xref: /btstack/src/classic/avrcp_target.c (revision aeb999167a399090d62e27f59afe05b0b5fe4921)
1 /*
2  * Copyright (C) 2016 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
24  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "avrcp_target.c"
39 
40 #include <stdint.h>
41 #include <stdio.h>
42 #include <string.h>
43 #include <inttypes.h>
44 
45 #include "classic/avrcp.h"
46 #include "classic/avrcp_target.h"
47 
48 #include "bluetooth_sdp.h"
49 #include "btstack_debug.h"
50 #include "btstack_event.h"
51 #include "btstack_util.h"
52 #include "l2cap.h"
53 
54 #include <stdio.h>
55 #define AVRCP_ATTR_HEADER_LEN  8
56 
57 static const uint8_t AVRCP_NOTIFICATION_TRACK_SELECTED[] = {0,0,0,0,0,0,0,0};
58 static const uint8_t AVRCP_NOTIFICATION_TRACK_NOT_SELECTED[] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
59 
60 avrcp_context_t avrcp_target_context;
61 
62 static uint32_t default_companies[] = {
63     0x581900 //BT SIG registered CompanyID
64 };
65 
66 static int avrcp_target_supports_browsing(uint16_t target_supported_features){
67     return target_supported_features & AVRCP_FEATURE_MASK_BROWSING;
68 }
69 
70 void avrcp_target_create_sdp_record(uint8_t * service, uint32_t service_record_handle, uint16_t supported_features, const char * service_name, const char * service_provider_name){
71     avrcp_create_sdp_record(0, service, service_record_handle, avrcp_target_supports_browsing(supported_features), supported_features, service_name, service_provider_name);
72 }
73 
74 static void
75 avrcp_target_emit_operation(btstack_packet_handler_t callback, uint16_t avrcp_cid, avrcp_operation_id_t operation_id,
76                             bool button_pressed, uint8_t operands_length, uint8_t operand) {
77     btstack_assert(callback != NULL);
78 
79     uint8_t event[9];
80     int pos = 0;
81     event[pos++] = HCI_EVENT_AVRCP_META;
82     event[pos++] = sizeof(event) - 2;
83     event[pos++] = AVRCP_SUBEVENT_OPERATION;
84     little_endian_store_16(event, pos, avrcp_cid);
85     pos += 2;
86     event[pos++] = operation_id;
87     event[pos++] = button_pressed ? 1 : 0;
88     event[pos++] = operands_length;
89     event[pos++] = operand;
90     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
91 }
92 
93 static void avrcp_target_emit_volume_changed(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t absolute_volume){
94     btstack_assert(callback != NULL);
95 
96     uint8_t event[7];
97     int offset = 0;
98     event[offset++] = HCI_EVENT_AVRCP_META;
99     event[offset++] = sizeof(event) - 2;
100     event[offset++] = AVRCP_SUBEVENT_NOTIFICATION_VOLUME_CHANGED;
101     little_endian_store_16(event, offset, avrcp_cid);
102     offset += 2;
103     event[offset++] = AVRCP_CTYPE_NOTIFY;
104     event[offset++] = absolute_volume;
105     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
106 }
107 
108 static void avrcp_target_emit_respond_vendor_dependent_query(btstack_packet_handler_t callback, uint16_t avrcp_cid, uint8_t subevent_id){
109     btstack_assert(callback != NULL);
110 
111     uint8_t event[5];
112     int pos = 0;
113     event[pos++] = HCI_EVENT_AVRCP_META;
114     event[pos++] = sizeof(event) - 2;
115     event[pos++] = subevent_id;
116     little_endian_store_16(event, pos, avrcp_cid);
117     (*callback)(HCI_EVENT_PACKET, 0, event, sizeof(event));
118 }
119 
120 // returns number of bytes stored
121 static uint16_t avrcp_target_pack_single_element_header(uint8_t * buffer, avrcp_media_attribute_id_t attr_id, uint16_t attr_value_size){
122     btstack_assert(attr_id > AVRCP_MEDIA_ATTR_ALL);
123     btstack_assert(attr_id < AVRCP_MEDIA_ATTR_RESERVED);
124     uint16_t pos = 0;
125     big_endian_store_32(buffer, pos, attr_id);
126     big_endian_store_16(buffer, pos + 4, RFC2978_CHARSET_MIB_UTF8);
127     big_endian_store_16(buffer, pos + 6, attr_value_size);
128     return 8;
129 }
130 
131 static uint16_t avrcp_now_playing_info_attr_id_value_len(avrcp_connection_t * connection, avrcp_media_attribute_id_t attr_id){
132     char buffer[AVRCP_MAX_ATTRIBUTE_SIZE];
133     uint16_t str_len;
134     switch (attr_id) {
135         case AVRCP_MEDIA_ATTR_ALL:
136         case AVRCP_MEDIA_ATTR_NONE:
137             return 0;
138         case AVRCP_MEDIA_ATTR_TRACK:
139             str_len = sprintf(buffer, "%0" PRIu32, connection->track_nr);
140             break;
141         case AVRCP_MEDIA_ATTR_TOTAL_NUM_ITEMS:
142             str_len = sprintf(buffer, "%0" PRIu32, connection->total_tracks);
143             break;
144         case AVRCP_MEDIA_ATTR_SONG_LENGTH_MS:
145             str_len = sprintf(buffer, "%0" PRIu32, connection->song_length_ms);
146             break;
147         default:
148             str_len = connection->now_playing_info[(uint16_t)attr_id - 1].len;
149             break;
150     }
151     return str_len;
152 }
153 
154 static uint16_t avrcp_now_playing_info_value_len_with_headers(avrcp_connection_t * connection){
155     uint16_t playing_info_len = 0;
156 
157     uint8_t i;
158     for ( i = (uint8_t)AVRCP_MEDIA_ATTR_ALL + 1; i < (uint8_t) AVRCP_MEDIA_ATTR_RESERVED; i++){
159         avrcp_media_attribute_id_t attr_id = (avrcp_media_attribute_id_t) i;
160 
161         if ((connection->now_playing_info_attr_bitmap & (1 << attr_id)) == 0) {
162             continue;
163         }
164 
165         switch (attr_id) {
166             case AVRCP_MEDIA_ATTR_ALL:
167             case AVRCP_MEDIA_ATTR_NONE:
168             case AVRCP_MEDIA_ATTR_DEFAULT_COVER_ART:
169                 break;
170             default:
171                 playing_info_len += AVRCP_ATTR_HEADER_LEN + avrcp_now_playing_info_attr_id_value_len(connection, attr_id);
172                 break;
173         }
174     }
175     return playing_info_len;
176 }
177 
178 static uint8_t * avrcp_get_attribute_value_from_u32(avrcp_connection_t * connection, uint32_t value, uint16_t * num_bytes_to_copy){
179     *num_bytes_to_copy = 0;
180 
181     if (connection->attribute_value_len == 0){
182         connection->attribute_value_len = sprintf((char *)connection->attribute_value, "%0" PRIu32, value);
183         connection->attribute_value_offset = 0;
184     }
185     *num_bytes_to_copy = connection->attribute_value_len - connection->attribute_value_offset;
186     return connection->attribute_value + connection->attribute_value_offset;
187 }
188 
189 static uint8_t * avrcp_get_next_value_fragment_for_attribute_id(avrcp_connection_t * connection, avrcp_media_attribute_id_t attr_id, uint16_t * num_bytes_to_copy){
190     switch (attr_id){
191         case AVRCP_MEDIA_ATTR_TRACK:
192             return avrcp_get_attribute_value_from_u32(connection, connection->track_nr, num_bytes_to_copy);
193         case AVRCP_MEDIA_ATTR_TOTAL_NUM_ITEMS:
194             return avrcp_get_attribute_value_from_u32(connection, connection->total_tracks, num_bytes_to_copy);
195         case AVRCP_MEDIA_ATTR_SONG_LENGTH_MS:
196             return avrcp_get_attribute_value_from_u32(connection, connection->song_length_ms, num_bytes_to_copy);
197         default:
198             break;
199     }
200     int attr_index = attr_id - 1;
201     if (connection->attribute_value_len == 0){
202         connection->attribute_value_len = avrcp_now_playing_info_attr_id_value_len(connection, attr_id);
203         connection->attribute_value_offset = 0;
204     }
205     *num_bytes_to_copy = connection->now_playing_info[attr_index].len - connection->attribute_value_offset;
206     return (uint8_t *) (connection->now_playing_info[attr_index].value + connection->attribute_value_offset);
207 }
208 
209 // TODO Review
210 static uint16_t avrcp_store_avctp_now_playing_info_fragment(avrcp_connection_t * connection, uint16_t packet_size, uint8_t * packet){
211     uint16_t num_free_bytes = packet_size;
212 
213     uint16_t bytes_stored = 0;
214 
215     while ((num_free_bytes > 0) && (connection->next_attr_id <= AVRCP_MEDIA_ATTR_SONG_LENGTH_MS)){
216         if ((connection->now_playing_info_attr_bitmap & (1 << (uint8_t)connection->next_attr_id)) == 0) {
217             continue;
218         }
219 
220         // store header
221         if (connection->attribute_value_offset == 0){
222             // pack the whole attribute value header
223             if (connection->parser_attribute_header_pos == 0) {
224                 avrcp_target_pack_single_element_header(connection->parser_attribute_header, connection->next_attr_id,
225                                                         connection->attribute_value_len);
226                 connection->parser_attribute_header_pos = 0;
227             }
228 
229             if (connection->parser_attribute_header_pos < AVRCP_ATTRIBUTE_HEADER_LEN){
230                 uint16_t num_header_bytes_to_store = btstack_min(num_free_bytes, AVRCP_ATTRIBUTE_HEADER_LEN - connection->parser_attribute_header_pos);
231                 memcpy(packet + bytes_stored, connection->parser_attribute_header + connection->parser_attribute_header_pos, num_header_bytes_to_store);
232                 connection->parser_attribute_header_pos += num_header_bytes_to_store;
233                 bytes_stored += num_header_bytes_to_store;
234                 num_free_bytes -= num_header_bytes_to_store;
235                 connection->data_offset += num_header_bytes_to_store;
236 
237                 if (num_free_bytes == 0){
238                     continue;
239                 }
240             }
241         }
242 
243         // store value
244         uint16_t num_bytes_to_copy;
245         uint8_t * attr_value_with_offset = avrcp_get_next_value_fragment_for_attribute_id(connection,
246                                                                                           connection->next_attr_id,
247                                                                                           &num_bytes_to_copy);
248 
249         uint16_t num_attr_value_bytes_to_store = btstack_min(num_free_bytes, connection->attribute_value_len - connection->attribute_value_offset);
250         memcpy(packet + bytes_stored, attr_value_with_offset, num_attr_value_bytes_to_store);
251 
252         bytes_stored   += num_attr_value_bytes_to_store;
253         num_free_bytes -= num_attr_value_bytes_to_store;
254         connection->attribute_value_offset += num_attr_value_bytes_to_store;
255         connection->data_offset += num_attr_value_bytes_to_store;
256 
257         if (connection->attribute_value_offset == connection->attribute_value_len){
258             // C++ compatible version of connection->next_attr_id++
259             connection->next_attr_id = (avrcp_media_attribute_id_t) (((int) connection->next_attr_id) + 1);
260             connection->attribute_value_offset = 0;
261             connection->attribute_value_len = 0;
262             connection->parser_attribute_header_pos = 0;
263         }
264     }
265     return bytes_stored;
266 }
267 
268 static void avrcp_send_response_with_avctp_fragmentation(avrcp_connection_t * connection){
269     l2cap_reserve_packet_buffer();
270     uint8_t * packet = l2cap_get_outgoing_buffer();
271 
272     // transport header
273     // Transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
274 
275     uint16_t max_payload_size;
276     connection->avctp_packet_type = avctp_get_packet_type(connection, &max_payload_size);
277     connection->packet_type = avrcp_get_packet_type(connection);
278 
279     // AVCTP header
280     // transport header : transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
281     uint16_t pos = 0;
282     packet[pos++] = (connection->transaction_id << 4) | (connection->avctp_packet_type << 2) | (AVRCP_RESPONSE_FRAME << 1) | 0;
283 
284     uint8_t param_len = connection->data_len;
285 
286     if (connection->avctp_packet_type == AVCTP_START_PACKET){
287         uint8_t max_frame_size = btstack_min(l2cap_get_remote_mtu_for_local_cid(connection->l2cap_signaling_cid), AVRCP_MAX_AV_C_MESSAGE_FRAME_SIZE);
288         // first packet: max_payload_size
289         // rest packets
290         uint16_t num_payload_bytes = param_len - max_payload_size;
291         uint16_t frame_size_for_continue_packet = max_frame_size - avctp_get_num_bytes_for_header(AVCTP_CONTINUE_PACKET);
292         uint16_t num_avctp_packets = (num_payload_bytes + frame_size_for_continue_packet - 1)/frame_size_for_continue_packet + 1;
293         packet[pos++] = num_avctp_packets;
294     }
295 
296     uint16_t bytes_stored = 0;
297     uint8_t i;
298 
299     switch (connection->avctp_packet_type) {
300         case AVCTP_SINGLE_PACKET:
301         case AVCTP_START_PACKET:
302             // Profile IDentifier (PID)
303             packet[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL >> 8;
304             packet[pos++] = BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL & 0x00FF;
305 
306             // AVRCP message
307             // command_type
308             packet[pos++] = connection->command_type;
309             // subunit_type | subunit ID
310             packet[pos++] = (connection->subunit_type << 3) | connection->subunit_id;
311             // opcode
312             packet[pos++] = (uint8_t) connection->command_opcode;
313 
314             switch (connection->command_opcode) {
315                 case AVRCP_CMD_OPCODE_VENDOR_DEPENDENT:
316                     big_endian_store_24(packet, pos, connection->company_id);
317                     pos += 3;
318                     packet[pos++] = connection->pdu_id;
319                     // AVRCP packet type
320 
321                     packet[pos++] = (uint8_t)connection->packet_type;
322                     // parameter length
323                     big_endian_store_16(packet, pos, param_len);
324                     pos += 2;
325 
326                     switch (connection->pdu_id) {
327                         // message is small enough to fit the single packet, no need for extra check
328                         case AVRCP_PDU_ID_GET_CAPABILITIES:
329                             packet[pos++] = connection->data[0];
330                             connection->data_offset++;
331 
332                             packet[pos++] = connection->data[1];
333                             connection->data_offset++;
334 
335                             switch ((avrcp_capability_id_t) connection->data[0]) {
336                                 case AVRCP_CAPABILITY_ID_EVENT:
337                                     for (i = (uint8_t) AVRCP_NOTIFICATION_EVENT_FIRST_INDEX;
338                                          i < (uint8_t) AVRCP_NOTIFICATION_EVENT_LAST_INDEX; i++) {
339                                         if ((connection->target_supported_notifications & (1 << i)) == 0) {
340                                             continue;
341                                         }
342                                         packet[pos++] = i;
343                                         connection->data_offset++;
344                                     }
345                                     break;
346                                 case AVRCP_CAPABILITY_ID_COMPANY:
347                                     // use Bluetooth SIG as default company
348                                     if (connection->target_supported_companies_num == 0) {
349                                         little_endian_store_24(packet, pos, default_companies[0]);
350                                         pos += 3;
351                                         connection->data_offset += 3;
352                                     } else {
353                                         for (i = 0; i < connection->data[1]; i++) {
354                                             little_endian_store_24(packet, pos,
355                                                                    connection->target_supported_companies[i]);
356                                             pos += 3;
357                                             connection->data_offset += 3;
358                                         }
359                                     }
360                                     break;
361                                 default:
362                                     btstack_assert(false);
363                                     return;
364                             }
365                             l2cap_send_prepared(connection->l2cap_signaling_cid, pos);
366                             return;
367 
368                         case AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES:
369                             packet[pos++] = connection->num_attributes;
370                             bytes_stored = avrcp_store_avctp_now_playing_info_fragment(connection, max_payload_size, packet + pos);
371 
372                             connection->avrcp_frame_bytes_sent += bytes_stored + pos;
373                             l2cap_send_prepared(connection->l2cap_signaling_cid, bytes_stored);
374                             return;
375 
376                         default:
377                             break;
378                     }
379                     break;
380 
381                 case AVRCP_CMD_OPCODE_PASS_THROUGH:
382                     packet[pos++] = connection->operation_id;
383                     // parameter length
384                     packet[pos++] = (uint8_t) connection->data_len;
385                     pos += 2;
386                     break;
387                 case AVRCP_CMD_OPCODE_UNIT_INFO:
388                     break;
389                 case AVRCP_CMD_OPCODE_SUBUNIT_INFO:
390                     break;
391                 default:
392                     btstack_assert(false);
393                     return;
394             }
395             break;
396         case AVCTP_CONTINUE_PACKET:
397         case AVCTP_END_PACKET:
398             switch (connection->pdu_id) {
399                 case AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES:
400                     bytes_stored = avrcp_store_avctp_now_playing_info_fragment(connection, max_payload_size, packet + pos);
401 
402                     connection->avrcp_frame_bytes_sent += bytes_stored + pos;
403                     l2cap_send_prepared(connection->l2cap_signaling_cid, bytes_stored);
404                     return;
405 
406                 default:
407                     break;
408             }
409             break;
410         default:
411             btstack_assert(false);
412             return;
413     }
414 
415     // compare number of bytes to store with the remaining buffer size
416     uint16_t bytes_to_copy = btstack_min(connection->data_len - connection->data_offset, max_payload_size - pos);
417 
418     (void)memcpy(packet + pos, &connection->data[connection->data_offset], bytes_to_copy);
419     pos += bytes_to_copy;
420     connection->data_offset += bytes_to_copy;
421     connection->avrcp_frame_bytes_sent += pos;
422 
423     l2cap_send_prepared(connection->l2cap_signaling_cid, pos);
424 }
425 
426 static void avrcp_send_reject_cmd_wrong_pid(avrcp_connection_t * connection){
427     l2cap_reserve_packet_buffer();
428     uint8_t * packet = l2cap_get_outgoing_buffer();
429 
430     // AVCTP header
431     // transport header : transaction label | Packet_type | C/R | IPID (1 == invalid profile identifier)
432     packet[0] = (connection->transaction_id << 4) | (AVRCP_SINGLE_PACKET << 2) | (AVRCP_RESPONSE_FRAME << 1) | 0;
433     big_endian_store_16(packet, 1, connection->invalid_pid);
434     l2cap_send_prepared(connection->l2cap_signaling_cid, 3);
435 }
436 
437 static void avrcp_target_custome_command_data_init(avrcp_connection_t * connection,
438     avrcp_command_opcode_t opcode, avrcp_command_type_t command_type,
439     avrcp_subunit_type_t subunit_type, avrcp_subunit_id_t subunit_id,
440     avrcp_pdu_id_t pdu_id, uint32_t company_id){
441 
442     connection->command_opcode = opcode;
443     connection->command_type = command_type;
444     connection->subunit_type = subunit_type;
445     connection->subunit_id = subunit_id;
446     connection->company_id = company_id << 16;
447     connection->pdu_id = pdu_id;
448     connection->data = NULL;
449     connection->data_offset = 0;
450     connection->data_len = 0;
451 }
452 
453 static void avrcp_target_vendor_dependent_response_data_init(avrcp_connection_t * connection, avrcp_command_type_t command_type, avrcp_pdu_id_t pdu_id){
454     connection->command_opcode = AVRCP_CMD_OPCODE_VENDOR_DEPENDENT;
455     connection->subunit_type   = AVRCP_SUBUNIT_TYPE_PANEL;
456     connection->subunit_id     = AVRCP_SUBUNIT_ID;
457     connection->company_id     = BT_SIG_COMPANY_ID;
458 
459     connection->command_type = command_type;
460     connection->pdu_id = pdu_id;
461     connection->data = connection->cmd_operands;
462     connection->data_offset = 0;
463     connection->avrcp_frame_bytes_sent = 0;
464     connection->state = AVCTP_W2_SEND_AVCTP_FRAGMENTED_MESSAGE;
465 }
466 
467 static void avrcp_target_pass_through_command_data_init(avrcp_connection_t * connection, avrcp_command_type_t command_type, avrcp_operation_id_t opid){
468     connection->command_opcode = AVRCP_CMD_OPCODE_PASS_THROUGH;
469     connection->subunit_type   = AVRCP_SUBUNIT_TYPE_PANEL;
470     connection->subunit_id     = AVRCP_SUBUNIT_ID;
471 
472     connection->command_type = command_type;
473     connection->company_id = 0;
474     connection->pdu_id = 0;
475     connection->operation_id = opid;
476 
477     connection->data = connection->cmd_operands;
478     connection->data_offset = 0;
479     connection->data_len = 0;
480 }
481 
482 
483 static uint8_t avrcp_target_vendor_dependent_response_accept(avrcp_connection_t * connection, avrcp_pdu_id_t pdu_id, uint8_t status){
484     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_ACCEPTED, pdu_id);
485     connection->data_len = 1;
486     connection->data[0] = status;
487 
488     connection->accept_response = 1;
489     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
490     return ERROR_CODE_SUCCESS;
491 }
492 
493 static uint8_t avrcp_target_response_vendor_dependent_reject(avrcp_connection_t * connection, avrcp_pdu_id_t pdu_id, avrcp_status_code_t status){
494     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_REJECTED, pdu_id);
495     connection->data_len = 1;
496     connection->data[0] = status;
497 
498     connection->state = AVCTP_W2_SEND_RESPONSE;
499     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
500     return ERROR_CODE_SUCCESS;
501 }
502 
503 static uint8_t avrcp_target_response_vendor_dependent_not_implemented(avrcp_connection_t * connection, avrcp_pdu_id_t pdu_id, uint8_t event_id){
504     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_NOT_IMPLEMENTED, pdu_id);
505     connection->data_len = 1;
506     connection->data[0] = event_id;
507 
508     connection->state = AVCTP_W2_SEND_RESPONSE;
509     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
510     return ERROR_CODE_SUCCESS;
511 }
512 
513 static uint8_t avrcp_target_response_vendor_dependent_interim(avrcp_connection_t * connection, avrcp_pdu_id_t pdu_id, uint8_t event_id, const uint8_t * value, uint16_t value_len){
514     btstack_assert(value_len + 1 < AVRCP_MAX_COMMAND_PARAMETER_LENGTH);
515 
516     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_INTERIM, pdu_id);
517     connection->data_len = 1 + value_len;
518     connection->data[0] = event_id;
519 
520     if (value && (value_len > 0)){
521         (void)memcpy(connection->data + 1, value, value_len);
522     }
523 
524     connection->state = AVCTP_W2_SEND_RESPONSE;
525     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
526     return ERROR_CODE_SUCCESS;
527 }
528 
529 static uint8_t avrcp_target_response_addressed_player_changed_interim(avrcp_connection_t * connection, avrcp_pdu_id_t pdu_id, uint8_t event_id){
530     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_INTERIM, pdu_id);
531 
532     connection->data_len = 5;
533     connection->data[0] = event_id;
534     big_endian_store_16(connection->data, 1, connection->addressed_player_id);
535     big_endian_store_16(connection->data, 3, connection->uid_counter);
536 
537     connection->state = AVCTP_W2_SEND_RESPONSE;
538     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
539     return ERROR_CODE_SUCCESS;
540 }
541 
542 static uint8_t avrcp_target_pass_through_response(uint16_t avrcp_cid, avrcp_command_type_t ctype, avrcp_operation_id_t opid, uint8_t operands_length, uint8_t operand){
543     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
544     if (!connection){
545         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
546     }
547     avrcp_target_pass_through_command_data_init(connection, ctype, opid);
548 
549     if (operands_length == 1){
550         connection->data_len = 1;
551         connection->cmd_operands[0] = operand;
552     }
553 
554     connection->state = AVCTP_W2_SEND_RESPONSE;
555     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
556     return ERROR_CODE_SUCCESS;
557 }
558 
559 uint8_t avrcp_target_operation_rejected(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint8_t operands_length, uint8_t operand){
560     return avrcp_target_pass_through_response(avrcp_cid, AVRCP_CTYPE_RESPONSE_REJECTED, opid, operands_length, operand);
561 }
562 
563 uint8_t avrcp_target_operation_accepted(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint8_t operands_length, uint8_t operand){
564     return avrcp_target_pass_through_response(avrcp_cid, AVRCP_CTYPE_RESPONSE_ACCEPTED, opid, operands_length, operand);
565 }
566 
567 uint8_t avrcp_target_operation_not_implemented(uint16_t avrcp_cid, avrcp_operation_id_t opid, uint8_t operands_length, uint8_t operand){
568     return avrcp_target_pass_through_response(avrcp_cid, AVRCP_CTYPE_RESPONSE_ACCEPTED, opid, operands_length, operand);
569 }
570 
571 uint8_t avrcp_target_set_unit_info(uint16_t avrcp_cid, avrcp_subunit_type_t unit_type, uint32_t company_id){
572     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
573     if (!connection){
574         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
575     }
576     connection->unit_type = unit_type;
577     connection->company_id = company_id;
578     return ERROR_CODE_SUCCESS;
579 }
580 
581 uint8_t avrcp_target_set_subunit_info(uint16_t avrcp_cid, avrcp_subunit_type_t subunit_type, const uint8_t * subunit_info_data, uint16_t subunit_info_data_size){
582     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
583     if (!connection){
584         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
585     }
586     connection->subunit_info_type = subunit_type;
587     connection->subunit_info_data = subunit_info_data;
588     connection->subunit_info_data_size = subunit_info_data_size;
589     return ERROR_CODE_SUCCESS;
590 }
591 
592 // TODO Review
593 static uint8_t avrcp_target_unit_info(avrcp_connection_t * connection){
594     if (connection->state != AVCTP_CONNECTION_OPENED){
595         return ERROR_CODE_COMMAND_DISALLOWED;
596     }
597     connection->state = AVCTP_W2_SEND_RESPONSE;
598 
599     avrcp_target_custome_command_data_init(connection,
600         AVRCP_CMD_OPCODE_UNIT_INFO, AVRCP_CTYPE_RESPONSE_IMPLEMENTED_STABLE,
601         AVRCP_SUBUNIT_TYPE_UNIT, AVRCP_SUBUNIT_ID_IGNORE, 0, connection->company_id);
602 
603     uint8_t unit = 0;
604     connection->data_len = 5;
605     connection->data[0] = 0x07;
606     connection->data[1] = (connection->unit_type << 4) | unit;
607     // company id is 3 bytes long
608     big_endian_store_24(connection->data, 2, connection->company_id);
609 
610     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
611     return ERROR_CODE_SUCCESS;
612 }
613 
614 // TODO Review
615 static uint8_t avrcp_target_subunit_info(avrcp_connection_t * connection, uint8_t offset){
616     if (connection->state != AVCTP_CONNECTION_OPENED) return ERROR_CODE_COMMAND_DISALLOWED;
617     if (offset >= 32) return AVRCP_STATUS_INVALID_PARAMETER;
618 
619     connection->state = AVCTP_W2_SEND_RESPONSE;
620 
621     avrcp_target_custome_command_data_init(connection, AVRCP_CMD_OPCODE_SUBUNIT_INFO, AVRCP_CTYPE_RESPONSE_IMPLEMENTED_STABLE,
622         AVRCP_SUBUNIT_TYPE_UNIT, AVRCP_SUBUNIT_ID_IGNORE, 0, connection->company_id);
623 
624     uint8_t page = offset / 4;
625     uint8_t extension_code = 7;
626     connection->data_len = 5;
627     connection->data[0] = (page << 4) | extension_code;
628 
629     // mark non-existent entries with 0xff
630     memset(&connection->cmd_operands[1], 0xFF, 4);
631     if ((connection->data != NULL) && (offset < connection->subunit_info_data_size)){
632         uint8_t bytes_to_copy = btstack_min(connection->subunit_info_data_size - offset, 4);
633         memcpy(&connection->data[1], &connection->subunit_info_data[offset], bytes_to_copy);
634     }
635 
636     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
637     return ERROR_CODE_SUCCESS;
638 }
639 
640 static uint8_t avrcp_target_response_vendor_dependent_supported_events(avrcp_connection_t * connection){
641     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_IMPLEMENTED_STABLE, AVRCP_PDU_ID_GET_CAPABILITIES);
642     connection->state = AVCTP_W2_SEND_RESPONSE;
643 
644     uint8_t event_id;
645     uint8_t num_events = 0;
646     for (event_id = (uint8_t) AVRCP_NOTIFICATION_EVENT_FIRST_INDEX; event_id < (uint8_t) AVRCP_NOTIFICATION_EVENT_LAST_INDEX; event_id++){
647         if ((connection->target_supported_notifications & (1<<event_id)) == 0){
648             continue;
649         }
650         num_events++;
651     }
652 
653     connection->data[0] = AVRCP_CAPABILITY_ID_EVENT;
654     connection->data[1] = num_events;
655     connection->data_len = 2 + num_events;
656 
657     // fill the data later directly to the L2CAP outgoing buffer
658     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
659     return ERROR_CODE_SUCCESS;
660 }
661 
662 static uint8_t avrcp_target_response_vendor_dependent_supported_companies(avrcp_connection_t * connection){
663     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_IMPLEMENTED_STABLE, AVRCP_PDU_ID_GET_CAPABILITIES);
664     connection->state = AVCTP_W2_SEND_RESPONSE;
665 
666     connection->data[0] = AVRCP_CAPABILITY_ID_COMPANY;
667     connection->data[1] = connection->target_supported_companies_num;
668     connection->data_len = 2 + connection->target_supported_companies_num * 3;
669 
670     // fill the data later directly to the L2CAP outgoing buffer and
671     // use Bluetooth SIG as default company
672     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
673     return ERROR_CODE_SUCCESS;
674 }
675 
676 uint8_t avrcp_target_support_event(uint16_t avrcp_cid, avrcp_notification_event_id_t event_id){
677     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
678     if (!connection){
679         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
680     }
681 
682     if ((event_id < (uint8_t)AVRCP_NOTIFICATION_EVENT_FIRST_INDEX) || (event_id > (uint8_t)AVRCP_NOTIFICATION_EVENT_LAST_INDEX)){
683         return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
684     }
685 
686     connection->target_supported_notifications |= (1 << (uint8_t)event_id);
687     return ERROR_CODE_SUCCESS;
688 }
689 
690 uint8_t avrcp_target_support_companies(uint16_t avrcp_cid, uint8_t num_companies, const uint32_t *companies){
691     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
692     if (!connection){
693         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
694     }
695 
696     connection->target_supported_companies_num = num_companies;
697     connection->target_supported_companies     = companies;
698     return ERROR_CODE_SUCCESS;
699 }
700 
701 // TODO Review (use flags)
702 uint8_t avrcp_target_play_status(uint16_t avrcp_cid, uint32_t song_length_ms, uint32_t song_position_ms, avrcp_playback_status_t play_status){
703     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
704     if (!connection){
705         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
706     }
707     if (connection->state != AVCTP_CONNECTION_OPENED){
708         return ERROR_CODE_COMMAND_DISALLOWED;
709     }
710 
711     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_IMPLEMENTED_STABLE, AVRCP_PDU_ID_GET_PLAY_STATUS);
712     connection->data_len = 9;
713     big_endian_store_32(connection->data, 0, song_length_ms);
714     big_endian_store_32(connection->data, 4, song_position_ms);
715     connection->data[8] = play_status;
716 
717     connection->state = AVCTP_W2_SEND_RESPONSE;
718     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
719     return ERROR_CODE_SUCCESS;
720 }
721 
722 static uint8_t avrcp_target_store_media_attr(avrcp_connection_t * connection, avrcp_media_attribute_id_t attr_id, const char * value){
723     int index = attr_id - 1;
724     if (!value) return AVRCP_STATUS_INVALID_PARAMETER;
725     connection->now_playing_info[index].value = (uint8_t*)value;
726     connection->now_playing_info[index].len   = strlen(value);
727     return ERROR_CODE_SUCCESS;
728 }
729 
730 uint8_t avrcp_target_set_playback_status(uint16_t avrcp_cid, avrcp_playback_status_t playback_status){
731     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
732     if (!connection){
733         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
734     }
735     if (connection->playback_status == playback_status){
736         return ERROR_CODE_SUCCESS;
737     }
738 
739     connection->playback_status = playback_status;
740     if (connection->notifications_enabled & (1 << AVRCP_NOTIFICATION_EVENT_PLAYBACK_STATUS_CHANGED)) {
741         connection->playback_status_changed = 1;
742         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
743     }
744     return ERROR_CODE_SUCCESS;
745 }
746 
747 uint8_t avrcp_target_set_now_playing_info(uint16_t avrcp_cid, const avrcp_track_t * current_track, uint16_t total_tracks){
748     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
749     if (!connection){
750         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
751     }
752     if (!current_track){
753         connection->track_selected = 0;
754         connection->playback_status = AVRCP_PLAYBACK_STATUS_ERROR;
755         return ERROR_CODE_COMMAND_DISALLOWED;
756     }
757 
758     (void)memcpy(connection->track_id, current_track->track_id, 8);
759     connection->song_length_ms = current_track->song_length_ms;
760     connection->track_nr = current_track->track_nr;
761     connection->total_tracks = total_tracks;
762     avrcp_target_store_media_attr(connection, AVRCP_MEDIA_ATTR_TITLE, current_track->title);
763     avrcp_target_store_media_attr(connection, AVRCP_MEDIA_ATTR_ARTIST, current_track->artist);
764     avrcp_target_store_media_attr(connection, AVRCP_MEDIA_ATTR_ALBUM, current_track->album);
765     avrcp_target_store_media_attr(connection, AVRCP_MEDIA_ATTR_GENRE, current_track->genre);
766 
767     connection->track_selected = 1;
768 
769     if (connection->notifications_enabled & (1 << AVRCP_NOTIFICATION_EVENT_TRACK_CHANGED)) {
770         connection->track_changed = 1;
771         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
772     }
773     return ERROR_CODE_SUCCESS;
774 }
775 
776 uint8_t avrcp_target_track_changed(uint16_t avrcp_cid, uint8_t * track_id){
777     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
778     if (!connection){
779         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
780     }
781     if (!track_id){
782         return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
783     }
784 
785     (void)memcpy(connection->track_id, track_id, 8);
786     if (connection->notifications_enabled & (1 << AVRCP_NOTIFICATION_EVENT_TRACK_CHANGED)) {
787         connection->track_changed = 1;
788         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
789     }
790     return ERROR_CODE_SUCCESS;
791 }
792 
793 uint8_t avrcp_target_playing_content_changed(uint16_t avrcp_cid){
794     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
795     if (!connection){
796         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
797     }
798     if (connection->notifications_enabled & (1 << AVRCP_NOTIFICATION_EVENT_NOW_PLAYING_CONTENT_CHANGED)) {
799         connection->playing_content_changed = 1;
800         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
801     }
802     return ERROR_CODE_SUCCESS;
803 }
804 
805 uint8_t avrcp_target_addressed_player_changed(uint16_t avrcp_cid, uint16_t player_id, uint16_t uid_counter){
806     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
807     if (!connection){
808         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
809     }
810 
811     if (connection->addressed_player_id == player_id){
812         return ERROR_CODE_SUCCESS;
813     }
814 
815     connection->uid_counter = uid_counter;
816     connection->addressed_player_id = player_id;
817 
818     if (connection->notifications_enabled & (1 << AVRCP_NOTIFICATION_EVENT_ADDRESSED_PLAYER_CHANGED)) {
819         connection->addressed_player_changed = 1;
820         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
821     }
822     return ERROR_CODE_SUCCESS;
823 }
824 
825 uint8_t avrcp_target_battery_status_changed(uint16_t avrcp_cid, avrcp_battery_status_t battery_status){
826     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
827     if (!connection){
828         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
829     }
830     if (connection->battery_status == battery_status){
831         return ERROR_CODE_SUCCESS;
832     }
833 
834     connection->battery_status = battery_status;
835 
836     if (connection->notifications_enabled & (1 << AVRCP_NOTIFICATION_EVENT_BATT_STATUS_CHANGED)) {
837         connection->battery_status_changed = 1;
838         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
839     }
840     return ERROR_CODE_SUCCESS;
841 }
842 
843 uint8_t avrcp_target_adjust_absolute_volume(uint16_t avrcp_cid, uint8_t absolute_volume){
844     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
845     if (!connection){
846         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
847     }
848 
849     connection->absolute_volume = absolute_volume;
850     return ERROR_CODE_SUCCESS;
851 }
852 
853 uint8_t avrcp_target_volume_changed(uint16_t avrcp_cid, uint8_t absolute_volume){
854     avrcp_connection_t * connection = avrcp_get_connection_for_avrcp_cid_for_role(AVRCP_TARGET, avrcp_cid);
855     if (!connection){
856         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
857     }
858     if (connection->absolute_volume == absolute_volume){
859         return ERROR_CODE_SUCCESS;
860     }
861 
862     connection->absolute_volume = absolute_volume;
863 
864     if (connection->notifications_enabled & (1 << AVRCP_NOTIFICATION_EVENT_VOLUME_CHANGED )) {
865         connection->notify_absolute_volume_changed = 1;
866         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
867     }
868     return ERROR_CODE_SUCCESS;
869 }
870 
871 static void avrcp_target_set_transaction_label_for_notification(avrcp_connection_t * connection, avrcp_notification_event_id_t notification, uint8_t transaction_label){
872     if (notification > AVRCP_NOTIFICATION_EVENT_MAX_VALUE) return;
873     connection->notifications_transaction_label[notification] = transaction_label;
874 }
875 
876 static uint8_t avrcp_target_get_transaction_label_for_notification(avrcp_connection_t * connection, avrcp_notification_event_id_t notification){
877     if (notification > AVRCP_NOTIFICATION_EVENT_MAX_VALUE) return 0;
878     return connection->notifications_transaction_label[notification];
879 }
880 
881 static bool avcrp_operation_id_is_valid(avrcp_operation_id_t operation_id){
882     if (operation_id < AVRCP_OPERATION_ID_RESERVED_1) return true;
883 
884     if (operation_id < AVRCP_OPERATION_ID_0) return false;
885     if (operation_id < AVRCP_OPERATION_ID_RESERVED_2) return true;
886 
887     if (operation_id < AVRCP_OPERATION_ID_CHANNEL_UP) return false;
888     if (operation_id < AVRCP_OPERATION_ID_RESERVED_3) return true;
889 
890     if (operation_id < AVRCP_OPERATION_ID_CHANNEL_UP) return false;
891     if (operation_id < AVRCP_OPERATION_ID_RESERVED_3) return true;
892 
893     if (operation_id < AVRCP_OPERATION_ID_SKIP) return false;
894     if (operation_id == AVRCP_OPERATION_ID_SKIP) return true;
895 
896     if (operation_id < AVRCP_OPERATION_ID_POWER) return false;
897     if (operation_id < AVRCP_OPERATION_ID_RESERVED_4) return true;
898 
899     if (operation_id < AVRCP_OPERATION_ID_ANGLE) return false;
900     if (operation_id < AVRCP_OPERATION_ID_RESERVED_5) return true;
901 
902     if (operation_id < AVRCP_OPERATION_ID_F1) return false;
903     if (operation_id < AVRCP_OPERATION_ID_RESERVED_6) return true;
904 
905     return false;
906 }
907 
908 
909 #ifdef ENABLE_AVCTP_FRAGMENTATION
910 static void avctp_reassemble_message(avrcp_connection_t * connection, avctp_packet_type_t packet_type, uint8_t *packet, uint16_t size){
911     // after header (transaction label and packet type)
912     uint16_t pos;
913     uint16_t bytes_to_store;
914 
915     switch (packet_type){
916         case AVCTP_START_PACKET:
917             if (size < 2) return;
918 
919             // store header
920             pos = 0;
921             connection->avctp_reassembly_buffer[pos] = packet[pos];
922             pos++;
923             connection->avctp_reassembly_size = pos;
924 
925             // NOTE: num packets not needed for reassembly, ignoring it does not pose security risk -> no need to store it
926             pos++;
927 
928             // PID in reassembled packet is at offset 1, it will be read later after the avctp_reassemble_message with AVCTP_END_PACKET is called
929 
930             bytes_to_store = btstack_min(size - pos, sizeof(connection->avctp_reassembly_buffer) - connection->avctp_reassembly_size);
931             memcpy(&connection->avctp_reassembly_buffer[connection->avctp_reassembly_size], &packet[pos], bytes_to_store);
932             connection->avctp_reassembly_size += bytes_to_store;
933             break;
934 
935         case AVCTP_CONTINUE_PACKET:
936         case AVCTP_END_PACKET:
937             if (size < 1) return;
938 
939             // store remaining data, ignore header
940             pos = 1;
941             bytes_to_store = btstack_min(size - pos, sizeof(connection->avctp_reassembly_buffer) - connection->avctp_reassembly_size);
942             memcpy(&connection->avctp_reassembly_buffer[connection->avctp_reassembly_size], &packet[pos], bytes_to_store);
943             connection->avctp_reassembly_size += bytes_to_store;
944             break;
945 
946         default:
947             return;
948     }
949 }
950 #endif
951 
952 static void avrcp_handle_l2cap_data_packet_for_signaling_connection(avrcp_connection_t * connection, uint8_t * packet, uint16_t size){
953     uint8_t avctp_header = packet[0];
954     connection->transaction_id = avctp_header >> 4;
955 
956     avctp_packet_type_t avctp_packet_type = (avctp_packet_type_t) ((avctp_header & 0x0F) >> 2);
957     switch (avctp_packet_type){
958         case AVCTP_SINGLE_PACKET:
959             break;
960 
961 #ifdef ENABLE_AVCTP_FRAGMENTATION
962         case AVCTP_START_PACKET:
963         case AVCTP_CONTINUE_PACKET:
964             avctp_reassemble_message(connection, avctp_packet_type, packet, size);
965             return;
966 
967         case AVCTP_END_PACKET:
968             avctp_reassemble_message(connection, avctp_packet_type, packet, size);
969 
970             packet = connection->avctp_reassembly_buffer;
971             size   = connection->avctp_reassembly_size;
972             break;
973 #endif
974         default:
975             return;
976     }
977 
978     if (size < 6u) return;
979 
980     uint16_t pid = big_endian_read_16(packet, 1);
981 
982     if (pid != BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL){
983         log_info("Invalid pid 0x%02x, expected 0x%02x", connection->invalid_pid, BLUETOOTH_SERVICE_CLASS_AV_REMOTE_CONTROL);
984         connection->reject_transport_header = 1;
985         connection->invalid_pid = pid;
986         connection->transport_header = (connection->transaction_id << 4) | (AVRCP_SINGLE_PACKET << 2 ) | (AVRCP_RESPONSE_FRAME << 1) | 1;
987         avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
988         return;
989     }
990 
991     // avrcp_subunit_type_t subunit_type = (avrcp_subunit_type_t) (packet[4] >> 3);
992     // avrcp_subunit_id_t   subunit_id   = (avrcp_subunit_id_t) (packet[4] & 0x07);
993 
994     avrcp_command_opcode_t opcode = (avrcp_command_opcode_t) avrcp_cmd_opcode(packet,size);
995 
996     int pos = 6;
997     uint16_t length;
998     avrcp_pdu_id_t   pdu_id;
999     // connection->data_len = 0;
1000     uint8_t offset;
1001     uint8_t operand;
1002     uint16_t event_mask;
1003     avrcp_operation_id_t operation_id;
1004 
1005     switch (opcode){
1006         case AVRCP_CMD_OPCODE_UNIT_INFO:
1007             avrcp_target_unit_info(connection);
1008             break;
1009         case AVRCP_CMD_OPCODE_SUBUNIT_INFO:
1010             if ((size - pos) < 3) return;
1011             // page: packet[pos] >> 4,
1012             offset =  4 * (packet[pos]>>4);
1013             // extension code (fixed 7) = packet[pos] & 0x0F
1014             // 4 bytes paga data, all 0xFF
1015             avrcp_target_subunit_info(connection, offset);
1016             break;
1017 
1018         case AVRCP_CMD_OPCODE_PASS_THROUGH:
1019             if (size < 8) return;
1020             log_info("AVRCP_OPERATION_ID 0x%02x, operands length %d", packet[6], packet[7]);
1021             operation_id = (avrcp_operation_id_t) (packet[6] & 0x7f);
1022             operand = 0;
1023             if ((packet[7] >= 1) && (size >= 9)){
1024                 operand = packet[8];
1025             }
1026 
1027             if (avcrp_operation_id_is_valid(operation_id)){
1028                 bool button_pressed = (packet[6] & 0x80) == 0;
1029 
1030                 avrcp_target_operation_accepted(connection->avrcp_cid, (avrcp_operation_id_t) packet[6], packet[7], operand);
1031                 avrcp_target_emit_operation(avrcp_target_context.avrcp_callback, connection->avrcp_cid,
1032                                                 operation_id, button_pressed, packet[7], operand);
1033             } else {
1034                 avrcp_target_operation_not_implemented(connection->avrcp_cid, (avrcp_operation_id_t) packet[6], packet[7], operand);
1035             }
1036             break;
1037 
1038 
1039         case AVRCP_CMD_OPCODE_VENDOR_DEPENDENT:
1040 
1041             if (size < 13) return;
1042 
1043             // pos = 6 - company id
1044             (void)memcpy(connection->cmd_operands, &packet[pos], 3);
1045             // connection->data_len = 3;
1046             pos += 3;
1047             // pos = 9
1048             pdu_id = (avrcp_pdu_id_t) packet[pos++];
1049             // 1 - reserved
1050             pos++;
1051             // 2-3 param length,
1052             length = big_endian_read_16(packet, pos);
1053             pos += 2;
1054             // pos = 13
1055             switch (pdu_id){
1056                 case AVRCP_PDU_ID_SET_ADDRESSED_PLAYER:{
1057                     if ((pos + 2) > size) return;
1058                     bool ok = length == 4;
1059                     if (avrcp_target_context.set_addressed_player_callback != NULL){
1060                         uint16_t player_id = big_endian_read_16(packet, pos);
1061                         ok = avrcp_target_context.set_addressed_player_callback(player_id);
1062                     }
1063                     if (ok){
1064                         avrcp_target_vendor_dependent_response_accept(connection, pdu_id, AVRCP_STATUS_SUCCESS);
1065                     } else {
1066                         avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_INVALID_PLAYER_ID);
1067                     }
1068                     break;
1069                 }
1070                 case AVRCP_PDU_ID_GET_CAPABILITIES:{
1071                     avrcp_capability_id_t capability_id = (avrcp_capability_id_t) packet[pos];
1072                     switch (capability_id){
1073                         case AVRCP_CAPABILITY_ID_EVENT:
1074                              avrcp_target_response_vendor_dependent_supported_events(connection);
1075                             break;
1076                         case AVRCP_CAPABILITY_ID_COMPANY:
1077                             avrcp_target_response_vendor_dependent_supported_companies(connection);
1078                             break;
1079                         default:
1080                             avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_INVALID_PARAMETER);
1081                             break;
1082                     }
1083                     break;
1084                 }
1085                 case AVRCP_PDU_ID_GET_PLAY_STATUS:
1086                     avrcp_target_emit_respond_vendor_dependent_query(avrcp_target_context.avrcp_callback, connection->avrcp_cid, AVRCP_SUBEVENT_PLAY_STATUS_QUERY);
1087                     break;
1088                 case AVRCP_PDU_ID_REQUEST_ABORT_CONTINUING_RESPONSE:
1089                     if ((pos + 1) > size) return;
1090                     connection->cmd_operands[0] = packet[pos];
1091                     connection->abort_continue_response = 1;
1092                     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1093                     break;
1094                 case AVRCP_PDU_ID_REQUEST_CONTINUING_RESPONSE:
1095                     if ((pos + 1) > size) return;
1096                     if (packet[pos] != AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES){
1097                         avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_INVALID_COMMAND);
1098                         return;
1099                     }
1100                     connection->now_playing_info_response = true;
1101                     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1102                     break;
1103                 case AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES:{
1104                     if ((pos + 9) > size) return;
1105                     uint8_t play_identifier[8];
1106                     memset(play_identifier, 0, 8);
1107                     if (memcmp(&packet[pos], play_identifier, 8) != 0) {
1108                         avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_INVALID_PARAMETER);
1109                         return;
1110                     }
1111                     pos += 8;
1112                     uint8_t attribute_count = packet[pos++];
1113                     connection->next_attr_id = AVRCP_MEDIA_ATTR_NONE;
1114                     if (!attribute_count){
1115                         connection->next_attr_id = AVRCP_MEDIA_ATTR_TITLE;
1116                         connection->now_playing_info_attr_bitmap = 0xFE;
1117                     } else {
1118                         int i;
1119                         connection->next_attr_id = AVRCP_MEDIA_ATTR_TITLE;
1120                         connection->now_playing_info_attr_bitmap = 0;
1121                         connection->num_attributes = 0;
1122                         if ((pos + attribute_count * 4) > size) return;
1123                         for (i=0; i < attribute_count; i++){
1124                             uint32_t attr_id = big_endian_read_32(packet, pos);
1125                             connection->now_playing_info_attr_bitmap |= (1 << attr_id);
1126                             pos += 4;
1127                         }
1128                     }
1129                     log_info("now_playing_info_attr_bitmap 0x%02x", connection->now_playing_info_attr_bitmap);
1130                     connection->num_attributes = count_set_bits_uint32(connection->now_playing_info_attr_bitmap);
1131                     connection->now_playing_info_response = true;
1132                     avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1133                     break;
1134                 }
1135                 case AVRCP_PDU_ID_REGISTER_NOTIFICATION:{
1136                     if ((pos + 1) > size) return;
1137                     avrcp_notification_event_id_t event_id = (avrcp_notification_event_id_t) packet[pos];
1138 
1139                     avrcp_target_set_transaction_label_for_notification(connection, event_id, connection->transaction_id);
1140 
1141                     if (event_id < AVRCP_NOTIFICATION_EVENT_PLAYBACK_STATUS_CHANGED ||
1142                         event_id > AVRCP_NOTIFICATION_EVENT_MAX_VALUE){
1143                         avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_INVALID_PARAMETER);
1144                         return;
1145                     }
1146 
1147                     switch (event_id){
1148                         case AVRCP_NOTIFICATION_EVENT_AVAILABLE_PLAYERS_CHANGED:
1149                         case AVRCP_NOTIFICATION_EVENT_PLAYER_APPLICATION_SETTING_CHANGED:
1150                         case AVRCP_NOTIFICATION_EVENT_UIDS_CHANGED:
1151                         case AVRCP_NOTIFICATION_EVENT_TRACK_REACHED_END:
1152                         case AVRCP_NOTIFICATION_EVENT_TRACK_REACHED_START:
1153                         case AVRCP_NOTIFICATION_EVENT_PLAYBACK_POS_CHANGED:
1154                         case AVRCP_NOTIFICATION_EVENT_SYSTEM_STATUS_CHANGED:
1155                         case AVRCP_NOTIFICATION_EVENT_MAX_VALUE:
1156                             avrcp_target_response_vendor_dependent_not_implemented(connection, pdu_id, event_id);
1157                             return;
1158                         default:
1159                             break;
1160                     }
1161 
1162                     event_mask = (1 << event_id);
1163                     connection->notifications_enabled |= event_mask;
1164 
1165                     switch (event_id){
1166                         case AVRCP_NOTIFICATION_EVENT_TRACK_CHANGED:
1167                             if (connection->track_selected){
1168                                 avrcp_target_response_vendor_dependent_interim(connection, pdu_id, event_id, AVRCP_NOTIFICATION_TRACK_SELECTED, 8);
1169                             } else {
1170                                 avrcp_target_response_vendor_dependent_interim(connection, pdu_id, event_id, AVRCP_NOTIFICATION_TRACK_NOT_SELECTED, 8);
1171                             }
1172                             break;
1173                         case AVRCP_NOTIFICATION_EVENT_PLAYBACK_STATUS_CHANGED:
1174                             avrcp_target_response_vendor_dependent_interim(connection, pdu_id, event_id, (const uint8_t *)&connection->playback_status, 1);
1175                             break;
1176                         case AVRCP_NOTIFICATION_EVENT_NOW_PLAYING_CONTENT_CHANGED:
1177                             avrcp_target_response_vendor_dependent_interim(connection, pdu_id, event_id, NULL, 0);
1178                             break;
1179                         case AVRCP_NOTIFICATION_EVENT_VOLUME_CHANGED:
1180                             avrcp_target_response_vendor_dependent_interim(connection, pdu_id, event_id, (const uint8_t *)&connection->absolute_volume, 1);
1181                             break;
1182                         case AVRCP_NOTIFICATION_EVENT_BATT_STATUS_CHANGED:
1183                             avrcp_target_response_vendor_dependent_interim(connection, pdu_id, event_id, (const uint8_t *)&connection->battery_status, 1);
1184                             break;
1185                         case AVRCP_NOTIFICATION_EVENT_ADDRESSED_PLAYER_CHANGED:
1186                             avrcp_target_response_addressed_player_changed_interim(connection, pdu_id, event_id);
1187                             return;
1188                         default:
1189                             btstack_assert(false);
1190                             return;
1191                     }
1192                     break;
1193                 }
1194                 case AVRCP_PDU_ID_SET_ABSOLUTE_VOLUME: {
1195                     if ( (length != 1) || ((pos + 1) > size)){
1196                         avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_INVALID_COMMAND);
1197                         break;
1198                     }
1199 
1200                     uint8_t absolute_volume = packet[pos];
1201                     if (absolute_volume < 0x80){
1202                         connection->absolute_volume = absolute_volume;
1203                     }
1204                     avrcp_target_emit_volume_changed(avrcp_target_context.avrcp_callback, connection->avrcp_cid, connection->absolute_volume);
1205                     avrcp_target_vendor_dependent_response_accept(connection, pdu_id, connection->absolute_volume);
1206                     break;
1207                 }
1208                 default:
1209                     log_info("AVRCP target: unhandled pdu id 0x%02x", pdu_id);
1210                     avrcp_target_response_vendor_dependent_reject(connection, pdu_id, AVRCP_STATUS_INVALID_COMMAND);
1211                     break;
1212             }
1213             break;
1214         default:
1215             log_info("AVRCP target: opcode 0x%02x not implemented", avrcp_cmd_opcode(packet,size));
1216             break;
1217     }
1218 }
1219 
1220 static void avrcp_target_notification_init(avrcp_connection_t * connection, avrcp_notification_event_id_t notification_id, uint8_t * value, uint16_t value_len){
1221     btstack_assert((value_len == 0) || (value != NULL));
1222 
1223     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_CHANGED_STABLE, AVRCP_PDU_ID_REGISTER_NOTIFICATION);
1224     connection->transaction_id = avrcp_target_get_transaction_label_for_notification(connection, notification_id);
1225 
1226     connection->data_len = 1 + value_len;
1227     connection->data[0] = notification_id;
1228     if (value_len > 0){
1229         (void)memcpy(connection->data + 1, value, value_len);
1230     }
1231 }
1232 
1233 static void avrcp_target_notification_addressed_player_changed_init(avrcp_connection_t * connection){
1234     avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_CHANGED_STABLE, AVRCP_PDU_ID_REGISTER_NOTIFICATION);
1235     connection->transaction_id = avrcp_target_get_transaction_label_for_notification(connection, AVRCP_NOTIFICATION_EVENT_ADDRESSED_PLAYER_CHANGED);
1236 
1237     connection->data_len = 5;
1238     connection->data[0] = AVRCP_NOTIFICATION_EVENT_ADDRESSED_PLAYER_CHANGED;
1239     big_endian_store_16(connection->data, 1, connection->addressed_player_id);
1240     big_endian_store_16(connection->data, 3, connection->uid_counter);
1241 }
1242 
1243 
1244 static void avrcp_target_reset_notification(avrcp_connection_t * connection, avrcp_notification_event_id_t notification_id){
1245     if (notification_id < AVRCP_NOTIFICATION_EVENT_FIRST_INDEX || notification_id > AVRCP_NOTIFICATION_EVENT_LAST_INDEX){
1246         return;
1247     }
1248     connection->notifications_enabled &= ~(1 << notification_id);
1249     connection->notifications_transaction_label[notification_id] = 0;
1250 }
1251 
1252 static void avrcp_request_next_avctp_segment(avrcp_connection_t * connection){
1253     // AVCTP
1254     switch (connection->avctp_packet_type){
1255         case AVCTP_END_PACKET:
1256         case AVRCP_SINGLE_PACKET:
1257             connection->avrcp_frame_bytes_sent = 0;
1258             connection->data_offset = 0;
1259             connection->data_len = 0;
1260             connection->state = AVCTP_CONNECTION_OPENED;
1261             break;
1262         default:
1263             connection->state = AVCTP_W2_SEND_AVCTP_FRAGMENTED_MESSAGE;
1264             avrcp_request_can_send_now(connection, connection->l2cap_signaling_cid);
1265             break;
1266     }
1267 }
1268 
1269 static void avrcp_target_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1270     avrcp_connection_t * connection;
1271 
1272     switch (packet_type) {
1273         case L2CAP_DATA_PACKET:
1274             connection = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_TARGET, channel);
1275             avrcp_handle_l2cap_data_packet_for_signaling_connection(connection, packet, size);
1276             break;
1277         case HCI_EVENT_PACKET:
1278             switch (hci_event_packet_get_type(packet)){
1279                 case L2CAP_EVENT_CAN_SEND_NOW:{
1280                     connection = avrcp_get_connection_for_l2cap_signaling_cid_for_role(AVRCP_TARGET, channel);
1281 
1282                     if (connection->accept_response){
1283                         connection->accept_response = 0;
1284                         avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_ACCEPTED, AVRCP_PDU_ID_REQUEST_CONTINUING_RESPONSE);
1285                         avrcp_send_response_with_avctp_fragmentation(connection);
1286                         avrcp_request_next_avctp_segment(connection);
1287                         return;
1288                     }
1289 
1290                     if (connection->abort_continue_response){
1291                         connection->abort_continue_response = 0;
1292                         connection->now_playing_info_response = false;
1293                         avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_ACCEPTED, AVRCP_PDU_ID_REQUEST_ABORT_CONTINUING_RESPONSE);
1294                         avrcp_send_response_with_avctp_fragmentation(connection);
1295                         avrcp_request_next_avctp_segment(connection);
1296                         return;
1297                     }
1298 
1299                     if (connection->now_playing_info_response){
1300                         connection->now_playing_info_response = false;
1301                         avrcp_target_vendor_dependent_response_data_init(connection, AVRCP_CTYPE_RESPONSE_ACCEPTED, AVRCP_PDU_ID_GET_ELEMENT_ATTRIBUTES);
1302                         connection->data_len = avrcp_now_playing_info_value_len_with_headers(connection);
1303 
1304                         avrcp_send_response_with_avctp_fragmentation(connection);
1305                         avrcp_request_next_avctp_segment(connection);
1306                         return;
1307                     }
1308 
1309                     if (connection->track_changed){
1310                         connection->track_changed = 0;
1311                         avrcp_target_notification_init(connection, AVRCP_NOTIFICATION_EVENT_TRACK_CHANGED, connection->track_id, 8);
1312                         avrcp_send_response_with_avctp_fragmentation(connection);
1313                         avrcp_target_reset_notification(connection, AVRCP_NOTIFICATION_EVENT_TRACK_CHANGED);
1314                         avrcp_request_next_avctp_segment(connection);
1315                         return;
1316                     }
1317 
1318                     if (connection->playback_status_changed){
1319                         connection->playback_status_changed = 0;
1320                         uint8_t playback_status = (uint8_t) connection->playback_status;
1321                         avrcp_target_notification_init(connection, AVRCP_NOTIFICATION_EVENT_PLAYBACK_STATUS_CHANGED, &playback_status, 1);
1322                         avrcp_send_response_with_avctp_fragmentation(connection);
1323                         avrcp_target_reset_notification(connection, AVRCP_NOTIFICATION_EVENT_PLAYBACK_STATUS_CHANGED);
1324                         avrcp_request_next_avctp_segment(connection);
1325                         return;
1326                     }
1327 
1328                     if (connection->playing_content_changed){
1329                         connection->playing_content_changed = 0;
1330                         // TODO review
1331                         avrcp_target_notification_init(connection, AVRCP_NOTIFICATION_EVENT_NOW_PLAYING_CONTENT_CHANGED, NULL,
1332                                                        avrcp_now_playing_info_value_len_with_headers(connection));
1333                         avrcp_send_response_with_avctp_fragmentation(connection);
1334                         avrcp_target_reset_notification(connection, AVRCP_NOTIFICATION_EVENT_NOW_PLAYING_CONTENT_CHANGED);
1335                         avrcp_request_next_avctp_segment(connection);
1336                         return;
1337                     }
1338 
1339                     if (connection->battery_status_changed){
1340                         connection->battery_status_changed = 0;
1341                         avrcp_target_notification_init(connection, AVRCP_NOTIFICATION_EVENT_BATT_STATUS_CHANGED, (uint8_t *)&connection->battery_status, 1);
1342                         avrcp_send_response_with_avctp_fragmentation(connection);
1343                         avrcp_target_reset_notification(connection, AVRCP_NOTIFICATION_EVENT_BATT_STATUS_CHANGED);
1344                         avrcp_request_next_avctp_segment(connection);
1345                         return;
1346                     }
1347 
1348                     if (connection->notify_absolute_volume_changed){
1349                         connection->notify_absolute_volume_changed = 0;
1350                         avrcp_target_notification_init(connection, AVRCP_NOTIFICATION_EVENT_VOLUME_CHANGED, &connection->absolute_volume, 1);
1351                         avrcp_send_response_with_avctp_fragmentation(connection);
1352                         avrcp_target_reset_notification(connection, AVRCP_NOTIFICATION_EVENT_VOLUME_CHANGED);
1353                         avrcp_request_next_avctp_segment(connection);
1354                         return;
1355                     }
1356 
1357                     if (connection->addressed_player_changed){
1358                         connection->addressed_player_changed = 0;
1359                         avrcp_target_notification_addressed_player_changed_init(connection);
1360                         avrcp_send_response_with_avctp_fragmentation(connection);
1361                         avrcp_target_reset_notification(connection, AVRCP_NOTIFICATION_EVENT_ADDRESSED_PLAYER_CHANGED);
1362                         avrcp_request_next_avctp_segment(connection);
1363                         return;
1364                     }
1365 
1366                     if (connection->reject_transport_header){
1367                         connection->reject_transport_header = 0;
1368                         avrcp_send_reject_cmd_wrong_pid(connection);
1369                         avrcp_request_next_avctp_segment(connection);
1370                         return;
1371                     }
1372 
1373                     switch (connection->state){
1374                         // next AVCTP segment
1375                         case AVCTP_W2_SEND_AVCTP_FRAGMENTED_MESSAGE:
1376                         case AVCTP_W2_SEND_RESPONSE:
1377                             avrcp_send_response_with_avctp_fragmentation(connection);
1378                             avrcp_request_next_avctp_segment(connection);
1379                             break;
1380 
1381                         default:
1382                             break;
1383                     }
1384 
1385                     break;
1386             }
1387             default:
1388                 break;
1389         }
1390         default:
1391             break;
1392     }
1393 }
1394 
1395 void avrcp_target_init(void){
1396     avrcp_target_context.role = AVRCP_TARGET;
1397     avrcp_target_context.packet_handler = avrcp_target_packet_handler;
1398     avrcp_register_target_packet_handler(&avrcp_target_packet_handler);
1399 }
1400 
1401 void avrcp_target_deinit(void){
1402     memset(&avrcp_target_context, 0, sizeof(avrcp_context_t));
1403 }
1404 
1405 void avrcp_target_register_packet_handler(btstack_packet_handler_t callback){
1406     btstack_assert(callback != NULL);
1407     avrcp_target_context.avrcp_callback = callback;
1408 }
1409 
1410 void avrcp_target_register_set_addressed_player_handler(bool (*callback)(uint16_t player_id)){
1411     btstack_assert(callback != NULL);
1412     avrcp_target_context.set_addressed_player_callback = callback;
1413 }
1414 
1415 
1416