audio/avctp.c

   1 /*
   2  *
   3  *  BlueZ - Bluetooth protocol stack for Linux
   4  *
   5  *  Copyright (C) 2006-2010  Nokia Corporation
   6  *  Copyright (C) 2004-2010  Marcel Holtmann <marcel@holtmann.org>
   7  *  Copyright (C) 2011  Texas Instruments, Inc.
   8  *
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  23  *
  24  */
  25
  26 #ifdef HAVE_CONFIG_H
  27 #include <config.h>
  28 #endif
  29
  30 #include <stdlib.h>
  31 #include <stdint.h>
  32 #include <errno.h>
  33 #include <unistd.h>
  34 #include <assert.h>
  35 #include <signal.h>
  36 #include <sys/types.h>
  37 #include <sys/stat.h>
  38 #include <fcntl.h>
  39 #include <netinet/in.h>
  40
  41 #include <bluetooth/bluetooth.h>
  42 #include <bluetooth/sdp.h>
  43
  44 #include <glib.h>
  45
  46 #include "adapter.h"
  47 #include "../src/device.h"
  48
  49 #include "log.h"
  50 #include "error.h"
  51 #include "uinput.h"
  52 #include "btio.h"
  53 #include "manager.h"
  54 #include "device.h"
  55 #include "avctp.h"
  56
  57 #define QUIRK_NO_RELEASE 1 << 0
  58
  59 /* Message types */
  60 #define AVCTP_COMMAND           0
  61 #define AVCTP_RESPONSE          1
  62
  63 /* Packet types */
  64 #define AVCTP_PACKET_SINGLE     0
  65 #define AVCTP_PACKET_START      1
  66 #define AVCTP_PACKET_CONTINUE   2
  67 #define AVCTP_PACKET_END        3
  68
  69 #if __BYTE_ORDER == __LITTLE_ENDIAN
  70
  71 struct avctp_header {
  72         uint8_t ipid:1;
  73         uint8_t cr:1;
  74         uint8_t packet_type:2;
  75         uint8_t transaction:4;
  76         uint16_t pid;
  77 } __attribute__ ((packed));
  78 #define AVCTP_HEADER_LENGTH 3
  79
  80 struct avc_header {
  81         uint8_t code:4;
  82         uint8_t _hdr0:4;
  83         uint8_t subunit_id:3;
  84         uint8_t subunit_type:5;
  85         uint8_t opcode;
  86 } __attribute__ ((packed));
  87
  88 #elif __BYTE_ORDER == __BIG_ENDIAN
  89
  90 struct avctp_header {
  91         uint8_t transaction:4;
  92         uint8_t packet_type:2;
  93         uint8_t cr:1;
  94         uint8_t ipid:1;
  95         uint16_t pid;
  96 } __attribute__ ((packed));
  97 #define AVCTP_HEADER_LENGTH 3
  98
  99 struct avc_header {
 100         uint8_t _hdr0:4;
 101         uint8_t code:4;
 102         uint8_t subunit_type:5;
 103         uint8_t subunit_id:3;
 104         uint8_t opcode;
 105 } __attribute__ ((packed));
 106
 107 #else
 108 #error "Unknown byte order"
 109 #endif
 110
 111 struct avctp_state_callback {
 112         avctp_state_cb cb;
 113         void *user_data;
 114         unsigned int id;
 115 };
 116
 117 struct avctp_server {
 118         bdaddr_t src;
 119         GIOChannel *io;
 120         GSList *sessions;
 121 };
 122
 123 struct avctp {
 124         struct avctp_server *server;
 125         bdaddr_t dst;
 126
 127         avctp_state_t state;
 128
 129         int uinput;
 130
 131         GIOChannel *io;
 132         guint io_id;
 133
 134         uint16_t mtu;
 135
 136         uint8_t key_quirks[256];
 137 };
 138
 139 struct avctp_pdu_handler {
 140         uint8_t opcode;
 141         avctp_pdu_cb cb;
 142         void *user_data;
 143         unsigned int id;
 144 };
 145
 146 static struct {
 147         const char *name;
 148         uint8_t avc;
 149         uint16_t uinput;
 150 } key_map[] = {
 151         { "PLAY",               PLAY_OP,                KEY_PLAYCD },
 152         { "STOP",               STAVC_OP_OP,            KEY_STOPCD },
 153         { "PAUSE",              PAUSE_OP,               KEY_PAUSECD },
 154         { "FORWARD",            FORWARD_OP,             KEY_NEXTSONG },
 155         { "BACKWARD",           BACKWARD_OP,            KEY_PREVIOUSSONG },
 156         { "REWIND",             REWIND_OP,              KEY_REWIND },
 157         { "FAST FORWARD",       FAST_FORWARD_OP,        KEY_FASTFORWARD },
 158         { NULL }
 159 };
 160
 161 static GSList *callbacks = NULL;
 162 static GSList *servers = NULL;
 163 static GSList *handlers = NULL;
 164
 165 static void auth_cb(DBusError *derr, void *user_data);
 166
 167 static int send_event(int fd, uint16_t type, uint16_t code, int32_t value)
 168 {
 169         struct uinput_event event;
 170
 171         memset(&event, 0, sizeof(event));
 172         event.type      = type;
 173         event.code      = code;
 174         event.value     = value;
 175
 176         return write(fd, &event, sizeof(event));
 177 }
 178
 179 static void send_key(int fd, uint16_t key, int pressed)
 180 {
 181         if (fd < 0)
 182                 return;
 183
 184         send_event(fd, EV_KEY, key, pressed);
 185         send_event(fd, EV_SYN, SYN_REPORT, 0);
 186 }
 187
 188 static size_t handle_panel_passthrough(struct avctp *session,
 189                                         uint8_t transaction, uint8_t *code,
 190                                         uint8_t *subunit, uint8_t *operands,
 191                                         size_t operand_count, void *user_data)
 192 {
 193         const char *status;
 194         int pressed, i;
 195
 196         if (*code != AVC_CTYPE_CONTROL || *subunit != AVC_SUBUNIT_PANEL) {
 197                 *code = AVC_CTYPE_REJECTED;
 198                 return 0;
 199         }
 200
 201         if (operand_count == 0)
 202                 goto done;
 203
 204         if (operands[0] & 0x80) {
 205                 status = "released";
 206                 pressed = 0;
 207         } else {
 208                 status = "pressed";
 209                 pressed = 1;
 210         }
 211
 212         for (i = 0; key_map[i].name != NULL; i++) {
 213                 uint8_t key_quirks;
 214
 215                 if ((operands[0] & 0x7F) != key_map[i].avc)
 216                         continue;
 217
 218                 DBG("AV/C: %s %s", key_map[i].name, status);
 219
 220                 key_quirks = session->key_quirks[key_map[i].avc];
 221
 222                 if (key_quirks & QUIRK_NO_RELEASE) {
 223                         if (!pressed) {
 224                                 DBG("AV/C: Ignoring release");
 225                                 break;
 226                         }
 227
 228                         DBG("AV/C: treating key press as press + release");
 229                         send_key(session->uinput, key_map[i].uinput, 1);
 230                         send_key(session->uinput, key_map[i].uinput, 0);
 231                         break;
 232                 }
 233
 234                 send_key(session->uinput, key_map[i].uinput, pressed);
 235                 break;
 236         }
 237
 238         if (key_map[i].name == NULL)
 239                 DBG("AV/C: unknown button 0x%02X %s",
 240                                                 operands[0] & 0x7F, status);
 241
 242 done:
 243         *code = AVC_CTYPE_ACCEPTED;
 244         return operand_count;
 245 }
 246
 247 static size_t handle_unit_info(struct avctp *session,
 248                                         uint8_t transaction, uint8_t *code,
 249                                         uint8_t *subunit, uint8_t *operands,
 250                                         size_t operand_count, void *user_data)
 251 {
 252         if (*code != AVC_CTYPE_STATUS) {
 253                 *code = AVC_CTYPE_REJECTED;
 254                 return 0;
 255         }
 256
 257         *code = AVC_CTYPE_STABLE;
 258
 259         /* The first operand should be 0x07 for the UNITINFO response.
 260          * Neither AVRCP (section 22.1, page 117) nor AVC Digital
 261          * Interface Command Set (section 9.2.1, page 45) specs
 262          * explain this value but both use it */
 263         if (operand_count >= 1)
 264                 operands[0] = 0x07;
 265         if (operand_count >= 2)
 266                 operands[1] = AVC_SUBUNIT_PANEL << 3;
 267
 268         DBG("reply to AVC_OP_UNITINFO");
 269
 270         return 0;
 271 }
 272
 273 static size_t handle_subunit_info(struct avctp *session,
 274                                         uint8_t transaction, uint8_t *code,
 275                                         uint8_t *subunit, uint8_t *operands,
 276                                         size_t operand_count, void *user_data)
 277 {
 278         if (*code != AVC_CTYPE_STATUS) {
 279                 *code = AVC_CTYPE_REJECTED;
 280                 return 0;
 281         }
 282
 283         *code = AVC_CTYPE_STABLE;
 284
 285         /* The first operand should be 0x07 for the UNITINFO response.
 286          * Neither AVRCP (section 22.1, page 117) nor AVC Digital
 287          * Interface Command Set (section 9.2.1, page 45) specs
 288          * explain this value but both use it */
 289         if (operand_count >= 2)
 290                 operands[1] = AVC_SUBUNIT_PANEL << 3;
 291
 292         DBG("reply to AVC_OP_SUBUNITINFO");
 293
 294         return 0;
 295 }
 296
 297 static struct avctp_pdu_handler *find_handler(GSList *list, uint8_t opcode)
 298 {
 299         for (; list; list = list->next) {
 300                 struct avctp_pdu_handler *handler = list->data;
 301
 302                 if (handler->opcode == opcode)
 303                         return handler;
 304         }
 305
 306         return NULL;
 307 }
 308
 309 static void avctp_disconnected(struct avctp *session)
 310 {
 311         struct avctp_server *server = session->server;
 312
 313         if (!session)
 314                 return;
 315
 316         if (session->io) {
 317                 g_io_channel_shutdown(session->io, TRUE, NULL);
 318                 g_io_channel_unref(session->io);
 319                 session->io = NULL;
 320         }
 321
 322         if (session->io_id) {
 323                 g_source_remove(session->io_id);
 324                 session->io_id = 0;
 325
 326                 if (session->state == AVCTP_STATE_CONNECTING) {
 327                         struct audio_device *dev;
 328
 329                         dev = manager_get_device(&session->server->src,
 330                                                         &session->dst, FALSE);
 331                         audio_device_cancel_authorization(dev, auth_cb,
 332                                                                 session);
 333                 }
 334         }
 335
 336         if (session->uinput >= 0) {
 337                 char address[18];
 338
 339                 ba2str(&session->dst, address);
 340                 DBG("AVCTP: closing uinput for %s", address);
 341
 342                 ioctl(session->uinput, UI_DEV_DESTROY);
 343                 close(session->uinput);
 344                 session->uinput = -1;
 345         }
 346
 347         server->sessions = g_slist_remove(server->sessions, session);
 348         g_free(session);
 349 }
 350
 351 static void avctp_set_state(struct avctp *session, avctp_state_t new_state)
 352 {
 353         GSList *l;
 354         struct audio_device *dev;
 355         avctp_state_t old_state = session->state;
 356
 357         dev = manager_get_device(&session->server->src, &session->dst, FALSE);
 358         if (dev == NULL) {
 359                 error("avdtp_set_state(): no matching audio device");
 360                 return;
 361         }
 362
 363         session->state = new_state;
 364
 365         for (l = callbacks; l != NULL; l = l->next) {
 366                 struct avctp_state_callback *cb = l->data;
 367                 cb->cb(dev, old_state, new_state, cb->user_data);
 368         }
 369
 370         switch (new_state) {
 371         case AVCTP_STATE_DISCONNECTED:
 372                 DBG("AVCTP Disconnected");
 373
 374                 avctp_disconnected(session);
 375
 376                 if (old_state != AVCTP_STATE_CONNECTED)
 377                         break;
 378
 379                 if (!audio_device_is_active(dev, NULL))
 380                         audio_device_set_authorized(dev, FALSE);
 381
 382                 break;
 383         case AVCTP_STATE_CONNECTING:
 384                 DBG("AVCTP Connecting");
 385                 break;
 386         case AVCTP_STATE_CONNECTED:
 387                 DBG("AVCTP Connected");
 388                 break;
 389         default:
 390                 error("Invalid AVCTP state %d", new_state);
 391                 return;
 392         }
 393 }
 394
 395 static gboolean session_cb(GIOChannel *chan, GIOCondition cond,
 396                                 gpointer data)
 397 {
 398         struct avctp *session = data;
 399         uint8_t buf[1024], *operands, code, subunit;
 400         struct avctp_header *avctp;
 401         struct avc_header *avc;
 402         int ret, packet_size, operand_count, sock;
 403         struct avctp_pdu_handler *handler;
 404
 405         if (cond & (G_IO_ERR | G_IO_HUP | G_IO_NVAL))
 406                 goto failed;
 407
 408         sock = g_io_channel_unix_get_fd(session->io);
 409
 410         ret = read(sock, buf, sizeof(buf));
 411         if (ret <= 0)
 412                 goto failed;
 413
 414         DBG("Got %d bytes of data for AVCTP session %p", ret, session);
 415
 416         if ((unsigned int) ret < sizeof(struct avctp_header)) {
 417                 error("Too small AVCTP packet");
 418                 goto failed;
 419         }
 420
 421         avctp = (struct avctp_header *) buf;
 422
 423         DBG("AVCTP transaction %u, packet type %u, C/R %u, IPID %u, "
 424                         "PID 0x%04X",
 425                         avctp->transaction, avctp->packet_type,
 426                         avctp->cr, avctp->ipid, ntohs(avctp->pid));
 427
 428         ret -= sizeof(struct avctp_header);
 429         if ((unsigned int) ret < sizeof(struct avc_header)) {
 430                 error("Too small AVCTP packet");
 431                 goto failed;
 432         }
 433
 434         avc = (struct avc_header *) (buf + sizeof(struct avctp_header));
 435
 436         ret -= sizeof(struct avc_header);
 437
 438         operands = buf + sizeof(struct avctp_header) + sizeof(struct avc_header);
 439         operand_count = ret;
 440
 441         DBG("AV/C %s 0x%01X, subunit_type 0x%02X, subunit_id 0x%01X, "
 442                         "opcode 0x%02X, %d operands",
 443                         avctp->cr ? "response" : "command",
 444                         avc->code, avc->subunit_type, avc->subunit_id,
 445                         avc->opcode, operand_count);
 446
 447         if (avctp->cr == AVCTP_RESPONSE)
 448                 return TRUE;
 449
 450         packet_size = AVCTP_HEADER_LENGTH + AVC_HEADER_LENGTH;
 451         avctp->cr = AVCTP_RESPONSE;
 452
 453         if (avctp->packet_type != AVCTP_PACKET_SINGLE) {
 454                 avc->code = AVC_CTYPE_NOT_IMPLEMENTED;
 455                 goto done;
 456         }
 457
 458         if (avctp->pid != htons(AV_REMOTE_SVCLASS_ID)) {
 459                 avctp->ipid = 1;
 460                 avc->code = AVC_CTYPE_REJECTED;
 461                 goto done;
 462         }
 463
 464         handler = find_handler(handlers, avc->opcode);
 465         if (!handler) {
 466                 DBG("handler not found for 0x%02x", avc->opcode);
 467                 avc->code = AVC_CTYPE_REJECTED;
 468                 goto done;
 469         }
 470
 471         code = avc->code;
 472         subunit = avc->subunit_type;
 473
 474         packet_size += handler->cb(session, avctp->transaction, &code,
 475                                         &subunit, operands, operand_count,
 476                                         handler->user_data);
 477
 478         avc->code = code;
 479         avc->subunit_type = subunit;
 480
 481 done:
 482         ret = write(sock, buf, packet_size);
 483         if (ret != packet_size)
 484                 goto failed;
 485
 486         return TRUE;
 487
 488 failed:
 489         DBG("AVCTP session %p got disconnected", session);
 490         avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
 491         return FALSE;
 492 }
 493
 494 static int uinput_create(char *name)
 495 {
 496         struct uinput_dev dev;
 497         int fd, err, i;
 498
 499         fd = open("/dev/uinput", O_RDWR);
 500         if (fd < 0) {
 501                 fd = open("/dev/input/uinput", O_RDWR);
 502                 if (fd < 0) {
 503                         fd = open("/dev/misc/uinput", O_RDWR);
 504                         if (fd < 0) {
 505                                 err = -errno;
 506                                 error("Can't open input device: %s (%d)",
 507                                                         strerror(-err), -err);
 508                                 return err;
 509                         }
 510                 }
 511         }
 512
 513         memset(&dev, 0, sizeof(dev));
 514         if (name)
 515                 strncpy(dev.name, name, UINPUT_MAX_NAME_SIZE - 1);
 516
 517         dev.id.bustype = BUS_BLUETOOTH;
 518         dev.id.vendor  = 0x0000;
 519         dev.id.product = 0x0000;
 520         dev.id.version = 0x0000;
 521
 522         if (write(fd, &dev, sizeof(dev)) < 0) {
 523                 err = -errno;
 524                 error("Can't write device information: %s (%d)",
 525                                                 strerror(-err), -err);
 526                 close(fd);
 527                 return err;
 528         }
 529
 530         ioctl(fd, UI_SET_EVBIT, EV_KEY);
 531         ioctl(fd, UI_SET_EVBIT, EV_REL);
 532         ioctl(fd, UI_SET_EVBIT, EV_REP);
 533         ioctl(fd, UI_SET_EVBIT, EV_SYN);
 534
 535         for (i = 0; key_map[i].name != NULL; i++)
 536                 ioctl(fd, UI_SET_KEYBIT, key_map[i].uinput);
 537
 538         if (ioctl(fd, UI_DEV_CREATE, NULL) < 0) {
 539                 err = -errno;
 540                 error("Can't create uinput device: %s (%d)",
 541                                                 strerror(-err), -err);
 542                 close(fd);
 543                 return err;
 544         }
 545
 546         return fd;
 547 }
 548
 549 static void init_uinput(struct avctp *session)
 550 {
 551         struct audio_device *dev;
 552         char address[18], name[248 + 1];
 553
 554         dev = manager_get_device(&session->server->src, &session->dst, FALSE);
 555
 556         device_get_name(dev->btd_dev, name, sizeof(name));
 557         if (g_str_equal(name, "Nokia CK-20W")) {
 558                 session->key_quirks[FORWARD_OP] |= QUIRK_NO_RELEASE;
 559                 session->key_quirks[BACKWARD_OP] |= QUIRK_NO_RELEASE;
 560                 session->key_quirks[PLAY_OP] |= QUIRK_NO_RELEASE;
 561                 session->key_quirks[PAUSE_OP] |= QUIRK_NO_RELEASE;
 562         }
 563
 564         ba2str(&session->dst, address);
 565
 566         session->uinput = uinput_create(address);
 567         if (session->uinput < 0)
 568                 error("AVRCP: failed to init uinput for %s", address);
 569         else
 570                 DBG("AVRCP: uinput initialized for %s", address);
 571 }
 572
 573 static void avctp_connect_cb(GIOChannel *chan, GError *err, gpointer data)
 574 {
 575         struct avctp *session = data;
 576         char address[18];
 577         uint16_t imtu;
 578         GError *gerr = NULL;
 579
 580         if (err) {
 581                 avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
 582                 error("%s", err->message);
 583                 return;
 584         }
 585
 586         bt_io_get(chan, BT_IO_L2CAP, &gerr,
 587                         BT_IO_OPT_DEST, &address,
 588                         BT_IO_OPT_IMTU, &imtu,
 589                         BT_IO_OPT_INVALID);
 590         if (gerr) {
 591                 avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
 592                 error("%s", gerr->message);
 593                 g_error_free(gerr);
 594                 return;
 595         }
 596
 597         DBG("AVCTP: connected to %s", address);
 598
 599         if (!session->io)
 600                 session->io = g_io_channel_ref(chan);
 601
 602         init_uinput(session);
 603
 604         avctp_set_state(session, AVCTP_STATE_CONNECTED);
 605         session->mtu = imtu;
 606         session->io_id = g_io_add_watch(chan,
 607                                 G_IO_IN | G_IO_ERR | G_IO_HUP | G_IO_NVAL,
 608                                 (GIOFunc) session_cb, session);
 609 }
 610
 611 static void auth_cb(DBusError *derr, void *user_data)
 612 {
 613         struct avctp *session = user_data;
 614         GError *err = NULL;
 615
 616         if (session->io_id) {
 617                 g_source_remove(session->io_id);
 618                 session->io_id = 0;
 619         }
 620
 621         if (derr && dbus_error_is_set(derr)) {
 622                 error("Access denied: %s", derr->message);
 623                 avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
 624                 return;
 625         }
 626
 627         if (!bt_io_accept(session->io, avctp_connect_cb, session,
 628                                                                 NULL, &err)) {
 629                 error("bt_io_accept: %s", err->message);
 630                 g_error_free(err);
 631                 avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
 632         }
 633 }
 634
 635 static struct avctp_server *find_server(GSList *list, const bdaddr_t *src)
 636 {
 637         for (; list; list = list->next) {
 638                 struct avctp_server *server = list->data;
 639
 640                 if (bacmp(&server->src, src) == 0)
 641                         return server;
 642         }
 643
 644         return NULL;
 645 }
 646
 647 static struct avctp *find_session(GSList *list, const bdaddr_t *dst)
 648 {
 649         for (; list != NULL; list = g_slist_next(list)) {
 650                 struct avctp *s = list->data;
 651
 652                 if (bacmp(dst, &s->dst))
 653                         continue;
 654
 655                 return s;
 656         }
 657
 658         return NULL;
 659 }
 660
 661 static struct avctp *avctp_get_internal(const bdaddr_t *src,
 662                                                         const bdaddr_t *dst)
 663 {
 664         struct avctp_server *server;
 665         struct avctp *session;
 666
 667         assert(src != NULL);
 668         assert(dst != NULL);
 669
 670         server = find_server(servers, src);
 671         if (server == NULL)
 672                 return NULL;
 673
 674         session = find_session(server->sessions, dst);
 675         if (session)
 676                 return session;
 677
 678         session = g_new0(struct avctp, 1);
 679
 680         session->server = server;
 681         bacpy(&session->dst, dst);
 682         session->state = AVCTP_STATE_DISCONNECTED;
 683
 684         server->sessions = g_slist_append(server->sessions, session);
 685
 686         return session;
 687 }
 688
 689 static void avctp_confirm_cb(GIOChannel *chan, gpointer data)
 690 {
 691         struct avctp *session;
 692         struct audio_device *dev;
 693         char address[18];
 694         bdaddr_t src, dst;
 695         GError *err = NULL;
 696
 697         bt_io_get(chan, BT_IO_L2CAP, &err,
 698                         BT_IO_OPT_SOURCE_BDADDR, &src,
 699                         BT_IO_OPT_DEST_BDADDR, &dst,
 700                         BT_IO_OPT_DEST, address,
 701                         BT_IO_OPT_INVALID);
 702         if (err) {
 703                 error("%s", err->message);
 704                 g_error_free(err);
 705                 g_io_channel_shutdown(chan, TRUE, NULL);
 706                 return;
 707         }
 708
 709         DBG("AVCTP: incoming connect from %s", address);
 710
 711         session = avctp_get_internal(&src, &dst);
 712         if (!session)
 713                 goto drop;
 714
 715         dev = manager_get_device(&src, &dst, FALSE);
 716         if (!dev) {
 717                 dev = manager_get_device(&src, &dst, TRUE);
 718                 if (!dev) {
 719                         error("Unable to get audio device object for %s",
 720                                         address);
 721                         goto drop;
 722                 }
 723         }
 724
 725         if (dev->control == NULL) {
 726                 btd_device_add_uuid(dev->btd_dev, AVRCP_REMOTE_UUID);
 727                 if (dev->control == NULL)
 728                         goto drop;
 729         }
 730
 731         if (session->io) {
 732                 error("Refusing unexpected connect from %s", address);
 733                 goto drop;
 734         }
 735
 736         avctp_set_state(session, AVCTP_STATE_CONNECTING);
 737         session->io = g_io_channel_ref(chan);
 738
 739         if (audio_device_request_authorization(dev, AVRCP_TARGET_UUID,
 740                                                 auth_cb, session) < 0)
 741                 goto drop;
 742
 743         session->io_id = g_io_add_watch(chan, G_IO_ERR | G_IO_HUP | G_IO_NVAL,
 744                                                         session_cb, session);
 745         return;
 746
 747 drop:
 748         if (!session || !session->io)
 749                 g_io_channel_shutdown(chan, TRUE, NULL);
 750         if (session)
 751                 avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
 752 }
 753
 754 static GIOChannel *avctp_server_socket(const bdaddr_t *src, gboolean master)
 755 {
 756         GError *err = NULL;
 757         GIOChannel *io;
 758
 759         io = bt_io_listen(BT_IO_L2CAP, NULL, avctp_confirm_cb, NULL,
 760                                 NULL, &err,
 761                                 BT_IO_OPT_SOURCE_BDADDR, src,
 762                                 BT_IO_OPT_PSM, AVCTP_PSM,
 763                                 BT_IO_OPT_SEC_LEVEL, BT_IO_SEC_MEDIUM,
 764                                 BT_IO_OPT_MASTER, master,
 765                                 BT_IO_OPT_INVALID);
 766         if (!io) {
 767                 error("%s", err->message);
 768                 g_error_free(err);
 769         }
 770
 771         return io;
 772 }
 773
 774 static unsigned int passthrough_id = 0;
 775 static unsigned int unit_id = 0;
 776 static unsigned int subunit_id = 0;
 777
 778 int avctp_register(const bdaddr_t *src, gboolean master)
 779 {
 780         struct avctp_server *server;
 781
 782         server = g_new0(struct avctp_server, 1);
 783         if (!server)
 784                 return -ENOMEM;
 785
 786         server->io = avctp_server_socket(src, master);
 787         if (!server->io) {
 788                 g_free(server);
 789                 return -1;
 790         }
 791
 792         bacpy(&server->src, src);
 793
 794         servers = g_slist_append(servers, server);
 795
 796         if (!passthrough_id)
 797                 passthrough_id = avctp_register_pdu_handler(AVC_OP_PASSTHROUGH,
 798                                         handle_panel_passthrough, NULL);
 799
 800         if (!unit_id)
 801                 unit_id = avctp_register_pdu_handler(AVC_OP_UNITINFO, handle_unit_info,
 802                                                                         NULL);
 803
 804         if (!subunit_id)
 805                 subunit_id = avctp_register_pdu_handler(AVC_OP_SUBUNITINFO,
 806                                                 handle_subunit_info, NULL);
 807
 808         return 0;
 809 }
 810
 811 void avctp_unregister(const bdaddr_t *src)
 812 {
 813         struct avctp_server *server;
 814
 815         server = find_server(servers, src);
 816         if (!server)
 817                 return;
 818
 819         while (server->sessions)
 820                 avctp_disconnected(server->sessions->data);
 821
 822         servers = g_slist_remove(servers, server);
 823
 824         g_io_channel_shutdown(server->io, TRUE, NULL);
 825         g_io_channel_unref(server->io);
 826         g_free(server);
 827
 828         if (servers)
 829                 return;
 830
 831         if (passthrough_id) {
 832                 avctp_unregister_pdu_handler(passthrough_id);
 833                 passthrough_id = 0;
 834         }
 835
 836         if (unit_id) {
 837                 avctp_unregister_pdu_handler(unit_id);
 838                 passthrough_id = 0;
 839         }
 840
 841         if (subunit_id) {
 842                 avctp_unregister_pdu_handler(subunit_id);
 843                 subunit_id = 0;
 844         }
 845 }
 846
 847 int avctp_send_passthrough(struct avctp *session, uint8_t op)
 848 {
 849         unsigned char buf[AVCTP_HEADER_LENGTH + AVC_HEADER_LENGTH + 2];
 850         struct avctp_header *avctp = (void *) buf;
 851         struct avc_header *avc = (void *) &buf[AVCTP_HEADER_LENGTH];
 852         uint8_t *operands = &buf[AVCTP_HEADER_LENGTH + AVC_HEADER_LENGTH];
 853         int sk;
 854         static uint8_t transaction = 0;
 855
 856         if (session->state != AVCTP_STATE_CONNECTED)
 857                 return -ENOTCONN;
 858
 859         memset(buf, 0, sizeof(buf));
 860
 861         avctp->transaction = transaction++;
 862         avctp->packet_type = AVCTP_PACKET_SINGLE;
 863         avctp->cr = AVCTP_COMMAND;
 864         avctp->pid = htons(AV_REMOTE_SVCLASS_ID);
 865
 866         avc->code = AVC_CTYPE_CONTROL;
 867         avc->subunit_type = AVC_SUBUNIT_PANEL;
 868         avc->opcode = AVC_OP_PASSTHROUGH;
 869
 870         operands[0] = op & 0x7f;
 871         operands[1] = 0;
 872
 873         sk = g_io_channel_unix_get_fd(session->io);
 874
 875         if (write(sk, buf, sizeof(buf)) < 0)
 876                 return -errno;
 877
 878         /* Button release */
 879         avctp->transaction = transaction++;
 880         operands[0] |= 0x80;
 881
 882         if (write(sk, buf, sizeof(buf)) < 0)
 883                 return -errno;
 884
 885         return 0;
 886 }
 887
 888 int avctp_send_vendordep(struct avctp *session, uint8_t transaction,
 889                                 uint8_t code, uint8_t subunit,
 890                                 uint8_t *operands, size_t operand_count)
 891 {
 892         uint8_t *buf;
 893         struct avctp_header *avctp;
 894         struct avc_header *avc;
 895         uint8_t *pdu;
 896         int sk, err = 0;
 897         uint16_t size;
 898
 899         if (session->state != AVCTP_STATE_CONNECTED)
 900                 return -ENOTCONN;
 901
 902         sk = g_io_channel_unix_get_fd(session->io);
 903         size = AVCTP_HEADER_LENGTH + AVC_HEADER_LENGTH + operand_count;
 904         buf = g_malloc0(size);
 905
 906         avctp = (void *) buf;
 907         avc = (void *) &buf[AVCTP_HEADER_LENGTH];
 908         pdu = (void *) &buf[AVCTP_HEADER_LENGTH + AVC_HEADER_LENGTH];
 909
 910         avctp->transaction = transaction;
 911         avctp->packet_type = AVCTP_PACKET_SINGLE;
 912         avctp->cr = AVCTP_RESPONSE;
 913         avctp->pid = htons(AV_REMOTE_SVCLASS_ID);
 914
 915         avc->code = code;
 916         avc->subunit_type = subunit;
 917         avc->opcode = AVC_OP_VENDORDEP;
 918
 919         memcpy(pdu, operands, operand_count);
 920
 921         if (write(sk, buf, size) < 0)
 922                 err = -errno;
 923
 924         g_free(buf);
 925         return err;
 926 }
 927
 928 unsigned int avctp_add_state_cb(avctp_state_cb cb, void *user_data)
 929 {
 930         struct avctp_state_callback *state_cb;
 931         static unsigned int id = 0;
 932
 933         state_cb = g_new(struct avctp_state_callback, 1);
 934         state_cb->cb = cb;
 935         state_cb->user_data = user_data;
 936         state_cb->id = ++id;
 937
 938         callbacks = g_slist_append(callbacks, state_cb);
 939
 940         return state_cb->id;
 941 }
 942
 943 gboolean avctp_remove_state_cb(unsigned int id)
 944 {
 945         GSList *l;
 946
 947         for (l = callbacks; l != NULL; l = l->next) {
 948                 struct avctp_state_callback *cb = l->data;
 949                 if (cb && cb->id == id) {
 950                         callbacks = g_slist_remove(callbacks, cb);
 951                         g_free(cb);
 952                         return TRUE;
 953                 }
 954         }
 955
 956         return FALSE;
 957 }
 958
 959 unsigned int avctp_register_pdu_handler(uint8_t opcode, avctp_pdu_cb cb,
 960                                                         void *user_data)
 961 {
 962         struct avctp_pdu_handler *handler;
 963         static unsigned int id = 0;
 964
 965         handler = find_handler(handlers, opcode);
 966         if (handler)
 967                 return 0;
 968
 969         handler = g_new(struct avctp_pdu_handler, 1);
 970         handler->opcode = opcode;
 971         handler->cb = cb;
 972         handler->user_data = user_data;
 973         handler->id = ++id;
 974
 975         handlers = g_slist_append(handlers, handler);
 976
 977         return handler->id;
 978 }
 979
 980 gboolean avctp_unregister_pdu_handler(unsigned int id)
 981 {
 982         GSList *l;
 983
 984         for (l = handlers; l != NULL; l = l->next) {
 985                 struct avctp_pdu_handler *handler = l->data;
 986
 987                 if (handler->id == id) {
 988                         handlers = g_slist_remove(handlers, handler);
 989                         g_free(handler);
 990                         return TRUE;
 991                 }
 992         }
 993
 994         return FALSE;
 995 }
 996
 997 struct avctp *avctp_connect(const bdaddr_t *src, const bdaddr_t *dst)
 998 {
 999         struct avctp *session;
1000         GError *err = NULL;
1001         GIOChannel *io;
1002
1003         session = avctp_get_internal(src, dst);
1004         if (!session)
1005                 return NULL;
1006
1007         if (session->state > AVCTP_STATE_DISCONNECTED)
1008                 return session;
1009
1010         avctp_set_state(session, AVCTP_STATE_CONNECTING);
1011
1012         io = bt_io_connect(BT_IO_L2CAP, avctp_connect_cb, session, NULL, &err,
1013                                 BT_IO_OPT_SOURCE_BDADDR, &session->server->src,
1014                                 BT_IO_OPT_DEST_BDADDR, &session->dst,
1015                                 BT_IO_OPT_PSM, AVCTP_PSM,
1016                                 BT_IO_OPT_INVALID);
1017         if (err) {
1018                 avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
1019                 error("%s", err->message);
1020                 g_error_free(err);
1021                 return NULL;
1022         }
1023
1024         session->io = io;
1025
1026         return session;
1027 }
1028
1029 void avctp_disconnect(struct avctp *session)
1030 {
1031         if (!session->io)
1032                 return;
1033
1034         avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
1035 }
1036
1037 struct avctp *avctp_get(const bdaddr_t *src, const bdaddr_t *dst)
1038 {
1039         return avctp_get_internal(src, dst);
1040 }