 }
1441 uint8_t avrcp_controller_press_and_hold_fast_forward(uint16_t avrcp_cid){
1442     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FAST_FORWARD, 0);
1443 }
1444 uint8_t avrcp_controller_press_and_hold_rewind(uint16_t avrcp_cid){
1445     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_REWIND, 0);
1446 }
1447 uint8_t avrcp_controller_press_and_hold_volume_up(uint16_t avrcp_cid){
1448     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_UP, 0);
1449 }
1450 uint8_t avrcp_controller_press_and_hold_volume_down(uint16_t avrcp_cid){
1451     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_DOWN, 0);
1452 }
1453 uint8_t avrcp_controller_press_and_hold_mute(uint16_t avrcp_cid){
1454     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_MUTE, 0);
1455 }
1456 
1457 /* stop continuous cmds */
1458 uint8_t avrcp_controller_release_press_and_hold_cmd(uint16_t avrcp_cid){
1459     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1460     if (!connection){
1461         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1462     }
1463 
1464     switch (connection->state){
1465         // respond when we receive response for (repeated) press command
1466         case AVCTP_W2_RECEIVE_PRESS_RESPONSE:
1467             connection->controller_press_and_hold_cmd_release = true;
1468             break;
1469 
1470         // release already sent or on the way, nothing to do
1471         case AVCTP_W2_RECEIVE_RESPONSE:
1472         case AVCTP_W2_SEND_RELEASE_COMMAND:
1473             break;
1474 
1475         // about to send next repeated press command or wait for it -> release right away
1476         case AVCTP_W2_SEND_PRESS_COMMAND:
1477         case AVCTP_W4_STOP:
1478             return avrcp_controller_request_pass_through_release_control_cmd(connection);
1479 
1480         // otherwise reject request
1481         default:
1482             return ERROR_CODE_COMMAND_DISALLOWED;
1483     }
1484     return ERROR_CODE_SUCCESS;
1485 }
1486 
1487 uint8_t avrcp_controller_enable_notification(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id){
1488     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1489     if (!connection){
1490         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1491     }
1492     return avrcp_controller_register_notification(connection, event_id);
1493 }
1494 
1495 uint8_t avrcp_controller_disable_notification(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id){
1496     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1497     if (!connection){
1498         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1499     }
1500     if (connection->remote_capabilities_state != AVRCP_REMOTE_CAPABILITIES_KNOWN){
1501         return ERROR_CODE_COMMAND_DISALLOWED;
1502     }
1503 
1504     if ((connection->notifications_supported_by_target & (1 << event_id)) == 0){
1505         return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
1506     }
1507 
1508     if ((connection->notifications_enabled & (1 << event_id)) == 0){
1509         return ERROR_CODE_SUCCESS;
1510     }
1511 
1512     connection->controller_notifications_to_deregister |= (1 << event_id);
1513     return ERROR_CODE_SUCCESS;
1514 }
1515 
1516 uint8_t avrcp_controller_unit_info(uint16_t avrcp_cid){
1517     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1518     if (!connection){
1519         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1520     }
1521     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1522 
1523     connection->state = AVCTP_W2_SEND_COMMAND;
1524     avrcp_controller_custom_command_data_init(connection, AVRCP_CMD_OPCODE_UNIT_INFO, AVRCP_CTYPE_STATUS,
1525                                               AVRCP_SUBUNIT_TYPE_UNIT, AVRCP_SUBUNIT_ID_IGNORE, AVRCP_PDU_ID_UNDEFINED,
1526                                               0);
1527 
1528     connection->data = connection->message_body;
1529     memset(connection->data, 0xFF, 5);
1530     connection->data_len = 5;
1531     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1532     return ERROR_CODE_SUCCESS;
1533 }
1534 
1535 uint8_t avrcp_controller_subunit_info(uint16_t avrcp_cid){
1536     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1537     if (!connection){
1538         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1539     }
1540     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1541 
1542     connection->state = AVCTP_W2_SEND_COMMAND;
1543     avrcp_controller_custom_command_data_init(connection, AVRCP_CMD_OPCODE_SUBUNIT_INFO, AVRCP_CTYPE_STATUS,
1544                                               AVRCP_SUBUNIT_TYPE_UNIT, AVRCP_SUBUNIT_ID_IGNORE, AVRCP_PDU_ID_UNDEFINED,
1545                                               0);
1546 
1547     connection->data = connection->message_body;
1548     memset(connection->data, 0xFF, 5);
1549     connection->data[0] = 7; // page: 0, extension_code: 7
1550     connection->data_len = 5;
1551     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1552     return ERROR_CODE_SUCCESS;
1553 }
1554 
1555 uint8_t avrcp_controller_get_supported_company_ids(uint16_t avrcp_cid){
1556     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1557     if (!connection){
1558         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1559     }
1560     if (connection->state != AVCTP_CONNECTION_OPENED){
1561         return ERROR_CODE_COMMAND_DISALLOWED;
1562     }
1563     avrcp_controller_get_capabilities_for_connection(connection, AVRCP_CAPABILITY_ID_COMPANY);
1564     return ERROR_CODE_SUCCESS;
1565 }
1566 
1567 uint8_t avrcp_controller_get_supported_events(uint16_t avrcp_cid){
1568     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1569     if (!connection){
1570         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1571     }
1572     if (connection->state != AVCTP_CONNECTION_OPENED){
1573         return ERROR_CODE_COMMAND_DISALLOWED;
1574     }
1575 
1576     switch (connection->remote_capabilities_state){
1577         case AVRCP_REMOTE_CAPABILITIES_NONE:
1578             connection->remote_capabilities_state = AVRCP_REMOTE_CAPABILITIES_W4_QUERY_RESULT;
1579             avrcp_controller_get_capabilities_for_connection(connection, AVRCP_CAPABILITY_ID_EVENT);
1580             break;
1581         case AVRCP_REMOTE_CAPABILITIES_KNOWN:
1582             avrcp_controller_emit_supported_events(connection);
1583             break;
1584         default:
1585             break;
1586     }
1587     return ERROR_CODE_SUCCESS;
1588 }
1589 
1590 uint8_t avrcp_controller_get_play_status(uint16_t avrcp_cid){
1591     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1592     if (!connection){
1593         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1594     }
1595     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1596 
1597     connection->state = AVCTP_W2_SEND_COMMAND;
1598     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_STATUS, AVRCP_PDU_ID_GET_PLAY_STATUS, true);
1599 
1600     connection->data_len = 0;
1601     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1602     return ERROR_CODE_SUCCESS;
1603 }
1604 
1605 uint8_t avrcp_controller_set_addressed_player(uint16_t avrcp_cid, uint16_t addressed_player_id){
1606     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1607     if (!connection){
1608         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1609     }
1610     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1611 
1612     connection->state = AVCTP_W2_SEND_COMMAND;
1613     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_SET_ADDRESSED_PLAYER, true);
1614 
1615     connection->data_len = 2;
1616     big_endian_store_16(connection->data, 0, addressed_player_id);
1617 
1618     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1619     return ERROR_CODE_SUCCESS;
1620 }
1621 
1622 uint8_t avrcp_controller_get_element_attributes(uint16_t avrcp_cid, uint8_t num_attributes, avrcp_media_attribute_id_t * attributes){
1623     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1624     if (!connection){
1625         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1626     }
1627 
1628     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1629 
1630     if (num_attributes >= AVRCP_MEDIA_ATTR_RESERVED) {
1631         return ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
1632     }
1633 
1634     connection->state = AVCTP_W2_SEND_GET_ELEMENT_ATTRIBUTES_REQUEST;
1635     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_STATUS, AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES, true);
1636 
1637     // collect element attributes
1638     uint8_t i;
1639     uint16_t attributes_set = 0;
1640     for (i = 0; i < num_attributes; i++){
1641         // ignore invalid attribute ID and "get all attributes"
1642         if (AVRCP_MEDIA_ATTR_ALL < attributes[i] && attributes[i] < AVRCP_MEDIA_ATTR_RESERVED){
1643             attributes_set |= 1 << (attributes[i] - AVRCP_MEDIA_ATTR_TITLE);
1644         }
1645     }
1646     connection->controller_element_attributes = attributes_set;
1647 
1648     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1649     return ERROR_CODE_SUCCESS;
1650 }
1651 
1652 uint8_t avrcp_controller_get_now_playing_info(uint16_t avrcp_cid){
1653     return avrcp_controller_get_element_attributes(avrcp_cid, 0, NULL);
1654 }
1655 
1656 uint8_t avrcp_controller_get_now_playing_info_for_media_attribute_id(uint16_t avrcp_cid, avrcp_media_attribute_id_t media_attribute_id){
1657     if (media_attribute_id == AVRCP_MEDIA_ATTR_ALL){
1658         return avrcp_controller_get_now_playing_info(avrcp_cid);
1659     }
1660     avrcp_media_attribute_id_t media_attrs[1];
1661     media_attrs[0] = media_attribute_id;
1662     return avrcp_controller_get_element_attributes(avrcp_cid, 1, media_attrs);
1663 }
1664 
1665 uint8_t avrcp_controller_set_absolute_volume(uint16_t avrcp_cid, uint8_t volume){
1666      avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1667     if (!connection){
1668         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1669     }
1670 
1671     //
1672     // allow sending of multiple set abs volume commands without waiting for response
1673     //
1674     uint8_t status = ERROR_CODE_COMMAND_DISALLOWED;
1675     switch (connection->state){
1676         case AVCTP_CONNECTION_OPENED:
1677             status = ERROR_CODE_SUCCESS;
1678             break;
1679         case AVCTP_W2_RECEIVE_RESPONSE:
1680             // - is pending response also set abs volume
1681             if (connection->command_opcode  != AVRCP_CMD_OPCODE_VENDOR_DEPENDENT) break;
1682             if (connection->command_type    != AVRCP_CTYPE_CONTROL)               break;
1683             if (connection->subunit_type    != AVRCP_SUBUNIT_TYPE_PANEL)          break;
1684             if (connection->subunit_id      != AVRCP_SUBUNIT_ID)                  break;
1685             if (connection->pdu_id          != AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME)  break;
1686             // - is next transaction id valid in window
1687             if (avrcp_controller_is_transaction_id_valid(connection, avrcp_controller_calc_next_transaction_label(connection->transaction_id_counter)) == false) break;
1688             status = ERROR_CODE_SUCCESS;
1689             break;
1690         default:
1691             break;
1692     }
1693     if (status != ERROR_CODE_SUCCESS) return status;
1694 
1695     connection->state = AVCTP_W2_SEND_COMMAND;
1696     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME, true);
1697 
1698     // Parameter Length
1699     connection->data_len = 1;
1700     connection->data[0] = volume;
1701 
1702     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1703     return ERROR_CODE_SUCCESS;
1704 }
1705 
1706 uint8_t avrcp_controller_query_shuffle_and_repeat_modes(uint16_t avrcp_cid){
1707     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1708     if (!connection){
1709         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1710     }
1711     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1712 
1713     connection->state = AVCTP_W2_SEND_COMMAND;
1714     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_STATUS, AVRCP_PDU_ID_GET_CURRENT_PLAYER_APPLICATION_SETTING_VALUE, true);
1715 
1716     connection->data_len = 5;
1717     connection->data[0] = 4;                     // NumPlayerApplicationSettingAttributeID
1718     // PlayerApplicationSettingAttributeID1 AVRCP Spec, Appendix F, 133
1719     connection->data[1] = 0x01;   // equalizer  (1-OFF, 2-ON)
1720     connection->data[2] = 0x02;   // repeat     (1-off, 2-single track, 3-all tracks, 4-group repeat)
1721     connection->data[3] = 0x03;   // shuffle    (1-off, 2-all tracks, 3-group shuffle)
1722     connection->data[4] = 0x04;   // scan       (1-off, 2-all tracks, 3-group scan)
1723 
1724     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1725     return ERROR_CODE_SUCCESS;
1726 }
1727 
1728 static uint8_t avrcp_controller_set_current_player_application_setting_value(uint16_t avrcp_cid, uint8_t attr_id, uint8_t attr_value){
1729     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1730     if (!connection){
1731         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1732     }
1733     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1734 
1735     connection->state = AVCTP_W2_SEND_COMMAND;
1736     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_SET_PLAYER_APPLICATION_SETTING_VALUE, true);
1737 
1738     // Parameter Length
1739     connection->data_len = 3;
1740     connection->data[0]  = 2;
1741     connection->data[1]  = attr_id;
1742     connection->data[2]  = attr_value;
1743 
1744     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1745     return ERROR_CODE_SUCCESS;
1746 }
1747 
1748 uint8_t avrcp_controller_set_shuffle_mode(uint16_t avrcp_cid, avrcp_shuffle_mode_t mode){
1749     if ((mode < AVRCP_SHUFFLE_MODE_OFF) || (mode > AVRCP_SHUFFLE_MODE_GROUP)) return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
1750     return avrcp_controller_set_current_player_application_setting_value(avrcp_cid, 0x03, mode);
1751 }
1752 
1753 uint8_t avrcp_controller_set_repeat_mode(uint16_t avrcp_cid, avrcp_repeat_mode_t mode){
1754     if ((mode < AVRCP_REPEAT_MODE_OFF) || (mode > AVRCP_REPEAT_MODE_GROUP)) return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
1755     return avrcp_controller_set_current_player_application_setting_value(avrcp_cid, 0x02, mode);
1756 }
1757 
1758 uint8_t avrcp_controller_play_item_for_scope(uint16_t avrcp_cid, uint8_t * uid, uint16_t uid_counter, avrcp_browsing_scope_t scope){
1759     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1760     if (!connection){
1761         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1762     }
1763     if (connection->state != AVCTP_CONNECTION_OPENED){
1764         log_error("Connection in wrong state, expected %d, received %d", AVCTP_CONNECTION_OPENED, connection->state);
1765         return ERROR_CODE_COMMAND_DISALLOWED;
1766     }
1767     connection->state = AVCTP_W2_SEND_COMMAND;
1768     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_PLAY_ITEM, true);
1769 
1770     // Parameter Length
1771     connection->data_len = 11;
1772     connection->data[0]  = scope;
1773     memset(&connection->data[1], 0, 8);
1774     if (uid){
1775         (void)memcpy(&connection->data[1], uid, 8);
1776     }
1777     big_endian_store_16(connection->data, 9, uid_counter);
1778 
1779     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1780     return ERROR_CODE_SUCCESS;
1781 }
1782 
1783 uint8_t avrcp_controller_add_item_from_scope_to_now_playing_list(uint16_t avrcp_cid, uint8_t * uid, uint16_t uid_counter, avrcp_browsing_scope_t scope){
1784     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1785     if (!connection){
1786         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1787     }
1788     if (connection->state != AVCTP_CONNECTION_OPENED){
1789         log_error("Connection in wrong state, expected %d, received %d", AVCTP_CONNECTION_OPENED, connection->state);
1790         return ERROR_CODE_COMMAND_DISALLOWED;
1791     }
1792 
1793     connection->state = AVCTP_W2_SEND_COMMAND;
1794     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_ADD_TO_NOW_PLAYING, true);
1795 
1796     // Parameter Length
1797     connection->data_len = 11;
1798     connection->data[0]  = scope;
1799     memset(&connection->data[1], 0, 8);
1800     if (uid){
1801         (void)memcpy(&connection->data[1], uid, 8);
1802     }
1803     big_endian_store_16(connection->data, 9, uid_counter);
1804 
1805     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1806     return ERROR_CODE_SUCCESS;
1807 }
1808 
1809 uint8_t avrcp_controller_set_max_num_fragments(uint16_t avrcp_cid, uint8_t max_num_fragments){
1810     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1811     if (!connection){
1812         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1813     }
1814     connection->controller_max_num_fragments = max_num_fragments;
1815     return ERROR_CODE_SUCCESS;
1816 }
1817 
1818 
1819 uint8_t avrcp_controller_send_custom_command(uint16_t avrcp_cid,
1820     avrcp_command_type_t command_type,
1821     avrcp_subunit_type_t subunit_type, avrcp_subunit_id_t subunit_id,
1822     avrcp_pdu_id_t pdu_id, uint32_t company_id,
1823     const uint8_t * data, uint16_t data_len){
1824 
1825     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1826     if (!connection){
1827         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1828     }
1829     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1830 
1831     connection->state = AVCTP_W2_SEND_COMMAND;
1832     avrcp_controller_custom_command_data_init(connection, AVRCP_CMD_OPCODE_VENDOR_DEPENDENT, command_type, subunit_type,
1833                                               subunit_id, pdu_id, company_id);
1834 
1835     connection->data = (uint8_t *)data;
1836     connection->data_len = data_len;
1837 
1838     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1839     return ERROR_CODE_SUCCESS;
1840 }
1841 
1842 uint8_t avrcp_controller_force_send_press_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid){
1843     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1844     if (!connection){
1845         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1846     }
1847     if (connection->state < AVCTP_CONNECTION_OPENED){
1848         return ERROR_CODE_COMMAND_DISALLOWED;
1849     }
1850 
1851     connection->state = AVCTP_W2_SEND_COMMAND;
1852     avrcp_controller_pass_through_command_data_init(connection, opid);
1853     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1854     return ERROR_CODE_SUCCESS;
1855 }