xref: /btstack/src/classic/avrcp_controller.c (revision 873b8e568a06e91bdee3ef31830b8b0519d8f1bd)
1 /*
2  * Copyright (C) 2016 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "avrcp_controller.c"
39 
40 #include <stdint.h>
41 #include <string.h>
42 #include <inttypes.h>
43 
44 #include "classic/avrcp.h"
45 #include "classic/avrcp_controller.h"
46 
47 #include "bluetooth_sdp.h"
48 #include "btstack_debug.h"
49 #include "btstack_event.h"
50 #include "btstack_util.h"
51 #include "l2cap.h"
52 
53 #define AVRCP_CMD_BUFFER_SIZE 30
54 
55 // made public in avrcp_controller.h
56 avrcp_context_t avrcp_controller_context;
57 
58 static uint8_t avrcp_controller_calc_next_transaction_label(uint8_t current_transaction_label){
59     current_transaction_label++;
60     if (current_transaction_label == 16){
61         current_transaction_label = 1;
62     }
63     return current_transaction_label;
64 }
65 
66 static uint8_t avrcp_controller_get_next_transaction_label(avrcp_connection_t * connection){
67     connection->transaction_id_counter = avrcp_controller_calc_next_transaction_label(connection->transaction_id_counter);
68     return connection->transaction_id_counter;
69 }
70 
71 static bool avrcp_controller_is_transaction_id_valid(avrcp_connection_t * connection, uint8_t transaction_id){
72     uint8_t delta = ((int8_t) transaction_id - connection->last_confirmed_transaction_id) & 0x0f;
73     return delta < 15;
74 }
75 
76 static uint16_t avrcp_get_max_payload_size_for_packet_type(avrcp_packet_type_t packet_type){
77     switch (packet_type){
78         case AVRCP_SINGLE_PACKET:
79             return AVRCP_CMD_BUFFER_SIZE - 3;
80         case AVRCP_START_PACKET:
81             return AVRCP_CMD_BUFFER_SIZE - 4;
82         case AVRCP_CONTINUE_PACKET:
83         case AVRCP_END_PACKET:
84             return AVRCP_CMD_BUFFER_SIZE - 1;
85         default:
86             btstack_assert(false);
87             return 0;
88     }
89 }
90 
91 static int avrcp_controller_supports_browsing(uint16_t controller_supported_features){
92     return controller_supported_features & AVRCP_FEATURE_MASK_BROWSING;
93 }
94 
95 static void avrcp_controller_emit_notification_for_event_id(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id,
96                                                             avrcp_command_type_t ctype, const uint8_t *payload,
97                                                             uint16_t size) {
98     switch (event_id){
99         case AVRCP_NOTIFICATION_EVENT_PLAYBACK_POS_CHANGED:{
100             if (size < 4) break;
101             uint32_t song_position = big_endian_read_32(payload, 0);
102             uint16_t offset = 0;
103             uint8_t event[10];
104             event[offset++] = HCI_EVENT_AVRCP_META;
105             event[offset++] = sizeof(event) - 2;
106             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_PLAYBACK_POS_CHANGED;
107             little_endian_store_16(event, offset, avrcp_cid);
108             offset += 2;
109             event[offset++] = ctype;
110             little_endian_store_32(event, offset, song_position);
111             offset += 4;
112             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
113             break;
114         }
115         case AVRCP_NOTIFICATION_EVENT_PLAYBACK_STATUS_CHANGED:{
116             if (size < 1) break;
117             uint16_t offset = 0;
118             uint8_t event[7];
119             event[offset++] = HCI_EVENT_AVRCP_META;
120             event[offset++] = sizeof(event) - 2;
121             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_PLAYBACK_STATUS_CHANGED;
122             little_endian_store_16(event, offset, avrcp_cid);
123             offset += 2;
124             event[offset++] = ctype;
125             event[offset++] = payload[0];
126             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
127             break;
128         }
129         case AVRCP_NOTIFICATION_EVENT_TRACK_CHANGED:{
130             uint16_t offset = 0;
131             uint8_t event[6];
132             event[offset++] = HCI_EVENT_AVRCP_META;
133             event[offset++] = sizeof(event) - 2;
134             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_TRACK_CHANGED;
135             little_endian_store_16(event, offset, avrcp_cid);
136             offset += 2;
137             event[offset++] = ctype;
138             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
139             break;
140         }
141         case AVRCP_NOTIFICATION_EVENT_NOW_PLAYING_CONTENT_CHANGED:{
142             uint16_t offset = 0;
143             uint8_t event[6];
144             event[offset++] = HCI_EVENT_AVRCP_META;
145             event[offset++] = sizeof(event) - 2;
146             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_NOW_PLAYING_CONTENT_CHANGED;
147             little_endian_store_16(event, offset, avrcp_cid);
148             offset += 2;
149             event[offset++] = ctype;
150             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
151             break;
152         }
153         case AVRCP_NOTIFICATION_EVENT_AVAILABLE_PLAYERS_CHANGED:{
154             uint16_t offset = 0;
155             uint8_t event[6];
156             event[offset++] = HCI_EVENT_AVRCP_META;
157             event[offset++] = sizeof(event) - 2;
158             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_AVAILABLE_PLAYERS_CHANGED;
159             little_endian_store_16(event, offset, avrcp_cid);
160             offset += 2;
161             event[offset++] = ctype;
162             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
163             break;
164         }
165         case AVRCP_NOTIFICATION_EVENT_VOLUME_CHANGED:{
166             if (size < 1) break;
167             uint16_t offset = 0;
168             uint8_t event[7];
169             event[offset++] = HCI_EVENT_AVRCP_META;
170             event[offset++] = sizeof(event) - 2;
171             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_VOLUME_CHANGED;
172             little_endian_store_16(event, offset, avrcp_cid);
173             offset += 2;
174             event[offset++] = ctype;
175             event[offset++] = payload[0] & 0x7F;
176             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
177             break;
178         }
179         case AVRCP_NOTIFICATION_EVENT_UIDS_CHANGED:{
180             if (size < 2) break;
181             uint8_t event[8];
182             uint16_t offset = 0;
183             uint16_t uuid = big_endian_read_16(payload, 0);
184             event[offset++] = HCI_EVENT_AVRCP_META;
185             event[offset++] = sizeof(event) - 2;
186             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_UIDS_CHANGED;
187             little_endian_store_16(event, offset, avrcp_cid);
188             offset += 2;
189             event[offset++] = ctype;
190             little_endian_store_16(event, offset, uuid);
191             offset += 2;
192             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
193             break;
194         }
195 
196         case AVRCP_NOTIFICATION_EVENT_TRACK_REACHED_END:{
197             uint16_t offset = 0;
198             uint8_t event[6];
199             event[offset++] = HCI_EVENT_AVRCP_META;
200             event[offset++] = sizeof(event) - 2;
201             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_TRACK_REACHED_END;
202             little_endian_store_16(event, offset, avrcp_cid);
203             offset += 2;
204             event[offset++] = ctype;
205             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
206             break;
207         }
208         case AVRCP_NOTIFICATION_EVENT_TRACK_REACHED_START:{
209             uint16_t offset = 0;
210             uint8_t event[6];
211             event[offset++] = HCI_EVENT_AVRCP_META;
212             event[offset++] = sizeof(event) - 2;
213             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_TRACK_REACHED_START;
214             little_endian_store_16(event, offset, avrcp_cid);
215             offset += 2;
216             event[offset++] = ctype;
217             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
218             break;
219         }
220         case AVRCP_NOTIFICATION_EVENT_BATT_STATUS_CHANGED:{
221             if (size < 1) break;
222             uint16_t offset = 0;
223             uint8_t event[7];
224             event[offset++] = HCI_EVENT_AVRCP_META;
225             event[offset++] = sizeof(event) - 2;
226             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_BATT_STATUS_CHANGED;
227             little_endian_store_16(event, offset, avrcp_cid);
228             offset += 2;
229             event[offset++] = ctype;
230             event[offset++] = payload[0];
231             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
232             break;
233         }
234 
235         case AVRCP_NOTIFICATION_EVENT_SYSTEM_STATUS_CHANGED:{
236             if (size < 1) break;
237             uint16_t offset = 0;
238             uint8_t event[7];
239             event[offset++] = HCI_EVENT_AVRCP_META;
240             event[offset++] = sizeof(event) - 2;
241             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_SYSTEM_STATUS_CHANGED;
242             little_endian_store_16(event, offset, avrcp_cid);
243             offset += 2;
244             event[offset++] = ctype;
245             event[offset++] = payload[0];
246             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
247             break;
248         }
249 
250         case AVRCP_NOTIFICATION_EVENT_PLAYER_APPLICATION_SETTING_CHANGED:
251         default:
252             log_info("avrcp: not implemented");
253             break;
254     }
255 }
256 
257 static void avrcp_controller_emit_repeat_and_shuffle_mode(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t ctype, avrcp_repeat_mode_t repeat_mode, avrcp_shuffle_mode_t shuffle_mode){
258     btstack_assert(callback != NULL);
259 
260     uint8_t event[8];
261     int pos = 0;
262     event[pos++] = HCI_EVENT_AVRCP_META;
263     event[pos++] = sizeof(event) - 2;
264     event[pos++] = AVRCP_SUBEVENT_SHUFFLE_AND_REPEAT_MODE;
265     little_endian_store_16(event, pos, avrcp_cid);
266     pos += 2;
267     event[pos++] = ctype;
268     event[pos++] = repeat_mode;
269     event[pos++] = shuffle_mode;
270     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
271 }
272 
273 static void avrcp_controller_emit_now_playing_info_event_done(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t ctype, uint8_t status){
274     uint8_t event[7];
275     int pos = 0;
276     event[pos++] = HCI_EVENT_AVRCP_META;
277     event[pos++] = sizeof(event) - 2;
278     event[pos++] = AVRCP_SUBEVENT_NOW_PLAYING_INFO_DONE;
279     little_endian_store_16(event, pos, avrcp_cid);
280     pos += 2;
281     event[pos++] = ctype;
282     event[pos++] = status;
283     (*callback)(HCI_EVENT_PACKET, 0, event, pos);
284 }
285 
286 static void avrcp_controller_emit_now_playing_info_event(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t ctype, avrcp_media_attribute_id_t attr_id, uint8_t * value, uint16_t value_len){
287     uint8_t event[HCI_EVENT_BUFFER_SIZE];
288     int pos = 0;
289     event[pos++] = HCI_EVENT_AVRCP_META;
290     // reserve one byte for subevent type and data len
291     int data_len_pos = pos;
292     pos++;
293     int subevent_type_pos = pos;
294     pos++;
295     little_endian_store_16(event, pos, avrcp_cid);
296     pos += 2;
297     event[pos++] = ctype;
298 
299     switch (attr_id){
300         case AVRCP_MEDIA_ATTR_TITLE:
301             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_TITLE_INFO;
302             event[pos++] = value_len;
303             (void)memcpy(event + pos, value, value_len);
304             break;
305         case AVRCP_MEDIA_ATTR_ARTIST:
306             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_ARTIST_INFO;
307             event[pos++] = value_len;
308             (void)memcpy(event + pos, value, value_len);
309             break;
310         case AVRCP_MEDIA_ATTR_ALBUM:
311             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_ALBUM_INFO;
312             event[pos++] = value_len;
313             (void)memcpy(event + pos, value, value_len);
314             break;
315         case AVRCP_MEDIA_ATTR_GENRE:
316             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_GENRE_INFO;
317             event[pos++] = value_len;
318             (void)memcpy(event + pos, value, value_len);
319             break;
320         case AVRCP_MEDIA_ATTR_SONG_LENGTH_MS:
321             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_SONG_LENGTH_MS_INFO;
322             if (value){
323                 little_endian_store_32(event, pos, btstack_atoi((char *)value));
324             } else {
325                 little_endian_store_32(event, pos, 0);
326             }
327             pos += 4;
328             break;
329         case AVRCP_MEDIA_ATTR_TRACK:
330             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_TRACK_INFO;
331             if (value){
332                 event[pos++] = btstack_atoi((char *)value);
333             } else {
334                 event[pos++] = 0;
335             }
336             break;
337         case AVRCP_MEDIA_ATTR_TOTAL_NUM_ITEMS:
338             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_TOTAL_TRACKS_INFO;
339             if (value){
340                 event[pos++] = btstack_atoi((char *)value);
341             } else {
342                 event[pos++] = 0;
343             }
344             break;
345         default:
346             break;
347     }
348     event[data_len_pos] = pos - 2;
349     (*callback)(HCI_EVENT_PACKET, 0, event, pos);
350 }
351 
352 static void avrcp_controller_emit_operation_status(btstack_packet_handler_t callback, uint8_t subevent, uint16_t avrcp_cid, uint8_t ctype, uint8_t operation_id){
353     btstack_assert(callback != NULL);
354 
355     uint8_t event[7];
356     int pos = 0;
357     event[pos++] = HCI_EVENT_AVRCP_META;
358     event[pos++] = sizeof(event) - 2;
359     event[pos++] = subevent;
360     little_endian_store_16(event, pos, avrcp_cid);
361     pos += 2;
362     event[pos++] = ctype;
363     event[pos++] = operation_id;
364     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
365 }
366 
367 static void avrcp_parser_reset(avrcp_connection_t * connection){
368     connection->list_offset = 0;
369     connection->num_attributes = 0;
370     connection->num_parsed_attributes = 0;
371     connection->parser_attribute_header_pos = 0;
372     connection->num_received_fragments = 0;
373     connection->parser_state = AVRCP_PARSER_GET_ATTRIBUTE_HEADER;
374 }
375 
376 static void avrcp_parser_process_byte(uint8_t byte, avrcp_connection_t * connection, avrcp_command_type_t ctype){
377     uint16_t attribute_total_value_len;
378     uint32_t attribute_id;
379     switch(connection->parser_state){
380         case AVRCP_PARSER_GET_ATTRIBUTE_HEADER:
381             connection->parser_attribute_header[connection->parser_attribute_header_pos++] = byte;
382             connection->list_offset++;
383 
384             if (connection->parser_attribute_header_pos < AVRCP_ATTRIBUTE_HEADER_LEN) return;
385 
386             attribute_total_value_len = big_endian_read_16(connection->parser_attribute_header, 6);
387             connection->attribute_value_len = btstack_min(attribute_total_value_len, AVRCP_MAX_ATTRIBUTTE_SIZE);
388             if (connection->attribute_value_len > 0){
389                 // get ready for attribute value
390                 connection->parser_state = AVRCP_PARSER_GET_ATTRIBUTE_VALUE;
391                 return;
392             }
393 
394             // emit empty attribute
395             attribute_id = big_endian_read_32(connection->parser_attribute_header, 0);
396             avrcp_controller_emit_now_playing_info_event(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, (avrcp_media_attribute_id_t) attribute_id, connection->attribute_value, connection->attribute_value_len);
397 
398             // done, see below
399             break;
400 
401         case AVRCP_PARSER_GET_ATTRIBUTE_VALUE:
402             connection->attribute_value[connection->attribute_value_offset++] = byte;
403             connection->list_offset++;
404 
405             if (connection->attribute_value_offset < connection->attribute_value_len) return;
406 
407             // emit (potentially partial) attribute
408             attribute_id = big_endian_read_32(connection->parser_attribute_header, 0);
409             avrcp_controller_emit_now_playing_info_event(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, (avrcp_media_attribute_id_t) attribute_id, connection->attribute_value, connection->attribute_value_len);
410 
411             attribute_total_value_len = big_endian_read_16(connection->parser_attribute_header, 6);
412             if (connection->attribute_value_offset < attribute_total_value_len){
413                 // ignore rest of attribute
414                 connection->parser_state = AVRCP_PARSER_IGNORE_REST_OF_ATTRIBUTE_VALUE;
415                 return;
416             }
417 
418             // done, see below
419             break;
420 
421         case AVRCP_PARSER_IGNORE_REST_OF_ATTRIBUTE_VALUE:
422             connection->attribute_value_offset++;
423             connection->list_offset++;
424 
425             attribute_total_value_len = big_endian_read_16(connection->parser_attribute_header, 6);
426             if (connection->attribute_value_offset < attribute_total_value_len) return;
427 
428             // done, see below
429             break;
430 
431         default:
432             return;
433     }
434 
435     // attribute fully read, check if more to come
436     if (connection->list_offset < connection->list_size){
437         // more to come, reset parser
438         connection->parser_state = AVRCP_PARSER_GET_ATTRIBUTE_HEADER;
439         connection->parser_attribute_header_pos = 0;
440         connection->attribute_value_offset = 0;
441     } else {
442         // fully done
443         avrcp_parser_reset(connection);
444         avrcp_controller_emit_now_playing_info_event_done(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, 0);
445     }
446 }
447 
448 static void avrcp_controller_parse_and_emit_element_attrs(uint8_t * packet, uint16_t num_bytes_to_read, avrcp_connection_t * connection, avrcp_command_type_t ctype){
449     int i;
450     for (i=0;i<num_bytes_to_read;i++){
451         avrcp_parser_process_byte(packet[i], connection, ctype);
452     }
453 }
454 
455 
456 static int avrcp_send_cmd(avrcp_connection_t * connection, avrcp_packet_type_t packet_type){
457     uint8_t  command[AVRCP_CMD_BUFFER_SIZE];
458     uint16_t pos = 0;
459 
460     // non-fragmented: transport header (1) + PID (2)
461     // fragmented:     transport header (1) + num packets (1) + PID (2)
462 
463     // transport header : transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
464     command[pos++] = (connection->transaction_id << 4) | (packet_type << 2) | (AVRCP_COMMAND_FRAME << 1) | 0;
465 
466     if (packet_type == AVRCP_START_PACKET){
467         // num packets: (3 bytes overhead (PID, num packets) + command) / (MTU - transport header).
468         // to get number of packets using integer division, we subtract 1 from the data e.g. len = 5, packet size 5 => need 1 packet
469         command[pos++] = ((connection->cmd_operands_fragmented_len + 3 - 1) / (AVRCP_CMD_BUFFER_SIZE - 1)) + 1;
470     }
471 
472     if ((packet_type == AVRCP_SINGLE_PACKET) || (packet_type == AVRCP_START_PACKET)){
473         // Profile IDentifier (PID)
474         command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL >> 8;
475         command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL & 0x00FF;
476 
477         // command_type
478         command[pos++] = connection->command_type;
479         // subunit_type | subunit ID
480         command[pos++] = (connection->subunit_type << 3) | connection->subunit_id;
481         // opcode
482         command[pos++] = (uint8_t)connection->command_opcode;
483     }
484 
485     if (packet_type == AVRCP_SINGLE_PACKET){
486         // operands
487         (void)memcpy(command + pos, connection->cmd_operands,
488                      connection->cmd_operands_length);
489         pos += connection->cmd_operands_length;
490     } else {
491         uint16_t bytes_free = AVRCP_CMD_BUFFER_SIZE - pos;
492         uint16_t bytes_to_store = connection->cmd_operands_fragmented_len-connection->cmd_operands_fragmented_pos;
493         uint16_t bytes_to_copy = btstack_min(bytes_to_store, bytes_free);
494         (void)memcpy(command + pos,
495                      &connection->cmd_operands_fragmented_buffer[connection->cmd_operands_fragmented_pos],
496                      bytes_to_copy);
497         pos += bytes_to_copy;
498         connection->cmd_operands_fragmented_pos += bytes_to_copy;
499     }
500 
501     return l2cap_send(connection->l2cap_signaling_cid, command, pos);
502 }
503 
504 static int avrcp_send_register_notification(avrcp_connection_t * connection, uint8_t event_id){
505     uint8_t command[18];
506     uint16_t pos = 0;
507     // transport header : transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
508     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
509     command[pos++] = (connection->transaction_id << 4) | (AVRCP_SINGLE_PACKET << 2) | (AVRCP_COMMAND_FRAME << 1) | 0;
510 
511     command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL >> 8;
512     command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL & 0x00FF;
513     command[pos++] = AVRCP_CTYPE_NOTIFY;
514     command[pos++] = (AVRCP_SUBUNIT_TYPE_PANEL << 3) | AVRCP_SUBUNIT_ID;
515     command[pos++] = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
516 
517     big_endian_store_24(command, pos, BT_SIG_COMPANY_ID);
518     pos += 3;
519     command[pos++] = AVRCP_PDU_ID_REGISTER_NOTIFICATION;
520     command[pos++] = 0;                       // reserved(upper 6) | packet_type -> 0
521     big_endian_store_16(command, pos, 5);     // parameter length
522     pos += 2;
523     command[pos++] = event_id;
524     big_endian_store_32(command, pos, 1);     // send notification on playback position every second, for other notifications it is ignored
525     pos += 4;
526     return l2cap_send(connection->l2cap_signaling_cid, command, pos);
527 }
528 
529 static void avrcp_press_and_hold_timeout_handler(btstack_timer_source_t * timer){
530     UNUSED(timer);
531     avrcp_connection_t * connection = (avrcp_connection_t*) btstack_run_loop_get_timer_context(timer);
532     btstack_run_loop_set_timer(&connection->press_and_hold_cmd_timer, 2000); // 2 seconds timeout
533     btstack_run_loop_add_timer(&connection->press_and_hold_cmd_timer);
534     connection->state = AVCTP_W2_SEND_PRESS_COMMAND;
535     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
536 }
537 
538 static void avrcp_press_and_hold_timer_start(avrcp_connection_t * connection){
539     btstack_run_loop_remove_timer(&connection->press_and_hold_cmd_timer);
540     btstack_run_loop_set_timer_handler(&connection->press_and_hold_cmd_timer, avrcp_press_and_hold_timeout_handler);
541     btstack_run_loop_set_timer_context(&connection->press_and_hold_cmd_timer, connection);
542     btstack_run_loop_set_timer(&connection->press_and_hold_cmd_timer, 2000); // 2 seconds timeout
543     btstack_run_loop_add_timer(&connection->press_and_hold_cmd_timer);
544 }
545 
546 static void avrcp_press_and_hold_timer_stop(avrcp_connection_t * connection){
547     connection->press_and_hold_cmd_active = false;
548     btstack_run_loop_remove_timer(&connection->press_and_hold_cmd_timer);
549 }
550 
551 
552 static uint8_t avrcp_controller_request_pass_through_release_control_cmd(avrcp_connection_t * connection){
553     connection->state = AVCTP_W2_SEND_RELEASE_COMMAND;
554     if (connection->press_and_hold_cmd_active){
555         avrcp_press_and_hold_timer_stop(connection);
556     }
557     connection->cmd_operands[0] = 0x80 | connection->cmd_operands[0];
558     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
559     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
560     return ERROR_CODE_SUCCESS;
561 }
562 
563 static uint8_t avrcp_controller_request_pass_through_press_control_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint16_t playback_speed, bool continuous_cmd){
564     log_info("Send command %d", opid);
565     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
566     if (!connection){
567         log_error("Could not find a connection. avrcp cid 0x%02x", avrcp_cid);
568         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
569     }
570 
571     if (connection->state != AVCTP_CONNECTION_OPENED){
572         log_error("Connection in wrong state %d, expected %d. avrcp cid 0x%02x", connection->state, AVCTP_CONNECTION_OPENED, avrcp_cid);
573         return ERROR_CODE_COMMAND_DISALLOWED;
574     }
575     connection->state = AVCTP_W2_SEND_PRESS_COMMAND;
576     connection->command_opcode =  AVRCP_CMD_OPCODE_PASS_THROUGH;
577     connection->command_type = AVRCP_CTYPE_CONTROL;
578     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
579     connection->subunit_id =   AVRCP_SUBUNIT_ID;
580     connection->cmd_operands_length = 0;
581 
582     connection->press_and_hold_cmd_active = continuous_cmd;
583     connection->cmd_operands_length = 2;
584     connection->cmd_operands[0] = opid;
585     if (playback_speed > 0){
586         connection->cmd_operands[2] = playback_speed;
587         connection->cmd_operands_length++;
588     }
589     connection->cmd_operands[1] = connection->cmd_operands_length - 2;
590 
591     if (connection->press_and_hold_cmd_active){
592         avrcp_press_and_hold_timer_start(connection);
593     }
594 
595     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
596     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
597     return ERROR_CODE_SUCCESS;
598 }
599 
600 static uint8_t request_single_pass_through_press_control_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint16_t playback_speed){
601     return avrcp_controller_request_pass_through_press_control_cmd(avrcp_cid, opid, playback_speed, false);
602 }
603 
604 static uint8_t request_continuous_pass_through_press_control_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint16_t playback_speed){
605     return avrcp_controller_request_pass_through_press_control_cmd(avrcp_cid, opid, playback_speed, true);
606 }
607 
608 static int avrcp_controller_register_notification(avrcp_connection_t * connection, avrcp_notification_event_id_t event_id){
609     if (connection->notifications_to_deregister & (1 << event_id)) return 0;
610     if (connection->notifications_enabled & (1 << event_id)) return 0;
611     if (connection->notifications_to_register & (1 << event_id)) return 0;
612     connection->notifications_to_register |= (1 << event_id);
613     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
614     return 1;
615 }
616 
617 static uint8_t avrcp_controller_request_abort_continuation(avrcp_connection_t * connection){
618     connection->state = AVCTP_W2_SEND_COMMAND;
619     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
620     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
621     connection->command_type = AVRCP_CTYPE_CONTROL;
622     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
623     connection->subunit_id = AVRCP_SUBUNIT_ID;
624     int pos = 0;
625     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
626     pos += 3;
627     connection->cmd_operands[pos++] = AVRCP_PDU_ID_REQUEST_ABORT_CONTINUING_RESPONSE; // PDU ID
628     connection->cmd_operands[pos++] = 0;
629     // Parameter Length
630     connection->cmd_operands_length = 8;
631     big_endian_store_16(connection->cmd_operands, pos, 1);
632     pos += 2;
633     connection->cmd_operands[pos++] = AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES;
634     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
635     return ERROR_CODE_SUCCESS;
636 }
637 
638 
639 static uint8_t avrcp_controller_request_continue_response(avrcp_connection_t * connection){
640     connection->state = AVCTP_W2_SEND_COMMAND;
641     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
642     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
643     connection->command_type = AVRCP_CTYPE_CONTROL;
644     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
645     connection->subunit_id = AVRCP_SUBUNIT_ID;
646     int pos = 0;
647     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
648     pos += 3;
649     connection->cmd_operands[pos++] = AVRCP_PDU_ID_REQUEST_CONTINUING_RESPONSE; // PDU ID
650     connection->cmd_operands[pos++] = 0;
651     // Parameter Length
652     connection->cmd_operands_length = 8;
653     big_endian_store_16(connection->cmd_operands, pos, 1);
654     pos += 2;
655     connection->cmd_operands[pos++] = AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES;
656     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
657     return ERROR_CODE_SUCCESS;
658 }
659 
660 static void
661 avrcp_controller_handle_notification(avrcp_connection_t *connection, avrcp_command_type_t ctype, uint8_t *payload, uint16_t size) {
662     if (size < 1) return;
663     uint16_t pos = 0;
664     avrcp_notification_event_id_t event_id = (avrcp_notification_event_id_t) payload[pos++];
665     uint16_t event_mask = (1 << event_id);
666     uint16_t reset_event_mask = ~event_mask;
667 
668     switch (ctype){
669         case AVRCP_CTYPE_RESPONSE_INTERIM:
670             // register as enabled
671             connection->notifications_enabled |= event_mask;
672             if ( (connection->initial_status_reported & event_mask) > 0 ){
673                 return;
674             }
675             connection->initial_status_reported |= event_mask;
676             break;
677         case AVRCP_CTYPE_RESPONSE_CHANGED_STABLE:
678             // received change, event is considered deregistered
679             // we are re-enabling it automatically, if it is not
680             // explicitly disabled
681             connection->notifications_enabled &= reset_event_mask;
682             if (! (connection->notifications_to_deregister & event_mask)){
683                 avrcp_controller_register_notification(connection, event_id);
684             } else {
685                 connection->notifications_to_deregister &= reset_event_mask;
686             }
687             break;
688         default:
689             connection->notifications_to_register &= reset_event_mask;
690             connection->notifications_enabled &= reset_event_mask;
691             connection->notifications_to_deregister &= reset_event_mask;
692             break;
693     }
694 
695     avrcp_controller_emit_notification_for_event_id(connection->avrcp_cid, event_id, ctype, payload + pos, size - pos);
696 }
697 
698 #ifdef ENABLE_AVCTP_FRAGMENTATION
699 static void avctp_reassemble_message(avrcp_connection_t * connection, avctp_packet_type_t packet_type, uint8_t *packet, uint16_t size){
700     // after header (transaction label and packet type)
701     uint16_t pos;
702     uint16_t bytes_to_store;
703 
704     switch (packet_type){
705         case AVCTP_START_PACKET:
706             if (size < 2) return;
707 
708             // store header
709             pos = 0;
710             connection->avctp_reassembly_buffer[pos] = packet[pos];
711             pos++;
712             connection->avctp_reassembly_size = pos;
713 
714             // NOTE: num packets not needed for reassembly, ignoring it does not pose security risk -> no need to store it
715             pos++;
716 
717             // PID in reassembled packet is at offset 1, it will be read later after the avctp_reassemble_message with AVCTP_END_PACKET is called
718 
719             bytes_to_store = btstack_min(size - pos, sizeof(connection->avctp_reassembly_buffer) - connection->avctp_reassembly_size);
720             memcpy(&connection->avctp_reassembly_buffer[connection->avctp_reassembly_size], &packet[pos], bytes_to_store);
721             connection->avctp_reassembly_size += bytes_to_store;
722             break;
723 
724         case AVCTP_CONTINUE_PACKET:
725         case AVCTP_END_PACKET:
726             if (size < 1) return;
727 
728             // store remaining data, ignore header
729             pos = 1;
730             bytes_to_store = btstack_min(size - pos, sizeof(connection->avctp_reassembly_buffer) - connection->avctp_reassembly_size);
731             memcpy(&connection->avctp_reassembly_buffer[connection->avctp_reassembly_size], &packet[pos], bytes_to_store);
732             connection->avctp_reassembly_size += bytes_to_store;
733             break;
734 
735         default:
736             return;
737     }
738 }
739 #endif
740 
741 static void avrcp_handle_l2cap_data_packet_for_signaling_connection(avrcp_connection_t * connection, uint8_t *packet, uint16_t size){
742     if (size < 6u) return;
743     uint8_t  pdu_id;
744     avrcp_packet_type_t  vendor_dependent_packet_type;
745 
746     uint16_t pos = 0;
747     connection->last_confirmed_transaction_id = packet[pos] >> 4;
748     avrcp_frame_type_t  frame_type =  (avrcp_frame_type_t)((packet[pos] >> 1) & 0x01);
749     avctp_packet_type_t packet_type = (avctp_packet_type_t)((packet[pos] >> 2) & 0x03);
750     pos++;
751 
752     if (frame_type != AVRCP_RESPONSE_FRAME) return;
753 
754     switch (packet_type){
755         case AVCTP_SINGLE_PACKET:
756             break;
757 
758 #ifdef ENABLE_AVCTP_FRAGMENTATION
759         case AVCTP_START_PACKET:
760         case AVCTP_CONTINUE_PACKET:
761             avctp_reassemble_message(connection, packet_type, packet, size);
762             return;
763 
764         case AVCTP_END_PACKET:
765             avctp_reassemble_message(connection, packet_type, packet, size);
766 
767             packet = connection->avctp_reassembly_buffer;
768             size   = connection->avctp_reassembly_size;
769             break;
770 #endif
771 
772         default:
773             return;
774     }
775 
776     pos += 2; // PID
777 
778     avrcp_command_type_t ctype = (avrcp_command_type_t) packet[pos++];
779 
780 #ifdef ENABLE_LOG_INFO
781     uint8_t byte_value = packet[pos];
782     avrcp_subunit_type_t subunit_type = (avrcp_subunit_type_t) (byte_value >> 3);
783     avrcp_subunit_type_t subunit_id   = (avrcp_subunit_type_t) (byte_value & 0x07);
784 #endif
785     pos++;
786 
787     uint8_t opcode = packet[pos++];
788     uint16_t param_length;
789 
790     switch (opcode){
791         case AVRCP_CMD_OPCODE_SUBUNIT_INFO:{
792             if (connection->state != AVCTP_W2_RECEIVE_RESPONSE) return;
793             connection->state = AVCTP_CONNECTION_OPENED;
794 
795 #ifdef ENABLE_LOG_INFO
796             // page, extention code (1)
797             pos++;
798             uint8_t unit_type = packet[pos] >> 3;
799             uint8_t max_subunit_ID = packet[pos] & 0x07;
800             log_info("SUBUNIT INFO response: ctype 0x%02x (0C), subunit_type 0x%02x (1F), subunit_id 0x%02x (07), opcode 0x%02x (30), unit_type 0x%02x, max_subunit_ID %d", ctype, subunit_type, subunit_id, opcode, unit_type, max_subunit_ID);
801 #endif
802             break;
803         }
804         case AVRCP_CMD_OPCODE_UNIT_INFO:{
805             if (connection->state != AVCTP_W2_RECEIVE_RESPONSE) return;
806             connection->state = AVCTP_CONNECTION_OPENED;
807 
808 #ifdef ENABLE_LOG_INFO
809             // byte value 7 (1)
810             pos++;
811             uint8_t unit_type = packet[pos] >> 3;
812             uint8_t unit = packet[pos] & 0x07;
813             pos++;
814             uint32_t company_id = big_endian_read_24(packet, pos);
815             log_info("UNIT INFO response: ctype 0x%02x (0C), subunit_type 0x%02x (1F), subunit_id 0x%02x (07), opcode 0x%02x (30), unit_type 0x%02x, unit %d, company_id 0x%06" PRIx32,
816                 ctype, subunit_type, subunit_id, opcode, unit_type, unit, company_id);
817 #endif
818             break;
819         }
820         case AVRCP_CMD_OPCODE_VENDOR_DEPENDENT:
821 
822             if ((size - pos) < 7) return;
823 
824             // Company ID (3)
825             pos += 3;
826             pdu_id = packet[pos++];
827             vendor_dependent_packet_type = (avrcp_packet_type_t)(packet[pos++] & 0x03);
828             param_length = big_endian_read_16(packet, pos);
829             pos += 2;
830 
831             if ((size - pos) < param_length) return;
832 
833             // handle asynchronous notifications, without changing state
834             if (pdu_id == AVRCP_PDU_ID_REGISTER_NOTIFICATION){
835                 avrcp_controller_handle_notification(connection, ctype, packet + pos, size - pos);
836                 break;
837             }
838 
839             if (connection->state != AVCTP_W2_RECEIVE_RESPONSE){
840                 log_info("AVRCP_CMD_OPCODE_VENDOR_DEPENDENT state %d", connection->state);
841                 return;
842             }
843             connection->state = AVCTP_CONNECTION_OPENED;
844 
845             log_info("VENDOR DEPENDENT response: pdu id 0x%02x, param_length %d, status %s", pdu_id, param_length, avrcp_ctype2str(ctype));
846             switch (pdu_id){
847                 case AVRCP_PDU_ID_GET_CURRENT_PLAYER_APPLICATION_SETTING_VALUE:{
848                     uint8_t num_attributes = packet[pos++];
849                     int i;
850                     avrcp_repeat_mode_t  repeat_mode =  AVRCP_REPEAT_MODE_INVALID;
851                     avrcp_shuffle_mode_t shuffle_mode = AVRCP_SHUFFLE_MODE_INVALID;
852                     for (i = 0; i < num_attributes; i++){
853                         uint8_t attribute_id    = packet[pos++];
854                         uint8_t value = packet[pos++];
855                         switch (attribute_id){
856                             case 0x02:
857                                 repeat_mode = (avrcp_repeat_mode_t) value;
858                                 break;
859                             case 0x03:
860                                 shuffle_mode = (avrcp_shuffle_mode_t) value;
861                                 break;
862                             default:
863                                 break;
864                         }
865                     }
866                     avrcp_controller_emit_repeat_and_shuffle_mode(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, repeat_mode, shuffle_mode);
867                     break;
868                 }
869 
870                 case AVRCP_PDU_ID_SET_PLAYER_APPLICATION_SETTING_VALUE:{
871                     uint16_t offset = 0;
872                     uint8_t event[6];
873                     event[offset++] = HCI_EVENT_AVRCP_META;
874                     event[offset++] = sizeof(event) - 2;
875                     event[offset++] = AVRCP_SUBEVENT_PLAYER_APPLICATION_VALUE_RESPONSE;
876                     little_endian_store_16(event, offset, connection->avrcp_cid);
877                     offset += 2;
878                     event[offset++] = ctype;
879                     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
880                     break;
881                 }
882 
883                 case AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME:{
884                     uint16_t offset = 0;
885                     uint8_t event[7];
886                     event[offset++] = HCI_EVENT_AVRCP_META;
887                     event[offset++] = sizeof(event) - 2;
888                     event[offset++] = AVRCP_SUBEVENT_SET_ABSOLUTE_VOLUME_RESPONSE;
889                     little_endian_store_16(event, offset, connection->avrcp_cid);
890                     offset += 2;
891                     event[offset++] = ctype;
892                     event[offset++] = packet[pos++];
893                     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
894                     break;
895                 }
896 
897                 case AVRCP_PDU_ID_GET_CAPABILITIES:{
898                     avrcp_capability_id_t capability_id = (avrcp_capability_id_t) packet[pos++];
899                     uint8_t capability_count = 0;
900                     if (param_length > 1){
901                         capability_count = packet[pos++];
902                     }
903                     uint16_t i;
904                     uint16_t offset = 0;
905                     uint8_t event[10];
906 
907                     switch (capability_id){
908 
909                         case AVRCP_CAPABILITY_ID_COMPANY:
910                             // TODO: avoid out of bounds read
911                             for (i = 0; i < capability_count; i++){
912                                 uint32_t company_id = big_endian_read_24(packet, pos);
913                                 pos += 3;
914                                 log_info("  0x%06" PRIx32 ", ", company_id);
915 
916                                 offset = 0;
917                                 event[offset++] = HCI_EVENT_AVRCP_META;
918                                 event[offset++] = sizeof(event) - 2;
919                                 event[offset++] = AVRCP_SUBEVENT_GET_CAPABILITY_COMPANY_ID;
920                                 little_endian_store_16(event, offset, connection->avrcp_cid);
921                                 offset += 2;
922                                 event[offset++] = ctype;
923                                 event[offset++] = 0;
924                                 little_endian_store_24(event, offset, company_id);
925                                 offset += 3;
926                                 (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
927                                 break;
928                             }
929 
930                             offset = 0;
931                             event[offset++] = HCI_EVENT_AVRCP_META;
932                             event[offset++] = sizeof(event) - 2;
933                             event[offset++] = AVRCP_SUBEVENT_GET_CAPABILITY_COMPANY_ID_DONE;
934                             little_endian_store_16(event, offset, connection->avrcp_cid);
935                             offset += 2;
936                             event[offset++] = ctype;
937                             event[offset++] = 0;
938                             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
939                             break;
940 
941                         case AVRCP_CAPABILITY_ID_EVENT:
942                             // TODO: avoid out of bounds read
943                             for (i = 0; i < capability_count; i++){
944                                 uint8_t event_id = packet[pos++];
945                                 log_info("  0x%02x %s", event_id, avrcp_event2str(event_id));
946 
947                                 offset = 0;
948                                 event[offset++] = HCI_EVENT_AVRCP_META;
949                                 event[offset++] = sizeof(event) - 2;
950                                 event[offset++] = AVRCP_SUBEVENT_GET_CAPABILITY_EVENT_ID;
951                                 little_endian_store_16(event, offset, connection->avrcp_cid);
952                                 offset += 2;
953                                 event[offset++] = ctype;
954                                 event[offset++] = 0;
955                                 event[offset++] = event_id;
956                                 (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
957                             }
958 
959                             offset = 0;
960                             event[offset++] = HCI_EVENT_AVRCP_META;
961                             event[offset++] = sizeof(event) - 2;
962                             event[offset++] = AVRCP_SUBEVENT_GET_CAPABILITY_EVENT_ID_DONE;
963                             little_endian_store_16(event, offset, connection->avrcp_cid);
964                             offset += 2;
965                             event[offset++] = ctype;
966                             event[offset++] = 0;
967                             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
968                             break;
969 
970                         default:
971                             // ignore
972                             break;
973                     }
974                     break;
975                 }
976 
977                 case AVRCP_PDU_ID_GET_PLAY_STATUS:{
978                     uint32_t song_length = big_endian_read_32(packet, pos);
979                     pos += 4;
980                     uint32_t song_position = big_endian_read_32(packet, pos);
981                     pos += 4;
982                     uint8_t play_status = packet[pos];
983 
984                     uint8_t event[15];
985                     int offset = 0;
986                     event[offset++] = HCI_EVENT_AVRCP_META;
987                     event[offset++] = sizeof(event) - 2;
988                     event[offset++] = AVRCP_SUBEVENT_PLAY_STATUS;
989                     little_endian_store_16(event, offset, connection->avrcp_cid);
990                     offset += 2;
991                     event[offset++] = ctype;
992                     little_endian_store_32(event, offset, song_length);
993                     offset += 4;
994                     little_endian_store_32(event, offset, song_position);
995                     offset += 4;
996                     event[offset++] = play_status;
997                     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
998                     break;
999                 }
1000 
1001                 case AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES:{
1002                     switch (vendor_dependent_packet_type){
1003                         case AVRCP_START_PACKET:
1004                         case AVRCP_SINGLE_PACKET:
1005                             avrcp_parser_reset(connection);
1006                             connection->list_size = param_length;
1007                             connection->num_attributes = packet[pos++];
1008 
1009                             avrcp_controller_parse_and_emit_element_attrs(packet+pos, size-pos, connection, ctype);
1010                             if (vendor_dependent_packet_type == AVRCP_START_PACKET){
1011                                 avrcp_controller_request_continue_response(connection);
1012                             }
1013                             break;
1014                         case AVRCP_CONTINUE_PACKET:
1015                         case AVRCP_END_PACKET:
1016                             connection->num_received_fragments++;
1017 
1018                             if (connection->num_received_fragments < connection->max_num_fragments){
1019                                 avrcp_controller_parse_and_emit_element_attrs(packet+pos, size-pos, connection, ctype);
1020 
1021                                 if (vendor_dependent_packet_type == AVRCP_CONTINUE_PACKET){
1022                                     avrcp_controller_request_continue_response(connection);
1023                                 }
1024                             } else {
1025                                 avrcp_controller_emit_now_playing_info_event_done(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, 1);
1026                                 avrcp_parser_reset(connection);
1027                                 avrcp_controller_request_abort_continuation(connection);
1028                             }
1029                             break;
1030                         default:
1031                             // TODO check
1032                             btstack_assert(false);
1033                             break;
1034                     }
1035                 }
1036                 default:
1037                     break;
1038             }
1039             break;
1040         case AVRCP_CMD_OPCODE_PASS_THROUGH:{
1041             if ((size - pos) < 1) return;
1042             uint8_t operation_id = packet[pos++];
1043             switch (connection->state){
1044                 case AVCTP_W2_RECEIVE_PRESS_RESPONSE:
1045                     // trigger release for simple command:
1046                     if (!connection->press_and_hold_cmd_active){
1047                         connection->state = AVCTP_W2_SEND_RELEASE_COMMAND;
1048                         break;
1049                     }
1050                     // for press and hold, send release if it just has been requested, otherwise, wait for next repeat
1051                     if (connection->press_and_hold_cmd_release){
1052                         connection->press_and_hold_cmd_release = false;
1053                         connection->state = AVCTP_W2_SEND_RELEASE_COMMAND;
1054                     } else {
1055                         connection->state = AVCTP_W4_STOP;
1056                     }
1057                     break;
1058                 case AVCTP_W2_RECEIVE_RESPONSE:
1059                     connection->state = AVCTP_CONNECTION_OPENED;
1060                     break;
1061                 default:
1062                     break;
1063             }
1064             if (connection->state == AVCTP_W4_STOP){
1065                 avrcp_controller_emit_operation_status(avrcp_controller_context.avrcp_callback, AVRCP_SUBEVENT_OPERATION_START, connection->avrcp_cid, ctype, operation_id);
1066             }
1067             if (connection->state == AVCTP_CONNECTION_OPENED) {
1068                 // RELEASE response
1069                 operation_id = operation_id & 0x7F;
1070                 avrcp_controller_emit_operation_status(avrcp_controller_context.avrcp_callback, AVRCP_SUBEVENT_OPERATION_COMPLETE, connection->avrcp_cid, ctype, operation_id);
1071             }
1072             if (connection->state == AVCTP_W2_SEND_RELEASE_COMMAND){
1073                 // PRESS response
1074                 avrcp_controller_request_pass_through_release_control_cmd(connection);
1075             }
1076             break;
1077         }
1078         default:
1079             break;
1080     }
1081 
1082     // trigger pending notification reqistrations
1083     if ((connection->state == AVCTP_CONNECTION_OPENED) && connection->notifications_to_register){
1084         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1085     }
1086 }
1087 
1088 static void avrcp_controller_handle_can_send_now(avrcp_connection_t * connection){
1089     switch (connection->state){
1090         case AVCTP_W2_SEND_PRESS_COMMAND:
1091             connection->state = AVCTP_W2_RECEIVE_PRESS_RESPONSE;
1092             avrcp_send_cmd(connection, AVRCP_SINGLE_PACKET);
1093             return;
1094         case AVCTP_W2_SEND_COMMAND:
1095         case AVCTP_W2_SEND_RELEASE_COMMAND:
1096             connection->state = AVCTP_W2_RECEIVE_RESPONSE;
1097             avrcp_send_cmd(connection, AVRCP_SINGLE_PACKET);
1098             return;
1099         case AVCTP_W2_SEND_FRAGMENTED_COMMAND:
1100             if (connection->cmd_operands_fragmented_pos == 0){
1101                  avrcp_send_cmd(connection, AVRCP_START_PACKET);
1102                  avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1103             } else {
1104                 if ((connection->cmd_operands_fragmented_len - connection->cmd_operands_fragmented_pos) > avrcp_get_max_payload_size_for_packet_type(AVRCP_CONTINUE_PACKET)){
1105                      avrcp_send_cmd(connection, AVRCP_CONTINUE_PACKET);
1106                      avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1107                  } else {
1108                     connection->state = AVCTP_W2_RECEIVE_RESPONSE;
1109                     avrcp_send_cmd(connection, AVRCP_END_PACKET);
1110                  }
1111             }
1112             return;
1113         default:
1114             break;
1115     }
1116     // send register notification if queued
1117     if (connection->notifications_to_register != 0){
1118         uint8_t event_id;
1119         for (event_id = 1; event_id <= AVRCP_NOTIFICATION_EVENT_VOLUME_CHANGED; event_id++){
1120             if (connection->notifications_to_register & (1<<event_id)){
1121                 connection->notifications_to_register &= ~ (1 << event_id);
1122                 avrcp_send_register_notification(connection, event_id);
1123                 return;
1124             }
1125         }
1126     }
1127 }
1128 
1129 static void avrcp_controller_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1130     avrcp_connection_t * connection;
1131 
1132     switch (packet_type) {
1133         case L2CAP_DATA_PACKET:
1134             connection = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_CONTROLLER, channel);
1135             avrcp_handle_l2cap_data_packet_for_signaling_connection(connection, packet, size);
1136             break;
1137 
1138         case HCI_EVENT_PACKET:
1139             switch (hci_event_packet_get_type(packet)){
1140                 case L2CAP_EVENT_CAN_SEND_NOW:
1141                     connection = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_CONTROLLER, channel);
1142                     avrcp_controller_handle_can_send_now(connection);
1143                     break;
1144             default:
1145                 break;
1146         }
1147         default:
1148             break;
1149     }
1150 }
1151 
1152 void avrcp_controller_create_sdp_record(uint8_t * service, uint32_t service_record_handle, uint16_t supported_features, const char * service_name, const char * service_provider_name){
1153     avrcp_create_sdp_record(1, service, service_record_handle, avrcp_controller_supports_browsing(supported_features), supported_features, service_name, service_provider_name);
1154 }
1155 
1156 void avrcp_controller_init(void){
1157     avrcp_controller_context.role = AVRCP_CONTROLLER;
1158     avrcp_controller_context.packet_handler = avrcp_controller_packet_handler;
1159     avrcp_register_controller_packet_handler(&avrcp_controller_packet_handler);
1160 }
1161 
1162 void avrcp_controller_deinit(void){
1163     memset(&avrcp_controller_context, 0, sizeof(avrcp_context_t));
1164 }
1165 
1166 void avrcp_controller_register_packet_handler(btstack_packet_handler_t callback){
1167     btstack_assert(callback != NULL);
1168     avrcp_controller_context.avrcp_callback = callback;
1169 }
1170 
1171 
1172 uint8_t avrcp_controller_play(uint16_t avrcp_cid){
1173     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PLAY, 0);
1174 }
1175 
1176 uint8_t avrcp_controller_stop(uint16_t avrcp_cid){
1177     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_STOP, 0);
1178 }
1179 
1180 uint8_t avrcp_controller_pause(uint16_t avrcp_cid){
1181     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PAUSE, 0);
1182 }
1183 
1184 uint8_t avrcp_controller_forward(uint16_t avrcp_cid){
1185     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FORWARD, 0);
1186 }
1187 
1188 uint8_t avrcp_controller_backward(uint16_t avrcp_cid){
1189     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_BACKWARD, 0);
1190 }
1191 
1192 uint8_t avrcp_controller_volume_up(uint16_t avrcp_cid){
1193     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_UP, 0);
1194 }
1195 
1196 uint8_t avrcp_controller_volume_down(uint16_t avrcp_cid){
1197     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_DOWN, 0);
1198 }
1199 
1200 uint8_t avrcp_controller_mute(uint16_t avrcp_cid){
1201     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_MUTE, 0);
1202 }
1203 
1204 uint8_t avrcp_controller_skip(uint16_t avrcp_cid){
1205     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_SKIP, 0);
1206 }
1207 
1208 uint8_t avrcp_controller_fast_forward(uint16_t avrcp_cid){
1209     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FAST_FORWARD, 0);
1210 }
1211 
1212 uint8_t avrcp_controller_rewind(uint16_t avrcp_cid){
1213     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_REWIND, 0);
1214 }
1215 
1216 /* start continuous cmds */
1217 
1218 uint8_t avrcp_controller_start_press_and_hold_cmd(uint16_t avrcp_cid, avrcp_operation_id_t operation_id){
1219     return request_continuous_pass_through_press_control_cmd(avrcp_cid, operation_id, 0);
1220 }
1221 
1222 uint8_t avrcp_controller_press_and_hold_play(uint16_t avrcp_cid){
1223     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PLAY, 0);
1224 }
1225 uint8_t avrcp_controller_press_and_hold_stop(uint16_t avrcp_cid){
1226     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_STOP, 0);
1227 }
1228 uint8_t avrcp_controller_press_and_hold_pause(uint16_t avrcp_cid){
1229     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PAUSE, 0);
1230 }
1231 uint8_t avrcp_controller_press_and_hold_forward(uint16_t avrcp_cid){
1232     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FORWARD, 0);
1233 }
1234 uint8_t avrcp_controller_press_and_hold_backward(uint16_t avrcp_cid){
1235     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_BACKWARD, 0);
1236 }
1237 uint8_t avrcp_controller_press_and_hold_fast_forward(uint16_t avrcp_cid){
1238     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FAST_FORWARD, 0);
1239 }
1240 uint8_t avrcp_controller_press_and_hold_rewind(uint16_t avrcp_cid){
1241     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_REWIND, 0);
1242 }
1243 uint8_t avrcp_controller_press_and_hold_volume_up(uint16_t avrcp_cid){
1244     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_UP, 0);
1245 }
1246 uint8_t avrcp_controller_press_and_hold_volume_down(uint16_t avrcp_cid){
1247     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_DOWN, 0);
1248 }
1249 uint8_t avrcp_controller_press_and_hold_mute(uint16_t avrcp_cid){
1250     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_MUTE, 0);
1251 }
1252 
1253 /* stop continuous cmds */
1254 uint8_t avrcp_controller_release_press_and_hold_cmd(uint16_t avrcp_cid){
1255     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1256     if (!connection){
1257         log_error("avrcp_stop_play: could not find a connection.");
1258         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1259     }
1260 
1261     switch (connection->state){
1262         // respond when we receive response for (repeated) press command
1263         case AVCTP_W2_RECEIVE_PRESS_RESPONSE:
1264             connection->press_and_hold_cmd_release = true;
1265             break;
1266 
1267         // release already sent or on the way, nothing to do
1268         case AVCTP_W2_RECEIVE_RESPONSE:
1269         case AVCTP_W2_SEND_RELEASE_COMMAND:
1270             break;
1271 
1272         // about to send next repeated press command or wait for it -> release right away
1273         case AVCTP_W2_SEND_PRESS_COMMAND:
1274         case AVCTP_W4_STOP:
1275             return avrcp_controller_request_pass_through_release_control_cmd(connection);
1276 
1277         // otherwise reject request
1278         default:
1279             return ERROR_CODE_COMMAND_DISALLOWED;
1280     }
1281     return ERROR_CODE_SUCCESS;
1282 }
1283 
1284 uint8_t avrcp_controller_enable_notification(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id){
1285     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1286     if (!connection){
1287         log_error("avrcp_get_play_status: could not find a connection.");
1288         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1289     }
1290     avrcp_controller_register_notification(connection, event_id);
1291     return ERROR_CODE_SUCCESS;
1292 }
1293 
1294 uint8_t avrcp_controller_disable_notification(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id){
1295     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1296     if (!connection){
1297         log_error("avrcp_get_play_status: could not find a connection.");
1298         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1299     }
1300     connection->notifications_to_deregister |= (1 << event_id);
1301     return ERROR_CODE_SUCCESS;
1302 }
1303 
1304 uint8_t avrcp_controller_unit_info(uint16_t avrcp_cid){
1305     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1306     if (!connection){
1307         log_error("avrcp_unit_info: could not find a connection.");
1308         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1309     }
1310     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1311     connection->state = AVCTP_W2_SEND_COMMAND;
1312 
1313     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1314     connection->command_opcode = AVRCP_CMD_OPCODE_UNIT_INFO;
1315     connection->command_type = AVRCP_CTYPE_STATUS;
1316     connection->subunit_type = AVRCP_SUBUNIT_TYPE_UNIT; //vendor unique
1317     connection->subunit_id =   AVRCP_SUBUNIT_ID_IGNORE;
1318     memset(connection->cmd_operands, 0xFF, connection->cmd_operands_length);
1319     connection->cmd_operands_length = 5;
1320     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1321     return ERROR_CODE_SUCCESS;
1322 }
1323 
1324 uint8_t avrcp_controller_subunit_info(uint16_t avrcp_cid){
1325     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1326     if (!connection){
1327         log_error("avrcp_unit_info: could not find a connection.");
1328         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1329     }
1330     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1331     connection->state = AVCTP_W2_SEND_COMMAND;
1332 
1333     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1334     connection->command_opcode = AVRCP_CMD_OPCODE_SUBUNIT_INFO;
1335     connection->command_type = AVRCP_CTYPE_STATUS;
1336     connection->subunit_type = AVRCP_SUBUNIT_TYPE_UNIT; //vendor unique
1337     connection->subunit_id =   AVRCP_SUBUNIT_ID_IGNORE;
1338     memset(connection->cmd_operands, 0xFF, connection->cmd_operands_length);
1339     connection->cmd_operands[0] = 7; // page: 0, extention_code: 7
1340     connection->cmd_operands_length = 5;
1341     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1342     return ERROR_CODE_SUCCESS;
1343 }
1344 
1345 static uint8_t avrcp_controller_get_capabilities(uint16_t avrcp_cid, uint8_t capability_id){
1346     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1347     if (!connection){
1348         log_error("avrcp_get_capabilities: could not find a connection.");
1349         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1350     }
1351     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1352     connection->state = AVCTP_W2_SEND_COMMAND;
1353 
1354     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1355     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1356     connection->command_type = AVRCP_CTYPE_STATUS;
1357     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1358     connection->subunit_id = AVRCP_SUBUNIT_ID;
1359     big_endian_store_24(connection->cmd_operands, 0, BT_SIG_COMPANY_ID);
1360     connection->cmd_operands[3] = AVRCP_PDU_ID_GET_CAPABILITIES; // PDU ID
1361     connection->cmd_operands[4] = 0;
1362     big_endian_store_16(connection->cmd_operands, 5, 1); // parameter length
1363     connection->cmd_operands[7] = capability_id;                  // capability ID
1364     connection->cmd_operands_length = 8;
1365     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1366     return ERROR_CODE_SUCCESS;
1367 }
1368 
1369 uint8_t avrcp_controller_get_supported_company_ids(uint16_t avrcp_cid){
1370     return avrcp_controller_get_capabilities(avrcp_cid, AVRCP_CAPABILITY_ID_COMPANY);
1371 }
1372 
1373 uint8_t avrcp_controller_get_supported_events(uint16_t avrcp_cid){
1374     return avrcp_controller_get_capabilities(avrcp_cid, AVRCP_CAPABILITY_ID_EVENT);
1375 }
1376 
1377 uint8_t avrcp_controller_get_play_status(uint16_t avrcp_cid){
1378     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1379     if (!connection){
1380         log_error("avrcp_get_play_status: could not find a connection.");
1381         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1382     }
1383     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1384     connection->state = AVCTP_W2_SEND_COMMAND;
1385     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1386     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1387     connection->command_type = AVRCP_CTYPE_STATUS;
1388     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1389     connection->subunit_id = AVRCP_SUBUNIT_ID;
1390     big_endian_store_24(connection->cmd_operands, 0, BT_SIG_COMPANY_ID);
1391     connection->cmd_operands[3] = AVRCP_PDU_ID_GET_PLAY_STATUS;
1392     connection->cmd_operands[4] = 0;                     // reserved(upper 6) | packet_type -> 0
1393     big_endian_store_16(connection->cmd_operands, 5, 0); // parameter length
1394     connection->cmd_operands_length = 7;
1395     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1396     return ERROR_CODE_SUCCESS;
1397 }
1398 
1399 uint8_t avrcp_controller_set_addressed_player(uint16_t avrcp_cid, uint16_t addressed_player_id){
1400     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1401     if (!connection){
1402         log_error("avrcp_get_capabilities: could not find a connection.");
1403         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1404     }
1405     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1406     connection->state = AVCTP_W2_SEND_COMMAND;
1407 
1408     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1409     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1410     connection->command_type = AVRCP_CTYPE_CONTROL;
1411     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1412     connection->subunit_id = AVRCP_SUBUNIT_ID;
1413     int pos = 0;
1414     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1415     pos += 3;
1416     connection->cmd_operands[pos++] = AVRCP_PDU_ID_SET_ADDRESSED_PLAYER; // PDU ID
1417     connection->cmd_operands[pos++] = 0;
1418 
1419     // Parameter Length
1420     big_endian_store_16(connection->cmd_operands, pos, 2);
1421     pos += 2;
1422 
1423     big_endian_store_16(connection->cmd_operands, pos, addressed_player_id);
1424     pos += 2;
1425 
1426     connection->cmd_operands_length = pos;
1427     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1428     return ERROR_CODE_SUCCESS;
1429 }
1430 
1431 uint8_t avrcp_controller_get_element_attributes(uint16_t avrcp_cid, uint8_t num_attributes, avrcp_media_attribute_id_t * attributes){
1432     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1433     if (!connection){
1434         log_error("avrcp_get_capabilities: could not find a connection.");
1435         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1436     }
1437 
1438     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1439 
1440     if (num_attributes >= AVRCP_MEDIA_ATTR_RESERVED) {
1441         return ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
1442     }
1443     connection->state = AVCTP_W2_SEND_COMMAND;
1444 
1445     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1446     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1447     connection->command_type = AVRCP_CTYPE_STATUS;
1448     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1449     connection->subunit_id = AVRCP_SUBUNIT_ID;
1450     int pos = 0;
1451     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1452     pos += 3;
1453     connection->cmd_operands[pos++] = AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES; // PDU ID
1454     connection->cmd_operands[pos++] = 0;
1455 
1456     // Parameter Length
1457     big_endian_store_16(connection->cmd_operands, pos, 9);
1458     pos += 2;
1459 
1460     // write 8 bytes value
1461     memset(connection->cmd_operands + pos, 0, 8); // identifier: PLAYING
1462     pos += 8;
1463 
1464     connection->cmd_operands[pos++] = num_attributes; // attribute count, if 0 get all attributes
1465 
1466     int i;
1467     for (i = 0; i < num_attributes; i++){
1468         // every attribute is 4 bytes long
1469         big_endian_store_32(connection->cmd_operands, pos, attributes[i]);
1470         pos += 4;
1471     }
1472 
1473     connection->cmd_operands_length = pos;
1474     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1475     return ERROR_CODE_SUCCESS;
1476 }
1477 
1478 uint8_t avrcp_controller_get_now_playing_info(uint16_t avrcp_cid){
1479     return avrcp_controller_get_element_attributes(avrcp_cid, 0, NULL);
1480 }
1481 
1482 uint8_t avrcp_controller_set_absolute_volume(uint16_t avrcp_cid, uint8_t volume){
1483      avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1484     if (!connection){
1485         log_error("avrcp_get_capabilities: could not find a connection.");
1486         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1487     }
1488 
1489     //
1490     // allow sending of multiple set abs volume commands without waiting for response
1491     //
1492     uint8_t status = ERROR_CODE_COMMAND_DISALLOWED;
1493     switch (connection->state){
1494         case AVCTP_CONNECTION_OPENED:
1495             status = ERROR_CODE_SUCCESS;
1496             break;
1497         case AVCTP_W2_RECEIVE_RESPONSE:
1498             // - is pending response also set abs volume
1499             if (connection->command_opcode  != AVRCP_CMD_OPCODE_VENDOR_DEPENDENT) break;
1500             if (connection->command_type    != AVRCP_CTYPE_CONTROL)               break;
1501             if (connection->subunit_type    != AVRCP_SUBUNIT_TYPE_PANEL)          break;
1502             if (connection->subunit_id      != AVRCP_SUBUNIT_ID)                  break;
1503             if (connection->cmd_operands[3] != AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME)  break;
1504             // - is next transaction id valid in window
1505             if (avrcp_controller_is_transaction_id_valid(connection, avrcp_controller_calc_next_transaction_label(connection->transaction_id_counter)) == false) break;
1506             status = ERROR_CODE_SUCCESS;
1507             break;
1508         default:
1509             break;
1510     }
1511     if (status != ERROR_CODE_SUCCESS) return status;
1512 
1513     connection->state = AVCTP_W2_SEND_COMMAND;
1514 
1515     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1516     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1517     connection->command_type = AVRCP_CTYPE_CONTROL;
1518     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1519     connection->subunit_id = AVRCP_SUBUNIT_ID;
1520     int pos = 0;
1521     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1522     pos += 3;
1523     connection->cmd_operands[pos++] = AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME; // PDU ID
1524     connection->cmd_operands[pos++] = 0;
1525 
1526     // Parameter Length
1527     big_endian_store_16(connection->cmd_operands, pos, 1);
1528     pos += 2;
1529     connection->cmd_operands[pos++] = volume;
1530 
1531     connection->cmd_operands_length = pos;
1532     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1533     return ERROR_CODE_SUCCESS;
1534 }
1535 
1536 uint8_t avrcp_controller_query_shuffle_and_repeat_modes(uint16_t avrcp_cid){
1537     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1538     if (!connection){
1539         log_error("avrcp_get_capabilities: could not find a connection.");
1540         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1541     }
1542     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1543     connection->state = AVCTP_W2_SEND_COMMAND;
1544 
1545     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1546     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1547     connection->command_type = AVRCP_CTYPE_STATUS;
1548     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1549     connection->subunit_id = AVRCP_SUBUNIT_ID;
1550     big_endian_store_24(connection->cmd_operands, 0, BT_SIG_COMPANY_ID);
1551     connection->cmd_operands[3] = AVRCP_PDU_ID_GET_CURRENT_PLAYER_APPLICATION_SETTING_VALUE; // PDU ID
1552     connection->cmd_operands[4] = 0;
1553     big_endian_store_16(connection->cmd_operands, 5, 5); // parameter length
1554     connection->cmd_operands[7] = 4;                     // NumPlayerApplicationSettingAttributeID
1555     // PlayerApplicationSettingAttributeID1 AVRCP Spec, Appendix F, 133
1556     connection->cmd_operands[8]  = 0x01;    // equalizer  (1-OFF, 2-ON)
1557     connection->cmd_operands[9]  = 0x02;    // repeat     (1-off, 2-single track, 3-all tracks, 4-group repeat)
1558     connection->cmd_operands[10] = 0x03;    // shuffle    (1-off, 2-all tracks, 3-group shuffle)
1559     connection->cmd_operands[11] = 0x04;    // scan       (1-off, 2-all tracks, 3-group scan)
1560     connection->cmd_operands_length = 12;
1561     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1562     return ERROR_CODE_SUCCESS;
1563 }
1564 
1565 static uint8_t avrcp_controller_set_current_player_application_setting_value(uint16_t avrcp_cid, uint8_t attr_id, uint8_t attr_value){
1566     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1567     if (!connection){
1568         log_error("avrcp_get_capabilities: could not find a connection.");
1569         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1570     }
1571     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1572     connection->state = AVCTP_W2_SEND_COMMAND;
1573 
1574     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1575     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1576     connection->command_type = AVRCP_CTYPE_CONTROL;
1577     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1578     connection->subunit_id = AVRCP_SUBUNIT_ID;
1579     int pos = 0;
1580     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1581     pos += 3;
1582     connection->cmd_operands[pos++] = AVRCP_PDU_ID_SET_PLAYER_APPLICATION_SETTING_VALUE; // PDU ID
1583     connection->cmd_operands[pos++] = 0;
1584     // Parameter Length
1585     big_endian_store_16(connection->cmd_operands, pos, 3);
1586     pos += 2;
1587     connection->cmd_operands[pos++] = 2;
1588     connection->cmd_operands_length = pos;
1589     connection->cmd_operands[pos++]  = attr_id;
1590     connection->cmd_operands[pos++]  = attr_value;
1591     connection->cmd_operands_length = pos;
1592     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1593     return ERROR_CODE_SUCCESS;
1594 }
1595 
1596 uint8_t avrcp_controller_set_shuffle_mode(uint16_t avrcp_cid, avrcp_shuffle_mode_t mode){
1597     if ((mode < AVRCP_SHUFFLE_MODE_OFF) || (mode > AVRCP_SHUFFLE_MODE_GROUP)) return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
1598     return avrcp_controller_set_current_player_application_setting_value(avrcp_cid, 0x03, mode);
1599 }
1600 
1601 uint8_t avrcp_controller_set_repeat_mode(uint16_t avrcp_cid, avrcp_repeat_mode_t mode){
1602     if ((mode < AVRCP_REPEAT_MODE_OFF) || (mode > AVRCP_REPEAT_MODE_GROUP)) return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
1603     return avrcp_controller_set_current_player_application_setting_value(avrcp_cid, 0x02, mode);
1604 }
1605 
1606 uint8_t avrcp_controller_play_item_for_scope(uint16_t avrcp_cid, uint8_t * uid, uint16_t uid_counter, avrcp_browsing_scope_t scope){
1607     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1608     if (!connection){
1609         log_error("Could not find a connection with cid 0%02x.", avrcp_cid);
1610         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1611     }
1612     if (connection->state != AVCTP_CONNECTION_OPENED){
1613         log_error("Connection in wrong state, expected %d, received %d", AVCTP_CONNECTION_OPENED, connection->state);
1614         return ERROR_CODE_COMMAND_DISALLOWED;
1615     }
1616     connection->state = AVCTP_W2_SEND_COMMAND;
1617 
1618     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1619     connection->command_type = AVRCP_CTYPE_CONTROL;
1620     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1621     connection->subunit_id = AVRCP_SUBUNIT_ID;
1622     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1623     int pos = 0;
1624     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1625     pos += 3;
1626     connection->cmd_operands[pos++] = AVRCP_PDU_ID_PLAY_ITEM; // PDU ID
1627     // reserved
1628     connection->cmd_operands[pos++] = 0;
1629     // Parameter Length
1630     big_endian_store_16(connection->cmd_operands, pos, 11);
1631     pos += 2;
1632     connection->cmd_operands[pos++]  = scope;
1633     memset(&connection->cmd_operands[pos], 0, 8);
1634     if (uid){
1635         (void)memcpy(&connection->cmd_operands[pos], uid, 8);
1636     }
1637     pos += 8;
1638     big_endian_store_16(connection->cmd_operands, pos, uid_counter);
1639     pos += 2;
1640     connection->cmd_operands_length = pos;
1641 
1642     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1643     return ERROR_CODE_SUCCESS;
1644 }
1645 
1646 uint8_t avrcp_controller_add_item_from_scope_to_now_playing_list(uint16_t avrcp_cid, uint8_t * uid, uint16_t uid_counter, avrcp_browsing_scope_t scope){
1647     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1648     if (!connection){
1649         log_error("Could not find a connection with cid 0%02x.", avrcp_cid);
1650         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1651     }
1652     if (connection->state != AVCTP_CONNECTION_OPENED){
1653         log_error("Connection in wrong state, expected %d, received %d", AVCTP_CONNECTION_OPENED, connection->state);
1654         return ERROR_CODE_COMMAND_DISALLOWED;
1655     }
1656     connection->state = AVCTP_W2_SEND_COMMAND;
1657 
1658     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1659     connection->command_type = AVRCP_CTYPE_CONTROL;
1660     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
1661     connection->subunit_id = AVRCP_SUBUNIT_ID;
1662     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
1663     int pos = 0;
1664     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1665     pos += 3;
1666     connection->cmd_operands[pos++] = AVRCP_PDU_ID_ADD_TO_NOW_PLAYING; // PDU ID
1667     // reserved
1668     connection->cmd_operands[pos++] = 0;
1669     // Parameter Length
1670     big_endian_store_16(connection->cmd_operands, pos, 11);
1671     pos += 2;
1672     connection->cmd_operands[pos++]  = scope;
1673     memset(&connection->cmd_operands[pos], 0, 8);
1674     if (uid){
1675         (void)memcpy(&connection->cmd_operands[pos], uid, 8);
1676     }
1677     pos += 8;
1678     big_endian_store_16(connection->cmd_operands, pos, uid_counter);
1679     pos += 2;
1680     connection->cmd_operands_length = pos;
1681 
1682     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1683     return ERROR_CODE_SUCCESS;
1684 }
1685 
1686 uint8_t avrcp_controller_set_max_num_fragments(uint16_t avrcp_cid, uint8_t max_num_fragments){
1687     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1688     if (!connection){
1689         log_error("avrcp_controller_play_item: could not find a connection.");
1690         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1691     }
1692     connection->max_num_fragments = max_num_fragments;
1693     return ERROR_CODE_SUCCESS;
1694 }
1695 
1696 uint8_t avrcp_controller_send_custom_command(uint16_t avrcp_cid, avrcp_command_type_t command_type, avrcp_subunit_type_t subunit_type, avrcp_subunit_id_t subunit_id, avrcp_command_opcode_t command_opcode, const uint8_t * command_buffer, uint16_t command_len){
1697     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1698     if (!connection){
1699         log_error("avrcp_controller_play_item: could not find a connection.");
1700         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1701     }
1702 
1703     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1704     connection->state = AVCTP_W2_SEND_FRAGMENTED_COMMAND;
1705 
1706     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1707     connection->command_opcode = command_opcode;
1708     connection->command_type = command_type;
1709     connection->subunit_type = subunit_type;
1710     connection->subunit_id = subunit_id;
1711     connection->cmd_operands_fragmented_buffer = command_buffer;
1712     connection->cmd_operands_fragmented_pos = 0;
1713     connection->cmd_operands_fragmented_len = command_len;
1714 
1715     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1716     return ERROR_CODE_SUCCESS;
1717 }
1718