xref: /btstack/src/classic/avrcp_controller.c (revision 2b3e0ec01eed7fa5a1ab18f9a5170c683e61b552)
1 /*
2  * Copyright (C) 2016 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
24  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "avrcp_controller.c"
39 
40 #include <stdint.h>
41 #include <string.h>
42 #include <inttypes.h>
43 
44 #include "classic/avrcp.h"
45 #include "classic/avrcp_controller.h"
46 
47 #include "bluetooth_sdp.h"
48 #include "btstack_debug.h"
49 #include "btstack_event.h"
50 
51 static const char * avrcp_default_controller_service_name = "AVRCP Controller";
52 static const char * avrcp_default_controller_service_provider_name = "BlueKitchen";
53 
54 // made public in avrcp_controller.h
55 avrcp_context_t avrcp_controller_context;
56 
57 static uint8_t avrcp_controller_calc_next_transaction_label(uint8_t current_transaction_label){
58     current_transaction_label++;
59     if (current_transaction_label == 16){
60         current_transaction_label = 1;
61     }
62     return current_transaction_label;
63 }
64 
65 static uint8_t avrcp_controller_get_next_transaction_label(avrcp_connection_t * connection){
66     connection->transaction_id_counter = avrcp_controller_calc_next_transaction_label(connection->transaction_id_counter);
67     return connection->transaction_id_counter;
68 }
69 
70 static bool avrcp_controller_is_transaction_id_valid(avrcp_connection_t * connection, uint8_t transaction_id){
71     uint8_t delta = ((int8_t) transaction_id - connection->controller_last_confirmed_transaction_id) & 0x0f;
72     return delta < 15;
73 }
74 
75 static void avrcp_controller_custom_command_data_init(avrcp_connection_t * connection,
76                                                       avrcp_command_opcode_t opcode, avrcp_command_type_t command_type,
77                                                       avrcp_subunit_type_t subunit_type, avrcp_subunit_id_t subunit_id,
78                                                       avrcp_pdu_id_t pdu_id, uint32_t company_id){
79 
80     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
81     connection->command_opcode = opcode;
82     connection->command_type = command_type;
83     connection->subunit_type = subunit_type;
84     connection->subunit_id = subunit_id;
85     connection->company_id = company_id;
86     connection->pdu_id = pdu_id;
87     connection->data = NULL;
88     connection->data_offset = 0;
89     connection->data_len = 0;
90 }
91 
92 static void avrcp_controller_vendor_dependent_command_data_init(avrcp_connection_t * connection, avrcp_command_type_t command_type, avrcp_pdu_id_t pdu_id, bool get_next_transaction_label){
93     if (get_next_transaction_label){
94         connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
95     }
96     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
97     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
98     connection->subunit_id = AVRCP_SUBUNIT_ID;
99     connection->company_id = BT_SIG_COMPANY_ID;
100 
101     connection->command_type = command_type;
102     connection->pdu_id = pdu_id;
103     connection->data = connection->message_body;
104     connection->data_offset = 0;
105     connection->data_len = 0;
106 }
107 
108 static void avrcp_controller_pass_through_command_data_init(avrcp_connection_t * connection, avrcp_operation_id_t opid){
109     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
110     connection->command_opcode =  AVRCP_CMD_OPCODE_PASS_THROUGH;
111     connection->command_type = AVRCP_CTYPE_CONTROL;
112     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
113     connection->subunit_id =   AVRCP_SUBUNIT_ID;
114 
115     connection->company_id = 0;
116     connection->pdu_id = AVRCP_PDU_ID_UNDEFINED;
117     connection->operation_id = opid;
118 
119     connection->data = connection->message_body;
120     connection->data_offset = 0;
121     connection->data_len = 0;
122 }
123 
124 static int avrcp_controller_supports_browsing(uint16_t controller_supported_features){
125     return controller_supported_features & AVRCP_FEATURE_MASK_BROWSING;
126 }
127 
128 static void avrcp_controller_prepare_custom_command_response(avrcp_connection_t * connection, uint16_t response_len, uint8_t * in_place_buffer){
129     uint8_t pos = 0;
130     in_place_buffer[pos++] = HCI_EVENT_AVRCP_META;
131     // skip len
132     pos++;
133     in_place_buffer[pos++] = AVRCP_SUBEVENT_CUSTOM_COMMAND_RESPONSE;
134     little_endian_store_16(in_place_buffer, pos, connection->avrcp_cid);
135     pos += 2;
136     in_place_buffer[pos++] = (uint8_t)connection->command_type;
137     in_place_buffer[pos++] = (uint8_t)connection->pdu_id;
138     little_endian_store_16(in_place_buffer, pos, response_len);
139     pos += 2;
140     in_place_buffer[1] = pos + response_len - 2;
141 }
142 
143 static void avrcp_controller_emit_notification_complete(avrcp_connection_t * connection, uint8_t status, uint8_t event_id, bool enabled){
144     uint8_t event[8];
145     uint8_t pos = 0;
146     event[pos++] = HCI_EVENT_AVRCP_META;
147     event[pos++] = sizeof(event) - 2;
148     event[pos++] = AVRCP_SUBEVENT_NOTIFICATION_STATE;
149     little_endian_store_16(event, pos, connection->avrcp_cid);
150     pos += 2;
151     event[pos++] = status;
152     event[pos++] = enabled ? 1 : 0;
153     event[pos++] = event_id;
154     UNUSED(pos);
155     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
156 }
157 
158 static void avrcp_controller_emit_supported_events(avrcp_connection_t * connection){
159     uint8_t ctype = (uint8_t) AVRCP_CTYPE_RESPONSE_CHANGED_STABLE;
160     uint8_t event_id;
161 
162     for (event_id = (uint8_t) AVRCP_NOTIFICATION_EVENT_FIRST_INDEX; event_id < (uint8_t) AVRCP_NOTIFICATION_EVENT_LAST_INDEX; event_id++){
163         if ((connection->notifications_supported_by_target & (1 << event_id)) == 0){
164             continue;
165         }
166         uint8_t event[8];
167         uint8_t pos = 0;
168         event[pos++] = HCI_EVENT_AVRCP_META;
169         event[pos++] = sizeof(event) - 2;
170         event[pos++] = AVRCP_SUBEVENT_GET_CAPABILITY_EVENT_ID;
171         little_endian_store_16(event, pos, connection->avrcp_cid);
172         pos += 2;
173         event[pos++] = ctype;
174         event[pos++] = 0;
175         event[pos++] = event_id;
176         UNUSED(pos);
177         (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
178     }
179 
180     uint8_t event[7];
181     uint8_t pos = 0;
182     event[pos++] = HCI_EVENT_AVRCP_META;
183     event[pos++] = sizeof(event) - 2;
184     event[pos++] = AVRCP_SUBEVENT_GET_CAPABILITY_EVENT_ID_DONE;
185     little_endian_store_16(event, pos, connection->avrcp_cid);
186     pos += 2;
187     event[pos++] = ctype;
188     event[pos++] = 0;
189     UNUSED(pos);
190     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
191 }
192 
193 static void avrcp_controller_emit_notification_for_event_id(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id,
194                                                             avrcp_command_type_t ctype, const uint8_t *payload,
195                                                             uint16_t size) {
196     switch (event_id){
197         case AVRCP_NOTIFICATION_EVENT_PLAYBACK_POS_CHANGED:{
198             if (size < 4) break;
199             uint32_t song_position = big_endian_read_32(payload, 0);
200             uint16_t offset = 0;
201             uint8_t event[10];
202             event[offset++] = HCI_EVENT_AVRCP_META;
203             event[offset++] = sizeof(event) - 2;
204             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_PLAYBACK_POS_CHANGED;
205             little_endian_store_16(event, offset, avrcp_cid);
206             offset += 2;
207             event[offset++] = ctype;
208             little_endian_store_32(event, offset, song_position);
209             offset += 4;
210             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
211             break;
212         }
213         case AVRCP_NOTIFICATION_EVENT_PLAYBACK_STATUS_CHANGED:{
214             if (size < 1) break;
215             uint16_t offset = 0;
216             uint8_t event[7];
217             event[offset++] = HCI_EVENT_AVRCP_META;
218             event[offset++] = sizeof(event) - 2;
219             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_PLAYBACK_STATUS_CHANGED;
220             little_endian_store_16(event, offset, avrcp_cid);
221             offset += 2;
222             event[offset++] = ctype;
223             event[offset++] = payload[0];
224             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
225             break;
226         }
227         case AVRCP_NOTIFICATION_EVENT_TRACK_CHANGED:{
228             uint16_t offset = 0;
229             uint8_t event[6];
230             event[offset++] = HCI_EVENT_AVRCP_META;
231             event[offset++] = sizeof(event) - 2;
232             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_TRACK_CHANGED;
233             little_endian_store_16(event, offset, avrcp_cid);
234             offset += 2;
235             event[offset++] = ctype;
236             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
237             break;
238         }
239         case AVRCP_NOTIFICATION_EVENT_NOW_PLAYING_CONTENT_CHANGED:{
240             uint16_t offset = 0;
241             uint8_t event[6];
242             event[offset++] = HCI_EVENT_AVRCP_META;
243             event[offset++] = sizeof(event) - 2;
244             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_NOW_PLAYING_CONTENT_CHANGED;
245             little_endian_store_16(event, offset, avrcp_cid);
246             offset += 2;
247             event[offset++] = ctype;
248             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
249             break;
250         }
251         case AVRCP_NOTIFICATION_EVENT_AVAILABLE_PLAYERS_CHANGED:{
252             uint16_t offset = 0;
253             uint8_t event[6];
254             event[offset++] = HCI_EVENT_AVRCP_META;
255             event[offset++] = sizeof(event) - 2;
256             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_AVAILABLE_PLAYERS_CHANGED;
257             little_endian_store_16(event, offset, avrcp_cid);
258             offset += 2;
259             event[offset++] = ctype;
260             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
261             break;
262         }
263         case AVRCP_NOTIFICATION_EVENT_VOLUME_CHANGED:{
264             if (size < 1) break;
265             uint16_t offset = 0;
266             uint8_t event[7];
267             event[offset++] = HCI_EVENT_AVRCP_META;
268             event[offset++] = sizeof(event) - 2;
269             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_VOLUME_CHANGED;
270             little_endian_store_16(event, offset, avrcp_cid);
271             offset += 2;
272             event[offset++] = ctype;
273             event[offset++] = payload[0] & 0x7F;
274             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
275             break;
276         }
277         case AVRCP_NOTIFICATION_EVENT_UIDS_CHANGED:{
278             if (size < 2) break;
279             uint8_t event[8];
280             uint16_t offset = 0;
281             uint16_t uuid = big_endian_read_16(payload, 0);
282             event[offset++] = HCI_EVENT_AVRCP_META;
283             event[offset++] = sizeof(event) - 2;
284             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_UIDS_CHANGED;
285             little_endian_store_16(event, offset, avrcp_cid);
286             offset += 2;
287             event[offset++] = ctype;
288             little_endian_store_16(event, offset, uuid);
289             offset += 2;
290             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
291             break;
292         }
293 
294         case AVRCP_NOTIFICATION_EVENT_TRACK_REACHED_END:{
295             uint16_t offset = 0;
296             uint8_t event[6];
297             event[offset++] = HCI_EVENT_AVRCP_META;
298             event[offset++] = sizeof(event) - 2;
299             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_TRACK_REACHED_END;
300             little_endian_store_16(event, offset, avrcp_cid);
301             offset += 2;
302             event[offset++] = ctype;
303             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
304             break;
305         }
306         case AVRCP_NOTIFICATION_EVENT_TRACK_REACHED_START:{
307             uint16_t offset = 0;
308             uint8_t event[6];
309             event[offset++] = HCI_EVENT_AVRCP_META;
310             event[offset++] = sizeof(event) - 2;
311             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_TRACK_REACHED_START;
312             little_endian_store_16(event, offset, avrcp_cid);
313             offset += 2;
314             event[offset++] = ctype;
315             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
316             break;
317         }
318         case AVRCP_NOTIFICATION_EVENT_BATT_STATUS_CHANGED:{
319             if (size < 1) break;
320             uint16_t offset = 0;
321             uint8_t event[7];
322             event[offset++] = HCI_EVENT_AVRCP_META;
323             event[offset++] = sizeof(event) - 2;
324             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_BATT_STATUS_CHANGED;
325             little_endian_store_16(event, offset, avrcp_cid);
326             offset += 2;
327             event[offset++] = ctype;
328             event[offset++] = payload[0];
329             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
330             break;
331         }
332 
333         case AVRCP_NOTIFICATION_EVENT_SYSTEM_STATUS_CHANGED:{
334             if (size < 1) break;
335             uint16_t offset = 0;
336             uint8_t event[7];
337             event[offset++] = HCI_EVENT_AVRCP_META;
338             event[offset++] = sizeof(event) - 2;
339             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_SYSTEM_STATUS_CHANGED;
340             little_endian_store_16(event, offset, avrcp_cid);
341             offset += 2;
342             event[offset++] = ctype;
343             event[offset++] = payload[0];
344             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
345             break;
346         }
347 
348         case AVRCP_NOTIFICATION_EVENT_PLAYER_APPLICATION_SETTING_CHANGED:
349         default:
350             log_info("avrcp: not implemented");
351             break;
352     }
353 }
354 
355 static void avrcp_controller_emit_repeat_and_shuffle_mode(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t ctype, avrcp_repeat_mode_t repeat_mode, avrcp_shuffle_mode_t shuffle_mode){
356     btstack_assert(callback != NULL);
357 
358     uint8_t event[8];
359     int pos = 0;
360     event[pos++] = HCI_EVENT_AVRCP_META;
361     event[pos++] = sizeof(event) - 2;
362     event[pos++] = AVRCP_SUBEVENT_SHUFFLE_AND_REPEAT_MODE;
363     little_endian_store_16(event, pos, avrcp_cid);
364     pos += 2;
365     event[pos++] = ctype;
366     event[pos++] = repeat_mode;
367     event[pos++] = shuffle_mode;
368     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
369 }
370 
371 static void avrcp_controller_emit_now_playing_info_event_done(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t ctype, uint8_t status){
372     uint8_t event[7];
373     int pos = 0;
374     event[pos++] = HCI_EVENT_AVRCP_META;
375     event[pos++] = sizeof(event) - 2;
376     event[pos++] = AVRCP_SUBEVENT_NOW_PLAYING_INFO_DONE;
377     little_endian_store_16(event, pos, avrcp_cid);
378     pos += 2;
379     event[pos++] = ctype;
380     event[pos++] = status;
381     (*callback)(HCI_EVENT_PACKET, 0, event, pos);
382 }
383 
384 static void avrcp_controller_emit_now_playing_info_event(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t ctype, avrcp_media_attribute_id_t attr_id, uint8_t * value, uint16_t value_len){
385     uint8_t event[HCI_EVENT_BUFFER_SIZE];
386     uint16_t pos = 0;
387     event[pos++] = HCI_EVENT_AVRCP_META;
388     // reserve one byte for subevent type and data len
389 	uint16_t data_len_pos = pos;
390     pos++;
391 	uint16_t subevent_type_pos = pos;
392     pos++;
393     little_endian_store_16(event, pos, avrcp_cid);
394     pos += 2;
395     event[pos++] = ctype;
396 
397     switch (attr_id){
398         case AVRCP_MEDIA_ATTR_TITLE:
399             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_TITLE_INFO;
400 			btstack_assert(value_len <= 255);
401             event[pos++] = (uint8_t) value_len;
402             (void)memcpy(event + pos, value, value_len);
403             break;
404         case AVRCP_MEDIA_ATTR_ARTIST:
405             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_ARTIST_INFO;
406 			btstack_assert(value_len <= 255);
407 			event[pos++] = (uint8_t) value_len;
408             (void)memcpy(event + pos, value, value_len);
409             break;
410         case AVRCP_MEDIA_ATTR_ALBUM:
411             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_ALBUM_INFO;
412 			btstack_assert(value_len <= 255);
413 			event[pos++] = (uint8_t) value_len;
414             (void)memcpy(event + pos, value, value_len);
415             break;
416         case AVRCP_MEDIA_ATTR_GENRE:
417             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_GENRE_INFO;
418 			btstack_assert(value_len <= 255);
419 			event[pos++] = (uint8_t) value_len;
420             (void)memcpy(event + pos, value, value_len);
421             break;
422 #ifdef ENABLE_AVRCP_COVER_ART
423         case AVRCP_MEDIA_ATTR_DEFAULT_COVER_ART:
424             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_COVER_ART_INFO;
425             btstack_assert(value_len <= 255);
426             event[pos++] = (uint8_t) value_len;
427             (void)memcpy(event + pos, value, value_len);
428             break;
429 #endif
430         case AVRCP_MEDIA_ATTR_SONG_LENGTH_MS:
431             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_SONG_LENGTH_MS_INFO;
432             if (value){
433                 little_endian_store_32(event, pos, btstack_atoi((char *)value));
434             } else {
435                 little_endian_store_32(event, pos, 0);
436             }
437             pos += 4;
438             break;
439         case AVRCP_MEDIA_ATTR_TRACK:
440             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_TRACK_INFO;
441             if (value){
442                 event[pos++] = btstack_atoi((char *)value);
443             } else {
444                 event[pos++] = 0;
445             }
446             break;
447         case AVRCP_MEDIA_ATTR_TOTAL_NUM_ITEMS:
448             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_TOTAL_TRACKS_INFO;
449             if (value){
450                 event[pos++] = btstack_atoi((char *)value);
451             } else {
452                 event[pos++] = 0;
453             }
454             break;
455         default:
456             break;
457     }
458     event[data_len_pos] = pos - 2;
459     (*callback)(HCI_EVENT_PACKET, 0, event, pos);
460 }
461 
462 static void avrcp_controller_emit_operation_status(btstack_packet_handler_t callback, uint8_t subevent, uint16_t avrcp_cid, uint8_t ctype, uint8_t operation_id){
463     btstack_assert(callback != NULL);
464 
465     uint8_t event[7];
466     int pos = 0;
467     event[pos++] = HCI_EVENT_AVRCP_META;
468     event[pos++] = sizeof(event) - 2;
469     event[pos++] = subevent;
470     little_endian_store_16(event, pos, avrcp_cid);
471     pos += 2;
472     event[pos++] = ctype;
473     event[pos++] = operation_id;
474     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
475 }
476 
477 static void avrcp_parser_reset(avrcp_connection_t * connection){
478     connection->list_offset = 0;
479     connection->parser_attribute_header_pos = 0;
480     connection->controller_num_received_fragments = 0;
481     connection->parser_state = AVRCP_PARSER_GET_ATTRIBUTE_HEADER;
482 }
483 
484 static void avrcp_parser_process_byte(uint8_t byte, avrcp_connection_t * connection, avrcp_command_type_t ctype){
485     uint16_t attribute_total_value_len;
486     uint32_t attribute_id;
487     switch(connection->parser_state){
488         case AVRCP_PARSER_GET_ATTRIBUTE_HEADER:
489             connection->parser_attribute_header[connection->parser_attribute_header_pos++] = byte;
490             connection->list_offset++;
491 
492             if (connection->parser_attribute_header_pos < AVRCP_ATTRIBUTE_HEADER_LEN) return;
493 
494             attribute_total_value_len = big_endian_read_16(connection->parser_attribute_header, 6);
495             connection->attribute_value_len = btstack_min(attribute_total_value_len, AVRCP_MAX_ATTRIBUTE_SIZE);
496             if (connection->attribute_value_len > 0){
497                 // get ready for attribute value
498                 connection->parser_state = AVRCP_PARSER_GET_ATTRIBUTE_VALUE;
499                 return;
500             }
501 
502             // emit empty attribute
503             attribute_id = big_endian_read_32(connection->parser_attribute_header, 0);
504             avrcp_controller_emit_now_playing_info_event(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, (avrcp_media_attribute_id_t) attribute_id, connection->attribute_value, connection->attribute_value_len);
505 
506             // done, see below
507             break;
508 
509         case AVRCP_PARSER_GET_ATTRIBUTE_VALUE:
510             connection->attribute_value[connection->attribute_value_offset++] = byte;
511             connection->list_offset++;
512 
513             if (connection->attribute_value_offset < connection->attribute_value_len) return;
514 
515             // emit (potentially partial) attribute
516             attribute_id = big_endian_read_32(connection->parser_attribute_header, 0);
517             avrcp_controller_emit_now_playing_info_event(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, (avrcp_media_attribute_id_t) attribute_id, connection->attribute_value, connection->attribute_value_len);
518 
519             attribute_total_value_len = big_endian_read_16(connection->parser_attribute_header, 6);
520             if (connection->attribute_value_offset < attribute_total_value_len){
521                 // ignore rest of attribute
522                 connection->parser_state = AVRCP_PARSER_IGNORE_REST_OF_ATTRIBUTE_VALUE;
523                 return;
524             }
525 
526             // done, see below
527             break;
528 
529         case AVRCP_PARSER_IGNORE_REST_OF_ATTRIBUTE_VALUE:
530             connection->attribute_value_offset++;
531             connection->list_offset++;
532 
533             attribute_total_value_len = big_endian_read_16(connection->parser_attribute_header, 6);
534             if (connection->attribute_value_offset < attribute_total_value_len) return;
535 
536             // done, see below
537             break;
538 
539         default:
540             return;
541     }
542 
543     // attribute fully read, check if more to come
544     if (connection->list_offset < connection->list_size){
545         // more to come, reset parser
546         connection->parser_state = AVRCP_PARSER_GET_ATTRIBUTE_HEADER;
547         connection->parser_attribute_header_pos = 0;
548         connection->attribute_value_offset = 0;
549     } else {
550         // fully done
551         avrcp_parser_reset(connection);
552         avrcp_controller_emit_now_playing_info_event_done(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, 0);
553     }
554 }
555 
556 static void avrcp_controller_parse_and_emit_element_attrs(uint8_t * packet, uint16_t num_bytes_to_read, avrcp_connection_t * connection, avrcp_command_type_t ctype){
557     int i;
558     for (i=0;i<num_bytes_to_read;i++){
559         avrcp_parser_process_byte(packet[i], connection, ctype);
560     }
561 }
562 
563 static void avrcp_send_cmd_with_avctp_fragmentation(avrcp_connection_t * connection){
564     l2cap_reserve_packet_buffer();
565     uint8_t * packet = l2cap_get_outgoing_buffer();
566 
567     uint16_t max_payload_size;
568     connection->avctp_packet_type = avctp_get_packet_type(connection, &max_payload_size);
569     connection->avrcp_packet_type = avrcp_get_packet_type(connection);
570 
571     // non-fragmented: transport header (1) + PID (2)
572     // fragmented:     transport header (1) + num packets (1) + PID (2)
573 
574     uint16_t param_len = connection->data_len;
575     // AVCTP header
576     // transport header : transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
577     uint16_t pos = 0;
578     packet[pos++] = (connection->transaction_id << 4) | (connection->avctp_packet_type << 2) | (AVRCP_COMMAND_FRAME << 1) | 0;
579 
580     if (connection->avctp_packet_type == AVCTP_START_PACKET){
581         uint16_t max_frame_size = btstack_min(connection->l2cap_mtu, AVRCP_MAX_AV_C_MESSAGE_FRAME_SIZE);
582         // first packet: max_payload_size
583         // rest packets
584         uint16_t num_payload_bytes = param_len - max_payload_size;
585         uint16_t frame_size_for_continue_packet = max_frame_size - avctp_get_num_bytes_for_header(AVCTP_CONTINUE_PACKET);
586         uint16_t num_avctp_packets = (num_payload_bytes + frame_size_for_continue_packet - 1)/frame_size_for_continue_packet + 1;
587 		btstack_assert(num_avctp_packets <= 255);
588         packet[pos++] = (uint8_t) num_avctp_packets;
589     }
590 
591     switch (connection->avctp_packet_type){
592         case AVCTP_SINGLE_PACKET:
593         case AVCTP_START_PACKET:
594             connection->data_offset = 0;
595             // Profile IDentifier (PID)
596             packet[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL >> 8;
597             packet[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL & 0x00FF;
598 
599             // command_type
600             packet[pos++] = connection->command_type;
601             // subunit_type | subunit ID
602             packet[pos++] = (connection->subunit_type << 3) | connection->subunit_id;
603             // opcode
604             packet[pos++] = (uint8_t)connection->command_opcode;
605 
606             switch (connection->command_opcode){
607                 case AVRCP_CMD_OPCODE_VENDOR_DEPENDENT:
608                     big_endian_store_24(packet, pos, connection->company_id);
609                     pos += 3;
610                     packet[pos++] = connection->pdu_id;
611                     packet[pos++] = connection->avrcp_packet_type;              // reserved(upper 6) | AVRCP packet_type
612                     big_endian_store_16(packet, pos, connection->data_len);     // parameter length
613                     pos += 2;
614                     break;
615                 case AVRCP_CMD_OPCODE_PASS_THROUGH:
616                     packet[pos++] = connection->operation_id;
617                     packet[pos++] = (uint8_t)connection->data_len;     // parameter length
618                     pos += 2;
619                     break;
620                 case AVRCP_CMD_OPCODE_UNIT_INFO:
621                 case AVRCP_CMD_OPCODE_SUBUNIT_INFO:
622                     break;
623                 default:
624                     btstack_assert(false);
625                     return;
626             }
627             break;
628         case AVCTP_CONTINUE_PACKET:
629         case AVCTP_END_PACKET:
630             break;
631         default:
632             btstack_assert(false);
633             return;
634     }
635     // compare number of bytes to store with the remaining buffer size
636     uint16_t bytes_to_copy = btstack_min(connection->data_len - connection->data_offset, max_payload_size - pos);
637 
638     (void)memcpy(packet + pos, &connection->data[connection->data_offset], bytes_to_copy);
639     pos += bytes_to_copy;
640     connection->data_offset += bytes_to_copy;
641 
642     l2cap_send_prepared(connection->l2cap_signaling_cid, pos);
643 }
644 
645 static int avrcp_send_register_notification(avrcp_connection_t * connection, uint8_t event_id){
646     uint8_t command[18];
647     uint16_t pos = 0;
648     // transport header : transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
649     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
650     command[pos++] = (connection->transaction_id << 4) | (AVRCP_SINGLE_PACKET << 2) | (AVRCP_COMMAND_FRAME << 1) | 0;
651 
652     command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL >> 8;
653     command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL & 0x00FF;
654     command[pos++] = AVRCP_CTYPE_NOTIFY;
655     command[pos++] = (AVRCP_SUBUNIT_TYPE_PANEL << 3) | AVRCP_SUBUNIT_ID;
656     command[pos++] = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
657 
658     big_endian_store_24(command, pos, BT_SIG_COMPANY_ID);
659     pos += 3;
660     command[pos++] = AVRCP_PDU_ID_REGISTER_NOTIFICATION;
661     command[pos++] = 0;                       // reserved(upper 6) | packet_type -> 0
662     big_endian_store_16(command, pos, 5);     // parameter length
663     pos += 2;
664     command[pos++] = event_id;
665     big_endian_store_32(command, pos, 1);     // send notification on playback position every second, for other notifications it is ignored
666     pos += 4;
667     return l2cap_send(connection->l2cap_signaling_cid, command, pos);
668 }
669 
670 static void avrcp_press_and_hold_timeout_handler(btstack_timer_source_t * timer){
671     UNUSED(timer);
672     avrcp_connection_t * connection = (avrcp_connection_t*) btstack_run_loop_get_timer_context(timer);
673     btstack_run_loop_set_timer(&connection->controller_press_and_hold_cmd_timer, 2000); // 2 seconds timeout
674     btstack_run_loop_add_timer(&connection->controller_press_and_hold_cmd_timer);
675     connection->state = AVCTP_W2_SEND_PRESS_COMMAND;
676     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
677 }
678 
679 static void avrcp_press_and_hold_timer_start(avrcp_connection_t * connection){
680     btstack_run_loop_remove_timer(&connection->controller_press_and_hold_cmd_timer);
681     btstack_run_loop_set_timer_handler(&connection->controller_press_and_hold_cmd_timer, avrcp_press_and_hold_timeout_handler);
682     btstack_run_loop_set_timer_context(&connection->controller_press_and_hold_cmd_timer, connection);
683     btstack_run_loop_set_timer(&connection->controller_press_and_hold_cmd_timer, 2000); // 2 seconds timeout
684     btstack_run_loop_add_timer(&connection->controller_press_and_hold_cmd_timer);
685 }
686 
687 static void avrcp_press_and_hold_timer_stop(avrcp_connection_t * connection){
688     connection->controller_press_and_hold_cmd_active = false;
689     btstack_run_loop_remove_timer(&connection->controller_press_and_hold_cmd_timer);
690 }
691 
692 
693 static uint8_t avrcp_controller_request_pass_through_release_control_cmd(avrcp_connection_t * connection){
694     connection->state = AVCTP_W2_SEND_RELEASE_COMMAND;
695     if (connection->controller_press_and_hold_cmd_active){
696         avrcp_press_and_hold_timer_stop(connection);
697     }
698     connection->operation_id = (avrcp_operation_id_t)(0x80 | connection->operation_id);
699     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
700     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
701     return ERROR_CODE_SUCCESS;
702 }
703 
704 static uint8_t avrcp_controller_request_pass_through_press_control_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint16_t playback_speed, bool continuous_cmd){
705 	UNUSED(playback_speed);
706 
707 	log_info("Send command %d", opid);
708     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
709     if (!connection){
710         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
711     }
712 
713     if (connection->state != AVCTP_CONNECTION_OPENED){
714         log_error("Connection in wrong state %d, expected %d. avrcp cid 0x%02x", connection->state, AVCTP_CONNECTION_OPENED, avrcp_cid);
715         return ERROR_CODE_COMMAND_DISALLOWED;
716     }
717     connection->state = AVCTP_W2_SEND_PRESS_COMMAND;
718     avrcp_controller_pass_through_command_data_init(connection, opid);
719 
720     connection->controller_press_and_hold_cmd_active = continuous_cmd;
721     if (connection->controller_press_and_hold_cmd_active){
722         avrcp_press_and_hold_timer_start(connection);
723     }
724 
725     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
726     return ERROR_CODE_SUCCESS;
727 }
728 
729 static uint8_t request_single_pass_through_press_control_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint16_t playback_speed){
730     return avrcp_controller_request_pass_through_press_control_cmd(avrcp_cid, opid, playback_speed, false);
731 }
732 
733 static uint8_t request_continuous_pass_through_press_control_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint16_t playback_speed){
734     return avrcp_controller_request_pass_through_press_control_cmd(avrcp_cid, opid, playback_speed, true);
735 }
736 
737 static void avrcp_controller_get_capabilities_for_connection(avrcp_connection_t * connection, uint8_t capability_id){
738     connection->state = AVCTP_W2_SEND_COMMAND;
739     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_STATUS, AVRCP_PDU_ID_GET_CAPABILITIES, true);
740 
741     // Parameter Length
742     connection->data_len = 1;
743     connection->data[0] = capability_id;  // capability ID
744 
745     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
746 }
747 
748 static uint8_t avrcp_controller_register_notification(avrcp_connection_t * connection, avrcp_notification_event_id_t event_id){
749     if ((connection->remote_capabilities_state == AVRCP_REMOTE_CAPABILITIES_KNOWN) && (connection->notifications_supported_by_target & (1 << event_id)) == 0){
750         return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
751     }
752     if ((connection->controller_notifications_to_deregister & (1 << event_id)) != 0){
753         return ERROR_CODE_COMMAND_DISALLOWED;
754     }
755     if ( (connection->notifications_enabled & (1 << event_id)) != 0){
756         return ERROR_CODE_SUCCESS;
757     }
758     connection->controller_notifications_to_register |= (1 << event_id);
759 
760     switch (connection->remote_capabilities_state){
761         case AVRCP_REMOTE_CAPABILITIES_NONE:
762             connection->remote_capabilities_state = AVRCP_REMOTE_CAPABILITIES_W4_QUERY_RESULT;
763             connection->controller_notifications_supported_by_target_suppress_emit_result = true;
764             avrcp_controller_get_capabilities_for_connection(connection, AVRCP_CAPABILITY_ID_EVENT);
765             break;
766         case AVRCP_REMOTE_CAPABILITIES_KNOWN:
767             avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
768             break;
769         default:
770             break;
771     }
772     return ERROR_CODE_SUCCESS;
773 }
774 
775 static uint8_t avrcp_controller_request_continuation(avrcp_connection_t * connection, avrcp_pdu_id_t pdu_id){
776     connection->state = AVCTP_W2_SEND_COMMAND;
777     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, pdu_id, false);
778 
779     // Parameter Length
780     connection->data_len = 3;
781     big_endian_store_16(connection->data, 0, 1);
782     connection->data[2] = AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES;
783 
784     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
785     return ERROR_CODE_SUCCESS;
786 }
787 
788 static uint8_t avrcp_controller_request_abort_continuation(avrcp_connection_t * connection){
789     return avrcp_controller_request_continuation(connection, AVRCP_PDU_ID_REQUEST_ABORT_CONTINUING_RESPONSE);
790 }
791 
792 static uint8_t avrcp_controller_request_continue_response(avrcp_connection_t * connection){
793     return avrcp_controller_request_continuation(connection, AVRCP_PDU_ID_REQUEST_CONTINUING_RESPONSE);
794 }
795 
796 static void avrcp_controller_handle_notification(avrcp_connection_t *connection, avrcp_command_type_t ctype, uint8_t *payload, uint16_t size) {
797     if (size < 1) return;
798     uint16_t pos = 0;
799     avrcp_notification_event_id_t event_id = (avrcp_notification_event_id_t) payload[pos++];
800     if ( (event_id < AVRCP_NOTIFICATION_EVENT_FIRST_INDEX) || (event_id > AVRCP_NOTIFICATION_EVENT_LAST_INDEX)){
801         return;
802     }
803 
804     uint16_t event_mask = (1 << event_id);
805     uint16_t reset_event_mask = ~event_mask;
806 
807     switch (ctype){
808         case AVRCP_CTYPE_RESPONSE_REJECTED:
809             connection->controller_notifications_to_deregister &= reset_event_mask;
810             connection->controller_notifications_to_register   &= reset_event_mask;
811             connection->controller_initial_status_reported     &= reset_event_mask;
812             avrcp_controller_emit_notification_complete(connection, ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE, event_id, false);
813             return;
814 
815         case AVRCP_CTYPE_RESPONSE_INTERIM:
816             // register as enabled
817             connection->notifications_enabled |= event_mask;
818 
819             // check if initial value is already sent
820             if ((connection->controller_initial_status_reported & event_mask) != 0 ){
821                 return;
822             }
823             // emit event only once, initially
824             avrcp_controller_emit_notification_complete(connection, ERROR_CODE_SUCCESS, event_id, true);
825             connection->controller_initial_status_reported |= event_mask;
826             // emit initial value after this switch
827             break;
828 
829         case AVRCP_CTYPE_RESPONSE_CHANGED_STABLE:
830             // received change, event is considered de-registered
831             // we are re-enabling it automatically, if it is not
832             // explicitly disabled
833             connection->notifications_enabled &= reset_event_mask;
834             if ((connection->controller_notifications_to_deregister & event_mask) == 0){
835                 avrcp_controller_register_notification(connection, event_id);
836             } else {
837                 connection->controller_notifications_to_deregister &= reset_event_mask;
838                 connection->controller_notifications_to_register   &= reset_event_mask;
839                 connection->controller_initial_status_reported     &= reset_event_mask;
840                 avrcp_controller_emit_notification_complete(connection, ERROR_CODE_SUCCESS, event_id, false);
841             }
842             break;
843 
844         default:
845             return;
846     }
847 
848     avrcp_controller_emit_notification_for_event_id(connection->avrcp_cid, event_id, ctype, payload + pos, size - pos);
849 }
850 
851 #ifdef ENABLE_AVCTP_FRAGMENTATION
852 static void avctp_reassemble_message(avrcp_connection_t * connection, avctp_packet_type_t packet_type, uint8_t *packet, uint16_t size){
853     // after header (transaction label and packet type)
854     uint16_t pos;
855     uint16_t bytes_to_store;
856 
857     switch (packet_type){
858         case AVCTP_START_PACKET:
859             if (size < 2) return;
860 
861             // store header
862             pos = 0;
863             connection->avctp_reassembly_buffer[pos] = packet[pos];
864             pos++;
865             connection->avctp_reassembly_size = pos;
866 
867             // NOTE: num packets not needed for reassembly, ignoring it does not pose security risk -> no need to store it
868             pos++;
869 
870             // PID in reassembled packet is at offset 1, it will be read later after the avctp_reassemble_message with AVCTP_END_PACKET is called
871 
872             bytes_to_store = btstack_min(size - pos, sizeof(connection->avctp_reassembly_buffer) - connection->avctp_reassembly_size);
873             memcpy(&connection->avctp_reassembly_buffer[connection->avctp_reassembly_size], &packet[pos], bytes_to_store);
874             connection->avctp_reassembly_size += bytes_to_store;
875             break;
876 
877         case AVCTP_CONTINUE_PACKET:
878         case AVCTP_END_PACKET:
879             if (size < 1) return;
880 
881             // store remaining data, ignore header
882             pos = 1;
883             bytes_to_store = btstack_min(size - pos, sizeof(connection->avctp_reassembly_buffer) - connection->avctp_reassembly_size);
884             memcpy(&connection->avctp_reassembly_buffer[connection->avctp_reassembly_size], &packet[pos], bytes_to_store);
885             connection->avctp_reassembly_size += bytes_to_store;
886             break;
887 
888         default:
889             return;
890     }
891 }
892 #endif
893 
894 static void avrcp_handle_l2cap_data_packet_for_signaling_connection(avrcp_connection_t * connection, uint8_t *packet, uint16_t size){
895     if (size < 6u) return;
896     uint8_t  pdu_id;
897     avrcp_packet_type_t  vendor_dependent_avrcp_packet_type;
898 
899     uint16_t pos = 0;
900     connection->controller_last_confirmed_transaction_id = packet[pos] >> 4;
901     avrcp_frame_type_t  frame_type =  (avrcp_frame_type_t)((packet[pos] >> 1) & 0x01);
902     avctp_packet_type_t packet_type = (avctp_packet_type_t)((packet[pos] >> 2) & 0x03);
903     pos++;
904 
905     if (frame_type != AVRCP_RESPONSE_FRAME) return;
906 
907     switch (packet_type){
908         case AVCTP_SINGLE_PACKET:
909             break;
910 
911 #ifdef ENABLE_AVCTP_FRAGMENTATION
912         case AVCTP_START_PACKET:
913         case AVCTP_CONTINUE_PACKET:
914             avctp_reassemble_message(connection, packet_type, packet, size);
915             return;
916 
917         case AVCTP_END_PACKET:
918             avctp_reassemble_message(connection, packet_type, packet, size);
919 
920             packet = connection->avctp_reassembly_buffer;
921             size   = connection->avctp_reassembly_size;
922             break;
923 #endif
924 
925         default:
926             return;
927     }
928 
929     pos += 2; // PID
930 
931     avrcp_command_type_t ctype = (avrcp_command_type_t) packet[pos++];
932 
933 #ifdef ENABLE_LOG_INFO
934     uint8_t byte_value = packet[pos];
935     avrcp_subunit_type_t subunit_type = (avrcp_subunit_type_t) (byte_value >> 3);
936     avrcp_subunit_type_t subunit_id   = (avrcp_subunit_type_t) (byte_value & 0x07);
937 #endif
938     pos++;
939 
940     uint8_t opcode = packet[pos++];
941     uint16_t param_length;
942 
943     switch (opcode){
944         case AVRCP_CMD_OPCODE_SUBUNIT_INFO:{
945             if (connection->state != AVCTP_W2_RECEIVE_RESPONSE) return;
946             connection->state = AVCTP_CONNECTION_OPENED;
947 
948 #ifdef ENABLE_LOG_INFO
949             // page, extension code (1)
950             pos++;
951             uint8_t unit_type = packet[pos] >> 3;
952             uint8_t max_subunit_ID = packet[pos] & 0x07;
953             log_info("SUBUNIT INFO response: ctype 0x%02x (0C), subunit_type 0x%02x (1F), subunit_id 0x%02x (07), opcode 0x%02x (30), target_unit_type 0x%02x, max_subunit_ID %d", ctype, subunit_type, subunit_id, opcode, unit_type, max_subunit_ID);
954 #endif
955             break;
956         }
957         case AVRCP_CMD_OPCODE_UNIT_INFO:{
958             if (connection->state != AVCTP_W2_RECEIVE_RESPONSE) return;
959             connection->state = AVCTP_CONNECTION_OPENED;
960 
961 #ifdef ENABLE_LOG_INFO
962             // byte value 7 (1)
963             pos++;
964             uint8_t unit_type = packet[pos] >> 3;
965             uint8_t unit = packet[pos] & 0x07;
966             pos++;
967             uint32_t company_id = big_endian_read_24(packet, pos);
968             log_info("UNIT INFO response: ctype 0x%02x (0C), subunit_type 0x%02x (1F), subunit_id 0x%02x (07), opcode 0x%02x (30), target_unit_type 0x%02x, unit %d, company_id 0x%06" PRIx32,
969                 ctype, subunit_type, subunit_id, opcode, unit_type, unit, company_id);
970 #endif
971             break;
972         }
973         case AVRCP_CMD_OPCODE_VENDOR_DEPENDENT:
974             if ((size - pos) < 7){
975                 return;
976             }
977             // Company ID (3)
978             pos += 3;
979             pdu_id = packet[pos++];
980             vendor_dependent_avrcp_packet_type = (avrcp_packet_type_t)(packet[pos++] & 0x03);
981             param_length = big_endian_read_16(packet, pos);
982             pos += 2;
983 
984             if ((size - pos) < param_length) {
985                 return;
986             }
987 
988             // handle asynchronous notifications, without changing state
989             if (pdu_id == AVRCP_PDU_ID_REGISTER_NOTIFICATION){
990                 avrcp_controller_handle_notification(connection, ctype, packet + pos, size - pos);
991                 break;
992             }
993             if (connection->state != AVCTP_W2_RECEIVE_RESPONSE) return;
994             connection->state = AVCTP_CONNECTION_OPENED;
995 
996             log_info("VENDOR DEPENDENT response: pdu id 0x%02x, param_length %d, status %s", pdu_id, param_length, avrcp_ctype2str(ctype));
997             switch (pdu_id){
998                 case AVRCP_PDU_ID_GET_CURRENT_PLAYER_APPLICATION_SETTING_VALUE:{
999                     uint8_t num_attributes = packet[pos++];
1000                     int i;
1001                     avrcp_repeat_mode_t  repeat_mode =  AVRCP_REPEAT_MODE_INVALID;
1002                     avrcp_shuffle_mode_t shuffle_mode = AVRCP_SHUFFLE_MODE_INVALID;
1003                     for (i = 0; i < num_attributes; i++){
1004                         uint8_t attribute_id    = packet[pos++];
1005                         uint8_t value = packet[pos++];
1006                         switch (attribute_id){
1007                             case 0x02:
1008                                 repeat_mode = (avrcp_repeat_mode_t) value;
1009                                 break;
1010                             case 0x03:
1011                                 shuffle_mode = (avrcp_shuffle_mode_t) value;
1012                                 break;
1013                             default:
1014                                 break;
1015                         }
1016                     }
1017                     avrcp_controller_emit_repeat_and_shuffle_mode(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, repeat_mode, shuffle_mode);
1018                     break;
1019                 }
1020 
1021                 case AVRCP_PDU_ID_SET_PLAYER_APPLICATION_SETTING_VALUE:{
1022                     uint16_t offset = 0;
1023                     uint8_t event[6];
1024                     event[offset++] = HCI_EVENT_AVRCP_META;
1025                     event[offset++] = sizeof(event) - 2;
1026                     event[offset++] = AVRCP_SUBEVENT_PLAYER_APPLICATION_VALUE_RESPONSE;
1027                     little_endian_store_16(event, offset, connection->avrcp_cid);
1028                     offset += 2;
1029                     event[offset++] = ctype;
1030                     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
1031                     break;
1032                 }
1033 
1034                 case AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME:{
1035                     uint16_t offset = 0;
1036                     uint8_t event[7];
1037                     event[offset++] = HCI_EVENT_AVRCP_META;
1038                     event[offset++] = sizeof(event) - 2;
1039                     event[offset++] = AVRCP_SUBEVENT_SET_ABSOLUTE_VOLUME_RESPONSE;
1040                     little_endian_store_16(event, offset, connection->avrcp_cid);
1041                     offset += 2;
1042                     event[offset++] = ctype;
1043                     event[offset++] = packet[pos++];
1044                     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
1045                     break;
1046                 }
1047 
1048                 case AVRCP_PDU_ID_GET_CAPABILITIES:{
1049                     avrcp_capability_id_t capability_id = (avrcp_capability_id_t) packet[pos++];
1050                     uint8_t capability_count = 0;
1051                     if (param_length > 1){
1052                         capability_count = packet[pos++];
1053                     }
1054                     uint16_t i;
1055                     uint16_t offset;
1056                     uint8_t event[10];
1057 
1058                     switch (capability_id){
1059 
1060                         case AVRCP_CAPABILITY_ID_COMPANY:
1061                             for (i = 0; (i < capability_count) && ((size - pos) >= 3); i++){
1062                                 uint32_t company_id = big_endian_read_24(packet, pos);
1063                                 pos += 3;
1064                                 log_info("  0x%06" PRIx32 ", ", company_id);
1065 
1066                                 offset = 0;
1067                                 event[offset++] = HCI_EVENT_AVRCP_META;
1068                                 event[offset++] = sizeof(event) - 2;
1069                                 event[offset++] = AVRCP_SUBEVENT_GET_CAPABILITY_COMPANY_ID;
1070                                 little_endian_store_16(event, offset, connection->avrcp_cid);
1071                                 offset += 2;
1072                                 event[offset++] = ctype;
1073                                 event[offset++] = 0;
1074                                 little_endian_store_24(event, offset, company_id);
1075                                 offset += 3;
1076                                 (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
1077                             }
1078 
1079                             offset = 0;
1080                             event[offset++] = HCI_EVENT_AVRCP_META;
1081                             event[offset++] = sizeof(event) - 2;
1082                             event[offset++] = AVRCP_SUBEVENT_GET_CAPABILITY_COMPANY_ID_DONE;
1083                             little_endian_store_16(event, offset, connection->avrcp_cid);
1084                             offset += 2;
1085                             event[offset++] = ctype;
1086                             event[offset++] = 0;
1087                             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
1088                             break;
1089 
1090                         case AVRCP_CAPABILITY_ID_EVENT:
1091                             for (i = 0; (i < capability_count) && ((size - pos) >= 1); i++){
1092                                 uint8_t event_id = packet[pos++];
1093                                 connection->notifications_supported_by_target |= (1 << event_id);
1094                             }
1095 
1096                             connection->remote_capabilities_state = AVRCP_REMOTE_CAPABILITIES_KNOWN;
1097 
1098                             // if the get supported events query is triggered by avrcp_controller_enable_notification call,
1099                             // avrcp_controller_emit_supported_events should be suppressed
1100                             if (connection->controller_notifications_supported_by_target_suppress_emit_result){
1101                                 connection->controller_notifications_supported_by_target_suppress_emit_result = false;
1102                                 // also, notification might not be supported
1103                                 // if so, emit AVRCP_SUBEVENT_ENABLE_NOTIFICATION_COMPLETE event to app,
1104                                 // and update controller_notifications_to_register bitmap
1105                                 for (i = (uint8_t)AVRCP_NOTIFICATION_EVENT_FIRST_INDEX; i < (uint8_t) AVRCP_NOTIFICATION_EVENT_LAST_INDEX; i++){
1106                                     if ((connection->controller_notifications_to_register & (1 << i)) != 0){
1107                                         if ((connection->notifications_supported_by_target & (1 << i)) == 0){
1108                                             avrcp_controller_emit_notification_complete(connection, ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE, (uint8_t) i, false);
1109                                             connection->controller_notifications_to_register &= ~(1 << i);
1110                                         }
1111                                     }
1112                                 }
1113                                 break;
1114                             }
1115                             // supported events are emitted only if the get supported events query
1116                             // is triggered by avrcp_controller_get_supported_events call
1117                             avrcp_controller_emit_supported_events(connection);
1118                             break;
1119 
1120                         default:
1121                             // ignore
1122                             break;
1123                     }
1124                     break;
1125                 }
1126 
1127                 case AVRCP_PDU_ID_GET_PLAY_STATUS:{
1128                     uint32_t song_length = big_endian_read_32(packet, pos);
1129                     pos += 4;
1130                     uint32_t song_position = big_endian_read_32(packet, pos);
1131                     pos += 4;
1132                     uint8_t play_status = packet[pos];
1133 
1134                     uint8_t event[15];
1135                     int offset = 0;
1136                     event[offset++] = HCI_EVENT_AVRCP_META;
1137                     event[offset++] = sizeof(event) - 2;
1138                     event[offset++] = AVRCP_SUBEVENT_PLAY_STATUS;
1139                     little_endian_store_16(event, offset, connection->avrcp_cid);
1140                     offset += 2;
1141                     event[offset++] = ctype;
1142                     little_endian_store_32(event, offset, song_length);
1143                     offset += 4;
1144                     little_endian_store_32(event, offset, song_position);
1145                     offset += 4;
1146                     event[offset++] = play_status;
1147                     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
1148                     break;
1149                 }
1150 
1151                 case AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES:
1152                     switch (vendor_dependent_avrcp_packet_type){
1153                         case AVRCP_START_PACKET:
1154                         case AVRCP_SINGLE_PACKET:
1155                             avrcp_parser_reset(connection);
1156                             connection->list_size = param_length;
1157                             // num_attributes
1158                             pos++;
1159 
1160                             avrcp_controller_parse_and_emit_element_attrs(packet+pos, size-pos, connection, ctype);
1161                             if (vendor_dependent_avrcp_packet_type == AVRCP_START_PACKET){
1162                                 avrcp_controller_request_continue_response(connection);
1163                                 return;
1164                             }
1165                             break;
1166                         case AVRCP_CONTINUE_PACKET:
1167                         case AVRCP_END_PACKET:
1168                             connection->controller_num_received_fragments++;
1169 
1170                             if (connection->controller_num_received_fragments < connection->controller_max_num_fragments){
1171                                 avrcp_controller_parse_and_emit_element_attrs(packet+pos, size-pos, connection, ctype);
1172 
1173                                 if (vendor_dependent_avrcp_packet_type == AVRCP_CONTINUE_PACKET){
1174                                     avrcp_controller_request_continue_response(connection);
1175                                     return;
1176                                 }
1177                             } else {
1178                                 avrcp_controller_emit_now_playing_info_event_done(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, 1);
1179                                 avrcp_parser_reset(connection);
1180                                 avrcp_controller_request_abort_continuation(connection);
1181                                 return;
1182                             }
1183                             break;
1184                         default:
1185                             btstack_assert(false);
1186                             break;
1187                     }
1188                     break;
1189 
1190                 default:
1191                     // custom command response comes here
1192                     switch (pdu_id){
1193                         case AVRCP_PDU_ID_REQUEST_ABORT_CONTINUING_RESPONSE:
1194                             avrcp_controller_emit_now_playing_info_event_done(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, 0);
1195                             break;
1196                         default:
1197                             if (pdu_id != connection->pdu_id) {
1198                                 break;
1199                             }
1200                             uint8_t *in_place_buffer = packet + pos - 9;
1201                             avrcp_controller_prepare_custom_command_response(connection, param_length,
1202                                                                              in_place_buffer);
1203                             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, in_place_buffer,
1204                                                                        param_length + 9);
1205 
1206                             break;
1207                     }
1208                     break;
1209             }
1210             break;
1211         case AVRCP_CMD_OPCODE_PASS_THROUGH:{
1212             if ((size - pos) < 1) return;
1213             uint8_t operation_id = packet[pos++];
1214             UNUSED(pos);
1215             switch (connection->state){
1216                 case AVCTP_W2_RECEIVE_PRESS_RESPONSE:
1217                     // trigger release for simple command:
1218                     if (!connection->controller_press_and_hold_cmd_active){
1219                         connection->state = AVCTP_W2_SEND_RELEASE_COMMAND;
1220                         break;
1221                     }
1222                     // for press and hold, send release if it just has been requested, otherwise, wait for next repeat
1223                     if (connection->controller_press_and_hold_cmd_release){
1224                         connection->controller_press_and_hold_cmd_release = false;
1225                         connection->state = AVCTP_W2_SEND_RELEASE_COMMAND;
1226                     } else {
1227                         connection->state = AVCTP_W4_STOP;
1228                     }
1229                     break;
1230                 case AVCTP_W2_RECEIVE_RESPONSE:
1231                     connection->state = AVCTP_CONNECTION_OPENED;
1232                     break;
1233                 default:
1234                     break;
1235             }
1236             if (connection->state == AVCTP_W4_STOP){
1237                 avrcp_controller_emit_operation_status(avrcp_controller_context.avrcp_callback, AVRCP_SUBEVENT_OPERATION_START, connection->avrcp_cid, ctype, operation_id);
1238             }
1239             if (connection->state == AVCTP_CONNECTION_OPENED) {
1240                 // RELEASE response
1241                 operation_id = operation_id & 0x7F;
1242                 avrcp_controller_emit_operation_status(avrcp_controller_context.avrcp_callback, AVRCP_SUBEVENT_OPERATION_COMPLETE, connection->avrcp_cid, ctype, operation_id);
1243             }
1244             if (connection->state == AVCTP_W2_SEND_RELEASE_COMMAND){
1245                 // PRESS response
1246                 avrcp_controller_request_pass_through_release_control_cmd(connection);
1247             }
1248             break;
1249         }
1250         default:
1251             break;
1252     }
1253 
1254     // trigger pending notification reqistrations
1255     if ((connection->state == AVCTP_CONNECTION_OPENED) && connection->controller_notifications_to_register){
1256         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1257     }
1258 }
1259 
1260 static void avrcp_controller_handle_can_send_now(avrcp_connection_t * connection){
1261     // identifier (9) + num attributes (1) + attributes (4 * num attributes)
1262     uint8_t get_element_attributes_command[9+8*((AVRCP_MEDIA_ATTR_RESERVED-AVRCP_MEDIA_ATTR_TITLE) + 1)];
1263     uint16_t pos;
1264     uint16_t num_attributes_index;
1265     uint8_t i;
1266 
1267     switch (connection->state){
1268         case AVCTP_W2_SEND_PRESS_COMMAND:
1269             avrcp_send_cmd_with_avctp_fragmentation(connection);
1270             connection->state = AVCTP_W2_RECEIVE_PRESS_RESPONSE;
1271             return;
1272 
1273         case AVCTP_W2_SEND_RELEASE_COMMAND:
1274             avrcp_send_cmd_with_avctp_fragmentation(connection);
1275             connection->state = AVCTP_W2_RECEIVE_RESPONSE;
1276             return;
1277 
1278         case AVCTP_W2_SEND_COMMAND:
1279             avrcp_send_cmd_with_avctp_fragmentation(connection);
1280             if (connection->data_offset < connection->data_len){
1281                 // continue AVCTP fragmentation
1282                 avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1283                 return;
1284             }
1285             connection->state = AVCTP_W2_RECEIVE_RESPONSE;
1286             return;
1287         case AVCTP_W2_SEND_GET_ELEMENT_ATTRIBUTES_REQUEST:
1288             // build command in local buffer
1289             pos = 0;
1290             connection->data = get_element_attributes_command;
1291             // write identifier
1292             memset(connection->data, 0, 8);
1293             pos += 8;
1294             num_attributes_index = pos;
1295             // If num_attributes is set to zero, all attribute information shall be returned,
1296             // and the AttributeID field is omitted
1297             connection->data[num_attributes_index] = 0;
1298             pos++;
1299             for (i = 0; i < (uint8_t)AVRCP_MEDIA_ATTR_RESERVED - (uint8_t)AVRCP_MEDIA_ATTR_TITLE; i++){
1300                 if ((connection->controller_element_attributes & (1<<i)) != 0){
1301                     // every attribute is 4 bytes long
1302                     big_endian_store_32(connection->data, pos, AVRCP_MEDIA_ATTR_TITLE + i);
1303                     pos += 4;
1304                     connection->data[num_attributes_index]++;
1305                 }
1306             }
1307 
1308             // Parameter Length
1309             connection->data_len = pos;
1310 
1311             log_info("AVCTP_W2_SEND_GET_ELEMENT_ATTRIBUTES_REQUEST, len %u", connection->data_len);
1312 
1313             // send data - assume it will fit into one packet
1314             avrcp_send_cmd_with_avctp_fragmentation(connection);
1315             connection->state = AVCTP_W2_RECEIVE_RESPONSE;
1316             return;
1317         default:
1318             break;
1319     }
1320 
1321     // send register notification if queued,
1322     // avrcp_handle_l2cap_data_packet_for_signaling_connection will trigger next one
1323     if (connection->controller_notifications_to_register != 0){
1324         uint8_t event_id;
1325         for (event_id = (uint8_t)AVRCP_NOTIFICATION_EVENT_FIRST_INDEX; event_id < (uint8_t)AVRCP_NOTIFICATION_EVENT_LAST_INDEX; event_id++){
1326             if (connection->controller_notifications_to_register & (1 << event_id)){
1327                 connection->controller_notifications_to_register &= ~ (1 << event_id);
1328                 avrcp_send_register_notification(connection, event_id);
1329                 return;
1330             }
1331         }
1332     }
1333 }
1334 
1335 static void avrcp_controller_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1336     avrcp_connection_t * connection;
1337 
1338     switch (packet_type) {
1339         case L2CAP_DATA_PACKET:
1340             connection = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_CONTROLLER, channel);
1341             avrcp_handle_l2cap_data_packet_for_signaling_connection(connection, packet, size);
1342             break;
1343 
1344         case HCI_EVENT_PACKET:
1345             switch (hci_event_packet_get_type(packet)){
1346                 case L2CAP_EVENT_CAN_SEND_NOW:
1347                     connection = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_CONTROLLER, channel);
1348                     avrcp_controller_handle_can_send_now(connection);
1349                     break;
1350             default:
1351                 break;
1352         }
1353         default:
1354             break;
1355     }
1356 }
1357 
1358 void avrcp_controller_create_sdp_record(uint8_t * service, uint32_t service_record_handle, uint16_t supported_features, const char * service_name, const char * service_provider_name){
1359     if (service_name == NULL){
1360         service_name = avrcp_default_controller_service_name;
1361     }
1362     if (service_provider_name == NULL){
1363         service_provider_name = avrcp_default_controller_service_provider_name;
1364     }
1365     avrcp_create_sdp_record(true, service, service_record_handle, avrcp_controller_supports_browsing(supported_features), supported_features, service_name, service_provider_name);
1366 }
1367 
1368 void avrcp_controller_init(void){
1369     avrcp_controller_context.role = AVRCP_CONTROLLER;
1370     avrcp_controller_context.packet_handler = avrcp_controller_packet_handler;
1371     avrcp_register_controller_packet_handler(&avrcp_controller_packet_handler);
1372 }
1373 
1374 void avrcp_controller_deinit(void){
1375     memset(&avrcp_controller_context, 0, sizeof(avrcp_context_t));
1376 }
1377 
1378 void avrcp_controller_register_packet_handler(btstack_packet_handler_t callback){
1379     btstack_assert(callback != NULL);
1380     avrcp_controller_context.avrcp_callback = callback;
1381 }
1382 
1383 
1384 uint8_t avrcp_controller_play(uint16_t avrcp_cid){
1385     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PLAY, 0);
1386 }
1387 
1388 uint8_t avrcp_controller_stop(uint16_t avrcp_cid){
1389     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_STOP, 0);
1390 }
1391 
1392 uint8_t avrcp_controller_pause(uint16_t avrcp_cid){
1393     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PAUSE, 0);
1394 }
1395 
1396 uint8_t avrcp_controller_forward(uint16_t avrcp_cid){
1397     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FORWARD, 0);
1398 }
1399 
1400 uint8_t avrcp_controller_backward(uint16_t avrcp_cid){
1401     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_BACKWARD, 0);
1402 }
1403 
1404 uint8_t avrcp_controller_volume_up(uint16_t avrcp_cid){
1405     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_UP, 0);
1406 }
1407 
1408 uint8_t avrcp_controller_volume_down(uint16_t avrcp_cid){
1409     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_DOWN, 0);
1410 }
1411 
1412 uint8_t avrcp_controller_mute(uint16_t avrcp_cid){
1413     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_MUTE, 0);
1414 }
1415 
1416 uint8_t avrcp_controller_skip(uint16_t avrcp_cid){
1417     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_SKIP, 0);
1418 }
1419 
1420 uint8_t avrcp_controller_fast_forward(uint16_t avrcp_cid){
1421     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FAST_FORWARD, 0);
1422 }
1423 
1424 uint8_t avrcp_controller_rewind(uint16_t avrcp_cid){
1425     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_REWIND, 0);
1426 }
1427 
1428 /* start continuous cmds */
1429 
1430 uint8_t avrcp_controller_start_press_and_hold_cmd(uint16_t avrcp_cid, avrcp_operation_id_t operation_id){
1431     return request_continuous_pass_through_press_control_cmd(avrcp_cid, operation_id, 0);
1432 }
1433 
1434 uint8_t avrcp_controller_press_and_hold_play(uint16_t avrcp_cid){
1435     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PLAY, 0);
1436 }
1437 uint8_t avrcp_controller_press_and_hold_stop(uint16_t avrcp_cid){
1438     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_STOP, 0);
1439 }
1440 uint8_t avrcp_controller_press_and_hold_pause(uint16_t avrcp_cid){
1441     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PAUSE, 0);
1442 }
1443 uint8_t avrcp_controller_press_and_hold_forward(uint16_t avrcp_cid){
1444     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FORWARD, 0);
1445 }
1446 uint8_t avrcp_controller_press_and_hold_backward(uint16_t avrcp_cid){
1447     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_BACKWARD, 0);
1448 }
1449 uint8_t avrcp_controller_press_and_hold_fast_forward(uint16_t avrcp_cid){
1450     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FAST_FORWARD, 0);
1451 }
1452 uint8_t avrcp_controller_press_and_hold_rewind(uint16_t avrcp_cid){
1453     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_REWIND, 0);
1454 }
1455 uint8_t avrcp_controller_press_and_hold_volume_up(uint16_t avrcp_cid){
1456     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_UP, 0);
1457 }
1458 uint8_t avrcp_controller_press_and_hold_volume_down(uint16_t avrcp_cid){
1459     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_DOWN, 0);
1460 }
1461 uint8_t avrcp_controller_press_and_hold_mute(uint16_t avrcp_cid){
1462     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_MUTE, 0);
1463 }
1464 
1465 /* stop continuous cmds */
1466 uint8_t avrcp_controller_release_press_and_hold_cmd(uint16_t avrcp_cid){
1467     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1468     if (!connection){
1469         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1470     }
1471 
1472     switch (connection->state){
1473         // respond when we receive response for (repeated) press command
1474         case AVCTP_W2_RECEIVE_PRESS_RESPONSE:
1475             connection->controller_press_and_hold_cmd_release = true;
1476             break;
1477 
1478         // release already sent or on the way, nothing to do
1479         case AVCTP_W2_RECEIVE_RESPONSE:
1480         case AVCTP_W2_SEND_RELEASE_COMMAND:
1481             break;
1482 
1483         // about to send next repeated press command or wait for it -> release right away
1484         case AVCTP_W2_SEND_PRESS_COMMAND:
1485         case AVCTP_W4_STOP:
1486             return avrcp_controller_request_pass_through_release_control_cmd(connection);
1487 
1488         // otherwise reject request
1489         default:
1490             return ERROR_CODE_COMMAND_DISALLOWED;
1491     }
1492     return ERROR_CODE_SUCCESS;
1493 }
1494 
1495 uint8_t avrcp_controller_enable_notification(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id){
1496     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1497     if (!connection){
1498         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1499     }
1500     return avrcp_controller_register_notification(connection, event_id);
1501 }
1502 
1503 uint8_t avrcp_controller_disable_notification(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id){
1504     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1505     if (!connection){
1506         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1507     }
1508     if (connection->remote_capabilities_state != AVRCP_REMOTE_CAPABILITIES_KNOWN){
1509         return ERROR_CODE_COMMAND_DISALLOWED;
1510     }
1511 
1512     if ((connection->notifications_supported_by_target & (1 << event_id)) == 0){
1513         return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
1514     }
1515 
1516     if ((connection->notifications_enabled & (1 << event_id)) == 0){
1517         return ERROR_CODE_SUCCESS;
1518     }
1519 
1520     connection->controller_notifications_to_deregister |= (1 << event_id);
1521     return ERROR_CODE_SUCCESS;
1522 }
1523 
1524 uint8_t avrcp_controller_unit_info(uint16_t avrcp_cid){
1525     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1526     if (!connection){
1527         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1528     }
1529     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1530 
1531     connection->state = AVCTP_W2_SEND_COMMAND;
1532     avrcp_controller_custom_command_data_init(connection, AVRCP_CMD_OPCODE_UNIT_INFO, AVRCP_CTYPE_STATUS,
1533                                               AVRCP_SUBUNIT_TYPE_UNIT, AVRCP_SUBUNIT_ID_IGNORE, AVRCP_PDU_ID_UNDEFINED,
1534                                               0);
1535 
1536     connection->data = connection->message_body;
1537     memset(connection->data, 0xFF, 5);
1538     connection->data_len = 5;
1539     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1540     return ERROR_CODE_SUCCESS;
1541 }
1542 
1543 uint8_t avrcp_controller_subunit_info(uint16_t avrcp_cid){
1544     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1545     if (!connection){
1546         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1547     }
1548     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1549 
1550     connection->state = AVCTP_W2_SEND_COMMAND;
1551     avrcp_controller_custom_command_data_init(connection, AVRCP_CMD_OPCODE_SUBUNIT_INFO, AVRCP_CTYPE_STATUS,
1552                                               AVRCP_SUBUNIT_TYPE_UNIT, AVRCP_SUBUNIT_ID_IGNORE, AVRCP_PDU_ID_UNDEFINED,
1553                                               0);
1554 
1555     connection->data = connection->message_body;
1556     memset(connection->data, 0xFF, 5);
1557     connection->data[0] = 7; // page: 0, extension_code: 7
1558     connection->data_len = 5;
1559     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1560     return ERROR_CODE_SUCCESS;
1561 }
1562 
1563 uint8_t avrcp_controller_get_supported_company_ids(uint16_t avrcp_cid){
1564     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1565     if (!connection){
1566         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1567     }
1568     if (connection->state != AVCTP_CONNECTION_OPENED){
1569         return ERROR_CODE_COMMAND_DISALLOWED;
1570     }
1571     avrcp_controller_get_capabilities_for_connection(connection, AVRCP_CAPABILITY_ID_COMPANY);
1572     return ERROR_CODE_SUCCESS;
1573 }
1574 
1575 uint8_t avrcp_controller_get_supported_events(uint16_t avrcp_cid){
1576     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1577     if (!connection){
1578         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1579     }
1580     if (connection->state != AVCTP_CONNECTION_OPENED){
1581         return ERROR_CODE_COMMAND_DISALLOWED;
1582     }
1583 
1584     switch (connection->remote_capabilities_state){
1585         case AVRCP_REMOTE_CAPABILITIES_NONE:
1586             connection->remote_capabilities_state = AVRCP_REMOTE_CAPABILITIES_W4_QUERY_RESULT;
1587             avrcp_controller_get_capabilities_for_connection(connection, AVRCP_CAPABILITY_ID_EVENT);
1588             break;
1589         case AVRCP_REMOTE_CAPABILITIES_KNOWN:
1590             avrcp_controller_emit_supported_events(connection);
1591             break;
1592         default:
1593             break;
1594     }
1595     return ERROR_CODE_SUCCESS;
1596 }
1597 
1598 uint8_t avrcp_controller_get_play_status(uint16_t avrcp_cid){
1599     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1600     if (!connection){
1601         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1602     }
1603     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1604 
1605     connection->state = AVCTP_W2_SEND_COMMAND;
1606     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_STATUS, AVRCP_PDU_ID_GET_PLAY_STATUS, true);
1607 
1608     connection->data_len = 0;
1609     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1610     return ERROR_CODE_SUCCESS;
1611 }
1612 
1613 uint8_t avrcp_controller_set_addressed_player(uint16_t avrcp_cid, uint16_t addressed_player_id){
1614     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1615     if (!connection){
1616         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1617     }
1618     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1619 
1620     connection->state = AVCTP_W2_SEND_COMMAND;
1621     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_SET_ADDRESSED_PLAYER, true);
1622 
1623     connection->data_len = 2;
1624     big_endian_store_16(connection->data, 0, addressed_player_id);
1625 
1626     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1627     return ERROR_CODE_SUCCESS;
1628 }
1629 
1630 uint8_t avrcp_controller_get_element_attributes(uint16_t avrcp_cid, uint8_t num_attributes, avrcp_media_attribute_id_t * attributes){
1631     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1632     if (!connection){
1633         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1634     }
1635 
1636     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1637 
1638     if (num_attributes >= AVRCP_MEDIA_ATTR_RESERVED) {
1639         return ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
1640     }
1641 
1642     connection->state = AVCTP_W2_SEND_GET_ELEMENT_ATTRIBUTES_REQUEST;
1643     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_STATUS, AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES, true);
1644 
1645     // collect element attributes
1646     uint8_t i;
1647     uint16_t attributes_set = 0;
1648     for (i = 0; i < num_attributes; i++){
1649         // ignore invalid attribute ID and "get all attributes"
1650         if (AVRCP_MEDIA_ATTR_ALL < attributes[i] && attributes[i] < AVRCP_MEDIA_ATTR_RESERVED){
1651             attributes_set |= 1 << (attributes[i] - AVRCP_MEDIA_ATTR_TITLE);
1652         }
1653     }
1654     connection->controller_element_attributes = attributes_set;
1655 
1656     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1657     return ERROR_CODE_SUCCESS;
1658 }
1659 
1660 uint8_t avrcp_controller_get_now_playing_info(uint16_t avrcp_cid){
1661     return avrcp_controller_get_element_attributes(avrcp_cid, 0, NULL);
1662 }
1663 
1664 uint8_t avrcp_controller_get_now_playing_info_for_media_attribute_id(uint16_t avrcp_cid, avrcp_media_attribute_id_t media_attribute_id){
1665     if (media_attribute_id == AVRCP_MEDIA_ATTR_ALL){
1666         return avrcp_controller_get_now_playing_info(avrcp_cid);
1667     }
1668     avrcp_media_attribute_id_t media_attrs[1];
1669     media_attrs[0] = media_attribute_id;
1670     return avrcp_controller_get_element_attributes(avrcp_cid, 1, media_attrs);
1671 }
1672 
1673 uint8_t avrcp_controller_set_absolute_volume(uint16_t avrcp_cid, uint8_t volume){
1674      avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1675     if (!connection){
1676         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1677     }
1678 
1679     //
1680     // allow sending of multiple set abs volume commands without waiting for response
1681     //
1682     uint8_t status = ERROR_CODE_COMMAND_DISALLOWED;
1683     switch (connection->state){
1684         case AVCTP_CONNECTION_OPENED:
1685             status = ERROR_CODE_SUCCESS;
1686             break;
1687         case AVCTP_W2_RECEIVE_RESPONSE:
1688             // - is pending response also set abs volume
1689             if (connection->command_opcode  != AVRCP_CMD_OPCODE_VENDOR_DEPENDENT) break;
1690             if (connection->command_type    != AVRCP_CTYPE_CONTROL)               break;
1691             if (connection->subunit_type    != AVRCP_SUBUNIT_TYPE_PANEL)          break;
1692             if (connection->subunit_id      != AVRCP_SUBUNIT_ID)                  break;
1693             if (connection->pdu_id          != AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME)  break;
1694             // - is next transaction id valid in window
1695             if (avrcp_controller_is_transaction_id_valid(connection, avrcp_controller_calc_next_transaction_label(connection->transaction_id_counter)) == false) break;
1696             status = ERROR_CODE_SUCCESS;
1697             break;
1698         default:
1699             break;
1700     }
1701     if (status != ERROR_CODE_SUCCESS) return status;
1702 
1703     connection->state = AVCTP_W2_SEND_COMMAND;
1704     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME, true);
1705 
1706     // Parameter Length
1707     connection->data_len = 1;
1708     connection->data[0] = volume;
1709 
1710     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1711     return ERROR_CODE_SUCCESS;
1712 }
1713 
1714 uint8_t avrcp_controller_query_shuffle_and_repeat_modes(uint16_t avrcp_cid){
1715     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1716     if (!connection){
1717         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1718     }
1719     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1720 
1721     connection->state = AVCTP_W2_SEND_COMMAND;
1722     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_STATUS, AVRCP_PDU_ID_GET_CURRENT_PLAYER_APPLICATION_SETTING_VALUE, true);
1723 
1724     connection->data_len = 5;
1725     connection->data[0] = 4;                     // NumPlayerApplicationSettingAttributeID
1726     // PlayerApplicationSettingAttributeID1 AVRCP Spec, Appendix F, 133
1727     connection->data[1] = 0x01;   // equalizer  (1-OFF, 2-ON)
1728     connection->data[2] = 0x02;   // repeat     (1-off, 2-single track, 3-all tracks, 4-group repeat)
1729     connection->data[3] = 0x03;   // shuffle    (1-off, 2-all tracks, 3-group shuffle)
1730     connection->data[4] = 0x04;   // scan       (1-off, 2-all tracks, 3-group scan)
1731 
1732     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1733     return ERROR_CODE_SUCCESS;
1734 }
1735 
1736 static uint8_t avrcp_controller_set_current_player_application_setting_value(uint16_t avrcp_cid, uint8_t attr_id, uint8_t attr_value){
1737     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1738     if (!connection){
1739         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1740     }
1741     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1742 
1743     connection->state = AVCTP_W2_SEND_COMMAND;
1744     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_SET_PLAYER_APPLICATION_SETTING_VALUE, true);
1745 
1746     // Parameter Length
1747     connection->data_len = 3;
1748     connection->data[0]  = 2;
1749     connection->data[1]  = attr_id;
1750     connection->data[2]  = attr_value;
1751 
1752     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1753     return ERROR_CODE_SUCCESS;
1754 }
1755 
1756 uint8_t avrcp_controller_set_shuffle_mode(uint16_t avrcp_cid, avrcp_shuffle_mode_t mode){
1757     if ((mode < AVRCP_SHUFFLE_MODE_OFF) || (mode > AVRCP_SHUFFLE_MODE_GROUP)) return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
1758     return avrcp_controller_set_current_player_application_setting_value(avrcp_cid, 0x03, mode);
1759 }
1760 
1761 uint8_t avrcp_controller_set_repeat_mode(uint16_t avrcp_cid, avrcp_repeat_mode_t mode){
1762     if ((mode < AVRCP_REPEAT_MODE_OFF) || (mode > AVRCP_REPEAT_MODE_GROUP)) return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
1763     return avrcp_controller_set_current_player_application_setting_value(avrcp_cid, 0x02, mode);
1764 }
1765 
1766 uint8_t avrcp_controller_play_item_for_scope(uint16_t avrcp_cid, uint8_t * uid, uint16_t uid_counter, avrcp_browsing_scope_t scope){
1767     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1768     if (!connection){
1769         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1770     }
1771     if (connection->state != AVCTP_CONNECTION_OPENED){
1772         log_error("Connection in wrong state, expected %d, received %d", AVCTP_CONNECTION_OPENED, connection->state);
1773         return ERROR_CODE_COMMAND_DISALLOWED;
1774     }
1775     connection->state = AVCTP_W2_SEND_COMMAND;
1776     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_PLAY_ITEM, true);
1777 
1778     // Parameter Length
1779     connection->data_len = 11;
1780     connection->data[0]  = scope;
1781     memset(&connection->data[1], 0, 8);
1782     if (uid){
1783         (void)memcpy(&connection->data[1], uid, 8);
1784     }
1785     big_endian_store_16(connection->data, 9, uid_counter);
1786 
1787     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1788     return ERROR_CODE_SUCCESS;
1789 }
1790 
1791 uint8_t avrcp_controller_add_item_from_scope_to_now_playing_list(uint16_t avrcp_cid, uint8_t * uid, uint16_t uid_counter, avrcp_browsing_scope_t scope){
1792     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1793     if (!connection){
1794         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1795     }
1796     if (connection->state != AVCTP_CONNECTION_OPENED){
1797         log_error("Connection in wrong state, expected %d, received %d", AVCTP_CONNECTION_OPENED, connection->state);
1798         return ERROR_CODE_COMMAND_DISALLOWED;
1799     }
1800 
1801     connection->state = AVCTP_W2_SEND_COMMAND;
1802     avrcp_controller_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_ADD_TO_NOW_PLAYING, true);
1803 
1804     // Parameter Length
1805     connection->data_len = 11;
1806     connection->data[0]  = scope;
1807     memset(&connection->data[1], 0, 8);
1808     if (uid){
1809         (void)memcpy(&connection->data[1], uid, 8);
1810     }
1811     big_endian_store_16(connection->data, 9, uid_counter);
1812 
1813     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1814     return ERROR_CODE_SUCCESS;
1815 }
1816 
1817 uint8_t avrcp_controller_set_max_num_fragments(uint16_t avrcp_cid, uint8_t max_num_fragments){
1818     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1819     if (!connection){
1820         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1821     }
1822     connection->controller_max_num_fragments = max_num_fragments;
1823     return ERROR_CODE_SUCCESS;
1824 }
1825 
1826 
1827 uint8_t avrcp_controller_send_custom_command(uint16_t avrcp_cid,
1828     avrcp_command_type_t command_type,
1829     avrcp_subunit_type_t subunit_type, avrcp_subunit_id_t subunit_id,
1830     avrcp_pdu_id_t pdu_id, uint32_t company_id,
1831     const uint8_t * data, uint16_t data_len){
1832 
1833     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1834     if (!connection){
1835         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1836     }
1837     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1838 
1839     connection->state = AVCTP_W2_SEND_COMMAND;
1840     avrcp_controller_custom_command_data_init(connection, AVRCP_CMD_OPCODE_VENDOR_DEPENDENT, command_type, subunit_type,
1841                                               subunit_id, pdu_id, company_id);
1842 
1843     connection->data = (uint8_t *)data;
1844     connection->data_len = data_len;
1845 
1846     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1847     return ERROR_CODE_SUCCESS;
1848 }
1849 
1850 uint8_t avrcp_controller_force_send_press_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid){
1851     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1852     if (!connection){
1853         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1854     }
1855     if (connection->state < AVCTP_CONNECTION_OPENED){
1856         return ERROR_CODE_COMMAND_DISALLOWED;
1857     }
1858 
1859     connection->state = AVCTP_W2_SEND_COMMAND;
1860     avrcp_controller_pass_through_command_data_init(connection, opid);
1861     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1862     return ERROR_CODE_SUCCESS;
1863 }