audio/avctp.c

   1 /*
   2  *
   3  *  BlueZ - Bluetooth protocol stack for Linux
   4  *
   5  *  Copyright (C) 2006-2010  Nokia Corporation
   6  *  Copyright (C) 2004-2010  Marcel Holtmann <marcel@holtmann.org>
   7  *  Copyright (C) 2011  Texas Instruments, Inc.
   8  *
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  23  *
  24  */
  25
  26 #ifdef HAVE_CONFIG_H
  27 #include <config.h>
  28 #endif
  29
  30 #include <stdlib.h>
  31 #include <stdint.h>
  32 #include <errno.h>
  33 #include <unistd.h>
  34 #include <assert.h>
  35 #include <signal.h>
  36 #include <sys/types.h>
  37 #include <sys/stat.h>
  38 #include <fcntl.h>
  39 #include <netinet/in.h>
  40
  41 #include <bluetooth/bluetooth.h>
  42 #include <bluetooth/sdp.h>
  43 #include <bluetooth/uuid.h>
  44
  45 #include <glib.h>
  46
  47 #include "adapter.h"
  48 #include "../src/device.h"
  49
  50 #include "log.h"
  51 #include "error.h"
  52 #include "uinput.h"
  53 #include "btio.h"
  54 #include "manager.h"
  55 #include "device.h"
  56 #include "avctp.h"
  57 #include "avrcp.h"
  58
  59 #define QUIRK_NO_RELEASE 1 << 0
  60
  61 /* Message types */
  62 #define AVCTP_COMMAND           0
  63 #define AVCTP_RESPONSE          1
  64
  65 /* Packet types */
  66 #define AVCTP_PACKET_SINGLE     0
  67 #define AVCTP_PACKET_START      1
  68 #define AVCTP_PACKET_CONTINUE   2
  69 #define AVCTP_PACKET_END        3
  70
  71 #if __BYTE_ORDER == __LITTLE_ENDIAN
  72
  73 struct avctp_header {
  74         uint8_t ipid:1;
  75         uint8_t cr:1;
  76         uint8_t packet_type:2;
  77         uint8_t transaction:4;
  78         uint16_t pid;
  79 } __attribute__ ((packed));
  80 #define AVCTP_HEADER_LENGTH 3
  81
  82 struct avc_header {
  83         uint8_t code:4;
  84         uint8_t _hdr0:4;
  85         uint8_t subunit_id:3;
  86         uint8_t subunit_type:5;
  87         uint8_t opcode;
  88 } __attribute__ ((packed));
  89
  90 #elif __BYTE_ORDER == __BIG_ENDIAN
  91
  92 struct avctp_header {
  93         uint8_t transaction:4;
  94         uint8_t packet_type:2;
  95         uint8_t cr:1;
  96         uint8_t ipid:1;
  97         uint16_t pid;
  98 } __attribute__ ((packed));
  99 #define AVCTP_HEADER_LENGTH 3
 100
 101 struct avc_header {
 102         uint8_t _hdr0:4;
 103         uint8_t code:4;
 104         uint8_t subunit_type:5;
 105         uint8_t subunit_id:3;
 106         uint8_t opcode;
 107 } __attribute__ ((packed));
 108
 109 #else
 110 #error "Unknown byte order"
 111 #endif
 112
 113 struct avctp_state_callback {
 114         avctp_state_cb cb;
 115         void *user_data;
 116         unsigned int id;
 117 };
 118
 119 struct avctp_server {
 120         bdaddr_t src;
 121         GIOChannel *io;
 122         GSList *sessions;
 123 };
 124
 125 struct avctp_rsp_handler {
 126         uint8_t id;
 127         avctp_rsp_cb func;
 128         void *user_data;
 129 };
 130
 131 struct avctp {
 132         struct avctp_server *server;
 133         bdaddr_t dst;
 134
 135         avctp_state_t state;
 136
 137         int uinput;
 138
 139         GIOChannel *io;
 140         guint io_id;
 141
 142         uint16_t mtu;
 143
 144         uint8_t key_quirks[256];
 145         GSList *handlers;
 146 };
 147
 148 struct avctp_pdu_handler {
 149         uint8_t opcode;
 150         avctp_pdu_cb cb;
 151         void *user_data;
 152         unsigned int id;
 153 };
 154
 155 static struct {
 156         const char *name;
 157         uint8_t avc;
 158         uint16_t uinput;
 159 } key_map[] = {
 160         { "PLAY",               PLAY_OP,                KEY_PLAYCD },
 161         { "STOP",               STAVC_OP_OP,            KEY_STOPCD },
 162         { "PAUSE",              PAUSE_OP,               KEY_PAUSECD },
 163         { "FORWARD",            FORWARD_OP,             KEY_NEXTSONG },
 164         { "BACKWARD",           BACKWARD_OP,            KEY_PREVIOUSSONG },
 165         { "REWIND",             REWIND_OP,              KEY_REWIND },
 166         { "FAST FORWARD",       FAST_FORWARD_OP,        KEY_FASTFORWARD },
 167         { NULL }
 168 };
 169
 170 static GSList *callbacks = NULL;
 171 static GSList *servers = NULL;
 172 static GSList *handlers = NULL;
 173 static uint8_t id = 0;
 174
 175 static void auth_cb(DBusError *derr, void *user_data);
 176
 177 static int send_event(int fd, uint16_t type, uint16_t code, int32_t value)
 178 {
 179         struct uinput_event event;
 180
 181         memset(&event, 0, sizeof(event));
 182         event.type      = type;
 183         event.code      = code;
 184         event.value     = value;
 185
 186         return write(fd, &event, sizeof(event));
 187 }
 188
 189 static void send_key(int fd, uint16_t key, int pressed)
 190 {
 191         if (fd < 0)
 192                 return;
 193
 194         send_event(fd, EV_KEY, key, pressed);
 195         send_event(fd, EV_SYN, SYN_REPORT, 0);
 196 }
 197
 198 static size_t handle_panel_passthrough(struct avctp *session,
 199                                         uint8_t transaction, uint8_t *code,
 200                                         uint8_t *subunit, uint8_t *operands,
 201                                         size_t operand_count, void *user_data)
 202 {
 203         const char *status;
 204         int pressed, i;
 205
 206         if (*code != AVC_CTYPE_CONTROL || *subunit != AVC_SUBUNIT_PANEL) {
 207                 *code = AVC_CTYPE_REJECTED;
 208                 return 0;
 209         }
 210
 211         if (operand_count == 0)
 212                 goto done;
 213
 214         if (operands[0] & 0x80) {
 215                 status = "released";
 216                 pressed = 0;
 217         } else {
 218                 status = "pressed";
 219                 pressed = 1;
 220         }
 221
 222         for (i = 0; key_map[i].name != NULL; i++) {
 223                 uint8_t key_quirks;
 224
 225                 if ((operands[0] & 0x7F) != key_map[i].avc)
 226                         continue;
 227
 228                 DBG("AV/C: %s %s", key_map[i].name, status);
 229
 230                 key_quirks = session->key_quirks[key_map[i].avc];
 231
 232                 if (key_quirks & QUIRK_NO_RELEASE) {
 233                         if (!pressed) {
 234                                 DBG("AV/C: Ignoring release");
 235                                 break;
 236                         }
 237
 238                         DBG("AV/C: treating key press as press + release");
 239                         send_key(session->uinput, key_map[i].uinput, 1);
 240                         send_key(session->uinput, key_map[i].uinput, 0);
 241                         break;
 242                 }
 243
 244                 send_key(session->uinput, key_map[i].uinput, pressed);
 245                 break;
 246         }
 247
 248         if (key_map[i].name == NULL) {
 249                 DBG("AV/C: unknown button 0x%02X %s",
 250                                                 operands[0] & 0x7F, status);
 251                 *code = AVC_CTYPE_NOT_IMPLEMENTED;
 252                 return 0;
 253         }
 254
 255 done:
 256         *code = AVC_CTYPE_ACCEPTED;
 257         return operand_count;
 258 }
 259
 260 static size_t handle_unit_info(struct avctp *session,
 261                                         uint8_t transaction, uint8_t *code,
 262                                         uint8_t *subunit, uint8_t *operands,
 263                                         size_t operand_count, void *user_data)
 264 {
 265         if (*code != AVC_CTYPE_STATUS) {
 266                 *code = AVC_CTYPE_REJECTED;
 267                 return 0;
 268         }
 269
 270         *code = AVC_CTYPE_STABLE;
 271
 272         /* The first operand should be 0x07 for the UNITINFO response.
 273          * Neither AVRCP (section 22.1, page 117) nor AVC Digital
 274          * Interface Command Set (section 9.2.1, page 45) specs
 275          * explain this value but both use it */
 276         if (operand_count >= 1)
 277                 operands[0] = 0x07;
 278         if (operand_count >= 2)
 279                 operands[1] = AVC_SUBUNIT_PANEL << 3;
 280
 281         DBG("reply to AVC_OP_UNITINFO");
 282
 283         return operand_count;
 284 }
 285
 286 static size_t handle_subunit_info(struct avctp *session,
 287                                         uint8_t transaction, uint8_t *code,
 288                                         uint8_t *subunit, uint8_t *operands,
 289                                         size_t operand_count, void *user_data)
 290 {
 291         if (*code != AVC_CTYPE_STATUS) {
 292                 *code = AVC_CTYPE_REJECTED;
 293                 return 0;
 294         }
 295
 296         *code = AVC_CTYPE_STABLE;
 297
 298         /* The first operand should be 0x07 for the UNITINFO response.
 299          * Neither AVRCP (section 22.1, page 117) nor AVC Digital
 300          * Interface Command Set (section 9.2.1, page 45) specs
 301          * explain this value but both use it */
 302         if (operand_count >= 2)
 303                 operands[1] = AVC_SUBUNIT_PANEL << 3;
 304
 305         DBG("reply to AVC_OP_SUBUNITINFO");
 306
 307         return operand_count;
 308 }
 309
 310 static struct avctp_pdu_handler *find_handler(GSList *list, uint8_t opcode)
 311 {
 312         for (; list; list = list->next) {
 313                 struct avctp_pdu_handler *handler = list->data;
 314
 315                 if (handler->opcode == opcode)
 316                         return handler;
 317         }
 318
 319         return NULL;
 320 }
 321
 322 static void avctp_disconnected(struct avctp *session)
 323 {
 324         struct avctp_server *server;
 325
 326         if (!session)
 327                 return;
 328
 329         if (session->io) {
 330                 g_io_channel_shutdown(session->io, TRUE, NULL);
 331                 g_io_channel_unref(session->io);
 332                 session->io = NULL;
 333         }
 334
 335         if (session->io_id) {
 336                 g_source_remove(session->io_id);
 337                 session->io_id = 0;
 338
 339                 if (session->state == AVCTP_STATE_CONNECTING) {
 340                         struct audio_device *dev;
 341
 342                         dev = manager_get_device(&session->server->src,
 343                                                         &session->dst, FALSE);
 344                         audio_device_cancel_authorization(dev, auth_cb,
 345                                                                 session);
 346                 }
 347         }
 348
 349         if (session->uinput >= 0) {
 350                 char address[18];
 351
 352                 ba2str(&session->dst, address);
 353                 DBG("AVCTP: closing uinput for %s", address);
 354
 355                 ioctl(session->uinput, UI_DEV_DESTROY);
 356                 close(session->uinput);
 357                 session->uinput = -1;
 358         }
 359
 360         server = session->server;
 361         server->sessions = g_slist_remove(server->sessions, session);
 362         g_slist_free_full(session->handlers, g_free);
 363         g_free(session);
 364 }
 365
 366 static void avctp_set_state(struct avctp *session, avctp_state_t new_state)
 367 {
 368         GSList *l;
 369         struct audio_device *dev;
 370         avctp_state_t old_state = session->state;
 371
 372         dev = manager_get_device(&session->server->src, &session->dst, FALSE);
 373         if (dev == NULL) {
 374                 error("avdtp_set_state(): no matching audio device");
 375                 return;
 376         }
 377
 378         session->state = new_state;
 379
 380         for (l = callbacks; l != NULL; l = l->next) {
 381                 struct avctp_state_callback *cb = l->data;
 382                 cb->cb(dev, old_state, new_state, cb->user_data);
 383         }
 384
 385         switch (new_state) {
 386         case AVCTP_STATE_DISCONNECTED:
 387                 DBG("AVCTP Disconnected");
 388
 389                 avctp_disconnected(session);
 390
 391                 if (old_state != AVCTP_STATE_CONNECTED)
 392                         break;
 393
 394                 if (!audio_device_is_active(dev, NULL))
 395                         audio_device_set_authorized(dev, FALSE);
 396
 397                 break;
 398         case AVCTP_STATE_CONNECTING:
 399                 DBG("AVCTP Connecting");
 400                 break;
 401         case AVCTP_STATE_CONNECTED:
 402                 DBG("AVCTP Connected");
 403                 break;
 404         default:
 405                 error("Invalid AVCTP state %d", new_state);
 406                 return;
 407         }
 408 }
 409
 410 static void handle_response(struct avctp *session, struct avctp_header *avctp,
 411                                 struct avc_header *avc, uint8_t *operands,
 412                                 size_t operand_count)
 413 {
 414         GSList *l;
 415
 416         for (l = session->handlers; l; l = l->next) {
 417                 struct avctp_rsp_handler *handler = l->data;
 418
 419                 if (handler->id != avctp->transaction)
 420                         continue;
 421
 422                 if (handler->func && handler->func(session, avc->code,
 423                                                 avc->subunit_type,
 424                                                 operands, operand_count,
 425                                                 handler->user_data))
 426                         return;
 427
 428                 session->handlers = g_slist_remove(session->handlers, handler);
 429                 g_free(handler);
 430
 431                 return;
 432         }
 433 }
 434
 435 static gboolean session_cb(GIOChannel *chan, GIOCondition cond,
 436                                 gpointer data)
 437 {
 438         struct avctp *session = data;
 439         uint8_t buf[1024], *operands, code, subunit;
 440         struct avctp_header *avctp;
 441         struct avc_header *avc;
 442         int ret, packet_size, operand_count, sock;
 443         struct avctp_pdu_handler *handler;
 444
 445         if (cond & (G_IO_ERR | G_IO_HUP | G_IO_NVAL))
 446                 goto failed;
 447
 448         sock = g_io_channel_unix_get_fd(session->io);
 449
 450         ret = read(sock, buf, sizeof(buf));
 451         if (ret <= 0)
 452                 goto failed;
 453
 454         DBG("Got %d bytes of data for AVCTP session %p", ret, session);
 455
 456         if ((unsigned int) ret < sizeof(struct avctp_header)) {
 457                 error("Too small AVCTP packet");
 458                 goto failed;
 459         }
 460
 461         avctp = (struct avctp_header *) buf;
 462
 463         DBG("AVCTP transaction %u, packet type %u, C/R %u, IPID %u, "
 464                         "PID 0x%04X",
 465                         avctp->transaction, avctp->packet_type,
 466                         avctp->cr, avctp->ipid, ntohs(avctp->pid));
 467
 468         ret -= sizeof(struct avctp_header);
 469         if ((unsigned int) ret < sizeof(struct avc_header)) {
 470                 error("Too small AVCTP packet");
 471                 goto failed;
 472         }
 473
 474         avc = (struct avc_header *) (buf + sizeof(struct avctp_header));
 475
 476         ret -= sizeof(struct avc_header);
 477
 478         operands = buf + sizeof(struct avctp_header) + sizeof(struct avc_header);
 479         operand_count = ret;
 480
 481         DBG("AV/C %s 0x%01X, subunit_type 0x%02X, subunit_id 0x%01X, "
 482                         "opcode 0x%02X, %d operands",
 483                         avctp->cr ? "response" : "command",
 484                         avc->code, avc->subunit_type, avc->subunit_id,
 485                         avc->opcode, operand_count);
 486
 487         if (avctp->cr == AVCTP_RESPONSE) {
 488                 handle_response(session, avctp, avc, operands, operand_count);
 489                 return TRUE;
 490         }
 491
 492         packet_size = AVCTP_HEADER_LENGTH + AVC_HEADER_LENGTH;
 493         avctp->cr = AVCTP_RESPONSE;
 494
 495         if (avctp->packet_type != AVCTP_PACKET_SINGLE) {
 496                 avc->code = AVC_CTYPE_NOT_IMPLEMENTED;
 497                 goto done;
 498         }
 499
 500         if (avctp->pid != htons(AV_REMOTE_SVCLASS_ID)) {
 501                 avctp->ipid = 1;
 502                 avc->code = AVC_CTYPE_REJECTED;
 503                 goto done;
 504         }
 505
 506         handler = find_handler(handlers, avc->opcode);
 507         if (!handler) {
 508                 DBG("handler not found for 0x%02x", avc->opcode);
 509                 packet_size += avrcp_handle_vendor_reject(&code, operands);
 510                 avc->code = code;
 511                 goto done;
 512         }
 513
 514         code = avc->code;
 515         subunit = avc->subunit_type;
 516
 517         packet_size += handler->cb(session, avctp->transaction, &code,
 518                                         &subunit, operands, operand_count,
 519                                         handler->user_data);
 520
 521         avc->code = code;
 522         avc->subunit_type = subunit;
 523
 524 done:
 525         ret = write(sock, buf, packet_size);
 526         if (ret != packet_size)
 527                 goto failed;
 528
 529         return TRUE;
 530
 531 failed:
 532         DBG("AVCTP session %p got disconnected", session);
 533         avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
 534         return FALSE;
 535 }
 536
 537 static int uinput_create(char *name)
 538 {
 539         struct uinput_dev dev;
 540         int fd, err, i;
 541
 542         fd = open("/dev/uinput", O_RDWR);
 543         if (fd < 0) {
 544                 fd = open("/dev/input/uinput", O_RDWR);
 545                 if (fd < 0) {
 546                         fd = open("/dev/misc/uinput", O_RDWR);
 547                         if (fd < 0) {
 548                                 err = -errno;
 549                                 error("Can't open input device: %s (%d)",
 550                                                         strerror(-err), -err);
 551                                 return err;
 552                         }
 553                 }
 554         }
 555
 556         memset(&dev, 0, sizeof(dev));
 557         if (name)
 558                 strncpy(dev.name, name, UINPUT_MAX_NAME_SIZE - 1);
 559
 560         dev.id.bustype = BUS_BLUETOOTH;
 561         dev.id.vendor  = 0x0000;
 562         dev.id.product = 0x0000;
 563         dev.id.version = 0x0000;
 564
 565         if (write(fd, &dev, sizeof(dev)) < 0) {
 566                 err = -errno;
 567                 error("Can't write device information: %s (%d)",
 568                                                 strerror(-err), -err);
 569                 close(fd);
 570                 return err;
 571         }
 572
 573         ioctl(fd, UI_SET_EVBIT, EV_KEY);
 574         ioctl(fd, UI_SET_EVBIT, EV_REL);
 575         ioctl(fd, UI_SET_EVBIT, EV_REP);
 576         ioctl(fd, UI_SET_EVBIT, EV_SYN);
 577
 578         for (i = 0; key_map[i].name != NULL; i++)
 579                 ioctl(fd, UI_SET_KEYBIT, key_map[i].uinput);
 580
 581         if (ioctl(fd, UI_DEV_CREATE, NULL) < 0) {
 582                 err = -errno;
 583                 error("Can't create uinput device: %s (%d)",
 584                                                 strerror(-err), -err);
 585                 close(fd);
 586                 return err;
 587         }
 588
 589         return fd;
 590 }
 591
 592 static void init_uinput(struct avctp *session)
 593 {
 594         struct audio_device *dev;
 595         char address[18], name[248 + 1];
 596
 597         dev = manager_get_device(&session->server->src, &session->dst, FALSE);
 598
 599         device_get_name(dev->btd_dev, name, sizeof(name));
 600         if (g_str_equal(name, "Nokia CK-20W")) {
 601                 session->key_quirks[FORWARD_OP] |= QUIRK_NO_RELEASE;
 602                 session->key_quirks[BACKWARD_OP] |= QUIRK_NO_RELEASE;
 603                 session->key_quirks[PLAY_OP] |= QUIRK_NO_RELEASE;
 604                 session->key_quirks[PAUSE_OP] |= QUIRK_NO_RELEASE;
 605         }
 606
 607         ba2str(&session->dst, address);
 608
 609         session->uinput = uinput_create(address);
 610         if (session->uinput < 0)
 611                 error("AVRCP: failed to init uinput for %s", address);
 612         else
 613                 DBG("AVRCP: uinput initialized for %s", address);
 614 }
 615
 616 static void avctp_connect_cb(GIOChannel *chan, GError *err, gpointer data)
 617 {
 618         struct avctp *session = data;
 619         char address[18];
 620         uint16_t imtu;
 621         GError *gerr = NULL;
 622
 623         if (err) {
 624                 avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
 625                 error("%s", err->message);
 626                 return;
 627         }
 628
 629         bt_io_get(chan, BT_IO_L2CAP, &gerr,
 630                         BT_IO_OPT_DEST, &address,
 631                         BT_IO_OPT_IMTU, &imtu,
 632                         BT_IO_OPT_INVALID);
 633         if (gerr) {
 634                 avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
 635                 error("%s", gerr->message);
 636                 g_error_free(gerr);
 637                 return;
 638         }
 639
 640         DBG("AVCTP: connected to %s", address);
 641
 642         if (!session->io)
 643                 session->io = g_io_channel_ref(chan);
 644
 645         init_uinput(session);
 646
 647         avctp_set_state(session, AVCTP_STATE_CONNECTED);
 648         session->mtu = imtu;
 649         session->io_id = g_io_add_watch(chan,
 650                                 G_IO_IN | G_IO_ERR | G_IO_HUP | G_IO_NVAL,
 651                                 (GIOFunc) session_cb, session);
 652 }
 653
 654 static void auth_cb(DBusError *derr, void *user_data)
 655 {
 656         struct avctp *session = user_data;
 657         GError *err = NULL;
 658
 659         if (session->io_id) {
 660                 g_source_remove(session->io_id);
 661                 session->io_id = 0;
 662         }
 663
 664         if (derr && dbus_error_is_set(derr)) {
 665                 error("Access denied: %s", derr->message);
 666                 avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
 667                 return;
 668         }
 669
 670         if (!bt_io_accept(session->io, avctp_connect_cb, session,
 671                                                                 NULL, &err)) {
 672                 error("bt_io_accept: %s", err->message);
 673                 g_error_free(err);
 674                 avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
 675         }
 676 }
 677
 678 static struct avctp_server *find_server(GSList *list, const bdaddr_t *src)
 679 {
 680         for (; list; list = list->next) {
 681                 struct avctp_server *server = list->data;
 682
 683                 if (bacmp(&server->src, src) == 0)
 684                         return server;
 685         }
 686
 687         return NULL;
 688 }
 689
 690 static struct avctp *find_session(GSList *list, const bdaddr_t *dst)
 691 {
 692         for (; list != NULL; list = g_slist_next(list)) {
 693                 struct avctp *s = list->data;
 694
 695                 if (bacmp(dst, &s->dst))
 696                         continue;
 697
 698                 return s;
 699         }
 700
 701         return NULL;
 702 }
 703
 704 static struct avctp *avctp_get_internal(const bdaddr_t *src,
 705                                                         const bdaddr_t *dst)
 706 {
 707         struct avctp_server *server;
 708         struct avctp *session;
 709
 710         assert(src != NULL);
 711         assert(dst != NULL);
 712
 713         server = find_server(servers, src);
 714         if (server == NULL)
 715                 return NULL;
 716
 717         session = find_session(server->sessions, dst);
 718         if (session)
 719                 return session;
 720
 721         session = g_new0(struct avctp, 1);
 722
 723         session->server = server;
 724         bacpy(&session->dst, dst);
 725         session->state = AVCTP_STATE_DISCONNECTED;
 726
 727         server->sessions = g_slist_append(server->sessions, session);
 728
 729         return session;
 730 }
 731
 732 static void avctp_confirm_cb(GIOChannel *chan, gpointer data)
 733 {
 734         struct avctp *session;
 735         struct audio_device *dev;
 736         char address[18];
 737         bdaddr_t src, dst;
 738         GError *err = NULL;
 739
 740         bt_io_get(chan, BT_IO_L2CAP, &err,
 741                         BT_IO_OPT_SOURCE_BDADDR, &src,
 742                         BT_IO_OPT_DEST_BDADDR, &dst,
 743                         BT_IO_OPT_DEST, address,
 744                         BT_IO_OPT_INVALID);
 745         if (err) {
 746                 error("%s", err->message);
 747                 g_error_free(err);
 748                 g_io_channel_shutdown(chan, TRUE, NULL);
 749                 return;
 750         }
 751
 752         DBG("AVCTP: incoming connect from %s", address);
 753
 754         session = avctp_get_internal(&src, &dst);
 755         if (!session)
 756                 goto drop;
 757
 758         dev = manager_get_device(&src, &dst, FALSE);
 759         if (!dev) {
 760                 dev = manager_get_device(&src, &dst, TRUE);
 761                 if (!dev) {
 762                         error("Unable to get audio device object for %s",
 763                                         address);
 764                         goto drop;
 765                 }
 766         }
 767
 768         if (dev->control == NULL) {
 769                 btd_device_add_uuid(dev->btd_dev, AVRCP_REMOTE_UUID);
 770                 if (dev->control == NULL)
 771                         goto drop;
 772         }
 773
 774         if (session->io) {
 775                 error("Refusing unexpected connect from %s", address);
 776                 goto drop;
 777         }
 778
 779         avctp_set_state(session, AVCTP_STATE_CONNECTING);
 780         session->io = g_io_channel_ref(chan);
 781
 782         if (audio_device_request_authorization(dev, AVRCP_TARGET_UUID,
 783                                                 auth_cb, session) < 0)
 784                 goto drop;
 785
 786         session->io_id = g_io_add_watch(chan, G_IO_ERR | G_IO_HUP | G_IO_NVAL,
 787                                                         session_cb, session);
 788         return;
 789
 790 drop:
 791         if (!session || !session->io)
 792                 g_io_channel_shutdown(chan, TRUE, NULL);
 793         if (session)
 794                 avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
 795 }
 796
 797 static GIOChannel *avctp_server_socket(const bdaddr_t *src, gboolean master)
 798 {
 799         GError *err = NULL;
 800         GIOChannel *io;
 801
 802         io = bt_io_listen(BT_IO_L2CAP, NULL, avctp_confirm_cb, NULL,
 803                                 NULL, &err,
 804                                 BT_IO_OPT_SOURCE_BDADDR, src,
 805                                 BT_IO_OPT_PSM, AVCTP_PSM,
 806                                 BT_IO_OPT_SEC_LEVEL, BT_IO_SEC_MEDIUM,
 807                                 BT_IO_OPT_MASTER, master,
 808                                 BT_IO_OPT_INVALID);
 809         if (!io) {
 810                 error("%s", err->message);
 811                 g_error_free(err);
 812         }
 813
 814         return io;
 815 }
 816
 817 static unsigned int passthrough_id = 0;
 818 static unsigned int unit_id = 0;
 819 static unsigned int subunit_id = 0;
 820
 821 int avctp_register(const bdaddr_t *src, gboolean master)
 822 {
 823         struct avctp_server *server;
 824
 825         server = g_new0(struct avctp_server, 1);
 826         if (!server)
 827                 return -ENOMEM;
 828
 829         server->io = avctp_server_socket(src, master);
 830         if (!server->io) {
 831                 g_free(server);
 832                 return -1;
 833         }
 834
 835         bacpy(&server->src, src);
 836
 837         servers = g_slist_append(servers, server);
 838
 839         if (!passthrough_id)
 840                 passthrough_id = avctp_register_pdu_handler(AVC_OP_PASSTHROUGH,
 841                                         handle_panel_passthrough, NULL);
 842
 843         if (!unit_id)
 844                 unit_id = avctp_register_pdu_handler(AVC_OP_UNITINFO, handle_unit_info,
 845                                                                         NULL);
 846
 847         if (!subunit_id)
 848                 subunit_id = avctp_register_pdu_handler(AVC_OP_SUBUNITINFO,
 849                                                 handle_subunit_info, NULL);
 850
 851         return 0;
 852 }
 853
 854 void avctp_unregister(const bdaddr_t *src)
 855 {
 856         struct avctp_server *server;
 857
 858         server = find_server(servers, src);
 859         if (!server)
 860                 return;
 861
 862         while (server->sessions)
 863                 avctp_disconnected(server->sessions->data);
 864
 865         servers = g_slist_remove(servers, server);
 866
 867         g_io_channel_shutdown(server->io, TRUE, NULL);
 868         g_io_channel_unref(server->io);
 869         g_free(server);
 870
 871         if (servers)
 872                 return;
 873
 874         if (passthrough_id) {
 875                 avctp_unregister_pdu_handler(passthrough_id);
 876                 passthrough_id = 0;
 877         }
 878
 879         if (unit_id) {
 880                 avctp_unregister_pdu_handler(unit_id);
 881                 passthrough_id = 0;
 882         }
 883
 884         if (subunit_id) {
 885                 avctp_unregister_pdu_handler(subunit_id);
 886                 subunit_id = 0;
 887         }
 888 }
 889
 890 int avctp_send_passthrough(struct avctp *session, uint8_t op)
 891 {
 892         unsigned char buf[AVCTP_HEADER_LENGTH + AVC_HEADER_LENGTH + 2];
 893         struct avctp_header *avctp = (void *) buf;
 894         struct avc_header *avc = (void *) &buf[AVCTP_HEADER_LENGTH];
 895         uint8_t *operands = &buf[AVCTP_HEADER_LENGTH + AVC_HEADER_LENGTH];
 896         int sk;
 897
 898         if (session->state != AVCTP_STATE_CONNECTED)
 899                 return -ENOTCONN;
 900
 901         memset(buf, 0, sizeof(buf));
 902
 903         avctp->transaction = id++;
 904         avctp->packet_type = AVCTP_PACKET_SINGLE;
 905         avctp->cr = AVCTP_COMMAND;
 906         avctp->pid = htons(AV_REMOTE_SVCLASS_ID);
 907
 908         avc->code = AVC_CTYPE_CONTROL;
 909         avc->subunit_type = AVC_SUBUNIT_PANEL;
 910         avc->opcode = AVC_OP_PASSTHROUGH;
 911
 912         operands[0] = op & 0x7f;
 913         operands[1] = 0;
 914
 915         sk = g_io_channel_unix_get_fd(session->io);
 916
 917         if (write(sk, buf, sizeof(buf)) < 0)
 918                 return -errno;
 919
 920         /* Button release */
 921         avctp->transaction = id++;
 922         operands[0] |= 0x80;
 923
 924         if (write(sk, buf, sizeof(buf)) < 0)
 925                 return -errno;
 926
 927         return 0;
 928 }
 929
 930 static int avctp_send(struct avctp *session, uint8_t transaction, uint8_t cr,
 931                                 uint8_t code, uint8_t subunit, uint8_t opcode,
 932                                 uint8_t *operands, size_t operand_count)
 933 {
 934         uint8_t *buf;
 935         struct avctp_header *avctp;
 936         struct avc_header *avc;
 937         uint8_t *pdu;
 938         int sk, err = 0;
 939         uint16_t size;
 940
 941         if (session->state != AVCTP_STATE_CONNECTED)
 942                 return -ENOTCONN;
 943
 944         sk = g_io_channel_unix_get_fd(session->io);
 945         size = AVCTP_HEADER_LENGTH + AVC_HEADER_LENGTH + operand_count;
 946         buf = g_malloc0(size);
 947
 948         avctp = (void *) buf;
 949         avc = (void *) &buf[AVCTP_HEADER_LENGTH];
 950         pdu = (void *) &buf[AVCTP_HEADER_LENGTH + AVC_HEADER_LENGTH];
 951
 952         avctp->transaction = transaction;
 953         avctp->packet_type = AVCTP_PACKET_SINGLE;
 954         avctp->cr = cr;
 955         avctp->pid = htons(AV_REMOTE_SVCLASS_ID);
 956
 957         avc->code = code;
 958         avc->subunit_type = subunit;
 959         avc->opcode = opcode;
 960
 961         memcpy(pdu, operands, operand_count);
 962
 963         if (write(sk, buf, size) < 0)
 964                 err = -errno;
 965
 966         g_free(buf);
 967         return err;
 968 }
 969
 970 int avctp_send_vendordep(struct avctp *session, uint8_t transaction,
 971                                 uint8_t code, uint8_t subunit,
 972                                 uint8_t *operands, size_t operand_count)
 973 {
 974         return avctp_send(session, transaction, AVCTP_RESPONSE, code, subunit,
 975                                         AVC_OP_VENDORDEP, operands, operand_count);
 976 }
 977
 978 int avctp_send_vendordep_req(struct avctp *session, uint8_t code,
 979                                         uint8_t subunit, uint8_t *operands,
 980                                         size_t operand_count,
 981                                         avctp_rsp_cb func, void *user_data)
 982 {
 983         struct avctp_rsp_handler *handler;
 984         int err;
 985
 986         err = avctp_send(session, id, AVCTP_COMMAND, code, subunit,
 987                                 AVC_OP_VENDORDEP, operands, operand_count);
 988         if (err < 0)
 989                 return err;
 990
 991         handler = g_new0(struct avctp_rsp_handler, 1);
 992         handler->id = id;
 993         handler->func = func;
 994         handler->user_data = user_data;
 995
 996         session->handlers = g_slist_prepend(session->handlers, handler);
 997
 998         id++;
 999
1000         return 0;
1001 }
1002
1003 unsigned int avctp_add_state_cb(avctp_state_cb cb, void *user_data)
1004 {
1005         struct avctp_state_callback *state_cb;
1006         static unsigned int id = 0;
1007
1008         state_cb = g_new(struct avctp_state_callback, 1);
1009         state_cb->cb = cb;
1010         state_cb->user_data = user_data;
1011         state_cb->id = ++id;
1012
1013         callbacks = g_slist_append(callbacks, state_cb);
1014
1015         return state_cb->id;
1016 }
1017
1018 gboolean avctp_remove_state_cb(unsigned int id)
1019 {
1020         GSList *l;
1021
1022         for (l = callbacks; l != NULL; l = l->next) {
1023                 struct avctp_state_callback *cb = l->data;
1024                 if (cb && cb->id == id) {
1025                         callbacks = g_slist_remove(callbacks, cb);
1026                         g_free(cb);
1027                         return TRUE;
1028                 }
1029         }
1030
1031         return FALSE;
1032 }
1033
1034 unsigned int avctp_register_pdu_handler(uint8_t opcode, avctp_pdu_cb cb,
1035                                                         void *user_data)
1036 {
1037         struct avctp_pdu_handler *handler;
1038         static unsigned int id = 0;
1039
1040         handler = find_handler(handlers, opcode);
1041         if (handler)
1042                 return 0;
1043
1044         handler = g_new(struct avctp_pdu_handler, 1);
1045         handler->opcode = opcode;
1046         handler->cb = cb;
1047         handler->user_data = user_data;
1048         handler->id = ++id;
1049
1050         handlers = g_slist_append(handlers, handler);
1051
1052         return handler->id;
1053 }
1054
1055 gboolean avctp_unregister_pdu_handler(unsigned int id)
1056 {
1057         GSList *l;
1058
1059         for (l = handlers; l != NULL; l = l->next) {
1060                 struct avctp_pdu_handler *handler = l->data;
1061
1062                 if (handler->id == id) {
1063                         handlers = g_slist_remove(handlers, handler);
1064                         g_free(handler);
1065                         return TRUE;
1066                 }
1067         }
1068
1069         return FALSE;
1070 }
1071
1072 struct avctp *avctp_connect(const bdaddr_t *src, const bdaddr_t *dst)
1073 {
1074         struct avctp *session;
1075         GError *err = NULL;
1076         GIOChannel *io;
1077
1078         session = avctp_get_internal(src, dst);
1079         if (!session)
1080                 return NULL;
1081
1082         if (session->state > AVCTP_STATE_DISCONNECTED)
1083                 return session;
1084
1085         avctp_set_state(session, AVCTP_STATE_CONNECTING);
1086
1087         io = bt_io_connect(BT_IO_L2CAP, avctp_connect_cb, session, NULL, &err,
1088                                 BT_IO_OPT_SOURCE_BDADDR, &session->server->src,
1089                                 BT_IO_OPT_DEST_BDADDR, &session->dst,
1090                                 BT_IO_OPT_PSM, AVCTP_PSM,
1091                                 BT_IO_OPT_INVALID);
1092         if (err) {
1093                 avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
1094                 error("%s", err->message);
1095                 g_error_free(err);
1096                 return NULL;
1097         }
1098
1099         session->io = io;
1100
1101         return session;
1102 }
1103
1104 void avctp_disconnect(struct avctp *session)
1105 {
1106         if (!session->io)
1107                 return;
1108
1109         avctp_set_state(session, AVCTP_STATE_DISCONNECTED);
1110 }
1111
1112 struct avctp *avctp_get(const bdaddr_t *src, const bdaddr_t *dst)
1113 {
1114         return avctp_get_internal(src, dst);
1115 }