xref: /btstack/src/classic/avrcp_controller.c (revision 8d316b1bc5ed4fb6ab0b680694f0d441d1978969)
1 /*
2  * Copyright (C) 2016 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
24  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "avrcp_controller.c"
39 
40 #include <stdint.h>
41 #include <string.h>
42 #include <inttypes.h>
43 
44 #include "classic/avrcp.h"
45 #include "classic/avrcp_controller.h"
46 
47 #include "bluetooth_sdp.h"
48 #include "btstack_debug.h"
49 #include "btstack_event.h"
50 #include "btstack_util.h"
51 #include "l2cap.h"
52 
53 #define AVRCP_MAX_AV_C_MESSAGE_FRAME_SIZE 512
54 
55 // made public in avrcp_controller.h
56 avrcp_context_t avrcp_controller_context;
57 
58 static uint8_t avrcp_controller_calc_next_transaction_label(uint8_t current_transaction_label){
59     current_transaction_label++;
60     if (current_transaction_label == 16){
61         current_transaction_label = 1;
62     }
63     return current_transaction_label;
64 }
65 
66 static uint8_t avrcp_controller_get_next_transaction_label(avrcp_connection_t * connection){
67     connection->transaction_id_counter = avrcp_controller_calc_next_transaction_label(connection->transaction_id_counter);
68     return connection->transaction_id_counter;
69 }
70 
71 static bool avrcp_controller_is_transaction_id_valid(avrcp_connection_t * connection, uint8_t transaction_id){
72     uint8_t delta = ((int8_t) transaction_id - connection->last_confirmed_transaction_id) & 0x0f;
73     return delta < 15;
74 }
75 
76 static uint16_t avrcp_get_max_payload_size_for_avctp_packet_type(avrcp_connection_t * connection, avctp_packet_type_t avctp_packet_type){
77     uint16_t max_frame_size = btstack_min(l2cap_get_remote_mtu_for_local_cid(connection->l2cap_signaling_cid), AVRCP_MAX_AV_C_MESSAGE_FRAME_SIZE);
78 
79     switch (avctp_packet_type){
80         case AVCTP_SINGLE_PACKET:
81             return max_frame_size - 3;
82         case AVCTP_START_PACKET:
83             return max_frame_size - 4;
84         case AVCTP_CONTINUE_PACKET:
85         case AVCTP_END_PACKET:
86             return max_frame_size - 1;
87         default:
88             btstack_assert(false);
89             return 0;
90     }
91 }
92 
93 
94 static void avrcp_custome_command_data_init(avrcp_connection_t * connection,
95     avrcp_command_opcode_t opcode, avrcp_command_type_t command_type,
96     avrcp_subunit_type_t subunit_type, avrcp_subunit_id_t subunit_id,
97     avrcp_pdu_id_t pdu_id, uint32_t company_id){
98 
99     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
100     connection->command_opcode = opcode;
101     connection->command_type = command_type;
102     connection->subunit_type = subunit_type;
103     connection->subunit_id = subunit_id;
104     connection->company_id = company_id << 16;
105     connection->pdu_id = pdu_id;
106     connection->cmd_operands_fragmented_buffer = NULL;
107     connection->cmd_operands_fragmented_pos = 0;
108     connection->cmd_operands_fragmented_len = 0;
109 }
110 
111 static void avrcp_vendor_dependent_command_data_init(avrcp_connection_t * connection, avrcp_command_type_t command_type, avrcp_pdu_id_t pdu_id){
112     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
113     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
114     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
115     connection->subunit_id = AVRCP_SUBUNIT_ID;
116     connection->company_id = BT_SIG_COMPANY_ID;
117 
118     connection->command_type = command_type;
119     connection->pdu_id = pdu_id;
120     connection->cmd_operands_fragmented_buffer = NULL;
121     connection->cmd_operands_fragmented_pos = 0;
122     connection->cmd_operands_fragmented_len = 0;
123 }
124 
125 static void avrcp_pass_through_command_data_init(avrcp_connection_t * connection, avrcp_operation_id_t opid){
126     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
127     connection->command_opcode =  AVRCP_CMD_OPCODE_PASS_THROUGH;
128     connection->command_type = AVRCP_CTYPE_CONTROL;
129     connection->subunit_type = AVRCP_SUBUNIT_TYPE_PANEL;
130     connection->subunit_id =   AVRCP_SUBUNIT_ID;
131 
132     connection->company_id = 0;
133     connection->pdu_id = 0;
134     connection->operation_id = opid;
135 
136     connection->cmd_operands_fragmented_buffer = NULL;
137     connection->cmd_operands_fragmented_pos = 0;
138     connection->cmd_operands_fragmented_len = 0;
139 }
140 static int avrcp_controller_supports_browsing(uint16_t controller_supported_features){
141     return controller_supported_features & AVRCP_FEATURE_MASK_BROWSING;
142 }
143 
144 static void avrcp_controller_emit_notification_complete(avrcp_connection_t * connection, uint8_t status, uint8_t event_id, bool enabled){
145     uint8_t event[8];
146     uint8_t pos = 0;
147     event[pos++] = HCI_EVENT_AVRCP_META;
148     event[pos++] = sizeof(event) - 2;
149     event[pos++] = AVRCP_SUBEVENT_NOTIFICATION_STATE;
150     little_endian_store_16(event, pos, connection->avrcp_cid);
151     pos += 2;
152     event[pos++] = status;
153     event[pos++] = enabled ? 1 : 0;
154     event[pos++] = event_id;
155     UNUSED(pos);
156     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
157 }
158 
159 static void avrcp_controller_emit_supported_events(avrcp_connection_t * connection){
160     uint8_t ctype = (uint8_t) AVRCP_CTYPE_RESPONSE_CHANGED_STABLE;
161     uint8_t event_id;
162 
163     for (event_id = (uint8_t) AVRCP_NOTIFICATION_EVENT_FIRST_INDEX; event_id < (uint8_t) AVRCP_NOTIFICATION_EVENT_LAST_INDEX; event_id++){
164         if ( (connection->target_supported_notifications & (1<<event_id)) == 0){
165             continue;
166         }
167         uint8_t event[8];
168         uint8_t pos = 0;
169         event[pos++] = HCI_EVENT_AVRCP_META;
170         event[pos++] = sizeof(event) - 2;
171         event[pos++] = AVRCP_SUBEVENT_GET_CAPABILITY_EVENT_ID;
172         little_endian_store_16(event, pos, connection->avrcp_cid);
173         pos += 2;
174         event[pos++] = ctype;
175         event[pos++] = 0;
176         event[pos++] = event_id;
177         UNUSED(pos);
178         (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
179     }
180 
181     uint8_t event[7];
182     uint8_t pos = 0;
183     event[pos++] = HCI_EVENT_AVRCP_META;
184     event[pos++] = sizeof(event) - 2;
185     event[pos++] = AVRCP_SUBEVENT_GET_CAPABILITY_EVENT_ID_DONE;
186     little_endian_store_16(event, pos, connection->avrcp_cid);
187     pos += 2;
188     event[pos++] = ctype;
189     event[pos++] = 0;
190     UNUSED(pos);
191     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
192 }
193 
194 static void avrcp_controller_emit_notification_for_event_id(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id,
195                                                             avrcp_command_type_t ctype, const uint8_t *payload,
196                                                             uint16_t size) {
197     switch (event_id){
198         case AVRCP_NOTIFICATION_EVENT_PLAYBACK_POS_CHANGED:{
199             if (size < 4) break;
200             uint32_t song_position = big_endian_read_32(payload, 0);
201             uint16_t offset = 0;
202             uint8_t event[10];
203             event[offset++] = HCI_EVENT_AVRCP_META;
204             event[offset++] = sizeof(event) - 2;
205             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_PLAYBACK_POS_CHANGED;
206             little_endian_store_16(event, offset, avrcp_cid);
207             offset += 2;
208             event[offset++] = ctype;
209             little_endian_store_32(event, offset, song_position);
210             offset += 4;
211             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
212             break;
213         }
214         case AVRCP_NOTIFICATION_EVENT_PLAYBACK_STATUS_CHANGED:{
215             if (size < 1) break;
216             uint16_t offset = 0;
217             uint8_t event[7];
218             event[offset++] = HCI_EVENT_AVRCP_META;
219             event[offset++] = sizeof(event) - 2;
220             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_PLAYBACK_STATUS_CHANGED;
221             little_endian_store_16(event, offset, avrcp_cid);
222             offset += 2;
223             event[offset++] = ctype;
224             event[offset++] = payload[0];
225             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
226             break;
227         }
228         case AVRCP_NOTIFICATION_EVENT_TRACK_CHANGED:{
229             uint16_t offset = 0;
230             uint8_t event[6];
231             event[offset++] = HCI_EVENT_AVRCP_META;
232             event[offset++] = sizeof(event) - 2;
233             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_TRACK_CHANGED;
234             little_endian_store_16(event, offset, avrcp_cid);
235             offset += 2;
236             event[offset++] = ctype;
237             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
238             break;
239         }
240         case AVRCP_NOTIFICATION_EVENT_NOW_PLAYING_CONTENT_CHANGED:{
241             uint16_t offset = 0;
242             uint8_t event[6];
243             event[offset++] = HCI_EVENT_AVRCP_META;
244             event[offset++] = sizeof(event) - 2;
245             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_NOW_PLAYING_CONTENT_CHANGED;
246             little_endian_store_16(event, offset, avrcp_cid);
247             offset += 2;
248             event[offset++] = ctype;
249             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
250             break;
251         }
252         case AVRCP_NOTIFICATION_EVENT_AVAILABLE_PLAYERS_CHANGED:{
253             uint16_t offset = 0;
254             uint8_t event[6];
255             event[offset++] = HCI_EVENT_AVRCP_META;
256             event[offset++] = sizeof(event) - 2;
257             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_AVAILABLE_PLAYERS_CHANGED;
258             little_endian_store_16(event, offset, avrcp_cid);
259             offset += 2;
260             event[offset++] = ctype;
261             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
262             break;
263         }
264         case AVRCP_NOTIFICATION_EVENT_VOLUME_CHANGED:{
265             if (size < 1) break;
266             uint16_t offset = 0;
267             uint8_t event[7];
268             event[offset++] = HCI_EVENT_AVRCP_META;
269             event[offset++] = sizeof(event) - 2;
270             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_VOLUME_CHANGED;
271             little_endian_store_16(event, offset, avrcp_cid);
272             offset += 2;
273             event[offset++] = ctype;
274             event[offset++] = payload[0] & 0x7F;
275             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
276             break;
277         }
278         case AVRCP_NOTIFICATION_EVENT_UIDS_CHANGED:{
279             if (size < 2) break;
280             uint8_t event[8];
281             uint16_t offset = 0;
282             uint16_t uuid = big_endian_read_16(payload, 0);
283             event[offset++] = HCI_EVENT_AVRCP_META;
284             event[offset++] = sizeof(event) - 2;
285             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_UIDS_CHANGED;
286             little_endian_store_16(event, offset, avrcp_cid);
287             offset += 2;
288             event[offset++] = ctype;
289             little_endian_store_16(event, offset, uuid);
290             offset += 2;
291             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
292             break;
293         }
294 
295         case AVRCP_NOTIFICATION_EVENT_TRACK_REACHED_END:{
296             uint16_t offset = 0;
297             uint8_t event[6];
298             event[offset++] = HCI_EVENT_AVRCP_META;
299             event[offset++] = sizeof(event) - 2;
300             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_TRACK_REACHED_END;
301             little_endian_store_16(event, offset, avrcp_cid);
302             offset += 2;
303             event[offset++] = ctype;
304             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
305             break;
306         }
307         case AVRCP_NOTIFICATION_EVENT_TRACK_REACHED_START:{
308             uint16_t offset = 0;
309             uint8_t event[6];
310             event[offset++] = HCI_EVENT_AVRCP_META;
311             event[offset++] = sizeof(event) - 2;
312             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_TRACK_REACHED_START;
313             little_endian_store_16(event, offset, avrcp_cid);
314             offset += 2;
315             event[offset++] = ctype;
316             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
317             break;
318         }
319         case AVRCP_NOTIFICATION_EVENT_BATT_STATUS_CHANGED:{
320             if (size < 1) break;
321             uint16_t offset = 0;
322             uint8_t event[7];
323             event[offset++] = HCI_EVENT_AVRCP_META;
324             event[offset++] = sizeof(event) - 2;
325             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_BATT_STATUS_CHANGED;
326             little_endian_store_16(event, offset, avrcp_cid);
327             offset += 2;
328             event[offset++] = ctype;
329             event[offset++] = payload[0];
330             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
331             break;
332         }
333 
334         case AVRCP_NOTIFICATION_EVENT_SYSTEM_STATUS_CHANGED:{
335             if (size < 1) break;
336             uint16_t offset = 0;
337             uint8_t event[7];
338             event[offset++] = HCI_EVENT_AVRCP_META;
339             event[offset++] = sizeof(event) - 2;
340             event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_EVENT_SYSTEM_STATUS_CHANGED;
341             little_endian_store_16(event, offset, avrcp_cid);
342             offset += 2;
343             event[offset++] = ctype;
344             event[offset++] = payload[0];
345             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
346             break;
347         }
348 
349         case AVRCP_NOTIFICATION_EVENT_PLAYER_APPLICATION_SETTING_CHANGED:
350         default:
351             log_info("avrcp: not implemented");
352             break;
353     }
354 }
355 
356 static void avrcp_controller_emit_repeat_and_shuffle_mode(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t ctype, avrcp_repeat_mode_t repeat_mode, avrcp_shuffle_mode_t shuffle_mode){
357     btstack_assert(callback != NULL);
358 
359     uint8_t event[8];
360     int pos = 0;
361     event[pos++] = HCI_EVENT_AVRCP_META;
362     event[pos++] = sizeof(event) - 2;
363     event[pos++] = AVRCP_SUBEVENT_SHUFFLE_AND_REPEAT_MODE;
364     little_endian_store_16(event, pos, avrcp_cid);
365     pos += 2;
366     event[pos++] = ctype;
367     event[pos++] = repeat_mode;
368     event[pos++] = shuffle_mode;
369     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
370 }
371 
372 static void avrcp_controller_emit_now_playing_info_event_done(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t ctype, uint8_t status){
373     uint8_t event[7];
374     int pos = 0;
375     event[pos++] = HCI_EVENT_AVRCP_META;
376     event[pos++] = sizeof(event) - 2;
377     event[pos++] = AVRCP_SUBEVENT_NOW_PLAYING_INFO_DONE;
378     little_endian_store_16(event, pos, avrcp_cid);
379     pos += 2;
380     event[pos++] = ctype;
381     event[pos++] = status;
382     (*callback)(HCI_EVENT_PACKET, 0, event, pos);
383 }
384 
385 static void avrcp_controller_emit_now_playing_info_event(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t ctype, avrcp_media_attribute_id_t attr_id, uint8_t * value, uint16_t value_len){
386     uint8_t event[HCI_EVENT_BUFFER_SIZE];
387     int pos = 0;
388     event[pos++] = HCI_EVENT_AVRCP_META;
389     // reserve one byte for subevent type and data len
390     int data_len_pos = pos;
391     pos++;
392     int subevent_type_pos = pos;
393     pos++;
394     little_endian_store_16(event, pos, avrcp_cid);
395     pos += 2;
396     event[pos++] = ctype;
397 
398     switch (attr_id){
399         case AVRCP_MEDIA_ATTR_TITLE:
400             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_TITLE_INFO;
401             event[pos++] = value_len;
402             (void)memcpy(event + pos, value, value_len);
403             break;
404         case AVRCP_MEDIA_ATTR_ARTIST:
405             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_ARTIST_INFO;
406             event[pos++] = value_len;
407             (void)memcpy(event + pos, value, value_len);
408             break;
409         case AVRCP_MEDIA_ATTR_ALBUM:
410             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_ALBUM_INFO;
411             event[pos++] = value_len;
412             (void)memcpy(event + pos, value, value_len);
413             break;
414         case AVRCP_MEDIA_ATTR_GENRE:
415             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_GENRE_INFO;
416             event[pos++] = value_len;
417             (void)memcpy(event + pos, value, value_len);
418             break;
419         case AVRCP_MEDIA_ATTR_SONG_LENGTH_MS:
420             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_SONG_LENGTH_MS_INFO;
421             if (value){
422                 little_endian_store_32(event, pos, btstack_atoi((char *)value));
423             } else {
424                 little_endian_store_32(event, pos, 0);
425             }
426             pos += 4;
427             break;
428         case AVRCP_MEDIA_ATTR_TRACK:
429             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_TRACK_INFO;
430             if (value){
431                 event[pos++] = btstack_atoi((char *)value);
432             } else {
433                 event[pos++] = 0;
434             }
435             break;
436         case AVRCP_MEDIA_ATTR_TOTAL_NUM_ITEMS:
437             event[subevent_type_pos] = AVRCP_SUBEVENT_NOW_PLAYING_TOTAL_TRACKS_INFO;
438             if (value){
439                 event[pos++] = btstack_atoi((char *)value);
440             } else {
441                 event[pos++] = 0;
442             }
443             break;
444         default:
445             break;
446     }
447     event[data_len_pos] = pos - 2;
448     (*callback)(HCI_EVENT_PACKET, 0, event, pos);
449 }
450 
451 static void avrcp_controller_emit_operation_status(btstack_packet_handler_t callback, uint8_t subevent, uint16_t avrcp_cid, uint8_t ctype, uint8_t operation_id){
452     btstack_assert(callback != NULL);
453 
454     uint8_t event[7];
455     int pos = 0;
456     event[pos++] = HCI_EVENT_AVRCP_META;
457     event[pos++] = sizeof(event) - 2;
458     event[pos++] = subevent;
459     little_endian_store_16(event, pos, avrcp_cid);
460     pos += 2;
461     event[pos++] = ctype;
462     event[pos++] = operation_id;
463     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
464 }
465 
466 static void avrcp_parser_reset(avrcp_connection_t * connection){
467     connection->list_offset = 0;
468     connection->num_attributes = 0;
469     connection->num_parsed_attributes = 0;
470     connection->parser_attribute_header_pos = 0;
471     connection->num_received_fragments = 0;
472     connection->parser_state = AVRCP_PARSER_GET_ATTRIBUTE_HEADER;
473 }
474 
475 static void avrcp_parser_process_byte(uint8_t byte, avrcp_connection_t * connection, avrcp_command_type_t ctype){
476     uint16_t attribute_total_value_len;
477     uint32_t attribute_id;
478     switch(connection->parser_state){
479         case AVRCP_PARSER_GET_ATTRIBUTE_HEADER:
480             connection->parser_attribute_header[connection->parser_attribute_header_pos++] = byte;
481             connection->list_offset++;
482 
483             if (connection->parser_attribute_header_pos < AVRCP_ATTRIBUTE_HEADER_LEN) return;
484 
485             attribute_total_value_len = big_endian_read_16(connection->parser_attribute_header, 6);
486             connection->attribute_value_len = btstack_min(attribute_total_value_len, AVRCP_MAX_ATTRIBUTTE_SIZE);
487             if (connection->attribute_value_len > 0){
488                 // get ready for attribute value
489                 connection->parser_state = AVRCP_PARSER_GET_ATTRIBUTE_VALUE;
490                 return;
491             }
492 
493             // emit empty attribute
494             attribute_id = big_endian_read_32(connection->parser_attribute_header, 0);
495             avrcp_controller_emit_now_playing_info_event(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, (avrcp_media_attribute_id_t) attribute_id, connection->attribute_value, connection->attribute_value_len);
496 
497             // done, see below
498             break;
499 
500         case AVRCP_PARSER_GET_ATTRIBUTE_VALUE:
501             connection->attribute_value[connection->attribute_value_offset++] = byte;
502             connection->list_offset++;
503 
504             if (connection->attribute_value_offset < connection->attribute_value_len) return;
505 
506             // emit (potentially partial) attribute
507             attribute_id = big_endian_read_32(connection->parser_attribute_header, 0);
508             avrcp_controller_emit_now_playing_info_event(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, (avrcp_media_attribute_id_t) attribute_id, connection->attribute_value, connection->attribute_value_len);
509 
510             attribute_total_value_len = big_endian_read_16(connection->parser_attribute_header, 6);
511             if (connection->attribute_value_offset < attribute_total_value_len){
512                 // ignore rest of attribute
513                 connection->parser_state = AVRCP_PARSER_IGNORE_REST_OF_ATTRIBUTE_VALUE;
514                 return;
515             }
516 
517             // done, see below
518             break;
519 
520         case AVRCP_PARSER_IGNORE_REST_OF_ATTRIBUTE_VALUE:
521             connection->attribute_value_offset++;
522             connection->list_offset++;
523 
524             attribute_total_value_len = big_endian_read_16(connection->parser_attribute_header, 6);
525             if (connection->attribute_value_offset < attribute_total_value_len) return;
526 
527             // done, see below
528             break;
529 
530         default:
531             return;
532     }
533 
534     // attribute fully read, check if more to come
535     if (connection->list_offset < connection->list_size){
536         // more to come, reset parser
537         connection->parser_state = AVRCP_PARSER_GET_ATTRIBUTE_HEADER;
538         connection->parser_attribute_header_pos = 0;
539         connection->attribute_value_offset = 0;
540     } else {
541         // fully done
542         avrcp_parser_reset(connection);
543         avrcp_controller_emit_now_playing_info_event_done(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, 0);
544     }
545 }
546 
547 static void avrcp_controller_parse_and_emit_element_attrs(uint8_t * packet, uint16_t num_bytes_to_read, avrcp_connection_t * connection, avrcp_command_type_t ctype){
548     int i;
549     for (i=0;i<num_bytes_to_read;i++){
550         avrcp_parser_process_byte(packet[i], connection, ctype);
551     }
552 }
553 
554 
555 static int avrcp_send_cmd_with_avctp_fragmentation(avrcp_connection_t * connection, avctp_packet_type_t avctp_packet_type){
556     l2cap_reserve_packet_buffer();
557     uint8_t * command = l2cap_get_outgoing_buffer();
558     uint16_t pos = 0;
559     uint16_t max_frame_size = btstack_min(l2cap_get_remote_mtu_for_local_cid(connection->l2cap_signaling_cid), AVRCP_MAX_AV_C_MESSAGE_FRAME_SIZE);
560 
561     // non-fragmented: transport header (1) + PID (2)
562     // fragmented:     transport header (1) + num packets (1) + PID (2)
563 
564     // transport header : transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
565     command[pos++] = (connection->transaction_id << 4) | (avctp_packet_type << 2) | (AVRCP_COMMAND_FRAME << 1) | 0;
566 
567     if (avctp_packet_type == AVCTP_START_PACKET){
568         // num packets: (3 bytes overhead (PID, num packets) + command) / (MTU - transport header).
569         // to get number of packets using integer division, we subtract 1 from the data e.g. len = 5, packet size 5 => need 1 packet
570         command[pos++] = ((connection->cmd_operands_fragmented_len + 3 - 1) / (max_frame_size - 1)) + 1;
571     }
572 
573     if ((avctp_packet_type == AVCTP_START_PACKET) || (avctp_packet_type == AVCTP_START_PACKET)){
574         // Profile IDentifier (PID)
575         command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL >> 8;
576         command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL & 0x00FF;
577 
578         // command_type
579         command[pos++] = connection->command_type;
580         // subunit_type | subunit ID
581         command[pos++] = (connection->subunit_type << 3) | connection->subunit_id;
582         // opcode
583         command[pos++] = (uint8_t)connection->command_opcode;
584     }
585 
586     if (avctp_packet_type == AVCTP_SINGLE_PACKET){
587         // operands
588         (void)memcpy(command + pos, connection->cmd_operands,
589                      connection->cmd_operands_length);
590         pos += connection->cmd_operands_length;
591     } else {
592         uint16_t bytes_free = max_frame_size - pos;
593         uint16_t bytes_to_store = connection->cmd_operands_fragmented_len-connection->cmd_operands_fragmented_pos;
594         uint16_t bytes_to_copy = btstack_min(bytes_to_store, bytes_free);
595         (void)memcpy(command + pos,
596                      &connection->cmd_operands_fragmented_buffer[connection->cmd_operands_fragmented_pos],
597                      bytes_to_copy);
598         pos += bytes_to_copy;
599         connection->cmd_operands_fragmented_pos += bytes_to_copy;
600     }
601 
602     return l2cap_send_prepared(connection->l2cap_signaling_cid, pos);
603 }
604 
605 static int avrcp_send_register_notification(avrcp_connection_t * connection, uint8_t event_id){
606     uint8_t command[18];
607     uint16_t pos = 0;
608     // transport header : transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
609     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
610     command[pos++] = (connection->transaction_id << 4) | (AVRCP_SINGLE_PACKET << 2) | (AVRCP_COMMAND_FRAME << 1) | 0;
611 
612     command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL >> 8;
613     command[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL & 0x00FF;
614     command[pos++] = AVRCP_CTYPE_NOTIFY;
615     command[pos++] = (AVRCP_SUBUNIT_TYPE_PANEL << 3) | AVRCP_SUBUNIT_ID;
616     command[pos++] = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
617 
618     big_endian_store_24(command, pos, BT_SIG_COMPANY_ID);
619     pos += 3;
620     command[pos++] = AVRCP_PDU_ID_REGISTER_NOTIFICATION;
621     command[pos++] = 0;                       // reserved(upper 6) | packet_type -> 0
622     big_endian_store_16(command, pos, 5);     // parameter length
623     pos += 2;
624     command[pos++] = event_id;
625     big_endian_store_32(command, pos, 1);     // send notification on playback position every second, for other notifications it is ignored
626     pos += 4;
627     return l2cap_send(connection->l2cap_signaling_cid, command, pos);
628 }
629 
630 static void avrcp_press_and_hold_timeout_handler(btstack_timer_source_t * timer){
631     UNUSED(timer);
632     avrcp_connection_t * connection = (avrcp_connection_t*) btstack_run_loop_get_timer_context(timer);
633     btstack_run_loop_set_timer(&connection->press_and_hold_cmd_timer, 2000); // 2 seconds timeout
634     btstack_run_loop_add_timer(&connection->press_and_hold_cmd_timer);
635     connection->state = AVCTP_W2_SEND_PRESS_COMMAND;
636     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
637 }
638 
639 static void avrcp_press_and_hold_timer_start(avrcp_connection_t * connection){
640     btstack_run_loop_remove_timer(&connection->press_and_hold_cmd_timer);
641     btstack_run_loop_set_timer_handler(&connection->press_and_hold_cmd_timer, avrcp_press_and_hold_timeout_handler);
642     btstack_run_loop_set_timer_context(&connection->press_and_hold_cmd_timer, connection);
643     btstack_run_loop_set_timer(&connection->press_and_hold_cmd_timer, 2000); // 2 seconds timeout
644     btstack_run_loop_add_timer(&connection->press_and_hold_cmd_timer);
645 }
646 
647 static void avrcp_press_and_hold_timer_stop(avrcp_connection_t * connection){
648     connection->press_and_hold_cmd_active = false;
649     btstack_run_loop_remove_timer(&connection->press_and_hold_cmd_timer);
650 }
651 
652 
653 static uint8_t avrcp_controller_request_pass_through_release_control_cmd(avrcp_connection_t * connection){
654     connection->state = AVCTP_W2_SEND_RELEASE_COMMAND;
655     if (connection->press_and_hold_cmd_active){
656         avrcp_press_and_hold_timer_stop(connection);
657     }
658     connection->cmd_operands[0] = 0x80 | connection->cmd_operands[0];
659     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
660     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
661     return ERROR_CODE_SUCCESS;
662 }
663 
664 static uint8_t avrcp_controller_request_pass_through_press_control_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint16_t playback_speed, bool continuous_cmd){
665     log_info("Send command %d", opid);
666     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
667     if (!connection){
668         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
669     }
670 
671     if (connection->state != AVCTP_CONNECTION_OPENED){
672         log_error("Connection in wrong state %d, expected %d. avrcp cid 0x%02x", connection->state, AVCTP_CONNECTION_OPENED, avrcp_cid);
673         return ERROR_CODE_COMMAND_DISALLOWED;
674     }
675     connection->state = AVCTP_W2_SEND_PRESS_COMMAND;
676     avrcp_pass_through_command_data_init(connection, opid);
677 
678     connection->press_and_hold_cmd_active = continuous_cmd;
679     connection->cmd_operands_length = 2;
680     connection->cmd_operands[0] = opid;
681     if (playback_speed > 0){
682         connection->cmd_operands[2] = playback_speed;
683         connection->cmd_operands_length++;
684     }
685     connection->cmd_operands[1] = connection->cmd_operands_length - 2;
686 
687     if (connection->press_and_hold_cmd_active){
688         avrcp_press_and_hold_timer_start(connection);
689     }
690 
691     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
692     return ERROR_CODE_SUCCESS;
693 }
694 
695 static uint8_t request_single_pass_through_press_control_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint16_t playback_speed){
696     return avrcp_controller_request_pass_through_press_control_cmd(avrcp_cid, opid, playback_speed, false);
697 }
698 
699 static uint8_t request_continuous_pass_through_press_control_cmd(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint16_t playback_speed){
700     return avrcp_controller_request_pass_through_press_control_cmd(avrcp_cid, opid, playback_speed, true);
701 }
702 
703 static void avrcp_controller_get_capabilities_for_connection(avrcp_connection_t * connection, uint8_t capability_id){
704     connection->state = AVCTP_W2_SEND_COMMAND;
705     avrcp_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_STATUS, AVRCP_PDU_ID_GET_CAPABILITIES);
706 
707     // TODO: refactor
708     big_endian_store_24(connection->cmd_operands, 0, BT_SIG_COMPANY_ID);
709     connection->cmd_operands[3] = AVRCP_PDU_ID_GET_CAPABILITIES; // PDU ID
710     connection->cmd_operands[4] = 0;
711     big_endian_store_16(connection->cmd_operands, 5, 1); // parameter length
712     connection->cmd_operands[7] = capability_id;                  // capability ID
713     connection->cmd_operands_length = 8;
714     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
715 }
716 
717 static uint8_t avrcp_controller_register_notification(avrcp_connection_t * connection, avrcp_notification_event_id_t event_id){
718     if (connection->target_supported_notifications_queried && (connection->target_supported_notifications & (1 << event_id)) == 0){
719         return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
720     }
721     if ( (connection->notifications_to_deregister & (1 << event_id)) != 0){
722         return ERROR_CODE_COMMAND_DISALLOWED;
723     }
724     if ( (connection->notifications_enabled & (1 << event_id)) != 0){
725         return ERROR_CODE_SUCCESS;
726     }
727     connection->notifications_to_register |= (1 << event_id);
728 
729     if (!connection->target_supported_notifications_queried){
730         connection->target_supported_notifications_suppress_emit_result = true;
731         avrcp_controller_get_capabilities_for_connection(connection, AVRCP_CAPABILITY_ID_EVENT);
732         return ERROR_CODE_SUCCESS;
733     }
734     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
735     return ERROR_CODE_SUCCESS;
736 }
737 
738 static uint8_t avrcp_controller_request_abort_continuation(avrcp_connection_t * connection){
739     connection->state = AVCTP_W2_SEND_COMMAND;
740     avrcp_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_REQUEST_ABORT_CONTINUING_RESPONSE);
741 
742     // TODO: refactor
743     int pos = 0;
744     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
745     pos += 3;
746     connection->cmd_operands[pos++] = AVRCP_PDU_ID_REQUEST_ABORT_CONTINUING_RESPONSE; // PDU ID
747     connection->cmd_operands[pos++] = 0;
748     // Parameter Length
749     connection->cmd_operands_length = 8;
750     big_endian_store_16(connection->cmd_operands, pos, 1);
751     pos += 2;
752     connection->cmd_operands[pos++] = AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES;
753     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
754     return ERROR_CODE_SUCCESS;
755 }
756 
757 
758 static uint8_t avrcp_controller_request_continue_response(avrcp_connection_t * connection){
759     connection->state = AVCTP_W2_SEND_COMMAND;
760     avrcp_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_REQUEST_CONTINUING_RESPONSE);
761 
762     // TODO: refactor
763     int pos = 0;
764     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
765     pos += 3;
766     connection->cmd_operands[pos++] = AVRCP_PDU_ID_REQUEST_CONTINUING_RESPONSE; // PDU ID
767     connection->cmd_operands[pos++] = 0;
768     // Parameter Length
769     connection->cmd_operands_length = 8;
770     big_endian_store_16(connection->cmd_operands, pos, 1);
771     pos += 2;
772     connection->cmd_operands[pos++] = AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES;
773     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
774     return ERROR_CODE_SUCCESS;
775 }
776 
777 static void avrcp_controller_handle_notification(avrcp_connection_t *connection, avrcp_command_type_t ctype, uint8_t *payload, uint16_t size) {
778     if (size < 1) return;
779     uint16_t pos = 0;
780     avrcp_notification_event_id_t event_id = (avrcp_notification_event_id_t) payload[pos++];
781     if ( (event_id < AVRCP_NOTIFICATION_EVENT_FIRST_INDEX) || (event_id > AVRCP_NOTIFICATION_EVENT_LAST_INDEX)){
782         return;
783     }
784 
785     uint16_t event_mask = (1 << event_id);
786     uint16_t reset_event_mask = ~event_mask;
787 
788     switch (ctype){
789         case AVRCP_CTYPE_RESPONSE_REJECTED:
790             connection->notifications_to_deregister &= reset_event_mask;
791             connection->notifications_to_register   &= reset_event_mask;
792             connection->initial_status_reported     &= reset_event_mask;
793             avrcp_controller_emit_notification_complete(connection, ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE, event_id, false);
794             return;
795 
796         case AVRCP_CTYPE_RESPONSE_INTERIM:
797             // register as enabled
798             connection->notifications_enabled |= event_mask;
799 
800             // check if initial value is already sent
801             if ( (connection->initial_status_reported & event_mask) != 0 ){
802                 return;
803             }
804             // emit event only once, initially
805             avrcp_controller_emit_notification_complete(connection, ERROR_CODE_SUCCESS, event_id, true);
806             connection->initial_status_reported |= event_mask;
807             // emit initial value after this switch
808             break;
809 
810         case AVRCP_CTYPE_RESPONSE_CHANGED_STABLE:
811             // received change, event is considered de-registered
812             // we are re-enabling it automatically, if it is not
813             // explicitly disabled
814             connection->notifications_enabled &= reset_event_mask;
815             if ((connection->notifications_to_deregister & event_mask) == 0){
816                 avrcp_controller_register_notification(connection, event_id);
817             } else {
818                 connection->notifications_to_deregister &= reset_event_mask;
819                 connection->notifications_to_register   &= reset_event_mask;
820                 connection->initial_status_reported     &= reset_event_mask;
821                 avrcp_controller_emit_notification_complete(connection, ERROR_CODE_SUCCESS, event_id, false);
822             }
823             break;
824 
825         default:
826             return;
827     }
828 
829     avrcp_controller_emit_notification_for_event_id(connection->avrcp_cid, event_id, ctype, payload + pos, size - pos);
830 }
831 
832 #ifdef ENABLE_AVCTP_FRAGMENTATION
833 static void avctp_reassemble_message(avrcp_connection_t * connection, avctp_packet_type_t packet_type, uint8_t *packet, uint16_t size){
834     // after header (transaction label and packet type)
835     uint16_t pos;
836     uint16_t bytes_to_store;
837 
838     switch (packet_type){
839         case AVCTP_START_PACKET:
840             if (size < 2) return;
841 
842             // store header
843             pos = 0;
844             connection->avctp_reassembly_buffer[pos] = packet[pos];
845             pos++;
846             connection->avctp_reassembly_size = pos;
847 
848             // NOTE: num packets not needed for reassembly, ignoring it does not pose security risk -> no need to store it
849             pos++;
850 
851             // PID in reassembled packet is at offset 1, it will be read later after the avctp_reassemble_message with AVCTP_END_PACKET is called
852 
853             bytes_to_store = btstack_min(size - pos, sizeof(connection->avctp_reassembly_buffer) - connection->avctp_reassembly_size);
854             memcpy(&connection->avctp_reassembly_buffer[connection->avctp_reassembly_size], &packet[pos], bytes_to_store);
855             connection->avctp_reassembly_size += bytes_to_store;
856             break;
857 
858         case AVCTP_CONTINUE_PACKET:
859         case AVCTP_END_PACKET:
860             if (size < 1) return;
861 
862             // store remaining data, ignore header
863             pos = 1;
864             bytes_to_store = btstack_min(size - pos, sizeof(connection->avctp_reassembly_buffer) - connection->avctp_reassembly_size);
865             memcpy(&connection->avctp_reassembly_buffer[connection->avctp_reassembly_size], &packet[pos], bytes_to_store);
866             connection->avctp_reassembly_size += bytes_to_store;
867             break;
868 
869         default:
870             return;
871     }
872 }
873 #endif
874 
875 static void avrcp_handle_l2cap_data_packet_for_signaling_connection(avrcp_connection_t * connection, uint8_t *packet, uint16_t size){
876     if (size < 6u) return;
877     uint8_t  pdu_id;
878     avrcp_packet_type_t  vendor_dependent_packet_type;
879 
880     uint16_t pos = 0;
881     connection->last_confirmed_transaction_id = packet[pos] >> 4;
882     avrcp_frame_type_t  frame_type =  (avrcp_frame_type_t)((packet[pos] >> 1) & 0x01);
883     avctp_packet_type_t packet_type = (avctp_packet_type_t)((packet[pos] >> 2) & 0x03);
884     pos++;
885 
886     if (frame_type != AVRCP_RESPONSE_FRAME) return;
887 
888     switch (packet_type){
889         case AVCTP_SINGLE_PACKET:
890             break;
891 
892 #ifdef ENABLE_AVCTP_FRAGMENTATION
893         case AVCTP_START_PACKET:
894         case AVCTP_CONTINUE_PACKET:
895             avctp_reassemble_message(connection, packet_type, packet, size);
896             return;
897 
898         case AVCTP_END_PACKET:
899             avctp_reassemble_message(connection, packet_type, packet, size);
900 
901             packet = connection->avctp_reassembly_buffer;
902             size   = connection->avctp_reassembly_size;
903             break;
904 #endif
905 
906         default:
907             return;
908     }
909 
910     pos += 2; // PID
911 
912     avrcp_command_type_t ctype = (avrcp_command_type_t) packet[pos++];
913 
914 #ifdef ENABLE_LOG_INFO
915     uint8_t byte_value = packet[pos];
916     avrcp_subunit_type_t subunit_type = (avrcp_subunit_type_t) (byte_value >> 3);
917     avrcp_subunit_type_t subunit_id   = (avrcp_subunit_type_t) (byte_value & 0x07);
918 #endif
919     pos++;
920 
921     uint8_t opcode = packet[pos++];
922     uint16_t param_length;
923 
924     switch (opcode){
925         case AVRCP_CMD_OPCODE_SUBUNIT_INFO:{
926             if (connection->state != AVCTP_W2_RECEIVE_RESPONSE) return;
927             connection->state = AVCTP_CONNECTION_OPENED;
928 
929 #ifdef ENABLE_LOG_INFO
930             // page, extension code (1)
931             pos++;
932             uint8_t unit_type = packet[pos] >> 3;
933             uint8_t max_subunit_ID = packet[pos] & 0x07;
934             log_info("SUBUNIT INFO response: ctype 0x%02x (0C), subunit_type 0x%02x (1F), subunit_id 0x%02x (07), opcode 0x%02x (30), unit_type 0x%02x, max_subunit_ID %d", ctype, subunit_type, subunit_id, opcode, unit_type, max_subunit_ID);
935 #endif
936             break;
937         }
938         case AVRCP_CMD_OPCODE_UNIT_INFO:{
939             if (connection->state != AVCTP_W2_RECEIVE_RESPONSE) return;
940             connection->state = AVCTP_CONNECTION_OPENED;
941 
942 #ifdef ENABLE_LOG_INFO
943             // byte value 7 (1)
944             pos++;
945             uint8_t unit_type = packet[pos] >> 3;
946             uint8_t unit = packet[pos] & 0x07;
947             pos++;
948             uint32_t company_id = big_endian_read_24(packet, pos);
949             log_info("UNIT INFO response: ctype 0x%02x (0C), subunit_type 0x%02x (1F), subunit_id 0x%02x (07), opcode 0x%02x (30), unit_type 0x%02x, unit %d, company_id 0x%06" PRIx32,
950                 ctype, subunit_type, subunit_id, opcode, unit_type, unit, company_id);
951 #endif
952             break;
953         }
954         case AVRCP_CMD_OPCODE_VENDOR_DEPENDENT:
955 
956             if ((size - pos) < 7) return;
957 
958             // Company ID (3)
959             pos += 3;
960             pdu_id = packet[pos++];
961             vendor_dependent_packet_type = (avrcp_packet_type_t)(packet[pos++] & 0x03);
962             param_length = big_endian_read_16(packet, pos);
963             pos += 2;
964 
965             if ((size - pos) < param_length) return;
966 
967             // handle asynchronous notifications, without changing state
968             if (pdu_id == AVRCP_PDU_ID_REGISTER_NOTIFICATION){
969                 avrcp_controller_handle_notification(connection, ctype, packet + pos, size - pos);
970                 break;
971             }
972 
973             if (connection->state != AVCTP_W2_RECEIVE_RESPONSE){
974                 log_info("AVRCP_CMD_OPCODE_VENDOR_DEPENDENT state %d", connection->state);
975                 return;
976             }
977             connection->state = AVCTP_CONNECTION_OPENED;
978 
979             log_info("VENDOR DEPENDENT response: pdu id 0x%02x, param_length %d, status %s", pdu_id, param_length, avrcp_ctype2str(ctype));
980             switch (pdu_id){
981                 case AVRCP_PDU_ID_GET_CURRENT_PLAYER_APPLICATION_SETTING_VALUE:{
982                     uint8_t num_attributes = packet[pos++];
983                     int i;
984                     avrcp_repeat_mode_t  repeat_mode =  AVRCP_REPEAT_MODE_INVALID;
985                     avrcp_shuffle_mode_t shuffle_mode = AVRCP_SHUFFLE_MODE_INVALID;
986                     for (i = 0; i < num_attributes; i++){
987                         uint8_t attribute_id    = packet[pos++];
988                         uint8_t value = packet[pos++];
989                         switch (attribute_id){
990                             case 0x02:
991                                 repeat_mode = (avrcp_repeat_mode_t) value;
992                                 break;
993                             case 0x03:
994                                 shuffle_mode = (avrcp_shuffle_mode_t) value;
995                                 break;
996                             default:
997                                 break;
998                         }
999                     }
1000                     avrcp_controller_emit_repeat_and_shuffle_mode(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, repeat_mode, shuffle_mode);
1001                     break;
1002                 }
1003 
1004                 case AVRCP_PDU_ID_SET_PLAYER_APPLICATION_SETTING_VALUE:{
1005                     uint16_t offset = 0;
1006                     uint8_t event[6];
1007                     event[offset++] = HCI_EVENT_AVRCP_META;
1008                     event[offset++] = sizeof(event) - 2;
1009                     event[offset++] = AVRCP_SUBEVENT_PLAYER_APPLICATION_VALUE_RESPONSE;
1010                     little_endian_store_16(event, offset, connection->avrcp_cid);
1011                     offset += 2;
1012                     event[offset++] = ctype;
1013                     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
1014                     break;
1015                 }
1016 
1017                 case AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME:{
1018                     uint16_t offset = 0;
1019                     uint8_t event[7];
1020                     event[offset++] = HCI_EVENT_AVRCP_META;
1021                     event[offset++] = sizeof(event) - 2;
1022                     event[offset++] = AVRCP_SUBEVENT_SET_ABSOLUTE_VOLUME_RESPONSE;
1023                     little_endian_store_16(event, offset, connection->avrcp_cid);
1024                     offset += 2;
1025                     event[offset++] = ctype;
1026                     event[offset++] = packet[pos++];
1027                     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
1028                     break;
1029                 }
1030 
1031                 case AVRCP_PDU_ID_GET_CAPABILITIES:{
1032                     avrcp_capability_id_t capability_id = (avrcp_capability_id_t) packet[pos++];
1033                     uint8_t capability_count = 0;
1034                     if (param_length > 1){
1035                         capability_count = packet[pos++];
1036                     }
1037                     uint16_t i;
1038                     uint16_t offset = 0;
1039                     uint8_t event[10];
1040 
1041                     switch (capability_id){
1042 
1043                         case AVRCP_CAPABILITY_ID_COMPANY:
1044                             for (i = 0; (i < capability_count) && ((size - pos) >= 3); i++){
1045                                 uint32_t company_id = big_endian_read_24(packet, pos);
1046                                 pos += 3;
1047                                 log_info("  0x%06" PRIx32 ", ", company_id);
1048 
1049                                 offset = 0;
1050                                 event[offset++] = HCI_EVENT_AVRCP_META;
1051                                 event[offset++] = sizeof(event) - 2;
1052                                 event[offset++] = AVRCP_SUBEVENT_GET_CAPABILITY_COMPANY_ID;
1053                                 little_endian_store_16(event, offset, connection->avrcp_cid);
1054                                 offset += 2;
1055                                 event[offset++] = ctype;
1056                                 event[offset++] = 0;
1057                                 little_endian_store_24(event, offset, company_id);
1058                                 offset += 3;
1059                                 (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
1060                             }
1061 
1062                             offset = 0;
1063                             event[offset++] = HCI_EVENT_AVRCP_META;
1064                             event[offset++] = sizeof(event) - 2;
1065                             event[offset++] = AVRCP_SUBEVENT_GET_CAPABILITY_COMPANY_ID_DONE;
1066                             little_endian_store_16(event, offset, connection->avrcp_cid);
1067                             offset += 2;
1068                             event[offset++] = ctype;
1069                             event[offset++] = 0;
1070                             (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, offset);
1071                             break;
1072 
1073                         case AVRCP_CAPABILITY_ID_EVENT:
1074                             for (i = 0; (i < capability_count) && ((size - pos) >= 1); i++){
1075                                 uint8_t event_id = packet[pos++];
1076                                 connection->target_supported_notifications |= (1 << event_id);
1077                             }
1078 
1079                             // if the get supported events query is triggered by avrcp_controller_enable_notification call,
1080                             // avrcp_controller_emit_supported_events should be suppressed
1081                             if (connection->target_supported_notifications_suppress_emit_result){
1082                                 connection->target_supported_notifications_suppress_emit_result = false;
1083                                 // also, notification might not be supported
1084                                 // if so, emit AVRCP_SUBEVENT_ENABLE_NOTIFICATION_COMPLETE event to app,
1085                                 // and update notifications_to_register bitmap
1086                                 for (i = (uint8_t)AVRCP_NOTIFICATION_EVENT_FIRST_INDEX; i < (uint8_t) AVRCP_NOTIFICATION_EVENT_LAST_INDEX; i++){
1087                                     if ((connection->notifications_to_register & (1<<i)) != 0){
1088                                         if ((connection->target_supported_notifications & (1<<i)) == 0){
1089                                             avrcp_controller_emit_notification_complete(connection, ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE, i, false);
1090                                             connection->notifications_to_register &= ~(1 << i);
1091                                         }
1092                                     }
1093                                 }
1094                                 break;
1095                             }
1096                             // supported events are emitted only if the get supported events query
1097                             // is triggered by avrcp_controller_get_supported_events call
1098                             avrcp_controller_emit_supported_events(connection);
1099                             break;
1100 
1101                         default:
1102                             // ignore
1103                             break;
1104                     }
1105                     break;
1106                 }
1107 
1108                 case AVRCP_PDU_ID_GET_PLAY_STATUS:{
1109                     uint32_t song_length = big_endian_read_32(packet, pos);
1110                     pos += 4;
1111                     uint32_t song_position = big_endian_read_32(packet, pos);
1112                     pos += 4;
1113                     uint8_t play_status = packet[pos];
1114 
1115                     uint8_t event[15];
1116                     int offset = 0;
1117                     event[offset++] = HCI_EVENT_AVRCP_META;
1118                     event[offset++] = sizeof(event) - 2;
1119                     event[offset++] = AVRCP_SUBEVENT_PLAY_STATUS;
1120                     little_endian_store_16(event, offset, connection->avrcp_cid);
1121                     offset += 2;
1122                     event[offset++] = ctype;
1123                     little_endian_store_32(event, offset, song_length);
1124                     offset += 4;
1125                     little_endian_store_32(event, offset, song_position);
1126                     offset += 4;
1127                     event[offset++] = play_status;
1128                     (*avrcp_controller_context.avrcp_callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
1129                     break;
1130                 }
1131 
1132                 case AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES:{
1133                     switch (vendor_dependent_packet_type){
1134                         case AVRCP_START_PACKET:
1135                         case AVRCP_SINGLE_PACKET:
1136                             avrcp_parser_reset(connection);
1137                             connection->list_size = param_length;
1138                             connection->num_attributes = packet[pos++];
1139 
1140                             avrcp_controller_parse_and_emit_element_attrs(packet+pos, size-pos, connection, ctype);
1141                             if (vendor_dependent_packet_type == AVRCP_START_PACKET){
1142                                 avrcp_controller_request_continue_response(connection);
1143                             }
1144                             break;
1145                         case AVRCP_CONTINUE_PACKET:
1146                         case AVRCP_END_PACKET:
1147                             connection->num_received_fragments++;
1148 
1149                             if (connection->num_received_fragments < connection->max_num_fragments){
1150                                 avrcp_controller_parse_and_emit_element_attrs(packet+pos, size-pos, connection, ctype);
1151 
1152                                 if (vendor_dependent_packet_type == AVRCP_CONTINUE_PACKET){
1153                                     avrcp_controller_request_continue_response(connection);
1154                                 }
1155                             } else {
1156                                 avrcp_controller_emit_now_playing_info_event_done(avrcp_controller_context.avrcp_callback, connection->avrcp_cid, ctype, 1);
1157                                 avrcp_parser_reset(connection);
1158                                 avrcp_controller_request_abort_continuation(connection);
1159                             }
1160                             break;
1161                         default:
1162                             // TODO check
1163                             btstack_assert(false);
1164                             break;
1165                     }
1166                 }
1167                 default:
1168                     break;
1169             }
1170             break;
1171         case AVRCP_CMD_OPCODE_PASS_THROUGH:{
1172             if ((size - pos) < 1) return;
1173             uint8_t operation_id = packet[pos++];
1174             switch (connection->state){
1175                 case AVCTP_W2_RECEIVE_PRESS_RESPONSE:
1176                     // trigger release for simple command:
1177                     if (!connection->press_and_hold_cmd_active){
1178                         connection->state = AVCTP_W2_SEND_RELEASE_COMMAND;
1179                         break;
1180                     }
1181                     // for press and hold, send release if it just has been requested, otherwise, wait for next repeat
1182                     if (connection->press_and_hold_cmd_release){
1183                         connection->press_and_hold_cmd_release = false;
1184                         connection->state = AVCTP_W2_SEND_RELEASE_COMMAND;
1185                     } else {
1186                         connection->state = AVCTP_W4_STOP;
1187                     }
1188                     break;
1189                 case AVCTP_W2_RECEIVE_RESPONSE:
1190                     connection->state = AVCTP_CONNECTION_OPENED;
1191                     break;
1192                 default:
1193                     break;
1194             }
1195             if (connection->state == AVCTP_W4_STOP){
1196                 avrcp_controller_emit_operation_status(avrcp_controller_context.avrcp_callback, AVRCP_SUBEVENT_OPERATION_START, connection->avrcp_cid, ctype, operation_id);
1197             }
1198             if (connection->state == AVCTP_CONNECTION_OPENED) {
1199                 // RELEASE response
1200                 operation_id = operation_id & 0x7F;
1201                 avrcp_controller_emit_operation_status(avrcp_controller_context.avrcp_callback, AVRCP_SUBEVENT_OPERATION_COMPLETE, connection->avrcp_cid, ctype, operation_id);
1202             }
1203             if (connection->state == AVCTP_W2_SEND_RELEASE_COMMAND){
1204                 // PRESS response
1205                 avrcp_controller_request_pass_through_release_control_cmd(connection);
1206             }
1207             break;
1208         }
1209         default:
1210             break;
1211     }
1212 
1213     // trigger pending notification reqistrations
1214     if ((connection->state == AVCTP_CONNECTION_OPENED) && connection->notifications_to_register){
1215         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1216     }
1217 }
1218 
1219 static void avrcp_controller_handle_can_send_now(avrcp_connection_t * connection){
1220     switch (connection->state){
1221         case AVCTP_W2_SEND_PRESS_COMMAND:
1222             connection->state = AVCTP_W2_RECEIVE_PRESS_RESPONSE;
1223             avrcp_send_cmd_with_avctp_fragmentation(connection, AVCTP_SINGLE_PACKET);
1224             return;
1225         case AVCTP_W2_SEND_COMMAND:
1226         case AVCTP_W2_SEND_RELEASE_COMMAND:
1227             connection->state = AVCTP_W2_RECEIVE_RESPONSE;
1228             avrcp_send_cmd_with_avctp_fragmentation(connection, AVCTP_SINGLE_PACKET);
1229             return;
1230         case AVCTP_W2_SEND_AVCTP_FRAGMENTED_MESSAGE:
1231             if (connection->cmd_operands_fragmented_pos == 0){
1232                  avrcp_send_cmd_with_avctp_fragmentation(connection, AVCTP_START_PACKET);
1233                  avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1234             } else {
1235                 if ((connection->cmd_operands_fragmented_len - connection->cmd_operands_fragmented_pos) > avrcp_get_max_payload_size_for_avctp_packet_type(connection, AVCTP_CONTINUE_PACKET)){
1236                      avrcp_send_cmd_with_avctp_fragmentation(connection, AVCTP_CONTINUE_PACKET);
1237                      avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1238                  } else {
1239                     connection->state = AVCTP_W2_RECEIVE_RESPONSE;
1240                     avrcp_send_cmd_with_avctp_fragmentation(connection, AVCTP_END_PACKET);
1241                  }
1242             }
1243             return;
1244         default:
1245             break;
1246     }
1247     // send register notification if queued
1248     if (connection->notifications_to_register != 0){
1249         uint8_t event_id;
1250         for (event_id = (uint8_t)AVRCP_NOTIFICATION_EVENT_FIRST_INDEX; event_id < (uint8_t)AVRCP_NOTIFICATION_EVENT_LAST_INDEX; event_id++){
1251             if (connection->notifications_to_register & (1<<event_id)){
1252                 connection->notifications_to_register &= ~ (1 << event_id);
1253                 avrcp_send_register_notification(connection, event_id);
1254                 return;
1255             }
1256         }
1257     }
1258 }
1259 
1260 static void avrcp_controller_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1261     avrcp_connection_t * connection;
1262 
1263     switch (packet_type) {
1264         case L2CAP_DATA_PACKET:
1265             connection = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_CONTROLLER, channel);
1266             avrcp_handle_l2cap_data_packet_for_signaling_connection(connection, packet, size);
1267             break;
1268 
1269         case HCI_EVENT_PACKET:
1270             switch (hci_event_packet_get_type(packet)){
1271                 case L2CAP_EVENT_CAN_SEND_NOW:
1272                     connection = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_CONTROLLER, channel);
1273                     avrcp_controller_handle_can_send_now(connection);
1274                     break;
1275             default:
1276                 break;
1277         }
1278         default:
1279             break;
1280     }
1281 }
1282 
1283 void avrcp_controller_create_sdp_record(uint8_t * service, uint32_t service_record_handle, uint16_t supported_features, const char * service_name, const char * service_provider_name){
1284     avrcp_create_sdp_record(1, service, service_record_handle, avrcp_controller_supports_browsing(supported_features), supported_features, service_name, service_provider_name);
1285 }
1286 
1287 void avrcp_controller_init(void){
1288     avrcp_controller_context.role = AVRCP_CONTROLLER;
1289     avrcp_controller_context.packet_handler = avrcp_controller_packet_handler;
1290     avrcp_register_controller_packet_handler(&avrcp_controller_packet_handler);
1291 }
1292 
1293 void avrcp_controller_deinit(void){
1294     memset(&avrcp_controller_context, 0, sizeof(avrcp_context_t));
1295 }
1296 
1297 void avrcp_controller_register_packet_handler(btstack_packet_handler_t callback){
1298     btstack_assert(callback != NULL);
1299     avrcp_controller_context.avrcp_callback = callback;
1300 }
1301 
1302 
1303 uint8_t avrcp_controller_play(uint16_t avrcp_cid){
1304     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PLAY, 0);
1305 }
1306 
1307 uint8_t avrcp_controller_stop(uint16_t avrcp_cid){
1308     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_STOP, 0);
1309 }
1310 
1311 uint8_t avrcp_controller_pause(uint16_t avrcp_cid){
1312     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PAUSE, 0);
1313 }
1314 
1315 uint8_t avrcp_controller_forward(uint16_t avrcp_cid){
1316     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FORWARD, 0);
1317 }
1318 
1319 uint8_t avrcp_controller_backward(uint16_t avrcp_cid){
1320     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_BACKWARD, 0);
1321 }
1322 
1323 uint8_t avrcp_controller_volume_up(uint16_t avrcp_cid){
1324     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_UP, 0);
1325 }
1326 
1327 uint8_t avrcp_controller_volume_down(uint16_t avrcp_cid){
1328     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_DOWN, 0);
1329 }
1330 
1331 uint8_t avrcp_controller_mute(uint16_t avrcp_cid){
1332     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_MUTE, 0);
1333 }
1334 
1335 uint8_t avrcp_controller_skip(uint16_t avrcp_cid){
1336     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_SKIP, 0);
1337 }
1338 
1339 uint8_t avrcp_controller_fast_forward(uint16_t avrcp_cid){
1340     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FAST_FORWARD, 0);
1341 }
1342 
1343 uint8_t avrcp_controller_rewind(uint16_t avrcp_cid){
1344     return request_single_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_REWIND, 0);
1345 }
1346 
1347 /* start continuous cmds */
1348 
1349 uint8_t avrcp_controller_start_press_and_hold_cmd(uint16_t avrcp_cid, avrcp_operation_id_t operation_id){
1350     return request_continuous_pass_through_press_control_cmd(avrcp_cid, operation_id, 0);
1351 }
1352 
1353 uint8_t avrcp_controller_press_and_hold_play(uint16_t avrcp_cid){
1354     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PLAY, 0);
1355 }
1356 uint8_t avrcp_controller_press_and_hold_stop(uint16_t avrcp_cid){
1357     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_STOP, 0);
1358 }
1359 uint8_t avrcp_controller_press_and_hold_pause(uint16_t avrcp_cid){
1360     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_PAUSE, 0);
1361 }
1362 uint8_t avrcp_controller_press_and_hold_forward(uint16_t avrcp_cid){
1363     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FORWARD, 0);
1364 }
1365 uint8_t avrcp_controller_press_and_hold_backward(uint16_t avrcp_cid){
1366     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_BACKWARD, 0);
1367 }
1368 uint8_t avrcp_controller_press_and_hold_fast_forward(uint16_t avrcp_cid){
1369     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_FAST_FORWARD, 0);
1370 }
1371 uint8_t avrcp_controller_press_and_hold_rewind(uint16_t avrcp_cid){
1372     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_REWIND, 0);
1373 }
1374 uint8_t avrcp_controller_press_and_hold_volume_up(uint16_t avrcp_cid){
1375     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_UP, 0);
1376 }
1377 uint8_t avrcp_controller_press_and_hold_volume_down(uint16_t avrcp_cid){
1378     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_VOLUME_DOWN, 0);
1379 }
1380 uint8_t avrcp_controller_press_and_hold_mute(uint16_t avrcp_cid){
1381     return request_continuous_pass_through_press_control_cmd(avrcp_cid, AVRCP_OPERATION_ID_MUTE, 0);
1382 }
1383 
1384 /* stop continuous cmds */
1385 uint8_t avrcp_controller_release_press_and_hold_cmd(uint16_t avrcp_cid){
1386     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1387     if (!connection){
1388         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1389     }
1390 
1391     switch (connection->state){
1392         // respond when we receive response for (repeated) press command
1393         case AVCTP_W2_RECEIVE_PRESS_RESPONSE:
1394             connection->press_and_hold_cmd_release = true;
1395             break;
1396 
1397         // release already sent or on the way, nothing to do
1398         case AVCTP_W2_RECEIVE_RESPONSE:
1399         case AVCTP_W2_SEND_RELEASE_COMMAND:
1400             break;
1401 
1402         // about to send next repeated press command or wait for it -> release right away
1403         case AVCTP_W2_SEND_PRESS_COMMAND:
1404         case AVCTP_W4_STOP:
1405             return avrcp_controller_request_pass_through_release_control_cmd(connection);
1406 
1407         // otherwise reject request
1408         default:
1409             return ERROR_CODE_COMMAND_DISALLOWED;
1410     }
1411     return ERROR_CODE_SUCCESS;
1412 }
1413 
1414 uint8_t avrcp_controller_enable_notification(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id){
1415     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1416     if (!connection){
1417         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1418     }
1419     return avrcp_controller_register_notification(connection, event_id);
1420 }
1421 
1422 uint8_t avrcp_controller_disable_notification(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id){
1423     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1424     if (!connection){
1425         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1426     }
1427     if (!connection->target_supported_notifications_queried){
1428         return ERROR_CODE_COMMAND_DISALLOWED;
1429     }
1430 
1431     if ((connection->target_supported_notifications & (1 << event_id)) == 0){
1432         return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
1433     }
1434 
1435     if ((connection->notifications_enabled & (1 << event_id)) == 0){
1436         return ERROR_CODE_SUCCESS;
1437     }
1438 
1439     connection->notifications_to_deregister |= (1 << event_id);
1440     return ERROR_CODE_SUCCESS;
1441 }
1442 
1443 uint8_t avrcp_controller_unit_info(uint16_t avrcp_cid){
1444     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1445     if (!connection){
1446         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1447     }
1448     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1449     connection->state = AVCTP_W2_SEND_COMMAND;
1450 
1451     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1452     connection->command_opcode = AVRCP_CMD_OPCODE_UNIT_INFO;
1453     connection->command_type = AVRCP_CTYPE_STATUS;
1454     connection->subunit_type = AVRCP_SUBUNIT_TYPE_UNIT; //vendor unique
1455     connection->subunit_id =   AVRCP_SUBUNIT_ID_IGNORE;
1456     memset(connection->cmd_operands, 0xFF, connection->cmd_operands_length);
1457     connection->cmd_operands_length = 5;
1458     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1459     return ERROR_CODE_SUCCESS;
1460 }
1461 
1462 uint8_t avrcp_controller_subunit_info(uint16_t avrcp_cid){
1463     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1464     if (!connection){
1465         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1466     }
1467     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1468     connection->state = AVCTP_W2_SEND_COMMAND;
1469 
1470     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1471     connection->command_opcode = AVRCP_CMD_OPCODE_SUBUNIT_INFO;
1472     connection->command_type = AVRCP_CTYPE_STATUS;
1473     connection->subunit_type = AVRCP_SUBUNIT_TYPE_UNIT; //vendor unique
1474     connection->subunit_id =   AVRCP_SUBUNIT_ID_IGNORE;
1475     memset(connection->cmd_operands, 0xFF, connection->cmd_operands_length);
1476     connection->cmd_operands[0] = 7; // page: 0, extention_code: 7
1477     connection->cmd_operands_length = 5;
1478     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1479     return ERROR_CODE_SUCCESS;
1480 }
1481 
1482 uint8_t avrcp_controller_get_supported_company_ids(uint16_t avrcp_cid){
1483     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1484     if (!connection){
1485         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1486     }
1487     if (connection->state != AVCTP_CONNECTION_OPENED){
1488         return ERROR_CODE_COMMAND_DISALLOWED;
1489     }
1490     avrcp_controller_get_capabilities_for_connection(connection, AVRCP_CAPABILITY_ID_COMPANY);
1491     return ERROR_CODE_SUCCESS;
1492 }
1493 
1494 uint8_t avrcp_controller_get_supported_events(uint16_t avrcp_cid){
1495     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1496     if (!connection){
1497         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1498     }
1499     if (connection->state != AVCTP_CONNECTION_OPENED){
1500         return ERROR_CODE_COMMAND_DISALLOWED;
1501     }
1502 
1503     if (!connection->target_supported_notifications_queried){
1504         connection->target_supported_notifications_queried = true;
1505         avrcp_controller_get_capabilities_for_connection(connection, AVRCP_CAPABILITY_ID_EVENT);
1506         return ERROR_CODE_SUCCESS;
1507     }
1508 
1509     avrcp_controller_emit_supported_events(connection);
1510     return ERROR_CODE_SUCCESS;
1511 }
1512 
1513 uint8_t avrcp_controller_get_play_status(uint16_t avrcp_cid){
1514     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1515     if (!connection){
1516         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1517     }
1518     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1519 
1520     connection->state = AVCTP_W2_SEND_COMMAND;
1521     avrcp_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_STATUS, AVRCP_PDU_ID_GET_PLAY_STATUS);
1522 
1523     // TODO refactor
1524     big_endian_store_24(connection->cmd_operands, 0, BT_SIG_COMPANY_ID);
1525     connection->cmd_operands[3] = AVRCP_PDU_ID_GET_PLAY_STATUS;
1526     connection->cmd_operands[4] = 0;                     // reserved(upper 6) | packet_type -> 0
1527     big_endian_store_16(connection->cmd_operands, 5, 0); // parameter length
1528     connection->cmd_operands_length = 7;
1529     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1530     return ERROR_CODE_SUCCESS;
1531 }
1532 
1533 uint8_t avrcp_controller_set_addressed_player(uint16_t avrcp_cid, uint16_t addressed_player_id){
1534     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1535     if (!connection){
1536         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1537     }
1538     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1539 
1540     connection->state = AVCTP_W2_SEND_COMMAND;
1541     avrcp_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_SET_ADDRESSED_PLAYER);
1542 
1543     // TODO refactor
1544     int pos = 0;
1545     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1546     pos += 3;
1547     connection->cmd_operands[pos++] = AVRCP_PDU_ID_SET_ADDRESSED_PLAYER; // PDU ID
1548     connection->cmd_operands[pos++] = 0;
1549 
1550     // Parameter Length
1551     big_endian_store_16(connection->cmd_operands, pos, 2);
1552     pos += 2;
1553 
1554     big_endian_store_16(connection->cmd_operands, pos, addressed_player_id);
1555     pos += 2;
1556 
1557     connection->cmd_operands_length = pos;
1558     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1559     return ERROR_CODE_SUCCESS;
1560 }
1561 
1562 uint8_t avrcp_controller_get_element_attributes(uint16_t avrcp_cid, uint8_t num_attributes, avrcp_media_attribute_id_t * attributes){
1563     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1564     if (!connection){
1565         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1566     }
1567 
1568     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1569 
1570     if (num_attributes >= AVRCP_MEDIA_ATTR_RESERVED) {
1571         return ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
1572     }
1573 
1574     connection->state = AVCTP_W2_SEND_COMMAND;
1575     avrcp_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_STATUS, AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES);
1576 
1577     // TODO refactor
1578     int pos = 0;
1579     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1580     pos += 3;
1581     connection->cmd_operands[pos++] = AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES; // PDU ID
1582     connection->cmd_operands[pos++] = 0;
1583 
1584     // Parameter Length
1585     big_endian_store_16(connection->cmd_operands, pos, 9);
1586     pos += 2;
1587 
1588     // write 8 bytes value
1589     memset(connection->cmd_operands + pos, 0, 8); // identifier: PLAYING
1590     pos += 8;
1591 
1592     connection->cmd_operands[pos++] = num_attributes; // attribute count, if 0 get all attributes
1593 
1594     int i;
1595     for (i = 0; i < num_attributes; i++){
1596         // every attribute is 4 bytes long
1597         big_endian_store_32(connection->cmd_operands, pos, attributes[i]);
1598         pos += 4;
1599     }
1600 
1601     connection->cmd_operands_length = pos;
1602     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1603     return ERROR_CODE_SUCCESS;
1604 }
1605 
1606 uint8_t avrcp_controller_get_now_playing_info(uint16_t avrcp_cid){
1607     return avrcp_controller_get_element_attributes(avrcp_cid, 0, NULL);
1608 }
1609 
1610 uint8_t avrcp_controller_get_now_playing_info_for_media_attribute_id(uint16_t avrcp_cid, avrcp_media_attribute_id_t media_attribute_id){
1611     if (media_attribute_id == AVRCP_MEDIA_ATTR_ALL){
1612         return avrcp_controller_get_now_playing_info(avrcp_cid);
1613     }
1614     return avrcp_controller_get_element_attributes(avrcp_cid, 1, &media_attribute_id);
1615 }
1616 
1617 uint8_t avrcp_controller_set_absolute_volume(uint16_t avrcp_cid, uint8_t volume){
1618      avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1619     if (!connection){
1620         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1621     }
1622 
1623     //
1624     // allow sending of multiple set abs volume commands without waiting for response
1625     //
1626     uint8_t status = ERROR_CODE_COMMAND_DISALLOWED;
1627     switch (connection->state){
1628         case AVCTP_CONNECTION_OPENED:
1629             status = ERROR_CODE_SUCCESS;
1630             break;
1631         case AVCTP_W2_RECEIVE_RESPONSE:
1632             // - is pending response also set abs volume
1633             if (connection->command_opcode  != AVRCP_CMD_OPCODE_VENDOR_DEPENDENT) break;
1634             if (connection->command_type    != AVRCP_CTYPE_CONTROL)               break;
1635             if (connection->subunit_type    != AVRCP_SUBUNIT_TYPE_PANEL)          break;
1636             if (connection->subunit_id      != AVRCP_SUBUNIT_ID)                  break;
1637             if (connection->cmd_operands[3] != AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME)  break;
1638             // - is next transaction id valid in window
1639             if (avrcp_controller_is_transaction_id_valid(connection, avrcp_controller_calc_next_transaction_label(connection->transaction_id_counter)) == false) break;
1640             status = ERROR_CODE_SUCCESS;
1641             break;
1642         default:
1643             break;
1644     }
1645     if (status != ERROR_CODE_SUCCESS) return status;
1646 
1647     connection->state = AVCTP_W2_SEND_COMMAND;
1648     avrcp_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME);
1649 
1650     // TODO refactor:
1651     int pos = 0;
1652     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1653     pos += 3;
1654     connection->cmd_operands[pos++] = AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME; // PDU ID
1655     connection->cmd_operands[pos++] = 0;
1656 
1657     // Parameter Length
1658     big_endian_store_16(connection->cmd_operands, pos, 1);
1659     pos += 2;
1660     connection->cmd_operands[pos++] = volume;
1661 
1662     connection->cmd_operands_length = pos;
1663     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1664     return ERROR_CODE_SUCCESS;
1665 }
1666 
1667 uint8_t avrcp_controller_query_shuffle_and_repeat_modes(uint16_t avrcp_cid){
1668     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1669     if (!connection){
1670         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1671     }
1672     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1673 
1674     connection->state = AVCTP_W2_SEND_COMMAND;
1675     avrcp_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_STATUS, AVRCP_PDU_ID_GET_CURRENT_PLAYER_APPLICATION_SETTING_VALUE);
1676 
1677     // TODO refactor
1678     big_endian_store_24(connection->cmd_operands, 0, BT_SIG_COMPANY_ID);
1679     connection->cmd_operands[3] = AVRCP_PDU_ID_GET_CURRENT_PLAYER_APPLICATION_SETTING_VALUE; // PDU ID
1680     connection->cmd_operands[4] = 0;
1681     big_endian_store_16(connection->cmd_operands, 5, 5); // parameter length
1682     connection->cmd_operands[7] = 4;                     // NumPlayerApplicationSettingAttributeID
1683     // PlayerApplicationSettingAttributeID1 AVRCP Spec, Appendix F, 133
1684     connection->cmd_operands[8]  = 0x01;    // equalizer  (1-OFF, 2-ON)
1685     connection->cmd_operands[9]  = 0x02;    // repeat     (1-off, 2-single track, 3-all tracks, 4-group repeat)
1686     connection->cmd_operands[10] = 0x03;    // shuffle    (1-off, 2-all tracks, 3-group shuffle)
1687     connection->cmd_operands[11] = 0x04;    // scan       (1-off, 2-all tracks, 3-group scan)
1688     connection->cmd_operands_length = 12;
1689     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1690     return ERROR_CODE_SUCCESS;
1691 }
1692 
1693 static uint8_t avrcp_controller_set_current_player_application_setting_value(uint16_t avrcp_cid, uint8_t attr_id, uint8_t attr_value){
1694     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1695     if (!connection){
1696         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1697     }
1698     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1699 
1700     connection->state = AVCTP_W2_SEND_COMMAND;
1701     avrcp_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_SET_PLAYER_APPLICATION_SETTING_VALUE);
1702 
1703     // TODO refactor
1704     int pos = 0;
1705     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1706     pos += 3;
1707     connection->cmd_operands[pos++] = AVRCP_PDU_ID_SET_PLAYER_APPLICATION_SETTING_VALUE; // PDU ID
1708     connection->cmd_operands[pos++] = 0;
1709     // Parameter Length
1710     big_endian_store_16(connection->cmd_operands, pos, 3);
1711     pos += 2;
1712     connection->cmd_operands[pos++] = 2;
1713     connection->cmd_operands_length = pos;
1714     connection->cmd_operands[pos++]  = attr_id;
1715     connection->cmd_operands[pos++]  = attr_value;
1716     connection->cmd_operands_length = pos;
1717     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1718     return ERROR_CODE_SUCCESS;
1719 }
1720 
1721 uint8_t avrcp_controller_set_shuffle_mode(uint16_t avrcp_cid, avrcp_shuffle_mode_t mode){
1722     if ((mode < AVRCP_SHUFFLE_MODE_OFF) || (mode > AVRCP_SHUFFLE_MODE_GROUP)) return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
1723     return avrcp_controller_set_current_player_application_setting_value(avrcp_cid, 0x03, mode);
1724 }
1725 
1726 uint8_t avrcp_controller_set_repeat_mode(uint16_t avrcp_cid, avrcp_repeat_mode_t mode){
1727     if ((mode < AVRCP_REPEAT_MODE_OFF) || (mode > AVRCP_REPEAT_MODE_GROUP)) return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
1728     return avrcp_controller_set_current_player_application_setting_value(avrcp_cid, 0x02, mode);
1729 }
1730 
1731 uint8_t avrcp_controller_play_item_for_scope(uint16_t avrcp_cid, uint8_t * uid, uint16_t uid_counter, avrcp_browsing_scope_t scope){
1732     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1733     if (!connection){
1734         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1735     }
1736     if (connection->state != AVCTP_CONNECTION_OPENED){
1737         log_error("Connection in wrong state, expected %d, received %d", AVCTP_CONNECTION_OPENED, connection->state);
1738         return ERROR_CODE_COMMAND_DISALLOWED;
1739     }
1740     connection->state = AVCTP_W2_SEND_COMMAND;
1741     avrcp_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_PLAY_ITEM);
1742 
1743     // TODO refactor
1744     int pos = 0;
1745     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1746     pos += 3;
1747     connection->cmd_operands[pos++] = AVRCP_PDU_ID_PLAY_ITEM; // PDU ID
1748     // reserved
1749     connection->cmd_operands[pos++] = 0;
1750     // Parameter Length
1751     big_endian_store_16(connection->cmd_operands, pos, 11);
1752     pos += 2;
1753     connection->cmd_operands[pos++]  = scope;
1754     memset(&connection->cmd_operands[pos], 0, 8);
1755     if (uid){
1756         (void)memcpy(&connection->cmd_operands[pos], uid, 8);
1757     }
1758     pos += 8;
1759     big_endian_store_16(connection->cmd_operands, pos, uid_counter);
1760     pos += 2;
1761     connection->cmd_operands_length = pos;
1762 
1763     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1764     return ERROR_CODE_SUCCESS;
1765 }
1766 
1767 uint8_t avrcp_controller_add_item_from_scope_to_now_playing_list(uint16_t avrcp_cid, uint8_t * uid, uint16_t uid_counter, avrcp_browsing_scope_t scope){
1768     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1769     if (!connection){
1770         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1771     }
1772     if (connection->state != AVCTP_CONNECTION_OPENED){
1773         log_error("Connection in wrong state, expected %d, received %d", AVCTP_CONNECTION_OPENED, connection->state);
1774         return ERROR_CODE_COMMAND_DISALLOWED;
1775     }
1776 
1777     connection->state = AVCTP_W2_SEND_COMMAND;
1778     avrcp_vendor_dependent_command_data_init(connection, AVRCP_CTYPE_CONTROL, AVRCP_PDU_ID_ADD_TO_NOW_PLAYING);
1779 
1780     // TODO refactor
1781     int pos = 0;
1782     big_endian_store_24(connection->cmd_operands, pos, BT_SIG_COMPANY_ID);
1783     pos += 3;
1784     connection->cmd_operands[pos++] = AVRCP_PDU_ID_ADD_TO_NOW_PLAYING; // PDU ID
1785     // reserved
1786     connection->cmd_operands[pos++] = 0;
1787     // Parameter Length
1788     big_endian_store_16(connection->cmd_operands, pos, 11);
1789     pos += 2;
1790     connection->cmd_operands[pos++]  = scope;
1791     memset(&connection->cmd_operands[pos], 0, 8);
1792     if (uid){
1793         (void)memcpy(&connection->cmd_operands[pos], uid, 8);
1794     }
1795     pos += 8;
1796     big_endian_store_16(connection->cmd_operands, pos, uid_counter);
1797     pos += 2;
1798     connection->cmd_operands_length = pos;
1799 
1800     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1801     return ERROR_CODE_SUCCESS;
1802 }
1803 
1804 uint8_t avrcp_controller_set_max_num_fragments(uint16_t avrcp_cid, uint8_t max_num_fragments){
1805     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1806     if (!connection){
1807         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1808     }
1809     connection->max_num_fragments = max_num_fragments;
1810     return ERROR_CODE_SUCCESS;
1811 }
1812 
1813 uint8_t avrcp_controller_send_custom_command(uint16_t avrcp_cid, avrcp_command_type_t command_type, avrcp_subunit_type_t subunit_type, avrcp_subunit_id_t subunit_id, avrcp_command_opcode_t command_opcode, const uint8_t * command_buffer, uint16_t command_len){
1814     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_CONTROLLER, avrcp_cid);
1815     if (!connection){
1816         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1817     }
1818 
1819     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
1820     connection->state = AVCTP_W2_SEND_AVCTP_FRAGMENTED_MESSAGE;
1821 
1822     connection->transaction_id = avrcp_controller_get_next_transaction_label(connection);
1823     connection->command_opcode = command_opcode;
1824     connection->command_type = command_type;
1825     connection->subunit_type = subunit_type;
1826     connection->subunit_id = subunit_id;
1827     connection->cmd_operands_fragmented_buffer = command_buffer;
1828     connection->cmd_operands_fragmented_pos = 0;
1829     connection->cmd_operands_fragmented_len = command_len;
1830 
1831     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1832     return ERROR_CODE_SUCCESS;
1833 }
1834