Initial Bluedroid stack commit

9 files changed, 5836 insertions, 0 deletions

diff --git a/stack/avrc/avrc_api.c b/stack/avrc/avrc_api.c
new file mode 100644
index 0000000..dd7e752
--- /dev/null
+++ b/stack/avrc/avrc_api.c
@@ -0,0 +1,1132 @@
+/*****************************************************************************
+**
+**  Name:       avrc_api.c
+**
+**  Description:Interface to AVRCP mandatory commands
+**
+**  Copyright (c) 2003-2010, Broadcom Corp., All Rights Reserved.
+**  Broadcom Bluetooth Core. Proprietary and confidential.
+**
+*****************************************************************************/
+#include <string.h>
+
+#include "gki.h"
+#include "avrc_api.h"
+#include "avrc_int.h"
+#include "wcassert.h"
+
+/*****************************************************************************
+**  Global data
+*****************************************************************************/
+
+
+#define AVRC_MAX_RCV_CTRL_EVT   AVCT_BROWSE_UNCONG_IND_EVT
+
+static const UINT8 avrc_ctrl_event_map[] = 
+{
+    AVRC_OPEN_IND_EVT,  /* AVCT_CONNECT_CFM_EVT */
+    AVRC_OPEN_IND_EVT,  /* AVCT_CONNECT_IND_EVT */
+    AVRC_CLOSE_IND_EVT, /* AVCT_DISCONNECT_CFM_EVT */
+    AVRC_CLOSE_IND_EVT, /* AVCT_DISCONNECT_IND_EVT */
+    AVRC_CONG_IND_EVT,  /* AVCT_CONG_IND_EVT */
+    AVRC_UNCONG_IND_EVT,/* AVCT_UNCONG_IND_EVT */
+    AVRC_BROWSE_OPEN_IND_EVT,  /* AVCT_BROWSE_CONN_CFM_EVT   */ 
+    AVRC_BROWSE_OPEN_IND_EVT,  /* AVCT_BROWSE_CONN_IND_EVT   */ 
+    AVRC_BROWSE_CLOSE_IND_EVT, /* AVCT_BROWSE_DISCONN_CFM_EVT */
+    AVRC_BROWSE_CLOSE_IND_EVT, /* AVCT_BROWSE_DISCONN_IND_EVT */
+    AVRC_BROWSE_CONG_IND_EVT,  /* AVCT_BROWSE_CONG_IND_EVT    */
+    AVRC_BROWSE_UNCONG_IND_EVT /* AVCT_BROWSE_UNCONG_IND_EVT  */
+};
+
+#define AVRC_OP_DROP        0xFE    /* use this unused opcode to indication no need to call the callback function */
+#define AVRC_OP_DROP_N_FREE 0xFD    /* use this unused opcode to indication no need to call the callback function & free buffer */
+
+/******************************************************************************
+**
+** Function         avrc_ctrl_cback
+**
+** Description      This is the callback function used by AVCTP to report
+**                  received link events.
+**
+** Returns          Nothing.
+**
+******************************************************************************/
+static void avrc_ctrl_cback(UINT8 handle, UINT8 event, UINT16 result,
+                                BD_ADDR peer_addr)
+{
+    UINT8   avrc_event;
+
+    if (event <= AVRC_MAX_RCV_CTRL_EVT && avrc_cb.ccb[handle].p_ctrl_cback)
+    {
+        avrc_event = avrc_ctrl_event_map[event];
+        if (event == AVCT_CONNECT_CFM_EVT)
+        {
+            if (result != 0) /* failed */
+                avrc_event = AVRC_CLOSE_IND_EVT;
+        }
+        (*avrc_cb.ccb[handle].p_ctrl_cback)(handle, avrc_event, result, peer_addr);
+    }
+    /* else drop the unknown event*/
+}
+
+/******************************************************************************
+**
+** Function         avrc_get_data_ptr
+**
+** Description      If the offset in the received buffer is smaller than required
+**                  move the portion of data AVRC cares.
+**
+** Returns          Nothing.
+**
+******************************************************************************/
+static UINT8 * avrc_get_data_ptr(BT_HDR *p_pkt)
+{
+    UINT8   *p_data = (UINT8 *)(p_pkt+1) + p_pkt->offset;
+    int     i, gap;
+
+    if (p_pkt->offset < AVCT_MSG_OFFSET)
+    {
+        gap = AVCT_MSG_OFFSET - p_pkt->offset;
+        for(i=p_pkt->len; i>0; i--)
+        {
+            *(p_data + i + gap) = *(p_data + i);
+        }
+        p_pkt->offset   += gap;
+        p_data          = (UINT8 *)(p_pkt+1) + p_pkt->offset;
+    }
+    *p_data         = AVRC_RSP_IMPL_STBL;
+    return p_data;
+}
+
+#if (AVRC_METADATA_INCLUDED == TRUE)
+/******************************************************************************
+**
+** Function         avrc_prep_end_frag
+**
+** Description      This function prepares an end response fragment
+**                  
+**
+** Returns          Nothing.
+**
+******************************************************************************/
+static void avrc_prep_end_frag(UINT8 handle)
+{
+    tAVRC_FRAG_CB   *p_fcb;
+    BT_HDR  *p_pkt_new;
+    UINT8   *p_data;
+
+    AVRC_TRACE_DEBUG0 ("avrc_prep_end_frag" );
+    p_fcb = &avrc_cb.fcb[handle];
+    p_pkt_new           = p_fcb->p_fmsg;
+    p_pkt_new->len      -= (AVRC_MAX_CTRL_DATA_LEN - AVRC_VENDOR_HDR_SIZE - AVRC_MIN_META_HDR_SIZE);
+    p_pkt_new->offset   += (AVRC_MAX_CTRL_DATA_LEN - AVRC_VENDOR_HDR_SIZE - AVRC_MIN_META_HDR_SIZE);
+    p_data = (UINT8 *)(p_pkt_new+1) + p_pkt_new->offset;
+    *p_data++       = (AVRC_RSP_ACCEPT & AVRC_CTYPE_MASK);
+    *p_data++       = (AVRC_SUB_PANEL << AVRC_SUBTYPE_SHIFT);
+    *p_data++       = AVRC_OP_VENDOR;
+    AVRC_CO_ID_TO_BE_STREAM(p_data, AVRC_CO_METADATA);
+    *p_data++       = p_fcb->frag_pdu;
+    *p_data++       = AVRC_PKT_END;
+    UINT16_TO_BE_STREAM(p_data, (p_pkt_new->len - AVRC_VENDOR_HDR_SIZE - AVRC_MIN_META_HDR_SIZE)); /* 4=pdu, pkt_type & len */
+}
+
+/******************************************************************************
+**
+** Function         avrc_send_continue_frag
+**
+** Description      This function sends a continue response fragment
+**                  
+**
+** Returns          Nothing.
+**
+******************************************************************************/
+static void avrc_send_continue_frag(UINT8 handle, UINT8 label)
+{
+    tAVRC_FRAG_CB   *p_fcb;
+    BT_HDR  *p_pkt_old, *p_pkt;
+    UINT8   *p_old, *p_data;
+    UINT8   cr = AVCT_RSP;
+    tAVRC_RSP   rej_rsp;
+
+    p_fcb = &avrc_cb.fcb[handle];
+    p_pkt = p_fcb->p_fmsg;
+
+    AVRC_TRACE_DEBUG1 ("avrc_send_continue_frag len(%d) / AVRC_MAX_CTRL_DATA_LEN", p_pkt->len );
+    if (p_pkt->len > AVRC_MAX_CTRL_DATA_LEN)
+    {
+        p_pkt_old = p_fcb->p_fmsg;
+        p_pkt = (BT_HDR *)GKI_getbuf((UINT16)(AVRC_PACKET_LEN + AVCT_MSG_OFFSET + BT_HDR_SIZE));
+        if (p_pkt)
+        {
+            p_pkt->len          = AVRC_MAX_CTRL_DATA_LEN;
+            p_pkt->offset       = AVCT_MSG_OFFSET;
+            p_pkt->layer_specific = p_pkt_old->layer_specific;
+            p_pkt->event = p_pkt_old->event;
+            p_old = (UINT8 *)(p_pkt_old+1) + p_pkt_old->offset;
+            p_data = (UINT8 *)(p_pkt+1) + p_pkt->offset;
+            memcpy (p_data, p_old, AVRC_MAX_CTRL_DATA_LEN);
+            /* use AVRC continue packet type */
+            p_data += AVRC_VENDOR_HDR_SIZE;
+            p_data++; /* pdu */
+            *p_data++ = AVRC_PKT_CONTINUE;
+            UINT16_TO_BE_STREAM(p_data, (AVRC_MAX_CTRL_DATA_LEN - AVRC_VENDOR_HDR_SIZE - 4)); /* 4=pdu, pkt_type & len */
+
+            /* prepare the left over for as an end fragment */
+            avrc_prep_end_frag (handle);
+        }
+        else
+        {
+            /* use the current GKI buffer to send Internal error status */
+            p_pkt = p_fcb->p_fmsg;
+            p_fcb->p_fmsg = NULL;
+            p_fcb->frag_enabled = FALSE;
+            AVRC_TRACE_ERROR0 ("AVRC_MsgReq no buffers for fragmentation - send internal error" );
+            p_data = (UINT8 *)(p_pkt+1) + p_pkt->offset;
+            *p_data++ = AVRC_PDU_REQUEST_CONTINUATION_RSP;
+            *p_data++ = 0;
+            UINT16_TO_BE_STREAM(p_data, 0);
+            p_pkt->len = 4;
+            rej_rsp.pdu = AVRC_PDU_REQUEST_CONTINUATION_RSP;
+            rej_rsp.status = AVRC_STS_INTERNAL_ERR;
+            AVRC_BldResponse( handle, (tAVRC_RESPONSE *)&rej_rsp, &p_pkt);
+            cr = AVCT_RSP;
+        }
+    }
+    else
+    {
+        /* end fragment. clean the control block */
+        p_fcb->frag_enabled = FALSE;
+        p_fcb->p_fmsg       = NULL;
+    }
+    AVCT_MsgReq( handle, label, cr, p_pkt);
+}
+
+/******************************************************************************
+**
+** Function         avrc_proc_vendor_command
+**
+** Description      This function processes received vendor command.
+**                  
+**
+** Returns          if not NULL, the response to send right away.
+**
+******************************************************************************/
+static BT_HDR * avrc_proc_vendor_command(UINT8 handle, UINT8 label,
+                               BT_HDR *p_pkt, tAVRC_MSG_VENDOR *p_msg)
+{
+    BT_HDR      *p_rsp = NULL;
+    UINT8       *p_data;
+    UINT8       *p_begin;
+    UINT8       pkt_type;
+    BOOLEAN     abort_frag = FALSE;
+    tAVRC_STS   status = AVRC_STS_NO_ERROR;
+    tAVRC_FRAG_CB   *p_fcb;
+
+    p_begin  = (UINT8 *)(p_pkt+1) + p_pkt->offset;
+    p_data   = p_begin + AVRC_VENDOR_HDR_SIZE;
+    pkt_type = *(p_data + 1) & AVRC_PKT_TYPE_MASK;
+
+    if (pkt_type != AVRC_PKT_SINGLE)
+    {
+        /* reject - commands can only be in single packets at AVRCP level */
+        AVRC_TRACE_ERROR1 ("commands must be in single packet pdu:0x%x", *p_data );
+        /* use the current GKI buffer to send the reject */
+        status = AVRC_STS_BAD_CMD;
+    }
+    /* check if there are fragments waiting to be sent */
+    else if (avrc_cb.fcb[handle].frag_enabled)
+    {
+        p_fcb = &avrc_cb.fcb[handle];
+        if (p_msg->company_id == AVRC_CO_METADATA)
+        {
+            switch (*p_data)
+            {
+            case AVRC_PDU_ABORT_CONTINUATION_RSP:
+                /* aborted by CT - send accept response */
+                abort_frag = TRUE;
+                p_begin = (UINT8 *)(p_pkt+1) + p_pkt->offset;
+                *p_begin = (AVRC_RSP_ACCEPT & AVRC_CTYPE_MASK);
+                if (*(p_data + 4) != p_fcb->frag_pdu)
+                {
+                    *p_begin = (AVRC_RSP_REJ & AVRC_CTYPE_MASK);
+                    *(p_data + 4) = AVRC_STS_BAD_PARAM;
+                }
+                else
+                {
+                    p_data = (p_begin + AVRC_VENDOR_HDR_SIZE + 2);
+                    UINT16_TO_BE_STREAM(p_data, 0);
+                    p_pkt->len = (p_data - p_begin);
+                }
+                AVCT_MsgReq( handle, label, AVCT_RSP, p_pkt);
+                p_msg->hdr.opcode = AVRC_OP_DROP; /* used the p_pkt to send response */
+                break;
+
+            case AVRC_PDU_REQUEST_CONTINUATION_RSP:
+                if (*(p_data + 4) == p_fcb->frag_pdu)
+                {
+                    avrc_send_continue_frag(handle, label);
+                    p_msg->hdr.opcode = AVRC_OP_DROP_N_FREE;
+                }
+                else
+                {
+                    /* the pdu id does not match - reject the command using the current GKI buffer */
+                    AVRC_TRACE_ERROR2("avrc_proc_vendor_command continue pdu: 0x%x does not match current re-assembly pdu: 0x%x",
+                        *(p_data + 4), p_fcb->frag_pdu);
+                    status = AVRC_STS_BAD_PARAM;
+                    abort_frag = TRUE;
+                }
+                break;
+
+            default:
+                /* implicit abort */
+                abort_frag = TRUE;
+            }
+        }
+        else
+        {
+            abort_frag = TRUE;
+            /* implicit abort */
+        }
+
+        if (abort_frag)
+        {
+            if (p_fcb->p_fmsg)
+                GKI_freebuf(p_fcb->p_fmsg);
+            p_fcb->p_fmsg = NULL;
+            p_fcb->frag_enabled = FALSE;
+        }
+    }
+
+    if (status != AVRC_STS_NO_ERROR)
+    {
+        /* use the current GKI buffer to build/send the reject message */
+        p_data = (UINT8 *)(p_pkt+1) + p_pkt->offset;
+        *p_data++ = AVRC_RSP_REJ;
+        p_data += AVRC_VENDOR_HDR_SIZE; /* pdu */
+        *p_data++ = 0;                  /* pkt_type */
+        UINT16_TO_BE_STREAM(p_data, 1); /* len */
+        *p_data++ = status;             /* error code */
+        p_pkt->len = AVRC_VENDOR_HDR_SIZE + 5;
+        p_rsp = p_pkt;
+    }
+
+    return p_rsp;
+}
+
+/******************************************************************************
+**
+** Function         avrc_proc_far_msg
+**
+** Description      This function processes vendor command/response fragmetation
+**                  and reassembly
+**
+** Returns          0, to report the message with msg_cback .
+**
+******************************************************************************/
+static UINT8 avrc_proc_far_msg(UINT8 handle, UINT8 label, UINT8 cr, BT_HDR **pp_pkt, tAVRC_MSG_VENDOR *p_msg)
+{
+    BT_HDR      *p_pkt = *pp_pkt;
+    UINT8       *p_data;
+    BOOLEAN     drop = FALSE;
+    BT_HDR      *p_rsp = NULL;
+    BT_HDR      *p_cmd = NULL;
+    BOOLEAN     req_continue = FALSE;
+    BT_HDR      *p_pkt_new = NULL;
+    UINT8       pkt_type;
+    UINT16      buf_len;
+    tAVRC_RASM_CB   *p_rcb;
+    tAVRC_NEXT_CMD   avrc_cmd;
+
+    p_data  = (UINT8 *)(p_pkt+1) + p_pkt->offset;
+    pkt_type = *(p_data + 1) & AVRC_PKT_TYPE_MASK;
+    AVRC_TRACE_DEBUG1 ("pkt_type %d", pkt_type );
+    p_rcb = &avrc_cb.rcb[handle];
+    if (p_msg->company_id == AVRC_CO_METADATA)
+    {
+        /* check if the message needs to be re-assembled */
+        if (pkt_type == AVRC_PKT_SINGLE || pkt_type == AVRC_PKT_START)
+        {
+            /* previous fragments need to be dropped, when received another new message */
+            p_rcb->rasm_offset = 0;
+            if (p_rcb->p_rmsg)
+            {
+                GKI_freebuf(p_rcb->p_rmsg);
+                p_rcb->p_rmsg = NULL;
+            }
+        }
+
+        if (pkt_type != AVRC_PKT_SINGLE && cr == AVCT_RSP)
+        {
+            /* not a single response packet - need to re-assemble metadata messages */
+            if (pkt_type == AVRC_PKT_START)
+            {
+                p_rcb->rasm_offset = p_pkt->offset;
+                p_rcb->p_rmsg = p_pkt;
+                /* set offset to point to where to copy next - use the same re-asm logic as AVCT */
+                p_rcb->p_rmsg->offset += p_rcb->p_rmsg->len;
+                p_rcb->rasm_pdu = *p_data;
+                req_continue = TRUE;
+            }
+            else
+            {
+                /* get size of buffer holding assembled message */
+                buf_len = GKI_get_buf_size (p_rcb->p_rmsg) - sizeof(BT_HDR);
+                /* adjust offset and len of fragment for header byte */
+                p_pkt->offset += (AVRC_VENDOR_HDR_SIZE + AVRC_MIN_META_HDR_SIZE);
+                p_pkt->len -= (AVRC_VENDOR_HDR_SIZE + AVRC_MIN_META_HDR_SIZE);
+                /* verify length */
+                if ((p_rcb->p_rmsg->offset + p_pkt->len) > buf_len)
+                {
+                    AVRC_TRACE_WARNING0("Fragmented message too big! - report the partial message");
+                    p_pkt->len = buf_len - p_rcb->p_rmsg->offset;
+                    pkt_type = AVRC_PKT_END;
+                }
+
+                /* copy contents of p_pkt to p_rx_msg */
+                memcpy((UINT8 *)(p_rcb->p_rmsg + 1) + p_rcb->p_rmsg->offset,
+                       (UINT8 *)(p_pkt + 1) + p_pkt->offset, p_pkt->len);
+
+                if (pkt_type == AVRC_PKT_END)
+                {
+                    p_rcb->p_rmsg->offset = p_rcb->rasm_offset;
+                    p_rcb->p_rmsg->len += p_pkt->len;
+                    p_pkt_new = p_rcb->p_rmsg;
+                    p_rcb->rasm_offset = 0;
+                    p_rcb->p_rmsg = NULL;
+                    p_msg->p_vendor_data   = (UINT8 *)(p_pkt_new+1) + p_pkt_new->offset;
+                    p_msg->hdr.ctype       = p_msg->p_vendor_data[0] & AVRC_CTYPE_MASK;
+                    p_msg->p_vendor_data  += AVRC_VENDOR_HDR_SIZE; /* 6 = ctype, subunit*, opcode & CO_ID */
+                    p_msg->vendor_len      = p_pkt_new->len - AVRC_VENDOR_HDR_SIZE;
+                    p_data = p_msg->p_vendor_data + 1; /* skip pdu */
+                    *p_data++ = AVRC_PKT_SINGLE;
+                    UINT16_TO_BE_STREAM(p_data, (p_msg->vendor_len - AVRC_MIN_META_HDR_SIZE));
+                    AVRC_TRACE_DEBUG3("end frag:%d, total len:%d, offset:%d", p_pkt->len, p_pkt_new->len, p_pkt_new->offset);
+                }
+                else
+                {
+                    p_rcb->p_rmsg->offset += p_pkt->len;
+                    p_rcb->p_rmsg->len += p_pkt->len;
+                    p_pkt_new = NULL;
+                    req_continue = TRUE;
+                }
+                GKI_freebuf(p_pkt);
+                *pp_pkt = p_pkt_new;
+            }
+        }
+
+        if (cr == AVCT_CMD)
+        {
+            p_rsp = avrc_proc_vendor_command(handle, label, *pp_pkt, p_msg);
+            if (p_rsp)
+            {
+                AVCT_MsgReq( handle, label, AVCT_RSP, p_rsp);
+                drop = 3;
+            }
+            else if (p_msg->hdr.opcode == AVRC_OP_DROP)
+            {
+                drop = 1;
+            }
+            else if (p_msg->hdr.opcode == AVRC_OP_DROP_N_FREE)
+                drop = 4;
+
+        }
+        else if (cr == AVCT_RSP && req_continue == TRUE)
+        {
+            avrc_cmd.pdu    = AVRC_PDU_REQUEST_CONTINUATION_RSP;
+            avrc_cmd.status = AVRC_STS_NO_ERROR;
+            avrc_cmd.target_pdu = p_rcb->rasm_pdu;
+            if (AVRC_BldCommand ((tAVRC_COMMAND *)&avrc_cmd, &p_cmd) == AVRC_STS_NO_ERROR)
+            {
+                cr   = AVCT_CMD;
+                drop = 2;
+                AVRC_MsgReq (handle, (UINT8)(label+1), cr, p_cmd);
+            }
+        }
+    }
+    return drop;
+}
+#endif /* (AVRC_METADATA_INCLUDED == TRUE) */
+
+/******************************************************************************
+**
+** Function         avrc_msg_cback
+**
+** Description      This is the callback function used by AVCTP to report
+**                  received AV control messages.
+**
+** Returns          Nothing.
+**
+******************************************************************************/
+static void avrc_msg_cback(UINT8 handle, UINT8 label, UINT8 cr,
+                               BT_HDR *p_pkt)
+{
+    UINT8       opcode;
+    tAVRC_MSG   msg;
+    UINT8       *p_data;
+    UINT8       *p_begin;
+    BOOLEAN     drop = FALSE;
+    BOOLEAN     free = TRUE;
+    BT_HDR      *p_rsp = NULL;
+    UINT8       *p_rsp_data;
+    int         xx;
+    BOOLEAN     reject = FALSE;
+#if (BT_USE_TRACES == TRUE)
+    char        *p_drop_msg = "dropped";
+#endif
+    tAVRC_MSG_VENDOR *p_msg = &msg.vendor;
+
+    if (cr == AVCT_CMD &&
+        (p_pkt->layer_specific & AVCT_DATA_CTRL && AVRC_PACKET_LEN < sizeof(p_pkt->len)))
+    {
+        /* Ignore the invalid AV/C command frame */
+#if (BT_USE_TRACES == TRUE)
+        p_drop_msg = "dropped - too long AV/C cmd frame size";
+#endif
+        GKI_freebuf(p_pkt);
+        return;
+    }
+
+    if (cr == AVCT_REJ)
+    {
+        /* The peer thinks that this PID is no longer open - remove this handle */
+        /*  */
+        GKI_freebuf(p_pkt);
+        AVCT_RemoveConn(handle);
+        return;
+    }
+
+    p_data  = (UINT8 *)(p_pkt+1) + p_pkt->offset;
+    memset(&msg, 0, sizeof(tAVRC_MSG) );
+#if ((AVRC_ADV_CTRL_INCLUDED == TRUE) && (AVCT_BROWSE_INCLUDED == TRUE))
+    if (p_pkt->layer_specific == AVCT_DATA_BROWSE)
+    {
+        opcode = AVRC_OP_BROWSE;
+        msg.browse.hdr.ctype= cr;
+        msg.browse.p_browse_data   = p_data;
+        msg.browse.browse_len      = p_pkt->len;
+        msg.browse.p_browse_pkt    = p_pkt;
+    }
+    else
+#endif
+    {
+        msg.hdr.ctype           = p_data[0] & AVRC_CTYPE_MASK;
+        AVRC_TRACE_DEBUG4("avrc_msg_cback handle:%d, ctype:%d, offset:%d, len: %d",
+                handle, msg.hdr.ctype, p_pkt->offset, p_pkt->len);
+        msg.hdr.subunit_type    = (p_data[1] & AVRC_SUBTYPE_MASK) >> AVRC_SUBTYPE_SHIFT;
+        msg.hdr.subunit_id      = p_data[1] & AVRC_SUBID_MASK;
+        opcode                  = p_data[2];
+    }
+
+    if ( ((avrc_cb.ccb[handle].control & AVRC_CT_TARGET) && (cr == AVCT_CMD)) ||
+        ((avrc_cb.ccb[handle].control & AVRC_CT_CONTROL) && (cr == AVCT_RSP)) )
+    {
+
+        switch(opcode)
+        {
+        case AVRC_OP_UNIT_INFO:
+            if (cr == AVCT_CMD)
+            {
+                /* send the response to the peer */
+                p_rsp           = p_pkt; /* this also sets free = FALSE, drop = TRUE */
+                /* check & set the offset. set response code, set subunit_type & subunit_id,
+                   set AVRC_OP_UNIT_INFO */
+                p_rsp_data      = avrc_get_data_ptr(p_pkt) + AVRC_AVC_HDR_SIZE; /* 3 bytes: ctype, subunit*, opcode */
+                *p_rsp_data++   = 7;
+                /* Panel subunit & id=0 */
+                *p_rsp_data++   = (AVRC_SUB_PANEL << AVRC_SUBTYPE_SHIFT);
+                AVRC_CO_ID_TO_BE_STREAM(p_rsp_data, avrc_cb.ccb[handle].company_id);
+                p_rsp->len      = (UINT16) (p_rsp_data - (UINT8 *)(p_rsp + 1) - p_rsp->offset);
+                cr = AVCT_RSP;
+#if (BT_USE_TRACES == TRUE)
+                p_drop_msg = "auto respond";
+#endif
+            }
+            else
+            {
+                /* parse response */
+                p_data += 4; /* 3 bytes: ctype, subunit*, opcode + octet 3 (is 7)*/
+                msg.unit.unit_type  = (*p_data & AVRC_SUBTYPE_MASK) >> AVRC_SUBTYPE_SHIFT;
+                msg.unit.unit       = *p_data & AVRC_SUBID_MASK;
+                p_data++;
+                AVRC_BE_STREAM_TO_CO_ID(msg.unit.company_id, p_data);
+            }
+            break;
+
+        case AVRC_OP_SUB_INFO:
+            if (cr == AVCT_CMD)
+            {
+                /* send the response to the peer */
+                p_rsp           = p_pkt; /* this also sets free = FALSE, drop = TRUE */
+                /* check & set the offset. set response code, set (subunit_type & subunit_id),
+                   set AVRC_OP_SUB_INFO, set (page & extention code) */
+                p_rsp_data      = avrc_get_data_ptr(p_pkt) + 4;
+                /* Panel subunit & id=0 */
+                *p_rsp_data++   = (AVRC_SUB_PANEL << AVRC_SUBTYPE_SHIFT);
+                memset(p_rsp_data, AVRC_CMD_OPRND_PAD, AVRC_SUBRSP_OPRND_BYTES);
+                p_rsp_data      += AVRC_SUBRSP_OPRND_BYTES;
+                p_rsp->len      = (UINT16) (p_rsp_data - (UINT8 *)(p_rsp + 1) - p_rsp->offset);
+                cr = AVCT_RSP;
+#if (BT_USE_TRACES == TRUE)
+                p_drop_msg = "auto responded";
+#endif
+            }
+            else
+            {
+                /* parse response */
+                p_data += AVRC_AVC_HDR_SIZE; /* 3 bytes: ctype, subunit*, opcode */
+                msg.sub.page    = (*p_data++ >> AVRC_SUB_PAGE_SHIFT) & AVRC_SUB_PAGE_MASK;
+                xx      = 0;
+                while (*p_data != AVRC_CMD_OPRND_PAD && xx<AVRC_SUB_TYPE_LEN)
+                {
+                    msg.sub.subunit_type[xx] = *p_data++ >> AVRC_SUBTYPE_SHIFT;
+                    if (msg.sub.subunit_type[xx] == AVRC_SUB_PANEL)
+                        msg.sub.panel   = TRUE;
+                    xx++;
+                }
+            }
+            break;
+
+        case AVRC_OP_VENDOR:
+            p_data  = (UINT8 *)(p_pkt+1) + p_pkt->offset;
+            p_begin = p_data;
+            if (p_pkt->len < AVRC_VENDOR_HDR_SIZE) /* 6 = ctype, subunit*, opcode & CO_ID */
+            {
+                if (cr == AVCT_CMD)
+                    reject = TRUE;
+                else
+                    drop = TRUE;
+                break;
+            }
+            p_data += AVRC_AVC_HDR_SIZE; /* skip the first 3 bytes: ctype, subunit*, opcode */
+            AVRC_BE_STREAM_TO_CO_ID(p_msg->company_id, p_data);
+            p_msg->p_vendor_data   = p_data;
+            p_msg->vendor_len      = p_pkt->len - (p_data - p_begin);
+
+#if (AVRC_METADATA_INCLUDED == TRUE)
+            drop = avrc_proc_far_msg(handle, label, cr, &p_pkt, p_msg);
+            if (drop)
+            {
+                free = FALSE;
+                if (drop == 4)
+                    free = TRUE;
+#if (BT_USE_TRACES == TRUE)
+                switch (drop)
+                {
+                case 1:
+                    p_drop_msg = "sent_frag";
+                    break;
+                case 2:
+                    p_drop_msg = "req_cont";
+                    break;
+                case 3:
+                    p_drop_msg = "sent_frag3";
+                    break;
+                case 4:
+                    p_drop_msg = "sent_frag_free";
+                    break;
+                default:
+                    p_drop_msg = "sent_fragd";
+                }
+#endif
+            }
+#endif /* (AVRC_METADATA_INCLUDED == TRUE) */
+            break;
+
+        case AVRC_OP_PASS_THRU:
+            if (p_pkt->len < 5) /* 3 bytes: ctype, subunit*, opcode & op_id & len */
+            {
+                if (cr == AVCT_CMD)
+                    reject = TRUE;
+                else
+                    drop = TRUE;
+                break;
+            }
+            p_data += AVRC_AVC_HDR_SIZE; /* skip the first 3 bytes: ctype, subunit*, opcode */
+            msg.pass.op_id  = (AVRC_PASS_OP_ID_MASK & *p_data);
+            if (AVRC_PASS_STATE_MASK & *p_data)
+                msg.pass.state  = TRUE;
+            else
+                msg.pass.state  = FALSE;
+            p_data++;
+            msg.pass.pass_len    = *p_data++;
+            if (msg.pass.pass_len != p_pkt->len - 5) 
+                msg.pass.pass_len = p_pkt->len - 5;
+            if (msg.pass.pass_len)
+                msg.pass.p_pass_data = p_data;
+            else
+                msg.pass.p_pass_data = NULL;
+            break;
+
+#if ((AVRC_ADV_CTRL_INCLUDED == TRUE) && (AVCT_BROWSE_INCLUDED == TRUE))
+        case AVRC_OP_BROWSE:
+            /* the event data is handled already.
+             * this empty "case" is to keep the message from being rejected by the default case. */
+            break;
+#endif
+
+        default:
+            if ((avrc_cb.ccb[handle].control & AVRC_CT_TARGET) && (cr == AVCT_CMD))
+            {
+                /* reject unsupported opcode */
+                reject = TRUE;
+            }
+            drop    = TRUE;
+            break;
+        }
+    }
+    else /* drop the event */
+    {
+#if ((AVRC_ADV_CTRL_INCLUDED == TRUE) && (AVCT_BROWSE_INCLUDED == TRUE))
+        if (opcode != AVRC_OP_BROWSE)
+#endif
+            drop    = TRUE;
+    }
+
+    if (reject)
+    {
+        /* reject unsupported opcode */
+        p_rsp           = p_pkt; /* this also sets free = FALSE, drop = TRUE */
+        p_rsp_data      = avrc_get_data_ptr(p_pkt);
+        *p_rsp_data     = AVRC_RSP_REJ;
+#if (BT_USE_TRACES == TRUE)
+        p_drop_msg = "rejected";
+#endif
+        cr      = AVCT_RSP;
+        drop    = TRUE;
+    }
+
+    if (p_rsp)
+    {
+        /* set to send response right away */
+        AVCT_MsgReq( handle, label, cr, p_rsp);
+        free = FALSE;
+        drop = TRUE;
+    }
+
+    if (drop == FALSE)
+    {
+        msg.hdr.opcode = opcode;
+        (*avrc_cb.ccb[handle].p_msg_cback)(handle, label, opcode, &msg);
+    }
+#if (BT_USE_TRACES == TRUE)
+    else
+    {
+        AVRC_TRACE_WARNING5("avrc_msg_cback %s msg handle:%d, control:%d, cr:%d, opcode:x%x",
+                p_drop_msg,
+                handle, avrc_cb.ccb[handle].control, cr, opcode);
+    }
+#endif
+
+#if ((AVRC_ADV_CTRL_INCLUDED == TRUE) && (AVCT_BROWSE_INCLUDED == TRUE))
+    if (opcode == AVRC_OP_BROWSE && msg.browse.p_browse_pkt == NULL)
+    {
+        free = FALSE;
+    }
+#endif
+
+    if (free)
+        GKI_freebuf(p_pkt);
+}
+
+
+
+
+/******************************************************************************
+**
+** Function         avrc_pass_msg
+**
+** Description      Compose a PASS THROUGH command according to p_msg
+**
+**                  Input Parameters:
+**                      p_msg: Pointer to PASS THROUGH message structure.
+**
+**                  Output Parameters:
+**                      None.
+**
+** Returns          pointer to a valid GKI buffer if successful.
+**                  NULL if p_msg is NULL.
+**
+******************************************************************************/
+static BT_HDR  * avrc_pass_msg(tAVRC_MSG_PASS *p_msg)
+{
+    BT_HDR  *p_cmd = NULL;
+    UINT8   *p_data;
+
+    WC_ASSERT(p_msg != NULL);
+    WC_ASSERT(AVRC_CMD_POOL_SIZE > (AVRC_MIN_CMD_LEN+p_msg->pass_len));
+
+    if ((p_cmd = (BT_HDR *) GKI_getpoolbuf(AVRC_CMD_POOL_ID)) != NULL)
+    {
+        p_cmd->offset   = AVCT_MSG_OFFSET;
+        p_cmd->layer_specific   = AVCT_DATA_CTRL;
+        p_data          = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
+        *p_data++       = (p_msg->hdr.ctype & AVRC_CTYPE_MASK);
+        *p_data++       = (AVRC_SUB_PANEL << AVRC_SUBTYPE_SHIFT); /* Panel subunit & id=0 */
+        *p_data++       = AVRC_OP_PASS_THRU;
+        *p_data         = (AVRC_PASS_OP_ID_MASK&p_msg->op_id);
+        if (p_msg->state)
+            *p_data     |= AVRC_PASS_STATE_MASK;
+        p_data++;
+
+        if (p_msg->op_id == AVRC_ID_VENDOR)
+        {
+            *p_data++       = p_msg->pass_len;
+            if (p_msg->pass_len && p_msg->p_pass_data)
+            {
+                memcpy(p_data, p_msg->p_pass_data, p_msg->pass_len);
+                p_data += p_msg->pass_len;
+            }
+        }
+        else /* set msg len to 0 for other op_id */
+        {
+            /* set msg len to 0 for other op_id */
+            *p_data++       = 0;
+        }
+        p_cmd->len      = (UINT16) (p_data - (UINT8 *)(p_cmd + 1) - p_cmd->offset);
+    }
+    return p_cmd;
+}
+
+/******************************************************************************
+**
+** Function         AVRC_Open
+**
+** Description      This function is called to open a connection to AVCTP. 
+**                  The connection can be either an initiator or acceptor, as
+**                  determined by the p_ccb->stream parameter. 
+**                  The connection can be a target, a controller or for both role,
+**                  as determined by the p_ccb->control parameter. 
+**                  By definition, a target connection is an acceptor connection
+**                  that waits for an incoming AVCTP connection from the peer. 
+**                  The connection remains available to the application until
+**                  the application closes it by calling AVRC_Close().  The
+**                  application does not need to reopen the connection after an
+**                  AVRC_CLOSE_IND_EVT is received.
+**
+**                  Input Parameters:
+**                      p_ccb->company_id: Company Identifier.
+**
+**                      p_ccb->p_ctrl_cback:  Pointer to control callback function.
+**
+**                      p_ccb->p_msg_cback:  Pointer to message callback function.
+**                      
+**                      p_ccb->conn: AVCTP connection role.  This is set to
+**                      AVCTP_INT for initiator connections and AVCTP_ACP
+**                      for acceptor connections.
+**
+**                      p_ccb->control: Control role.  This is set to
+**                      AVRC_CT_TARGET for target connections, AVRC_CT_CONTROL
+**                      for control connections or (AVRC_CT_TARGET|AVRC_CT_CONTROL)
+**                      for connections that support both roles.
+**
+**                      peer_addr: BD address of peer device.  This value is
+**                      only used for initiator connections; for acceptor
+**                      connections it can be set to NULL.
+**
+**                  Output Parameters:
+**                      p_handle: Pointer to handle.  This parameter is only 
+**                                valid if AVRC_SUCCESS is returned.
+**
+** Returns          AVRC_SUCCESS if successful.
+**                  AVRC_NO_RESOURCES if there are not enough resources to open
+**                  the connection.
+**
+******************************************************************************/
+UINT16 AVRC_Open(UINT8 *p_handle, tAVRC_CONN_CB *p_ccb, BD_ADDR_PTR peer_addr)
+{
+    UINT16      status;
+    tAVCT_CC    cc;
+
+    cc.p_ctrl_cback = avrc_ctrl_cback;      /* Control callback */
+    cc.p_msg_cback  = avrc_msg_cback;       /* Message callback */
+    cc.pid          = UUID_SERVCLASS_AV_REMOTE_CONTROL;  /* Profile ID */
+    cc.role         = p_ccb->conn;          /* Initiator/acceptor role */
+    cc.control      = p_ccb->control;       /* Control role (Control/Target) */
+
+    status = AVCT_CreateConn(p_handle, &cc, peer_addr);
+    if (status == AVCT_SUCCESS)
+    {
+        memcpy(&avrc_cb.ccb[*p_handle], p_ccb, sizeof(tAVRC_CONN_CB));
+#if (AVRC_METADATA_INCLUDED == TRUE)
+        memset(&avrc_cb.fcb[*p_handle], 0, sizeof(tAVRC_FRAG_CB));
+        memset(&avrc_cb.rcb[*p_handle], 0, sizeof(tAVRC_RASM_CB));
+#endif
+    }
+    AVRC_TRACE_DEBUG4("AVRC_Open role: %d, control:%d status:%d, handle:%d", cc.role, cc.control, status, *p_handle);
+
+    return status;
+}
+
+/******************************************************************************
+**
+** Function         AVRC_Close
+**
+** Description      Close a connection opened with AVRC_Open().
+**                  This function is called when the
+**                  application is no longer using a connection.
+**
+**                  Input Parameters:
+**                      handle: Handle of this connection.
+**
+**                  Output Parameters:
+**                      None.
+**
+** Returns          AVRC_SUCCESS if successful.
+**                  AVRC_BAD_HANDLE if handle is invalid.
+**
+******************************************************************************/
+UINT16 AVRC_Close(UINT8 handle)
+{
+    AVRC_TRACE_DEBUG1("AVRC_Close handle:%d", handle);
+    return AVCT_RemoveConn(handle);
+}
+
+#if ((AVRC_ADV_CTRL_INCLUDED == TRUE) && (AVCT_BROWSE_INCLUDED == TRUE))
+/******************************************************************************
+**
+** Function         AVRC_OpenBrowse
+**
+** Description      This function is called to open a browsing connection to AVCTP. 
+**                  The connection can be either an initiator or acceptor, as
+**                  determined by the p_conn_role. 
+**                  The handle is returned by a previous call to AVRC_Open.
+**
+** Returns          AVRC_SUCCESS if successful.
+**                  AVRC_NO_RESOURCES if there are not enough resources to open
+**                  the connection.
+**
+******************************************************************************/
+UINT16 AVRC_OpenBrowse(UINT8 handle, UINT8 conn_role)
+{
+    return AVCT_CreateBrowse(handle, conn_role);
+}
+
+/******************************************************************************
+**
+** Function         AVRC_CloseBrowse
+**
+** Description      Close a connection opened with AVRC_OpenBrowse().
+**                  This function is called when the
+**                  application is no longer using a connection.
+**
+** Returns          AVRC_SUCCESS if successful.
+**                  AVRC_BAD_HANDLE if handle is invalid.
+**
+******************************************************************************/
+UINT16 AVRC_CloseBrowse(UINT8 handle)
+{
+    return AVCT_RemoveBrowse(handle);
+}
+#endif
+
+/******************************************************************************
+**
+** Function         AVRC_MsgReq
+**
+** Description      This function is used to send the AVRCP byte stream in p_pkt
+**                  down to AVCTP.
+**                  
+**                  It is expected that p_pkt->offset is at least AVCT_MSG_OFFSET
+**                  p_pkt->layer_specific is AVCT_DATA_CTRL or AVCT_DATA_BROWSE
+**                  p_pkt->event is AVRC_OP_VENDOR, AVRC_OP_PASS_THRU or AVRC_OP_BROWSE 
+**                  The above BT_HDR settings are set by the AVRC_Bld* functions.
+**
+** Returns          AVRC_SUCCESS if successful.
+**                  AVRC_BAD_HANDLE if handle is invalid.
+**
+******************************************************************************/
+UINT16 AVRC_MsgReq (UINT8 handle, UINT8 label, UINT8 ctype, BT_HDR *p_pkt)
+{
+#if (AVRC_METADATA_INCLUDED == TRUE)
+    UINT8   *p_data;
+    UINT8   cr = AVCT_CMD;
+    BOOLEAN chk_frag = TRUE;
+    UINT8   *p_start = NULL;
+    tAVRC_FRAG_CB   *p_fcb;
+    UINT16  len;
+    BT_HDR  *p_pkt_new;
+#if ((AVRC_ADV_CTRL_INCLUDED == TRUE) && (AVCT_BROWSE_INCLUDED == TRUE))
+    UINT16  peer_mtu;
+#endif
+
+    if (!p_pkt)
+        return AVRC_BAD_PARAM;
+
+    if (ctype >= AVRC_RSP_NOT_IMPL)
+        cr = AVCT_RSP;
+
+    if (p_pkt->event == AVRC_OP_VENDOR)
+    {
+        /* add AVRCP Vendor Dependent headers */
+        p_start = ((UINT8 *)(p_pkt + 1) + p_pkt->offset);
+        p_pkt->offset -= AVRC_VENDOR_HDR_SIZE;
+        p_pkt->len += AVRC_VENDOR_HDR_SIZE;
+        p_data = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+        *p_data++       = (ctype & AVRC_CTYPE_MASK);
+        *p_data++       = (AVRC_SUB_PANEL << AVRC_SUBTYPE_SHIFT);
+        *p_data++       = AVRC_OP_VENDOR;
+        AVRC_CO_ID_TO_BE_STREAM(p_data, AVRC_CO_METADATA);
+    }
+    else if (p_pkt->event == AVRC_OP_PASS_THRU)
+    {
+        /* add AVRCP Pass Through headers */
+        p_start = ((UINT8 *)(p_pkt + 1) + p_pkt->offset);
+        p_pkt->offset -= AVRC_PASS_THRU_SIZE;
+        p_pkt->len += AVRC_PASS_THRU_SIZE;
+        p_data = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+        *p_data++       = (ctype & AVRC_CTYPE_MASK);
+        *p_data++       = (AVRC_SUB_PANEL << AVRC_SUBTYPE_SHIFT);
+        *p_data++       = AVRC_OP_PASS_THRU;/* opcode */
+        *p_data++       = AVRC_ID_VENDOR;   /* operation id */
+        *p_data++       = 5;                /* operation data len */
+        AVRC_CO_ID_TO_BE_STREAM(p_data, AVRC_CO_METADATA);
+    }
+#if ((AVRC_ADV_CTRL_INCLUDED == TRUE) && (AVCT_BROWSE_INCLUDED == TRUE))
+    else
+    {
+        chk_frag = FALSE;
+        peer_mtu = AVCT_GetBrowseMtu (handle);
+        if (p_pkt->len > (peer_mtu-AVCT_HDR_LEN_SINGLE))
+        {
+            AVRC_TRACE_ERROR3 ("p_pkt->len(%d) > peer_mtu(%d-%d)", p_pkt->len, peer_mtu, AVCT_HDR_LEN_SINGLE );
+            GKI_freebuf(p_pkt);
+            return AVRC_MSG_TOO_BIG;
+        }
+    }
+#endif
+
+    /* abandon previous fragments */
+    p_fcb = &avrc_cb.fcb[handle];
+    if (p_fcb->frag_enabled)
+        p_fcb->frag_enabled = FALSE;
+
+    if (p_fcb->p_fmsg)
+    {
+        GKI_freebuf(p_fcb->p_fmsg);
+        p_fcb->p_fmsg = NULL;
+    }
+
+    /* AVRCP spec has not defined any control channel commands that needs fragmentation at this level
+     * check for fragmentation only on the response */
+    if ((cr == AVCT_RSP) && (chk_frag == TRUE))
+    {
+        if (p_pkt->len > AVRC_MAX_CTRL_DATA_LEN)
+        {
+            AVRC_TRACE_DEBUG1 ("p_pkt->len(%d) > AVRC_MAX_CTRL_DATA_LEN", p_pkt->len );
+            p_pkt_new = (BT_HDR *)GKI_getbuf((UINT16)(AVRC_PACKET_LEN + AVCT_MSG_OFFSET + BT_HDR_SIZE));
+            if (p_pkt_new)
+            {
+                p_fcb->frag_enabled = TRUE;
+                p_fcb->p_fmsg       = p_pkt;
+                p_fcb->frag_pdu     = *p_start;
+                p_pkt               = p_pkt_new;
+                p_pkt_new           = p_fcb->p_fmsg;
+                p_pkt->len          = AVRC_MAX_CTRL_DATA_LEN;
+                p_pkt->offset       = p_pkt_new->offset;
+                p_pkt->layer_specific = p_pkt_new->layer_specific;
+                p_pkt->event = p_pkt_new->event;
+                p_data = (UINT8 *)(p_pkt+1) + p_pkt->offset;
+                p_start -= AVRC_VENDOR_HDR_SIZE;
+                memcpy (p_data, p_start, AVRC_MAX_CTRL_DATA_LEN);
+                /* use AVRC start packet type */
+                p_data += AVRC_VENDOR_HDR_SIZE;
+                p_data++; /* pdu */
+                *p_data++ = AVRC_PKT_START;
+                len = (AVRC_MAX_CTRL_DATA_LEN - AVRC_VENDOR_HDR_SIZE - AVRC_MIN_META_HDR_SIZE); /* 4 pdu, pkt_type & len */
+                UINT16_TO_BE_STREAM(p_data, len);
+
+                /* prepare the left over for as an end fragment */
+                avrc_prep_end_frag (handle);
+                AVRC_TRACE_DEBUG3 ("p_pkt len:%d/%d, next len:%d", p_pkt->len, len, p_fcb->p_fmsg->len );
+            }
+            else
+            {
+                AVRC_TRACE_ERROR0 ("AVRC_MsgReq no buffers for fragmentation" );
+                GKI_freebuf(p_pkt);
+                return AVRC_NO_RESOURCES;
+            }
+        }
+    }
+
+    return AVCT_MsgReq( handle, label, cr, p_pkt);
+#else
+    return AVRC_NO_RESOURCES;
+#endif
+}
+
+
+/******************************************************************************
+**
+** Function         AVRC_PassCmd
+**
+** Description      Send a PASS THROUGH command to the peer device.  This
+**                  function can only be called for controller role connections.
+**                  Any response message from the peer is passed back through
+**                  the tAVRC_MSG_CBACK callback function.
+**
+**                  Input Parameters:
+**                      handle: Handle of this connection.
+**
+**                      label: Transaction label.
+**
+**                      p_msg: Pointer to PASS THROUGH message structure. 
+**
+**                  Output Parameters:
+**                      None.
+**
+** Returns          AVRC_SUCCESS if successful.
+**                  AVRC_BAD_HANDLE if handle is invalid.
+**
+******************************************************************************/
+UINT16 AVRC_PassCmd(UINT8 handle, UINT8 label, tAVRC_MSG_PASS *p_msg)
+{
+    BT_HDR *p_buf;
+    WC_ASSERT(p_msg != NULL);
+    if (p_msg)
+    {
+        p_msg->hdr.ctype    = AVRC_CMD_CTRL;
+        p_buf = avrc_pass_msg(p_msg);
+        if (p_buf)
+            return AVCT_MsgReq( handle, label, AVCT_CMD, p_buf);
+    }
+    return AVRC_NO_RESOURCES;
+}
+
+/******************************************************************************
+**
+** Function         AVRC_PassRsp
+**
+** Description      Send a PASS THROUGH response to the peer device.  This
+**                  function can only be called for target role connections. 
+**                  This function must be called when a PASS THROUGH command
+**                  message is received from the peer through the
+**                  tAVRC_MSG_CBACK callback function.
+**
+**                  Input Parameters:
+**                      handle: Handle of this connection.
+**
+**                      label: Transaction label.  Must be the same value as
+**                      passed with the command message in the callback function.
+**
+**                      p_msg: Pointer to PASS THROUGH message structure.
+**
+**                  Output Parameters:
+**                      None.
+**
+** Returns          AVRC_SUCCESS if successful.
+**                  AVRC_BAD_HANDLE if handle is invalid.
+**
+******************************************************************************/
+UINT16 AVRC_PassRsp(UINT8 handle, UINT8 label, tAVRC_MSG_PASS *p_msg)
+{
+    BT_HDR *p_buf;
+    WC_ASSERT(p_msg != NULL);
+    if (p_msg)
+    {
+        p_buf = avrc_pass_msg(p_msg);
+        if (p_buf)
+            return AVCT_MsgReq( handle, label, AVCT_RSP, p_buf);
+    }
+    return AVRC_NO_RESOURCES;
+}
+
diff --git a/stack/avrc/avrc_bld_ct.c b/stack/avrc/avrc_bld_ct.c
new file mode 100644
index 0000000..a1d5fa1
--- /dev/null
+++ b/stack/avrc/avrc_bld_ct.c
@@ -0,0 +1,1102 @@
+/*****************************************************************************
+**
+**  Name:       avrc_bld_ct.c
+**
+**  Description:Interface to AVRCP build message functions for the Control Role
+**
+**  Copyright (c) 2008-2008, Broadcom Corp., All Rights Reserved.
+**  Broadcom Bluetooth Core. Proprietary and confidential.
+**
+*****************************************************************************/
+#include <string.h>
+
+#include "gki.h"
+#include "avrc_api.h"
+#include "avrc_defs.h"
+#include "avrc_int.h"
+
+/*****************************************************************************
+**  Global data
+*****************************************************************************/
+
+
+#if (AVRC_METADATA_INCLUDED == TRUE)
+/*******************************************************************************
+**
+** Function         avrc_bld_get_capability_cmd
+**
+** Description      This function builds the Get Capability command.
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_get_capability_cmd (tAVRC_GET_CAPS_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+
+    if (!AVRC_IS_VALID_CAP_ID(p_cmd->capability_id))
+    {
+        AVRC_TRACE_ERROR1("avrc_bld_get_capability_cmd bad capability_id:0x%x", p_cmd->capability_id);
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    AVRC_TRACE_API0("avrc_bld_get_capability_cmd");
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 2; /* pdu + rsvd */
+
+    /* add fixed lenth - capability_id(1) */
+    UINT16_TO_BE_STREAM(p_data, 1);
+    /* add the capability_id */
+    UINT8_TO_BE_STREAM(p_data, p_cmd->capability_id);
+    p_pkt->len = (p_data - p_start);
+
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_list_app_settings_attr_cmd
+**
+** Description      This function builds the List Application Settings Attribute
+**                  command.
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_list_app_settings_attr_cmd (tAVRC_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    AVRC_TRACE_API0("avrc_bld_list_app_settings_attr_cmd");
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_list_app_settings_values_cmd
+**
+** Description      This function builds the List Application Setting Values
+**                  command.
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_list_app_settings_values_cmd (tAVRC_LIST_APP_VALUES_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+
+    if (!AVRC_IsValidPlayerAttr(p_cmd->attr_id))
+    {
+        AVRC_TRACE_ERROR1("avrc_bld_list_app_settings_values_cmd bad attr:0x%x", p_cmd->attr_id);
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    AVRC_TRACE_API0("avrc_bld_list_app_settings_values_cmd");
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 2; /* pdu + rsvd */
+
+    /* add fixed lenth - attr_id(1) */
+    UINT16_TO_BE_STREAM(p_data, 1);
+    /* add the attr_id */
+    UINT8_TO_BE_STREAM(p_data, p_cmd->attr_id);
+    p_pkt->len = (p_data - p_start);
+
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_cur_app_setting_value_cmd
+**
+** Description      This function builds the Get Current Application Setting Value
+**                  or the Get Application Setting Attribute Text command.
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_get_cur_app_setting_value_cmd (tAVRC_GET_CUR_APP_VALUE_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+    UINT8   *p_len;
+    UINT16  len = 0;
+    UINT8   xx;
+    UINT8   *p_count;
+
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_len = p_data = p_start + 2; /* pdu + rsvd */
+
+    BE_STREAM_TO_UINT16(len, p_data);
+    p_count = p_data;
+    if (len == 0)
+    {
+        /* first time initialize the attribute count */
+        *p_count = 0;
+        p_data++;
+        len = 1;
+    }
+    else
+    {
+        p_data = p_start + p_pkt->len;
+    }
+
+    for (xx=0; xx<p_cmd->num_attr; xx++)
+    {
+        if (AVRC_IsValidPlayerAttr(p_cmd->attrs[xx]))
+        {
+            (*p_count)++;
+            UINT8_TO_BE_STREAM(p_data, p_cmd->attrs[xx]);
+            len++;
+        }
+    }
+    UINT16_TO_BE_STREAM(p_len, len);
+    p_pkt->len = (p_data - p_start);
+
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_set_app_setting_value_cmd
+**
+** Description      This function builds the Set Application Setting Value
+**                  command.
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_set_app_setting_value_cmd (tAVRC_SET_APP_VALUE_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+    UINT8   *p_len;
+    UINT16  len;
+    UINT8   xx;
+    UINT8   *p_count;
+
+    if (!p_cmd->p_vals)
+    {
+        AVRC_TRACE_ERROR0("avrc_bld_set_app_setting_value_cmd NULL parameter");
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    AVRC_TRACE_API1("avrc_bld_set_app_setting_value_cmd num_val:%d", p_cmd->num_val);
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_len = p_start + 2; /* pdu + rsvd */
+
+    BE_STREAM_TO_UINT16(len, p_data);
+    p_count = p_data;
+    if (len == 0)
+    {
+        /* first time initialize the attribute count */
+        *p_count = 0;
+        p_data++;
+        len = 1;
+    }
+    else
+    {
+        p_data = p_start + p_pkt->len;
+    }
+
+
+    for (xx=0; xx<p_cmd->num_val; xx++)
+    {
+        AVRC_TRACE_DEBUG3("[%d] id/val = 0x%x/0x%x", xx, p_cmd->p_vals[xx].attr_id, p_cmd->p_vals[xx].attr_val);
+        if (avrc_is_valid_player_attrib_value(p_cmd->p_vals[xx].attr_id, p_cmd->p_vals[xx].attr_val))
+        {
+            (*p_count)++;
+            UINT8_TO_BE_STREAM(p_data, p_cmd->p_vals[xx].attr_id);
+            UINT8_TO_BE_STREAM(p_data, p_cmd->p_vals[xx].attr_val);
+            len += 2;
+        }
+    }
+
+    UINT16_TO_BE_STREAM(p_len, len);
+    p_pkt->len = (p_data - p_start);
+
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_app_setting_attr_text_cmd
+**
+** Description      This function builds the Get Application Setting Attribute Text
+**                  command.
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_get_app_setting_attr_text_cmd (tAVRC_GET_APP_ATTR_TXT_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    AVRC_TRACE_API0("avrc_bld_get_app_setting_attr_text_cmd");
+    return avrc_bld_get_cur_app_setting_value_cmd((tAVRC_GET_CUR_APP_VALUE_CMD *)p_cmd, p_pkt);
+
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_app_setting_value_text_cmd
+**
+** Description      This function builds the Get Application Setting Value Text
+**                  command.
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_get_app_setting_value_text_cmd (tAVRC_GET_APP_VAL_TXT_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+    UINT8   *p_len;
+    UINT16  len = 0;
+    UINT8   xx;
+    UINT8   *p_count;
+
+    AVRC_TRACE_API0("avrc_bld_get_app_setting_value_text_cmd");
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_len = p_start + 2; /* pdu + rsvd */
+
+    BE_STREAM_TO_UINT16(len, p_data);
+    p_count = p_data + 1;
+    if (len == 0)
+    {
+        /* first time initialize the attribute count */
+        UINT8_TO_BE_STREAM(p_data, p_cmd->attr_id);
+        *p_count = 0;
+        p_data++;
+        len = 2;
+    }
+    else
+    {
+        p_data = p_start + p_pkt->len;
+    }
+
+    for (xx=0; xx<p_cmd->num_val; xx++)
+    {
+        (*p_count)++;
+        UINT8_TO_BE_STREAM(p_data, p_cmd->vals[xx]);
+        len++;
+    }
+    UINT16_TO_BE_STREAM(p_len, len);
+    p_pkt->len = (p_data - p_start);
+
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_inform_charset_cmd
+**
+** Description      This function builds the Inform Displayable Character Set
+**                  command.
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_inform_charset_cmd (tAVRC_INFORM_CHARSET_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+    UINT16  len = 0;
+    UINT8   xx;
+
+    AVRC_TRACE_API0("avrc_bld_inform_charset_cmd");
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 2; /* pdu + rsvd */
+
+    len = 1 + (p_cmd->num_id << 1);
+    UINT16_TO_BE_STREAM(p_data, len);
+
+    UINT8_TO_BE_STREAM(p_data, p_cmd->num_id);
+    for (xx=0; xx<p_cmd->num_id; xx++)
+    {
+        UINT16_TO_BE_STREAM(p_data, p_cmd->charsets[xx]);
+    }
+
+    p_pkt->len = (p_data - p_start);
+
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_inform_battery_status_cmd
+**
+** Description      This function builds the Inform Battery Status 
+**                  command.
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_inform_battery_status_cmd (tAVRC_BATTERY_STATUS_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+
+    if (!AVRC_IS_VALID_BATTERY_STATUS(p_cmd->battery_status))
+    {
+        AVRC_TRACE_ERROR1("avrc_bld_inform_battery_status_cmd bad battery_status:0x%x", p_cmd->battery_status);
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    AVRC_TRACE_API0("avrc_bld_inform_battery_status_cmd");
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 2; /* pdu + rsvd */
+    /* add fixed lenth - battery_status(1) */
+    UINT16_TO_BE_STREAM(p_data, 1);
+    /* add the battery_status */
+    UINT8_TO_BE_STREAM(p_data, p_cmd->battery_status);
+
+    p_pkt->len = (p_data - p_start);
+
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_elem_attrs_cmd
+**
+** Description      This function builds the Get Element Attributes
+**                  command.
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_get_elem_attrs_cmd (tAVRC_GET_ELEM_ATTRS_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+    UINT8   *p_len;
+    UINT16  len = 0;
+    UINT8   xx;
+    UINT8   *p_count;
+
+    AVRC_TRACE_API0("avrc_bld_get_elem_attrs_cmd");
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_len = p_start + 2; /* pdu + rsvd */
+    p_data = p_len + 2;
+
+    /* 8 byte identifier 0 - PLAYING - the only valid one */
+    UINT32_TO_BE_STREAM(p_data, 0);
+    UINT32_TO_BE_STREAM(p_data, 0);
+
+    p_count = p_data;
+    p_data++;
+    *p_count = 0;
+    len = 9;
+    for (xx=0; xx<p_cmd->num_attr; xx++)
+    {
+        if (AVRC_IS_VALID_MEDIA_ATTRIBUTE(p_cmd->attrs[xx]))
+        {
+            (*p_count)++;
+            UINT32_TO_BE_STREAM(p_data, p_cmd->attrs[xx]);
+            len += 4;
+        }
+    }
+    UINT16_TO_BE_STREAM(p_len, len);
+    p_pkt->len = (p_data - p_start);
+
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_play_status_cmd
+**
+** Description      This function builds the Get Play Status 
+**                  command.
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_get_play_status_cmd (tAVRC_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    AVRC_TRACE_API0("avrc_bld_get_play_status_cmd");
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_notify_cmd
+**
+** Description      This function builds the Register Notification command.
+**                  
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_notify_cmd (tAVRC_REG_NOTIF_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+
+    AVRC_TRACE_API0("avrc_bld_notify_cmd");
+    if (!AVRC_IS_VALID_EVENT_ID(p_cmd->event_id))
+    {
+        AVRC_TRACE_ERROR1("avrc_bld_notify_cmd bad event_id:0x%x", p_cmd->event_id);
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 2; /* pdu + rsvd */
+
+    /* add fixed lenth 5 - event_id (1) + interval(4) */
+    UINT16_TO_BE_STREAM(p_data, 5);
+    UINT8_TO_BE_STREAM(p_data, p_cmd->event_id);
+    UINT32_TO_BE_STREAM(p_data, p_cmd->param);
+    p_pkt->len = (p_data - p_start);
+
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_next_cmd
+**
+** Description      This function builds the Request Continue or Abort command.
+**                  
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_next_cmd (tAVRC_NEXT_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+
+    AVRC_TRACE_API0("avrc_bld_next_cmd");
+
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 2; /* pdu + rsvd */
+
+    /* add fixed lenth 1 - pdu_id (1) */
+    UINT16_TO_BE_STREAM(p_data, 1);
+    UINT8_TO_BE_STREAM(p_data, p_cmd->target_pdu);
+    p_pkt->len = (p_data - p_start);
+
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_group_navigation_cmd
+**
+** Description      This function builds the Group Navigation
+**                  command.
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+tAVRC_STS avrc_bld_group_navigation_cmd (UINT16 navi_id, BT_HDR *p_pkt)
+{
+    UINT8   *p_data;
+
+    if (!AVRC_IS_VALID_GROUP(navi_id))
+    {
+        AVRC_TRACE_ERROR1("avrc_bld_group_navigation_cmd bad navigation op id: %d", navi_id);
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    AVRC_TRACE_API0("avrc_bld_group_navigation_cmd");
+    p_data = (UINT8 *)(p_pkt+1) + p_pkt->offset;
+    UINT16_TO_BE_STREAM(p_data, navi_id);
+    p_pkt->len = 2;
+    return AVRC_STS_NO_ERROR;
+}
+
+/*****************************************************************************
+**  the following commands are introduced in AVRCP 1.4
+*****************************************************************************/
+
+#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
+/*******************************************************************************
+**
+** Function         avrc_bld_set_addr_player_cmd
+**
+** Description      This function builds the Set Addresses Player command.
+**                  
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_set_addr_player_cmd (tAVRC_SET_ADDR_PLAYER_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+
+    AVRC_TRACE_API0("avrc_bld_set_addr_player_cmd");
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 2; /* pdu + rsvd */
+    /* add fixed lenth - player_id(2) */
+    UINT16_TO_BE_STREAM(p_data, 2);
+    UINT16_TO_BE_STREAM(p_data, p_cmd->player_id);
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_set_abs_volume_cmd
+**
+** Description      This function builds the Set Absolute Volume command.
+**                  
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_set_abs_volume_cmd (tAVRC_SET_VOLUME_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+
+    AVRC_TRACE_API0("avrc_bld_set_abs_volume_cmd");
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 2; /* pdu + rsvd */
+    /* add fixed lenth 1 - volume (1) */
+    UINT16_TO_BE_STREAM(p_data, 1);
+    UINT8_TO_BE_STREAM(p_data, (AVRC_MAX_VOLUME & p_cmd->volume));
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_set_browsed_player_cmd
+**
+** Description      This function builds the Set Browsed Player command.
+**
+**                  This message goes through the Browsing channel and is
+**                  valid only when AVCT_BROWSE_INCLUDED compile option is TRUE
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+static tAVRC_STS avrc_bld_set_browsed_player_cmd (tAVRC_SET_BR_PLAYER_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+
+    AVRC_TRACE_API0("avrc_bld_set_browsed_player_cmd");
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 1; /* pdu */
+    /* add fixed lenth - player_id(2) */
+    UINT16_TO_BE_STREAM(p_data, 2);
+    UINT16_TO_BE_STREAM(p_data, p_cmd->player_id);
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+#endif
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_folder_items_cmd
+**
+** Description      This function builds the Get Folder Items command.
+**
+**                  This message goes through the Browsing channel and is
+**                  valid only when AVCT_BROWSE_INCLUDED compile option is TRUE
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+static tAVRC_STS avrc_bld_get_folder_items_cmd (tAVRC_GET_ITEMS_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+    UINT8   *p_len, xx;
+    UINT16  len = 0;
+
+    AVRC_TRACE_API0("avrc_bld_get_folder_items_cmd");
+    if (p_cmd->scope > AVRC_SCOPE_NOW_PLAYING || p_cmd->start_item > p_cmd->end_item)
+    {
+        AVRC_TRACE_ERROR3("bad scope:0x%x or range (%d-%d)", p_cmd->scope, p_cmd->start_item, p_cmd->end_item);
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_len = p_start + 1; /* pdu */
+    p_data = p_len + 2;
+
+    UINT8_TO_BE_STREAM(p_data, p_cmd->scope);
+    UINT32_TO_BE_STREAM(p_data, p_cmd->start_item);
+    UINT32_TO_BE_STREAM(p_data, p_cmd->end_item);
+    /* do not allow us to send the command with attribute list when scope is player list */
+    if (p_cmd->scope == AVRC_SCOPE_PLAYER_LIST)
+        p_cmd->attr_count = 0;
+
+    UINT8_TO_BE_STREAM(p_data, p_cmd->attr_count);
+    len = 10;
+    if ((p_cmd->attr_count != AVRC_FOLDER_ITEM_COUNT_NONE) &&
+        (p_cmd->attr_count > 0))
+    {
+        if (p_cmd->p_attr_list)
+        {
+            for (xx=0; xx<p_cmd->attr_count; xx++)
+            {
+                UINT32_TO_BE_STREAM(p_data, p_cmd->p_attr_list[xx]);
+                len += 4;
+            }
+        }
+        else
+        {
+            AVRC_TRACE_ERROR1("attr_count:%d but NULL p_attr_list", p_cmd->attr_count);
+            return AVRC_STS_BAD_PARAM;
+        }
+    }
+
+    UINT16_TO_BE_STREAM(p_len, len);
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+#endif
+
+/*******************************************************************************
+**
+** Function         avrc_bld_change_path_cmd
+**
+** Description      This function builds the Change Path command.
+**
+**                  This message goes through the Browsing channel and is
+**                  valid only when AVCT_BROWSE_INCLUDED compile option is TRUE
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+static tAVRC_STS avrc_bld_change_path_cmd (tAVRC_CHG_PATH_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+
+    AVRC_TRACE_API0("avrc_bld_change_path_cmd");
+    if (p_cmd->direction != AVRC_DIR_UP && p_cmd->direction != AVRC_DIR_DOWN)
+    {
+        AVRC_TRACE_ERROR1("AVRC_BldChangePathCmd bad direction:%d", p_cmd->direction);
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 1; /* pdu */
+    /* add fixed lenth - uid_counter(2) + direction(1) + uid(8) */
+    UINT16_TO_BE_STREAM(p_data, 11);
+    UINT16_TO_BE_STREAM(p_data, p_cmd->uid_counter);
+    *p_data++ = p_cmd->direction;
+    ARRAY_TO_BE_STREAM(p_data, p_cmd->folder_uid, AVRC_UID_SIZE);
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+#endif
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_item_attrs_cmd
+**
+** Description      This function builds the Get Item Attributes command.
+**
+**                  This message goes through the Browsing channel and is
+**                  valid only when AVCT_BROWSE_INCLUDED compile option is TRUE
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+static tAVRC_STS avrc_bld_get_item_attrs_cmd (tAVRC_GET_ATTRS_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+    UINT8   *p_len, xx;
+    UINT16  len;
+    UINT8   *p_count;
+
+    AVRC_TRACE_API0("avrc_bld_get_item_attrs_cmd");
+    if (p_cmd->scope > AVRC_SCOPE_NOW_PLAYING)
+    {
+        AVRC_TRACE_ERROR1("bad scope:%d", p_cmd->scope);
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_len = p_start + 1; /* pdu */
+    p_data = p_len + 2;
+
+    UINT8_TO_BE_STREAM(p_data, p_cmd->scope);
+    ARRAY_TO_BE_STREAM(p_data, p_cmd->uid, AVRC_UID_SIZE);
+    UINT16_TO_BE_STREAM(p_data, p_cmd->uid_counter);
+    //UINT8_TO_BE_STREAM(p_data, p_cmd->attr_count);
+    p_count = p_data++;
+    len = AVRC_UID_SIZE + 4;
+    *p_count = 0;
+
+    if (p_cmd->attr_count>0)
+    {
+        if (p_cmd->p_attr_list)
+        {
+            for (xx=0; xx<p_cmd->attr_count; xx++)
+            {
+                if (AVRC_IS_VALID_MEDIA_ATTRIBUTE(p_cmd->p_attr_list[xx]))
+                {
+                    (*p_count)++;
+                    UINT32_TO_BE_STREAM(p_data, p_cmd->p_attr_list[xx]);
+                    len += 4;
+                }
+#if (BT_USE_TRACES == TRUE)
+                else
+                {
+                    AVRC_TRACE_ERROR1("invalid attr id:%d", p_cmd->p_attr_list[xx]);
+                }
+#endif
+            }
+        }
+#if (BT_USE_TRACES == TRUE)
+        else
+        {
+            AVRC_TRACE_ERROR1("attr_count:%d, NULL p_attr_list", p_cmd->attr_count);
+        }
+#endif
+    }
+    UINT16_TO_BE_STREAM(p_len, len);
+
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+#endif
+
+/*******************************************************************************
+**
+** Function         avrc_bld_search_cmd
+**
+** Description      This function builds the Search command.
+**
+**                  This message goes through the Browsing channel and is
+**                  valid only when AVCT_BROWSE_INCLUDED compile option is TRUE
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+static tAVRC_STS avrc_bld_search_cmd (tAVRC_SEARCH_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+    UINT16  len;
+
+    AVRC_TRACE_API0("avrc_bld_search_cmd");
+    if (!p_cmd->string.p_str)
+    {
+        AVRC_TRACE_ERROR0("null string");
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 1; /* pdu */
+    /* variable lenth */
+    len = p_cmd->string.str_len + 4;
+    UINT16_TO_BE_STREAM(p_data, len);
+
+    UINT16_TO_BE_STREAM(p_data, p_cmd->string.charset_id);
+    UINT16_TO_BE_STREAM(p_data, p_cmd->string.str_len);
+    ARRAY_TO_BE_STREAM(p_data, p_cmd->string.p_str, p_cmd->string.str_len);
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+#endif
+
+/*******************************************************************************
+**
+** Function         avrc_bld_play_item_cmd
+**
+** Description      This function builds the Play Item command.
+**                  
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_play_item_cmd (tAVRC_PLAY_ITEM_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+
+    AVRC_TRACE_API0("avrc_bld_play_item_cmd");
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 2; /* pdu + rsvd */
+
+    /* fixed lenth - scope(1) + uid(8) + uid_counter(2) */
+    UINT16_TO_BE_STREAM(p_data, 11);
+
+    UINT8_TO_BE_STREAM(p_data, p_cmd->scope);
+    ARRAY_TO_BE_STREAM(p_data, p_cmd->uid, AVRC_UID_SIZE);
+    UINT16_TO_BE_STREAM(p_data, p_cmd->uid_counter);
+    p_pkt->len = (p_data - p_start);
+
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_add_to_now_playing_cmd
+**
+** Description      This function builds the Add to Now Playing command.
+**                  
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_add_to_now_playing_cmd (tAVRC_ADD_TO_PLAY_CMD *p_cmd, BT_HDR *p_pkt)
+{
+    AVRC_TRACE_API0("avrc_bld_add_to_now_playing_cmd");
+    return avrc_bld_play_item_cmd((tAVRC_PLAY_ITEM_CMD *)p_cmd, p_pkt);
+}
+
+#endif /* AVRC_ADV_CTRL_INCLUDED=TRUE */
+
+/*******************************************************************************
+**
+** Function         avrc_bld_init_cmd_buffer
+**
+** Description      This function initializes the command buffer based on PDU
+**
+** Returns          NULL, if no GKI buffer or failure to build the message.
+**                  Otherwise, the GKI buffer that contains the initialized message.
+**
+*******************************************************************************/
+static BT_HDR *avrc_bld_init_cmd_buffer(tAVRC_COMMAND *p_cmd)
+{
+    UINT16 offset, chnl = AVCT_DATA_CTRL, len=AVRC_META_CMD_POOL_SIZE;
+    BT_HDR *p_pkt=NULL;
+    UINT8  opcode;
+
+    opcode = avrc_opcode_from_pdu(p_cmd->pdu);
+    AVRC_TRACE_API2("avrc_bld_init_cmd_buffer: pdu=%x, opcode=%x", p_cmd->pdu, opcode);
+
+    switch (opcode)
+    {
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+    case AVRC_OP_BROWSE:
+        chnl    = AVCT_DATA_BROWSE;
+        offset  = AVCT_BROWSE_OFFSET;
+        len     = AVRC_BROWSE_POOL_SIZE;
+        break;
+#endif /* AVCT_BROWSE_INCLUDED */
+
+    case AVRC_OP_PASS_THRU:
+        offset  = AVRC_MSG_PASS_THRU_OFFSET;
+        break;
+
+    case AVRC_OP_VENDOR:
+        offset  = AVRC_MSG_VENDOR_OFFSET;
+        break;
+    }
+
+    /* allocate and initialize the buffer */
+    p_pkt = (BT_HDR *)GKI_getbuf(len);
+    if (p_pkt)
+    {
+        UINT8 *p_data, *p_start;
+
+        p_pkt->layer_specific = chnl;
+        p_pkt->event    = opcode;
+        p_pkt->offset   = offset;
+        p_data = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+        p_start = p_data;
+
+        /* pass thru - group navigation - has a two byte op_id, so dont do it here */
+        if (opcode != AVRC_OP_PASS_THRU)
+            *p_data++ = p_cmd->pdu;
+
+        switch (opcode)
+        {
+        case AVRC_OP_VENDOR:
+            /* reserved 0, packet_type 0 */
+            UINT8_TO_BE_STREAM(p_data, 0);
+            /* continue to the next "case to add length */
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+        case AVRC_OP_BROWSE:
+#endif
+            /* add fixed lenth - 0 */
+            UINT16_TO_BE_STREAM(p_data, 0);
+            break;
+        }
+
+        p_pkt->len = (p_data - p_start);
+    }
+    p_cmd->cmd.opcode = opcode;
+    return p_pkt;
+}
+
+/*******************************************************************************
+**
+** Function         AVRC_BldCommand
+**
+** Description      This function builds the given AVRCP command to the given 
+**                  GKI buffer
+**
+** Returns          AVRC_STS_NO_ERROR, if the command is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+tAVRC_STS AVRC_BldCommand( tAVRC_COMMAND *p_cmd, BT_HDR **pp_pkt)
+{
+    tAVRC_STS status = AVRC_STS_BAD_PARAM;
+    BT_HDR  *p_pkt;
+    BOOLEAN alloc = FALSE;
+
+    AVRC_TRACE_API2("AVRC_BldCommand: pdu=%x status=%x", p_cmd->cmd.pdu, p_cmd->cmd.status);
+    if (!p_cmd || !pp_pkt)
+    {
+        AVRC_TRACE_API2("AVRC_BldCommand. Invalid parameters passed. p_cmd=%p, pp_pkt=%p", p_cmd, pp_pkt);
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    if (*pp_pkt == NULL)
+    {
+        if ((*pp_pkt = avrc_bld_init_cmd_buffer(p_cmd)) == NULL)
+        {
+            AVRC_TRACE_API0("AVRC_BldCommand: Failed to initialize command buffer");
+            return AVRC_STS_INTERNAL_ERR;
+        }
+        alloc = TRUE;
+    }
+    status = AVRC_STS_NO_ERROR;
+    p_pkt = *pp_pkt;
+
+    switch (p_cmd->pdu)
+    {
+    case AVRC_PDU_NEXT_GROUP:                   /* 0x00 */
+    case AVRC_PDU_PREV_GROUP:                   /* 0x01 */
+        status = avrc_bld_group_navigation_cmd (p_cmd->pdu, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_CAPABILITIES:
+        status = avrc_bld_get_capability_cmd(&p_cmd->get_caps, p_pkt);
+        break;
+
+    case AVRC_PDU_LIST_PLAYER_APP_ATTR:
+        status = avrc_bld_list_app_settings_attr_cmd(&p_cmd->list_app_attr, p_pkt);
+        break;
+
+    case AVRC_PDU_LIST_PLAYER_APP_VALUES:
+        status = avrc_bld_list_app_settings_values_cmd(&p_cmd->list_app_values, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_CUR_PLAYER_APP_VALUE:
+        status = avrc_bld_get_cur_app_setting_value_cmd(&p_cmd->get_cur_app_val, p_pkt);
+        break;
+
+    case AVRC_PDU_SET_PLAYER_APP_VALUE:
+        status = avrc_bld_set_app_setting_value_cmd(&p_cmd->set_app_val, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_PLAYER_APP_ATTR_TEXT:
+        status = avrc_bld_get_app_setting_attr_text_cmd(&p_cmd->get_app_attr_txt, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT:
+        status = avrc_bld_get_app_setting_value_text_cmd(&p_cmd->get_app_val_txt, p_pkt);
+        break;
+
+    case AVRC_PDU_INFORM_DISPLAY_CHARSET:
+        status = avrc_bld_inform_charset_cmd(&p_cmd->inform_charset, p_pkt);
+        break;
+
+    case AVRC_PDU_INFORM_BATTERY_STAT_OF_CT:
+        status = avrc_bld_inform_battery_status_cmd(&p_cmd->inform_battery_status, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_ELEMENT_ATTR:
+        status = avrc_bld_get_elem_attrs_cmd(&p_cmd->get_elem_attrs, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_PLAY_STATUS:
+        status = avrc_bld_get_play_status_cmd(&p_cmd->get_play_status, p_pkt);
+        break;
+
+    case AVRC_PDU_REGISTER_NOTIFICATION:
+        status = avrc_bld_notify_cmd(&p_cmd->reg_notif, p_pkt);
+        break;
+
+    case AVRC_PDU_REQUEST_CONTINUATION_RSP:     /*        0x40 */
+        status = avrc_bld_next_cmd(&p_cmd->continu, p_pkt);
+        break;
+
+    case AVRC_PDU_ABORT_CONTINUATION_RSP:       /*          0x41 */
+        status = avrc_bld_next_cmd(&p_cmd->abort, p_pkt);
+        break;
+
+#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
+    case AVRC_PDU_SET_ABSOLUTE_VOLUME:         /* 0x50 */
+        status = avrc_bld_set_abs_volume_cmd(&p_cmd->volume, p_pkt);
+        break;
+
+    case AVRC_PDU_SET_ADDRESSED_PLAYER:        /* 0x60 */    
+        status = avrc_bld_set_addr_player_cmd(&p_cmd->addr_player, p_pkt);
+        break;
+
+    case AVRC_PDU_PLAY_ITEM:                   /* 0x74 */    
+        status = avrc_bld_play_item_cmd(&p_cmd->play_item, p_pkt);
+        break;
+
+    case AVRC_PDU_ADD_TO_NOW_PLAYING:          /* 0x90 */    
+        status = avrc_bld_add_to_now_playing_cmd(&p_cmd->add_to_play, p_pkt);
+        break;
+
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+    case AVRC_PDU_SET_BROWSED_PLAYER:          /* 0x70 */    
+        status = avrc_bld_set_browsed_player_cmd(&p_cmd->br_player, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_FOLDER_ITEMS:            /* 0x71 */   
+        status = avrc_bld_get_folder_items_cmd(&p_cmd->get_items, p_pkt);
+        break;
+
+    case AVRC_PDU_CHANGE_PATH:                 /* 0x72 */    
+        status = avrc_bld_change_path_cmd(&p_cmd->chg_path, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_ITEM_ATTRIBUTES:         /* 0x73 */    
+        status = avrc_bld_get_item_attrs_cmd(&p_cmd->get_attrs, p_pkt);
+        break;
+
+    case AVRC_PDU_SEARCH:                      /* 0x80 */    
+        status = avrc_bld_search_cmd(&p_cmd->search, p_pkt);
+        break;
+#endif
+#endif
+
+    }
+
+    if (alloc && (status != AVRC_STS_NO_ERROR) )
+    {
+        GKI_freebuf(p_pkt);
+        *pp_pkt = NULL;
+    }
+    AVRC_TRACE_API1("AVRC_BldCommand: returning %d", status);
+    return status;
+}
+#endif /* (AVRC_METADATA_INCLUDED == TRUE) */
+
diff --git a/stack/avrc/avrc_bld_tg.c b/stack/avrc/avrc_bld_tg.c
new file mode 100644
index 0000000..667499e
--- /dev/null
+++ b/stack/avrc/avrc_bld_tg.c
@@ -0,0 +1,1547 @@
+/*****************************************************************************
+**
+**  Name:       avrc_bld_tg.c
+**
+**  Description:Interface to AVRCP build message functions for the Target Role
+**
+**  Copyright (c) 2008-2008, Broadcom Corp., All Rights Reserved.
+**  Broadcom Bluetooth Core. Proprietary and confidential.
+**
+*****************************************************************************/
+#include <string.h>
+
+#include "gki.h"
+#include "avrc_api.h"
+#include "avrc_defs.h"
+#include "avrc_int.h"
+
+/*****************************************************************************
+**  Global data
+*****************************************************************************/
+#if (AVRC_METADATA_INCLUDED == TRUE)
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_capability_rsp
+**
+** Description      This function builds the Get Capability response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_get_capability_rsp (tAVRC_GET_CAPS_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start, *p_len, *p_count;
+    UINT16  len = 0;
+    UINT8   xx;
+    UINT32  *p_company_id;
+    UINT8   *p_event_id;
+    tAVRC_STS status = AVRC_STS_NO_ERROR;
+
+    if (!(AVRC_IS_VALID_CAP_ID(p_rsp->capability_id)))
+    {
+        AVRC_TRACE_ERROR1("avrc_bld_get_capability_rsp bad parameter. p_rsp: %x", p_rsp);
+        status = AVRC_STS_BAD_PARAM;
+        return status;
+    }
+
+    AVRC_TRACE_API0("avrc_bld_get_capability_rsp");
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_len = p_start + 2; /* pdu + rsvd */
+
+    BE_STREAM_TO_UINT16(len, p_data);
+    UINT8_TO_BE_STREAM(p_data, p_rsp->capability_id);
+    p_count = p_data;
+
+    if (len == 0)
+    {
+        *p_count = p_rsp->count;
+        p_data++;
+        len = 2; /* move past the capability_id and count */
+    }
+    else
+    {
+        p_data = p_start + p_pkt->len;
+        *p_count += p_rsp->count;
+    }
+
+    if (p_rsp->capability_id == AVRC_CAP_COMPANY_ID)
+    {
+        p_company_id = p_rsp->param.company_id;
+        for (xx=0; xx< p_rsp->count; xx++)
+        {
+            UINT24_TO_BE_STREAM(p_data, p_company_id[xx]);
+        }
+        len += p_rsp->count * 3;
+    }
+    else
+    {
+        p_event_id = p_rsp->param.event_id;
+        *p_count = 0;
+        for (xx=0; xx< p_rsp->count; xx++)
+        {
+            if (AVRC_IS_VALID_EVENT_ID(p_event_id[xx]))
+            {
+                (*p_count)++;
+                UINT8_TO_BE_STREAM(p_data, p_event_id[xx]);
+            }
+        }
+        len += (*p_count);
+    }
+    UINT16_TO_BE_STREAM(p_len, len);
+    p_pkt->len = (p_data - p_start);
+    status = AVRC_STS_NO_ERROR;
+
+    return status;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_list_app_settings_attr_rsp
+**
+** Description      This function builds the List Application Settings Attribute
+**                  response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_list_app_settings_attr_rsp (tAVRC_LIST_APP_ATTR_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start, *p_len, *p_num;
+    UINT16  len = 0;
+    UINT8   xx;
+
+    AVRC_TRACE_API0("avrc_bld_list_app_settings_attr_rsp");
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_len = p_start + 2; /* pdu + rsvd */
+
+    BE_STREAM_TO_UINT16(len, p_data);
+    p_num = p_data;
+    if (len == 0)
+    {
+        /* first time initialize the attribute count */
+        *p_num = 0;
+        p_data++;
+    }
+    else
+    {
+        p_data = p_start + p_pkt->len;
+    }
+
+    for (xx=0; xx<p_rsp->num_attr; xx++)
+    {
+        if(AVRC_IsValidPlayerAttr(p_rsp->attrs[xx]))
+        {
+            (*p_num)++;
+            UINT8_TO_BE_STREAM(p_data, p_rsp->attrs[xx]);
+        }
+    }
+
+    len = *p_num + 1;
+    UINT16_TO_BE_STREAM(p_len, len);
+    p_pkt->len = (p_data - p_start);
+
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_list_app_settings_values_rsp
+**
+** Description      This function builds the List Application Setting Values
+**                  response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_list_app_settings_values_rsp (tAVRC_LIST_APP_VALUES_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start, *p_len, *p_num;
+    UINT8   xx;
+    UINT16  len;
+
+    AVRC_TRACE_API0("avrc_bld_list_app_settings_values_rsp");
+
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_len = p_start + 2; /* pdu + rsvd */
+
+    /* get the existing length, if any, and also the num attributes */
+    BE_STREAM_TO_UINT16(len, p_data);
+    p_num = p_data;
+    /* first time initialize the attribute count */
+    if (len == 0)
+    {
+        *p_num = p_rsp->num_val;
+        p_data++;
+    }
+    else
+    {
+        p_data = p_start + p_pkt->len;
+        *p_num += p_rsp->num_val;
+    }
+
+
+    for (xx=0; xx<p_rsp->num_val; xx++)
+    {
+        UINT8_TO_BE_STREAM(p_data, p_rsp->vals[xx]);
+    }
+
+    len = *p_num + 1;
+    UINT16_TO_BE_STREAM(p_len, len);
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_cur_app_setting_value_rsp
+**
+** Description      This function builds the Get Current Application Setting Value
+**                  response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_get_cur_app_setting_value_rsp (tAVRC_GET_CUR_APP_VALUE_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start, *p_len, *p_count;
+    UINT16  len;
+    UINT8   xx;
+
+    if (!p_rsp->p_vals)
+    {
+        AVRC_TRACE_ERROR0("avrc_bld_get_cur_app_setting_value_rsp NULL parameter");
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    AVRC_TRACE_API0("avrc_bld_get_cur_app_setting_value_rsp");
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_len = p_start + 2; /* pdu + rsvd */
+
+    BE_STREAM_TO_UINT16(len, p_data);
+    p_count = p_data;
+    if (len == 0)
+    {
+        /* first time initialize the attribute count */
+        *p_count = 0;
+        p_data++;
+    }
+    else
+    {
+        p_data = p_start + p_pkt->len;
+    }
+
+    for (xx=0; xx<p_rsp->num_val; xx++)
+    {
+        if (avrc_is_valid_player_attrib_value(p_rsp->p_vals[xx].attr_id, p_rsp->p_vals[xx].attr_val))
+        {
+            (*p_count)++;
+            UINT8_TO_BE_STREAM(p_data, p_rsp->p_vals[xx].attr_id);
+            UINT8_TO_BE_STREAM(p_data, p_rsp->p_vals[xx].attr_val);
+        }
+    }
+    len = ((*p_count) << 1) + 1;
+    UINT16_TO_BE_STREAM(p_len, len);
+    p_pkt->len = (p_data - p_start);
+
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_set_app_setting_value_rsp
+**
+** Description      This function builds the Set Application Setting Value
+**                  response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_set_app_setting_value_rsp (tAVRC_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    /* nothing to be added. */
+    AVRC_TRACE_API0("avrc_bld_set_app_setting_value_rsp");
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_app_setting_text_rsp
+**
+** Description      This function builds the Get Application Settings Attribute Text
+**                  or Get Application Settings Value Text response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_app_setting_text_rsp (tAVRC_GET_APP_ATTR_TXT_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start, *p_len, *p_count;
+    UINT16  len, len_left;
+    UINT8   xx;
+    tAVRC_STS   sts = AVRC_STS_NO_ERROR;
+    UINT8       num_added = 0;
+
+    if (!p_rsp->p_attrs)
+    {
+        AVRC_TRACE_ERROR0("avrc_bld_app_setting_text_rsp NULL parameter");
+        return AVRC_STS_BAD_PARAM;
+    }
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_len = p_start + 2; /* pdu + rsvd */
+    len_left = GKI_get_buf_size(p_pkt) - BT_HDR_SIZE - p_pkt->offset - p_pkt->len;
+
+    BE_STREAM_TO_UINT16(len, p_data);
+    p_count = p_data;
+
+    if (len == 0)
+    {
+        *p_count = 0;
+        p_data++;
+    }
+    else
+    {
+        p_data = p_start + p_pkt->len;
+    }
+
+    for (xx=0; xx<p_rsp->num_attr; xx++)
+    {
+        if  (len_left < (p_rsp->p_attrs[xx].str_len + 4))
+        {
+            AVRC_TRACE_ERROR3("avrc_bld_app_setting_text_rsp out of room (str_len:%d, left:%d)",
+                xx, p_rsp->p_attrs[xx].str_len, len_left);
+            p_rsp->num_attr = num_added;
+            sts = AVRC_STS_INTERNAL_ERR;
+            break;
+        }
+        if ( !p_rsp->p_attrs[xx].str_len || !p_rsp->p_attrs[xx].p_str )
+        {
+            AVRC_TRACE_ERROR1("avrc_bld_app_setting_text_rsp NULL attr text[%d]", xx);
+            continue;
+        }
+        UINT8_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].attr_id);
+        UINT16_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].charset_id);
+        UINT8_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].str_len);
+        ARRAY_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].p_str, p_rsp->p_attrs[xx].str_len);
+        (*p_count)++;
+        num_added++;
+    }
+    len = p_data - p_count;
+    UINT16_TO_BE_STREAM(p_len, len);
+    p_pkt->len = (p_data - p_start);
+
+    return sts;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_app_setting_attr_text_rsp
+**
+** Description      This function builds the Get Application Setting Attribute Text
+**                  response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_get_app_setting_attr_text_rsp (tAVRC_GET_APP_ATTR_TXT_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    AVRC_TRACE_API0("avrc_bld_get_app_setting_attr_text_rsp");
+    return avrc_bld_app_setting_text_rsp(p_rsp, p_pkt);
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_app_setting_value_text_rsp
+**
+** Description      This function builds the Get Application Setting Value Text
+**                  response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_get_app_setting_value_text_rsp (tAVRC_GET_APP_ATTR_TXT_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    AVRC_TRACE_API0("avrc_bld_get_app_setting_value_text_rsp");
+    return avrc_bld_app_setting_text_rsp(p_rsp, p_pkt);
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_inform_charset_rsp
+**
+** Description      This function builds the Inform Displayable Character Set
+**                  response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_inform_charset_rsp (tAVRC_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    /* nothing to be added. */
+    AVRC_TRACE_API0("avrc_bld_inform_charset_rsp");
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_inform_battery_status_rsp
+**
+** Description      This function builds the Inform Battery Status 
+**                  response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_inform_battery_status_rsp (tAVRC_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    /* nothing to be added. */
+    AVRC_TRACE_API0("avrc_bld_inform_battery_status_rsp");
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_elem_attrs_rsp
+**
+** Description      This function builds the Get Element Attributes
+**                  response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_get_elem_attrs_rsp (tAVRC_GET_ELEM_ATTRS_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start, *p_len, *p_count;
+    UINT16  len;
+    UINT8   xx;
+
+    AVRC_TRACE_API0("avrc_bld_get_elem_attrs_rsp");
+    if (!p_rsp->p_attrs)
+    {
+        AVRC_TRACE_ERROR0("avrc_bld_get_elem_attrs_rsp NULL parameter");
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_len = p_start + 2; /* pdu + rsvd */
+
+    BE_STREAM_TO_UINT16(len, p_data);
+    p_count = p_data;
+
+    if (len == 0)
+    {
+        *p_count = 0;
+        p_data++;
+    }
+    else
+    {
+        p_data = p_start + p_pkt->len;
+    }
+
+    for (xx=0; xx<p_rsp->num_attr; xx++)
+    {
+        if (!AVRC_IS_VALID_MEDIA_ATTRIBUTE(p_rsp->p_attrs[xx].attr_id))
+        {
+            AVRC_TRACE_ERROR2("avrc_bld_get_elem_attrs_rsp invalid attr id[%d]: %d", xx, p_rsp->p_attrs[xx].attr_id);
+            continue;
+        }
+        if ( !p_rsp->p_attrs[xx].name.p_str )
+        {
+            p_rsp->p_attrs[xx].name.str_len = 0;
+        }
+        UINT32_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].attr_id);
+        UINT16_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].name.charset_id);
+        UINT16_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].name.str_len);
+        ARRAY_TO_BE_STREAM(p_data, p_rsp->p_attrs[xx].name.p_str, p_rsp->p_attrs[xx].name.str_len);
+        (*p_count)++;
+    }
+    len = p_data - p_count;
+    UINT16_TO_BE_STREAM(p_len, len);
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_play_status_rsp
+**
+** Description      This function builds the Get Play Status 
+**                  response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_get_play_status_rsp (tAVRC_GET_PLAY_STATUS_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+
+    AVRC_TRACE_API0("avrc_bld_get_play_status_rsp");
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 2;
+
+    /* add fixed lenth - song len(4) + song position(4) + status(1) */
+    UINT16_TO_BE_STREAM(p_data, 9);
+    UINT32_TO_BE_STREAM(p_data, p_rsp->song_len);
+    UINT32_TO_BE_STREAM(p_data, p_rsp->song_pos);
+    UINT8_TO_BE_STREAM(p_data, p_rsp->play_status);
+    p_pkt->len = (p_data - p_start);
+
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_notify_rsp
+**
+** Description      This function builds the Notification response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_notify_rsp (tAVRC_REG_NOTIF_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+    UINT8   *p_len;
+    UINT16  len = 0;
+    UINT8   xx;
+    tAVRC_STS status = AVRC_STS_NO_ERROR;
+
+    AVRC_TRACE_API0("avrc_bld_notify_rsp");
+
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_len = p_start + 2; /* pdu + rsvd */
+    p_data += 2;
+
+    UINT8_TO_BE_STREAM(p_data, p_rsp->event_id);
+    switch (p_rsp->event_id)
+    {
+    case AVRC_EVT_PLAY_STATUS_CHANGE:       /* 0x01 */
+        /* p_rsp->param.play_status >= AVRC_PLAYSTATE_STOPPED is always TRUE */
+        if ((p_rsp->param.play_status <= AVRC_PLAYSTATE_REV_SEEK) ||
+            (p_rsp->param.play_status == AVRC_PLAYSTATE_ERROR) )
+        {
+            UINT8_TO_BE_STREAM(p_data, p_rsp->param.play_status);
+            len = 2;
+        }
+        else
+        {
+            AVRC_TRACE_ERROR0("bad play state");
+            status = AVRC_STS_BAD_PARAM;
+        }
+        break;
+
+    case AVRC_EVT_TRACK_CHANGE:             /* 0x02 */
+        ARRAY_TO_BE_STREAM(p_data, p_rsp->param.track, AVRC_UID_SIZE);
+        len = (UINT8)(AVRC_UID_SIZE + 1);
+        break;
+
+    case AVRC_EVT_TRACK_REACHED_END:        /* 0x03 */
+    case AVRC_EVT_TRACK_REACHED_START:      /* 0x04 */
+#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
+    case AVRC_EVT_NOW_PLAYING_CHANGE:       /* 0x09 */
+    case AVRC_EVT_AVAL_PLAYERS_CHANGE:      /* 0x0a */
+#endif
+        len = 1;
+        break;
+
+    case AVRC_EVT_PLAY_POS_CHANGED:         /* 0x05 */
+        UINT32_TO_BE_STREAM(p_data, p_rsp->param.play_pos);
+        len = 5;
+        break;
+
+    case AVRC_EVT_BATTERY_STATUS_CHANGE:    /* 0x06 */
+        if (AVRC_IS_VALID_BATTERY_STATUS(p_rsp->param.battery_status))
+        {
+            UINT8_TO_BE_STREAM(p_data, p_rsp->param.battery_status);
+            len = 2;
+        }
+        else
+        {
+            AVRC_TRACE_ERROR0("bad battery status");
+            status = AVRC_STS_BAD_PARAM;
+        }
+        break;
+
+    case AVRC_EVT_SYSTEM_STATUS_CHANGE:     /* 0x07 */
+        if (AVRC_IS_VALID_SYSTEM_STATUS(p_rsp->param.system_status))
+        {
+            UINT8_TO_BE_STREAM(p_data, p_rsp->param.system_status);
+            len = 2;
+        }
+        else
+        {
+            AVRC_TRACE_ERROR0("bad system status");
+            status = AVRC_STS_BAD_PARAM;
+        }
+        break;
+
+    case AVRC_EVT_APP_SETTING_CHANGE:       /* 0x08 */
+        if (p_rsp->param.player_setting.num_attr > AVRC_MAX_APP_SETTINGS)
+            p_rsp->param.player_setting.num_attr = AVRC_MAX_APP_SETTINGS;
+
+        if (p_rsp->param.player_setting.num_attr > 0)
+        {
+            UINT8_TO_BE_STREAM(p_data, p_rsp->param.player_setting.num_attr);
+            len = 2;
+            for (xx=0; xx<p_rsp->param.player_setting.num_attr; xx++)
+            {
+                if (avrc_is_valid_player_attrib_value(p_rsp->param.player_setting.attr_id[xx], p_rsp->param.player_setting.attr_value[xx]))
+                {
+                    UINT8_TO_BE_STREAM(p_data, p_rsp->param.player_setting.attr_id[xx]);
+                    UINT8_TO_BE_STREAM(p_data, p_rsp->param.player_setting.attr_value[xx]);
+                }
+                else
+                {
+                    AVRC_TRACE_ERROR0("bad player app seeting attribute or value");
+                    status = AVRC_STS_BAD_PARAM;
+                    break;
+                }
+                len += 2;
+            }
+        }
+        else
+            status = AVRC_STS_BAD_PARAM;
+        break;
+
+#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
+    case AVRC_EVT_ADDR_PLAYER_CHANGE:       /* 0x0b */
+        UINT16_TO_BE_STREAM(p_data, p_rsp->param.addr_player.player_id); /* player_id */
+        UINT16_TO_BE_STREAM(p_data, p_rsp->param.addr_player.uid_counter); /* uid counter */
+        len = 5;
+        break;
+
+    case AVRC_EVT_UIDS_CHANGE:              /* 0x0c */
+        UINT16_TO_BE_STREAM(p_data, p_rsp->param.uid_counter); /* uid counter */
+        len = 3;
+        break;
+
+    case AVRC_EVT_VOLUME_CHANGE:            /* 0x0d */
+        UINT8_TO_BE_STREAM(p_data, (UINT8)(p_rsp->param.volume&AVRC_MAX_VOLUME));
+        len = 2;
+        break;
+#endif
+
+    default:
+        status = AVRC_STS_BAD_PARAM;
+        AVRC_TRACE_ERROR0("unknown event_id");
+    }
+
+    UINT16_TO_BE_STREAM(p_len, len);
+    p_pkt->len = (p_data - p_start);
+
+    return status;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_next_rsp
+**
+** Description      This function builds the Request Continue or Abort 
+**                  response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_next_rsp (tAVRC_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    /* nothing to be added. */
+    AVRC_TRACE_API0("avrc_bld_next_rsp");
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_group_navigation_rsp
+**
+** Description      This function builds the Group Navigation
+**                  response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+tAVRC_STS avrc_bld_group_navigation_rsp (UINT16 navi_id, BT_HDR *p_pkt)
+{
+    UINT8   *p_data;
+
+    if (!AVRC_IS_VALID_GROUP(navi_id))
+    {
+        AVRC_TRACE_ERROR1("avrc_bld_group_navigation_rsp bad navigation op id: %d", navi_id);
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    AVRC_TRACE_API0("avrc_bld_group_navigation_rsp");
+    p_data = (UINT8 *)(p_pkt+1) + p_pkt->offset;
+    UINT16_TO_BE_STREAM(p_data, navi_id);
+    p_pkt->len = 2;
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_rejected_rsp
+**
+** Description      This function builds the General Response response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_rejected_rsp( tAVRC_RSP *p_rsp, BT_HDR *p_pkt )
+{
+    UINT8 *p_data, *p_start;
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+    UINT8 opcode = avrc_opcode_from_pdu(p_rsp->pdu);
+#endif
+
+    AVRC_TRACE_API2("avrc_bld_rejected_rsp: status=%d, pdu:x%x", p_rsp->status, p_rsp->pdu);
+
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+    if (opcode == AVRC_OP_BROWSE)
+    {
+        p_data = p_start + 1;
+        if (avrc_opcode_from_pdu(*p_start) != AVRC_OP_BROWSE)
+        {
+            /* if the given opcode is not recognized as a browsing command opcode, use general reject command */
+            *p_start = AVRC_PDU_GENERAL_REJECT;
+        }
+    }
+    else
+#endif
+    {
+        p_data = p_start + 2;
+    }
+    AVRC_TRACE_DEBUG1("pdu:x%x", *p_start);
+
+    UINT16_TO_BE_STREAM(p_data, 1);
+    UINT8_TO_BE_STREAM(p_data, p_rsp->status);
+    p_pkt->len = p_data - p_start;
+
+    return AVRC_STS_NO_ERROR;
+}
+
+
+/*****************************************************************************
+**  the following commands are introduced in AVRCP 1.4
+*****************************************************************************/
+
+#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
+/*******************************************************************************
+**
+** Function         avrc_bld_ctrl_status_rsp
+**
+** Description      This function builds the responses with a UINT8 parameter.
+**                  
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_ctrl_status_rsp (tAVRC_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 2; /* pdu + rsvd */
+
+    /* add fixed lenth - status(1) */
+    UINT16_TO_BE_STREAM(p_data, 1);
+    UINT8_TO_BE_STREAM(p_data, p_rsp->status);
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_set_addr_player_rsp
+**
+** Description      This function builds the Set Addresses Player response.
+**                  
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_set_addr_player_rsp (tAVRC_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    AVRC_TRACE_API0("avrc_bld_set_addr_player_rsp");
+    return avrc_bld_ctrl_status_rsp(p_rsp, p_pkt);
+}
+
+/*******************************************************************************
+**
+** Function         avrc_bld_set_abs_volume_rsp
+**
+** Description      This function builds the Set Absolute Volume response.
+**                  
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_set_abs_volume_rsp (tAVRC_SET_VOLUME_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    p_rsp->status = (p_rsp->volume & AVRC_MAX_VOLUME);
+    AVRC_TRACE_API2("avrc_bld_set_abs_volume_rsp volume:%d, sts:%d", p_rsp->volume, p_rsp->status);
+    return avrc_bld_ctrl_status_rsp((tAVRC_RSP *)p_rsp, p_pkt);
+}
+
+
+/*******************************************************************************
+**
+** Function         avrc_bld_set_browsed_player_rsp
+**
+** Description      This function builds the Set Browsed Player response.
+**
+**                  This message goes through the Browsing channel and is
+**                  valid only when AVCT_BROWSE_INCLUDED compile option is TRUE
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+static tAVRC_STS avrc_bld_set_browsed_player_rsp (tAVRC_SET_BR_PLAYER_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+    UINT8   *p_len, xx;
+    UINT16  len;
+    tAVRC_NAME  *p_folders = p_rsp->p_folders;
+    UINT16  len_left;
+    UINT8   *p_num;
+    UINT16  mtu;
+
+    AVRC_TRACE_API0("avrc_bld_set_browsed_player_rsp");
+    /* make sure the given GKI buffer can accomodate this response */
+    len_left = GKI_get_buf_size(p_pkt) - BT_HDR_SIZE;
+    p_data = (UINT8 *)(p_pkt + 1);
+    BE_STREAM_TO_UINT16 (mtu, p_data);
+    if (len_left > mtu)
+    {
+        len_left = mtu;
+    }
+    len_left = len_left - p_pkt->offset - p_pkt->len;
+    AVRC_TRACE_DEBUG2("len_left:%d, mtu:%d ", len_left, mtu);
+
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_len = p_start + 1; /* pdu */
+
+    /* the existing len */
+    BE_STREAM_TO_UINT16(len, p_data);
+    p_num = p_data + 9;
+    if (len == 0)
+    {
+        /* first time initialize the attribute count */
+        UINT8_TO_BE_STREAM(p_data, p_rsp->status);
+        UINT16_TO_BE_STREAM(p_data, p_rsp->uid_counter);
+        UINT32_TO_BE_STREAM(p_data, p_rsp->num_items);
+        UINT16_TO_BE_STREAM(p_data, p_rsp->charset_id);
+        *p_num = 0;
+        p_data++;
+        len = 10;
+        len_left -= 12; /* assuming that we would never use a GKI buffer that is too small for headers */
+    }
+    else
+    {
+        p_data = p_start + p_pkt->len;
+    }
+
+    for (xx=0; (xx<p_rsp->folder_depth) && (len_left>(p_folders[xx].str_len + 2)); xx++)
+    {
+        (*p_num)++;
+        UINT16_TO_BE_STREAM(p_data, p_folders[xx].str_len);
+        ARRAY_TO_BE_STREAM(p_data, p_folders[xx].p_str, p_folders[xx].str_len);
+        len += (p_folders[xx].str_len + 2);
+    }
+    UINT16_TO_BE_STREAM(p_len, len);
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+#endif
+
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_folder_items_rsp
+**
+** Description      This function builds the Get Folder Items response.
+**                  The error code is returned in *p_status.
+**                  AVRC_STS_INTERNAL_ERR means no GKI buffers.
+**                  Try again later or with smaller item_count
+**
+**                  This message goes through the Browsing channel and is
+**                  valid only when AVCT_BROWSE_INCLUDED compile option is TRUE
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  AVRC_STS_INTERNAL_ERR, if the given GKI buffer does not have enough room
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+static tAVRC_STS avrc_bld_get_folder_items_rsp (tAVRC_GET_ITEMS_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+    UINT8   *p_len, xx;
+    UINT16  len;
+    UINT16  item_len;
+    UINT8   *p_item_len, yy;
+    tAVRC_ITEM_PLAYER   *p_player;
+    tAVRC_ITEM_FOLDER   *p_folder;
+    tAVRC_ITEM_MEDIA    *p_media;
+    tAVRC_ATTR_ENTRY    *p_attr;
+    tAVRC_ITEM          *p_item_list = p_rsp->p_item_list;
+    tAVRC_STS           status = AVRC_STS_NO_ERROR;
+    UINT16  len_left;
+    UINT8   *p_num, *p;
+    UINT8   *p_item_start, *p_attr_count;
+    UINT16  item_count;
+    UINT16  mtu;
+
+    AVRC_TRACE_API0("avrc_bld_get_folder_items_rsp");
+    /* make sure the given GKI buffer can accomodate this response */
+    len_left = GKI_get_buf_size(p_pkt) - BT_HDR_SIZE;
+    p = (UINT8 *)(p_pkt + 1);
+    BE_STREAM_TO_UINT16 (mtu, p);
+    if (len_left > mtu)
+        len_left = mtu;
+    len_left = len_left - p_pkt->offset - p_pkt->len;
+
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_len = p_start + 1; /* pdu */
+
+    /* the existing len */
+    BE_STREAM_TO_UINT16(len, p_data);
+    p_num = p_data + 3;
+    if (len == 0)
+    {
+        /* first time initialize the attribute count */
+        UINT8_TO_BE_STREAM(p_data, p_rsp->status);
+        UINT16_TO_BE_STREAM(p_data, p_rsp->uid_counter);
+        item_count = 0;
+        p_data+= 2;
+        len = 5;
+        len_left -= 5;
+    }
+    else
+    {
+        p_data = p_start + p_pkt->len;
+        p = p_num;
+        BE_STREAM_TO_UINT16 (item_count, p);
+    }
+    AVRC_TRACE_DEBUG3("len:%d, len_left:%d, num:%d", len, len_left, item_count);
+
+    /* min len required = item_type(1) + item len(2) + min item (14) = 17 */
+    for (xx=0; xx<p_rsp->item_count && len_left > 17; xx++)
+    {
+        p_item_start = p_data;
+        UINT8_TO_BE_STREAM(p_data, p_item_list[xx].item_type);
+        /* variable item lenth - save the location to add length */
+        p_item_len = p_data;
+        p_data += 2;
+        item_len = 0;
+        len_left -= 3; /* item_type(1) + item len(2) */
+        switch (p_item_list[xx].item_type)
+        {
+        case AVRC_ITEM_PLAYER:
+            /* min len required: 2 + 1 + 4 + 1 + 16 + 2 + 2 = 30 + str_len */
+            p_player = &p_item_list[xx].u.player;
+            item_len = AVRC_FEATURE_MASK_SIZE + p_player->name.str_len + 12;
+            if ((len_left > item_len) &&
+                p_player->name.p_str &&
+               (p_player->major_type & AVRC_MJ_TYPE_INVALID) == 0 &&
+               (p_player->sub_type & AVRC_SUB_TYPE_INVALID) == 0 &&
+               (p_player->play_status <= AVRC_PLAYSTATE_REV_SEEK || p_player->play_status == AVRC_PLAYSTATE_ERROR) )
+            {
+                UINT16_TO_BE_STREAM(p_data, p_player->player_id);
+                UINT8_TO_BE_STREAM(p_data, p_player->major_type);
+                UINT32_TO_BE_STREAM(p_data, p_player->sub_type);
+                UINT8_TO_BE_STREAM(p_data, p_player->play_status);
+                ARRAY_TO_BE_STREAM(p_data, p_player->features, AVRC_FEATURE_MASK_SIZE);
+                UINT16_TO_BE_STREAM(p_data, p_player->name.charset_id);
+                UINT16_TO_BE_STREAM(p_data, p_player->name.str_len);
+                ARRAY_TO_BE_STREAM(p_data, p_player->name.p_str, p_player->name.str_len);
+            }
+            else
+            {
+                p_data = p_item_start;
+            }
+            break;
+
+        case AVRC_ITEM_FOLDER:
+            /* min len required: 8 + 1 + 1 + 2 + 2 = 14 + str_len */
+            p_folder = &p_item_list[xx].u.folder;
+            item_len = AVRC_UID_SIZE + p_folder->name.str_len + 6;
+            if ((len_left > item_len) &&
+                p_folder->name.p_str &&
+                p_folder->type <= AVRC_FOLDER_TYPE_YEARS &&
+                p_folder->playable <= TRUE)
+            {
+                ARRAY_TO_BE_STREAM(p_data, p_folder->uid, AVRC_UID_SIZE);
+                UINT8_TO_BE_STREAM(p_data, p_folder->type);
+                UINT8_TO_BE_STREAM(p_data, p_folder->playable);
+                UINT16_TO_BE_STREAM(p_data, p_folder->name.charset_id);
+                UINT16_TO_BE_STREAM(p_data, p_folder->name.str_len);
+                ARRAY_TO_BE_STREAM(p_data, p_folder->name.p_str, p_folder->name.str_len);
+            }
+            else
+            {
+                p_data = p_item_start;
+            }
+            break;
+
+        case AVRC_ITEM_MEDIA:
+            /* min len required: 8 + 1 + 2 + 2 + 1 = 14 + str_len */
+            p_media = &p_item_list[xx].u.media;
+            item_len = AVRC_UID_SIZE + p_media->name.str_len + 6;
+            if ((len_left > item_len) &&
+                p_media->name.p_str &&
+                p_media->type <= AVRC_MEDIA_TYPE_VIDEO)
+            {
+                ARRAY_TO_BE_STREAM(p_data, p_media->uid, AVRC_UID_SIZE);
+                UINT8_TO_BE_STREAM(p_data, p_media->type);
+                UINT16_TO_BE_STREAM(p_data, p_media->name.charset_id);
+                UINT16_TO_BE_STREAM(p_data, p_media->name.str_len);
+                ARRAY_TO_BE_STREAM(p_data, p_media->name.p_str, p_media->name.str_len);
+                p_attr_count = p_data++;
+                *p_attr_count = 0;
+                len_left -= item_len;
+                if (p_media->attr_count>0)
+                {
+                    p_attr = p_media->p_attr_list;
+                    for (yy=0; yy<p_media->attr_count && len_left > 8; yy++)
+                    {
+                        if (p_attr[yy].name.p_str &&
+                            AVRC_IS_VALID_MEDIA_ATTRIBUTE(p_attr[yy].attr_id) &&
+                            (len_left >= (p_attr[yy].name.str_len + 8)) )
+                        {
+                            (*p_attr_count) ++;
+                            UINT32_TO_BE_STREAM(p_data, p_attr[yy].attr_id);
+                            UINT16_TO_BE_STREAM(p_data, p_attr[yy].name.charset_id);
+                            UINT16_TO_BE_STREAM(p_data, p_attr[yy].name.str_len);
+                            ARRAY_TO_BE_STREAM(p_data, p_attr[yy].name.p_str, p_attr[yy].name.str_len);
+                            item_len += (p_attr[yy].name.str_len + 8);
+                            len_left -= (p_attr[yy].name.str_len + 8);
+                        }
+                    }
+                }
+            }
+            else
+            {
+                p_data = p_item_start;
+            }
+            break;
+        } /* switch item_type */
+
+        if (p_item_start != p_data)
+        {
+            /* successfully added the item */
+            item_count++;
+            /* fill in variable item lenth */
+            UINT16_TO_BE_STREAM(p_item_len, item_len);
+        }
+        else
+        {
+            /* some item is not added properly - set an error status */
+            if (len_left > item_len)
+                status = AVRC_STS_INTERNAL_ERR;
+            else
+                status = AVRC_STS_BAD_PARAM;
+        }
+
+        len += item_len;
+        len += 3; /* the item_type(1) and item_len(2) */
+        AVRC_TRACE_DEBUG4("len:%d, len_left:%d, num:%d, item_len:%d", len, len_left, item_count, item_len);
+    } /* for item_count */
+
+    UINT16_TO_BE_STREAM(p_num, item_count);
+    UINT16_TO_BE_STREAM(p_len, len);
+    p_pkt->len = (p_data - p_start);
+
+    if (p_rsp->item_count != xx)
+    {
+        p_rsp->item_count = xx;
+        if  (status == AVRC_STS_NO_ERROR)
+            status = AVRC_STS_INTERNAL_ERR;
+    }
+
+    return status;
+}
+#endif
+
+
+/*******************************************************************************
+**
+** Function         avrc_bld_change_path_rsp
+**
+** Description      This function builds the Change Path response.
+**
+**                  This message goes through the Browsing channel and is
+**                  valid only when AVCT_BROWSE_INCLUDED compile option is TRUE
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+static tAVRC_STS avrc_bld_change_path_rsp (tAVRC_CHG_PATH_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_start + 1; /* pdu */
+    /* add fixed lenth - status(1) + num_items(4) */
+    UINT16_TO_BE_STREAM(p_data, 5);
+    UINT8_TO_BE_STREAM(p_data, p_rsp->status);
+    UINT32_TO_BE_STREAM(p_data, p_rsp->num_items);
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+#endif
+
+
+/*******************************************************************************
+**
+** Function         avrc_bld_get_item_attrs_rsp
+**
+** Description      This function builds the Get Item Attributes response.
+**
+**                  This message goes through the Browsing channel and is
+**                  valid only when AVCT_BROWSE_INCLUDED compile option is TRUE
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  AVRC_STS_INTERNAL_ERR, if the given GKI buffer does not have enough room
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+static tAVRC_STS avrc_bld_get_item_attrs_rsp (tAVRC_GET_ATTRS_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start;
+    UINT8   *p_len, xx;
+    UINT16  len, len_left;
+    UINT8   *p_num;
+    UINT16  mtu;
+
+    AVRC_TRACE_API0("avrc_bld_get_item_attrs_rsp");
+    /* calculate the GKI buffer size needed and validate the parameters */
+    if (!p_rsp->p_attr_list)
+    {
+        AVRC_TRACE_ERROR0("NULL p_attr_list");
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    /* check the length before adding the attr to the message */
+    len = 2;
+    for (xx=0; xx<p_rsp->attr_count; xx++)
+    {
+        if(p_rsp->p_attr_list[xx].name.p_str == 0 ||
+            !AVRC_IS_VALID_MEDIA_ATTRIBUTE(p_rsp->p_attr_list[xx].attr_id))
+        {
+            AVRC_TRACE_ERROR2("[%d] NULL p_attr_list str or bad attr_id:%d", xx, p_rsp->p_attr_list[xx].attr_id);
+            return AVRC_STS_BAD_PARAM;
+        }
+        len += (p_rsp->p_attr_list[xx].name.str_len + 8);
+    }
+    len_left = GKI_get_buf_size(p_pkt) - BT_HDR_SIZE;
+    p_data = (UINT8 *)(p_pkt + 1);
+    BE_STREAM_TO_UINT16 (mtu, p_data);
+    if (len_left > mtu)
+    {
+        len_left = mtu;
+    }
+    len_left = len_left - p_pkt->offset - p_pkt->len;
+
+    AVRC_TRACE_DEBUG3("len_left:%d, mtu:%d len needed:%d", len_left, mtu, len);
+    if (len_left < 11) /* 11 is 4/attr_id + 2/charset_id + 2/str_len + 3/first timer/attr count & len */
+    {
+        return AVRC_STS_INTERNAL_ERR;
+    }
+    if (len > len_left)
+    {
+        AVRC_TRACE_ERROR0("The GKI buffer does not have enough room to hold the given data.");
+    }
+
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_len = p_start + 1; /* pdu */
+
+    /* the existing len */
+    BE_STREAM_TO_UINT16(len, p_data);
+    p_num = p_data + 1;
+    if (len == 0)
+    {
+        /* first time initialize the attribute count */
+        UINT8_TO_BE_STREAM(p_data, p_rsp->status);
+        *p_num = 0;
+        p_data++;
+        len = 2;
+        len_left -= 3;
+    }
+    else
+    {
+        p_data = p_start + p_pkt->len;
+    }
+
+
+    for (xx=0; (xx<p_rsp->attr_count) && (len_left>9); xx++)
+    {
+        (*p_num)++;
+        UINT32_TO_BE_STREAM(p_data, p_rsp->p_attr_list[xx].attr_id);
+        UINT16_TO_BE_STREAM(p_data, p_rsp->p_attr_list[xx].name.charset_id);
+        UINT16_TO_BE_STREAM(p_data, p_rsp->p_attr_list[xx].name.str_len);
+        len_left -= 8;
+        if (p_rsp->p_attr_list[xx].name.str_len > len_left)
+            p_rsp->p_attr_list[xx].name.str_len = len_left;
+        ARRAY_TO_BE_STREAM(p_data, p_rsp->p_attr_list[xx].name.p_str, p_rsp->p_attr_list[xx].name.str_len);
+        len_left -= p_rsp->p_attr_list[xx].name.str_len;
+        len += (p_rsp->p_attr_list[xx].name.str_len + 8);
+    }
+
+    UINT16_TO_BE_STREAM(p_len, len);
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+#endif
+
+
+/*******************************************************************************
+**
+** Function         avrc_bld_search_rsp
+**
+** Description      This function builds the Search response.
+**
+**                  This message goes through the Browsing channel and is
+**                  valid only when AVCT_BROWSE_INCLUDED compile option is TRUE
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+static tAVRC_STS avrc_bld_search_rsp (tAVRC_SEARCH_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    UINT8   *p_data, *p_start, *p_len;
+
+    AVRC_TRACE_API0("avrc_bld_search_rsp");
+    /* get the existing length, if any, and also the num attributes */
+    p_start = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+    p_data = p_len = p_start + 1; /* pdu */
+
+    /* add fixed lenth - status(1) + uid_counter(2) + num_items(4) */
+    UINT16_TO_BE_STREAM(p_data, 7);
+    UINT8_TO_BE_STREAM(p_data, p_rsp->status);
+    UINT16_TO_BE_STREAM(p_data, p_rsp->uid_counter);
+    UINT32_TO_BE_STREAM(p_data, p_rsp->num_items);
+    p_pkt->len = (p_data - p_start);
+    return AVRC_STS_NO_ERROR;
+}
+#endif
+
+
+/*******************************************************************************
+**
+** Function         avrc_bld_play_item_rsp
+**
+** Description      This function builds the Play Item response.
+**                  
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_play_item_rsp (tAVRC_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    AVRC_TRACE_API0("avrc_bld_play_item_rsp");
+    return avrc_bld_ctrl_status_rsp(p_rsp, p_pkt);
+}
+
+
+/*******************************************************************************
+**
+** Function         avrc_bld_add_to_now_playing_rsp
+**
+** Description      This function builds the Add to Now Playing response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+static tAVRC_STS avrc_bld_add_to_now_playing_rsp (tAVRC_RSP *p_rsp, BT_HDR *p_pkt)
+{
+    AVRC_TRACE_API0("avrc_bld_add_to_now_playing_rsp");
+    return avrc_bld_ctrl_status_rsp(p_rsp, p_pkt);
+}
+
+#endif /* AVRC_ADV_CTRL_INCLUDED=TRUE */
+
+/*******************************************************************************
+**
+** Function         avrc_bld_init_rsp_buffer
+**
+** Description      This function initializes the response buffer based on PDU
+**
+** Returns          NULL, if no GKI buffer or failure to build the message.
+**                  Otherwise, the GKI buffer that contains the initialized message.
+**
+*******************************************************************************/
+static BT_HDR *avrc_bld_init_rsp_buffer(tAVRC_RESPONSE *p_rsp)
+{
+    UINT16 offset, chnl = AVCT_DATA_CTRL, len=AVRC_META_CMD_POOL_SIZE;
+    BT_HDR *p_pkt=NULL;
+    UINT8  opcode = avrc_opcode_from_pdu(p_rsp->pdu);
+
+    AVRC_TRACE_API3("avrc_bld_init_rsp_buffer: pdu=%x, opcode=%x/%x", p_rsp->pdu, opcode, p_rsp->rsp.opcode);
+    if (opcode != p_rsp->rsp.opcode && p_rsp->rsp.status != AVRC_STS_NO_ERROR && avrc_is_valid_opcode(p_rsp->rsp.opcode))
+    {
+        opcode = p_rsp->rsp.opcode;
+        AVRC_TRACE_API1("opcode=%x", opcode);
+    }
+
+    switch (opcode)
+    {
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+    case AVRC_OP_BROWSE:
+        chnl    = AVCT_DATA_BROWSE;
+        offset  = AVCT_BROWSE_OFFSET;
+        len     = AVRC_BROWSE_POOL_SIZE;
+        break;
+#endif /* AVCT_BROWSE_INCLUDED */
+
+    case AVRC_OP_PASS_THRU:
+        offset  = AVRC_MSG_PASS_THRU_OFFSET;
+        break;
+
+    case AVRC_OP_VENDOR:
+        offset  = AVRC_MSG_VENDOR_OFFSET;
+        if (p_rsp->pdu == AVRC_PDU_GET_ELEMENT_ATTR)
+            len     = AVRC_BROWSE_POOL_SIZE;
+        break;
+    }
+
+    /* allocate and initialize the buffer */
+    p_pkt = (BT_HDR *)GKI_getbuf(len);
+    if (p_pkt)
+    {
+        UINT8 *p_data, *p_start;
+
+        p_pkt->layer_specific = chnl;
+        p_pkt->event    = opcode;
+        p_pkt->offset   = offset;
+        p_data = (UINT8 *)(p_pkt + 1) + p_pkt->offset;
+        p_start = p_data;
+
+        /* pass thru - group navigation - has a two byte op_id, so dont do it here */
+        if (opcode != AVRC_OP_PASS_THRU)
+            *p_data++ = p_rsp->pdu;
+
+        switch (opcode)
+        {
+        case AVRC_OP_VENDOR:
+            /* reserved 0, packet_type 0 */
+            UINT8_TO_BE_STREAM(p_data, 0);
+            /* continue to the next "case to add length */
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+        case AVRC_OP_BROWSE:
+#endif
+            /* add fixed lenth - 0 */
+            UINT16_TO_BE_STREAM(p_data, 0);
+            break;
+        }
+
+        p_pkt->len = (p_data - p_start);
+    }
+    p_rsp->rsp.opcode = opcode;
+    return p_pkt;
+}
+
+/*******************************************************************************
+**
+** Function         AVRC_BldResponse
+**
+** Description      This function builds the given AVRCP response to the given 
+**                  GKI buffer
+**
+** Returns          AVRC_STS_NO_ERROR, if the response is built successfully
+**                  Otherwise, the error code.
+**
+*******************************************************************************/
+tAVRC_STS AVRC_BldResponse( UINT8 handle, tAVRC_RESPONSE *p_rsp, BT_HDR **pp_pkt)
+{
+    tAVRC_STS status = AVRC_STS_BAD_PARAM;
+    BT_HDR *p_pkt;
+    BOOLEAN alloc = FALSE;
+#if ((AVRC_ADV_CTRL_INCLUDED == TRUE) && (AVCT_BROWSE_INCLUDED == TRUE))
+    UINT8   *p;
+    UINT16  peer_mtu;
+#endif
+
+    if (!p_rsp || !pp_pkt)
+    {
+        AVRC_TRACE_API2("AVRC_BldResponse. Invalid parameters passed. p_rsp=%p, pp_pkt=%p", p_rsp, pp_pkt);
+        return AVRC_STS_BAD_PARAM;
+    }
+
+    if (*pp_pkt == NULL)
+    {
+        if ((*pp_pkt = avrc_bld_init_rsp_buffer(p_rsp)) == NULL)
+        {
+            AVRC_TRACE_API0("AVRC_BldResponse: Failed to initialize response buffer");
+            return AVRC_STS_INTERNAL_ERR;
+        }
+#if ((AVRC_ADV_CTRL_INCLUDED == TRUE) && (AVCT_BROWSE_INCLUDED == TRUE))
+        if ((*pp_pkt)->layer_specific == AVCT_DATA_BROWSE)
+        {
+            p = (UINT8 *)((*pp_pkt) + 1);
+            peer_mtu = AVCT_GetBrowseMtu(handle) - AVCT_HDR_LEN_SINGLE;
+            UINT16_TO_BE_STREAM(p, peer_mtu);
+        }
+#endif
+        alloc = TRUE;
+    }
+    status = AVRC_STS_NO_ERROR;
+    p_pkt = *pp_pkt;
+
+    AVRC_TRACE_API2("AVRC_BldResponse: pdu=%x status=%x", p_rsp->rsp.pdu, p_rsp->rsp.status);
+    if (p_rsp->rsp.status != AVRC_STS_NO_ERROR)
+    {
+        return( avrc_bld_rejected_rsp(&p_rsp->rsp, p_pkt) );
+    }
+
+    switch (p_rsp->pdu)
+    {
+    case AVRC_PDU_NEXT_GROUP:
+    case AVRC_PDU_PREV_GROUP:
+        status = avrc_bld_group_navigation_rsp(p_rsp->pdu, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_CAPABILITIES:
+        status = avrc_bld_get_capability_rsp(&p_rsp->get_caps, p_pkt);
+        break;
+
+    case AVRC_PDU_LIST_PLAYER_APP_ATTR:
+        status = avrc_bld_list_app_settings_attr_rsp(&p_rsp->list_app_attr, p_pkt);
+        break;
+
+    case AVRC_PDU_LIST_PLAYER_APP_VALUES:
+        status = avrc_bld_list_app_settings_values_rsp(&p_rsp->list_app_values, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_CUR_PLAYER_APP_VALUE:
+        status = avrc_bld_get_cur_app_setting_value_rsp(&p_rsp->get_cur_app_val, p_pkt);
+        break;
+
+    case AVRC_PDU_SET_PLAYER_APP_VALUE:
+        status = avrc_bld_set_app_setting_value_rsp(&p_rsp->set_app_val, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_PLAYER_APP_ATTR_TEXT:
+        status = avrc_bld_get_app_setting_attr_text_rsp(&p_rsp->get_app_attr_txt, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT:
+        status = avrc_bld_get_app_setting_value_text_rsp(&p_rsp->get_app_val_txt, p_pkt);
+        break;
+
+    case AVRC_PDU_INFORM_DISPLAY_CHARSET:
+        status = avrc_bld_inform_charset_rsp(&p_rsp->inform_charset, p_pkt);
+        break;
+
+    case AVRC_PDU_INFORM_BATTERY_STAT_OF_CT:
+        status = avrc_bld_inform_battery_status_rsp(&p_rsp->inform_battery_status, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_ELEMENT_ATTR:
+        status = avrc_bld_get_elem_attrs_rsp(&p_rsp->get_elem_attrs, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_PLAY_STATUS:
+        status = avrc_bld_get_play_status_rsp(&p_rsp->get_play_status, p_pkt);
+        break;
+
+    case AVRC_PDU_REGISTER_NOTIFICATION:
+        status = avrc_bld_notify_rsp(&p_rsp->reg_notif, p_pkt);
+        break;
+
+    case AVRC_PDU_REQUEST_CONTINUATION_RSP:     /*        0x40 */
+        status = avrc_bld_next_rsp(&p_rsp->continu, p_pkt);
+        break;
+
+    case AVRC_PDU_ABORT_CONTINUATION_RSP:       /*          0x41 */
+        status = avrc_bld_next_rsp(&p_rsp->abort, p_pkt);
+        break;
+
+#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
+    case AVRC_PDU_SET_ABSOLUTE_VOLUME:         /* 0x50 */
+        status = avrc_bld_set_abs_volume_rsp(&p_rsp->volume, p_pkt);
+        break;
+
+    case AVRC_PDU_SET_ADDRESSED_PLAYER:        /* 0x60 */    
+        status = avrc_bld_set_addr_player_rsp(&p_rsp->addr_player, p_pkt);
+        break;
+
+    case AVRC_PDU_PLAY_ITEM:                   /* 0x74 */    
+        status = avrc_bld_play_item_rsp(&p_rsp->play_item, p_pkt);
+        break;
+
+    case AVRC_PDU_ADD_TO_NOW_PLAYING:          /* 0x90 */    
+        status = avrc_bld_add_to_now_playing_rsp(&p_rsp->add_to_play, p_pkt);
+        break;
+
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+    case AVRC_PDU_SET_BROWSED_PLAYER:          /* 0x70 */    
+        status = avrc_bld_set_browsed_player_rsp(&p_rsp->br_player, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_FOLDER_ITEMS:            /* 0x71 */   
+        status = avrc_bld_get_folder_items_rsp(&p_rsp->get_items, p_pkt);
+        break;
+
+    case AVRC_PDU_CHANGE_PATH:                 /* 0x72 */    
+        status = avrc_bld_change_path_rsp(&p_rsp->chg_path, p_pkt);
+        break;
+
+    case AVRC_PDU_GET_ITEM_ATTRIBUTES:         /* 0x73 */    
+        status = avrc_bld_get_item_attrs_rsp(&p_rsp->get_attrs, p_pkt);
+        break;
+
+    case AVRC_PDU_SEARCH:                      /* 0x80 */    
+        status = avrc_bld_search_rsp(&p_rsp->search, p_pkt);
+        break;
+#endif
+#endif
+    }
+
+    if (alloc && (status != AVRC_STS_NO_ERROR) )
+    {
+        GKI_freebuf(p_pkt);
+        *pp_pkt = NULL;
+    }
+    AVRC_TRACE_API1("AVRC_BldResponse: returning %d", status);
+    return status;
+}
+
+#endif /* (AVRC_METADATA_INCLUDED == TRUE)*/
+
diff --git a/stack/avrc/avrc_int.h b/stack/avrc/avrc_int.h
new file mode 100644
index 0000000..33e561c
--- /dev/null
+++ b/stack/avrc/avrc_int.h
@@ -0,0 +1,146 @@
+/*****************************************************************************
+**
+**  Name:       avrc_int.h
+**
+**  Description:AVRCP internal header file.
+**
+**  Copyright (c) 2003-2006, Broadcom Corp., All Rights Reserved.
+**  Broadcom Bluetooth Core. Proprietary and confidential.
+**
+*****************************************************************************/
+
+
+#ifndef AVRC_INT_H
+#define AVRC_INT_H
+
+#include "avct_defs.h"
+#include "avrc_api.h"
+
+/*      DEBUG FLAGS
+ * 
+ * #define META_DEBUG_ENABLED                 
+ */
+/*****************************************************************************
+**  Constants
+*****************************************************************************/
+
+/* Number of attributes in AVRC SDP record. */
+#define AVRC_NUM_ATTR            6
+
+/* Number of protocol elements in protocol element list. */
+#define AVRC_NUM_PROTO_ELEMS     2
+
+#ifndef AVRC_MIN_CMD_LEN
+#define AVRC_MIN_CMD_LEN    20
+#endif
+
+#define AVRC_UNIT_OPRND_BYTES   5
+#define AVRC_SUB_OPRND_BYTES    4
+#define AVRC_SUBRSP_OPRND_BYTES 3
+#define AVRC_SUB_PAGE_MASK      7
+#define AVRC_SUB_PAGE_SHIFT     4
+#define AVRC_SUB_EXT_CODE       7
+#define AVRC_PASS_OP_ID_MASK    0x7F
+#define AVRC_PASS_STATE_MASK    0x80
+#define AVRC_CMD_OPRND_PAD      0xFF
+
+#define AVRC_CTYPE_MASK         0x0F
+#define AVRC_SUBTYPE_MASK       0xF8
+#define AVRC_SUBTYPE_SHIFT      3
+#define AVRC_SUBID_MASK         0x07
+#define AVRC_SUBID_IGNORE       0x07
+
+#define AVRC_SINGLE_PARAM_SIZE      1
+#define AVRC_METADATA_PKT_TYPE_MASK 0x03
+#define AVRC_PASS_THOUGH_MSG_MASK   0x80           /* MSB of msg_type indicates the PAS THROUGH msg */
+#define AVRC_VENDOR_UNIQUE_MASK     0x70           /* vendor unique id */
+
+
+/* Company ID is 24-bit integer We can not use the macros in bt_types.h */
+#define AVRC_CO_ID_TO_BE_STREAM(p, u32) {*(p)++ = (UINT8)((u32) >> 16); *(p)++ = (UINT8)((u32) >> 8); *(p)++ = (UINT8)(u32); }
+#define AVRC_BE_STREAM_TO_CO_ID(u32, p) {u32 = (((UINT32)(*((p) + 2))) + (((UINT32)(*((p) + 1))) << 8) + (((UINT32)(*(p))) << 16)); (p) += 3;}
+
+#define AVRC_AVC_HDR_SIZE           3   /* ctype, subunit*, opcode */
+
+#define AVRC_MIN_META_HDR_SIZE      4   /* pdu id(1), packet type(1), param len(2) */
+#define AVRC_MIN_BROWSE_HDR_SIZE    3   /* pdu id(1), param len(2) */
+
+#define AVRC_VENDOR_HDR_SIZE        6   /* ctype, subunit*, opcode, CO_ID */
+#define AVRC_MSG_VENDOR_OFFSET      23
+#define AVRC_MIN_VENDOR_SIZE        (AVRC_MSG_VENDOR_OFFSET + BT_HDR_SIZE + AVRC_MIN_META_HDR_SIZE)
+
+#define AVRC_PASS_THRU_SIZE         8
+#define AVRC_MSG_PASS_THRU_OFFSET   25
+#define AVRC_MIN_PASS_THRU_SIZE     (AVRC_MSG_PASS_THRU_OFFSET + BT_HDR_SIZE + 4)
+
+#define AVRC_MIN_BROWSE_SIZE        (AVCT_BROWSE_OFFSET + BT_HDR_SIZE + AVRC_MIN_BROWSE_HDR_SIZE)
+
+#define AVRC_CTRL_PKT_LEN(pf, pk)   {pf = (UINT8 *)((pk) + 1) + (pk)->offset + 2;}
+
+#define AVRC_MAX_CTRL_DATA_LEN      (AVRC_PACKET_LEN)
+
+/*****************************************************************************
+**  Type definitions
+*****************************************************************************/
+
+#if (AVRC_METADATA_INCLUDED == TRUE)
+/* type for Metadata fragmentation control block */
+typedef struct 
+{
+    BT_HDR              *p_fmsg;        /* the fragmented message */
+    UINT8               frag_pdu;       /* the PDU ID for fragmentation */
+    BOOLEAN             frag_enabled;   /* fragmentation flag */
+} tAVRC_FRAG_CB;
+
+/* type for Metadata re-assembly control block */
+typedef struct 
+{
+    BT_HDR              *p_rmsg;        /* the received message */
+    UINT16              rasm_offset;    /* re-assembly flag, the offset of the start fragment */
+    UINT8               rasm_pdu;       /* the PDU ID for re-assembly */
+} tAVRC_RASM_CB;
+#endif
+
+typedef struct
+{
+    tAVRC_CONN_CB       ccb[AVCT_NUM_CONN];
+#if (AVRC_METADATA_INCLUDED == TRUE)
+    tAVRC_FRAG_CB       fcb[AVCT_NUM_CONN];
+    tAVRC_RASM_CB       rcb[AVCT_NUM_CONN];
+#endif
+    tAVRC_FIND_CBACK    *p_cback;       /* pointer to application callback */
+    tSDP_DISCOVERY_DB   *p_db;          /* pointer to discovery database */
+    UINT16              service_uuid;   /* service UUID to search */
+    UINT8               trace_level;
+} tAVRC_CB;
+
+
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+/******************************************************************************
+** Main Control Block
+*******************************************************************************/
+#if AVRC_DYNAMIC_MEMORY == FALSE
+AVRC_API extern tAVRC_CB  avrc_cb;
+#else
+AVRC_API extern tAVRC_CB *avrc_cb_ptr;
+#define avrc_cb (*avrc_cb_ptr)
+#endif
+
+extern BOOLEAN avrc_is_valid_pdu_id(UINT8 pdu_id);
+extern BOOLEAN avrc_is_valid_player_attrib_value(UINT8 attrib, UINT8 value);
+extern BT_HDR * avrc_alloc_ctrl_pkt (UINT8 pdu);
+extern tAVRC_STS avrc_pars_pass_thru(tAVRC_MSG_PASS *p_msg, UINT16 *p_vendor_unique_id);
+extern UINT8 avrc_opcode_from_pdu(UINT8 pdu);
+extern BOOLEAN avrc_is_valid_opcode(UINT8 opcode);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* AVRC_INT_H */
+
diff --git a/stack/avrc/avrc_opt.c b/stack/avrc/avrc_opt.c
new file mode 100644
index 0000000..7711655
--- /dev/null
+++ b/stack/avrc/avrc_opt.c
@@ -0,0 +1,222 @@
+/*****************************************************************************
+**
+**  Name:       avrc_opt.c
+**
+**  Description:Interface to AVRCP optional commands
+**
+**  Copyright (c) 2003-2006, Broadcom Corp., All Rights Reserved.
+**  Broadcom Bluetooth Core. Proprietary and confidential.
+**
+*****************************************************************************/
+#include <string.h>
+
+#include "gki.h"
+#include "avrc_api.h"
+#include "avrc_int.h"
+
+#include "wcassert.h"
+
+
+/******************************************************************************
+**
+** Function         avrc_vendor_msg
+**
+** Description      Compose a VENDOR DEPENDENT command according to p_msg
+**
+**                  Input Parameters:
+**                      p_msg: Pointer to VENDOR DEPENDENT message structure.
+**
+**                  Output Parameters:
+**                      None.
+**
+** Returns          pointer to a valid GKI buffer if successful.
+**                  NULL if p_msg is NULL.
+**
+******************************************************************************/
+static BT_HDR  * avrc_vendor_msg(tAVRC_MSG_VENDOR *p_msg)
+{
+    BT_HDR  *p_cmd;
+    UINT8   *p_data;
+
+    WC_ASSERT(p_msg != NULL);
+
+#if AVRC_METADATA_INCLUDED == TRUE
+    WC_ASSERT(AVRC_META_CMD_POOL_SIZE > (AVRC_MIN_CMD_LEN+p_msg->vendor_len));
+    if ((p_cmd = (BT_HDR *) GKI_getpoolbuf(AVRC_META_CMD_POOL_ID)) != NULL)
+#else
+    WC_ASSERT(AVRC_CMD_POOL_SIZE > (AVRC_MIN_CMD_LEN+p_msg->vendor_len));
+    if ((p_cmd = (BT_HDR *) GKI_getpoolbuf(AVRC_CMD_POOL_ID)) != NULL)
+#endif
+    {
+        p_cmd->offset   = AVCT_MSG_OFFSET;
+        p_data          = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
+        *p_data++       = (p_msg->hdr.ctype & AVRC_CTYPE_MASK);
+        *p_data++       = (p_msg->hdr.subunit_type << AVRC_SUBTYPE_SHIFT) | p_msg->hdr.subunit_id;
+        *p_data++       = AVRC_OP_VENDOR;
+        AVRC_CO_ID_TO_BE_STREAM(p_data, p_msg->company_id);
+        if(p_msg->vendor_len && p_msg->p_vendor_data)
+        {
+            memcpy(p_data, p_msg->p_vendor_data, p_msg->vendor_len);
+        }
+        p_cmd->len  = (UINT16) (p_data + p_msg->vendor_len - (UINT8 *)(p_cmd + 1) - p_cmd->offset);
+        p_cmd->layer_specific   = AVCT_DATA_CTRL;
+    }
+    return p_cmd;
+}
+
+/******************************************************************************
+**
+** Function         AVRC_UnitCmd
+**
+** Description      Send a UNIT INFO command to the peer device.  This
+**                  function can only be called for controller role connections.
+**                  Any response message from the peer is passed back through
+**                  the tAVRC_MSG_CBACK callback function.
+**
+**                  Input Parameters:
+**                      handle: Handle of this connection.
+**
+**                      label: Transaction label.
+**
+**                  Output Parameters:
+**                      None.
+**
+** Returns          AVRC_SUCCESS if successful.
+**                  AVRC_BAD_HANDLE if handle is invalid.
+**
+******************************************************************************/
+UINT16 AVRC_UnitCmd(UINT8 handle, UINT8 label)
+{
+    BT_HDR  *p_cmd;
+    UINT8   *p_data;
+
+    if ((p_cmd = (BT_HDR *) GKI_getpoolbuf(AVRC_CMD_POOL_ID)) != NULL)
+    {
+        p_cmd->offset   = AVCT_MSG_OFFSET;
+        p_data          = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
+        *p_data++       = AVRC_CMD_STATUS;
+        /* unit & id ignore */
+        *p_data++       = (AVRC_SUB_UNIT << AVRC_SUBTYPE_SHIFT) | AVRC_SUBID_IGNORE;
+        *p_data++       = AVRC_OP_UNIT_INFO;
+        memset(p_data, AVRC_CMD_OPRND_PAD, AVRC_UNIT_OPRND_BYTES);
+        p_cmd->len      = p_data + AVRC_UNIT_OPRND_BYTES - (UINT8 *)(p_cmd + 1) - p_cmd->offset;
+        p_cmd->layer_specific   = AVCT_DATA_CTRL;
+    }
+    return AVCT_MsgReq( handle, label, AVCT_CMD, p_cmd);
+}
+
+/******************************************************************************
+**
+** Function         AVRC_SubCmd
+**
+** Description      Send a SUBUNIT INFO command to the peer device.  This
+**                  function can only be called for controller role connections.
+**                  Any response message from the peer is passed back through
+**                  the tAVRC_MSG_CBACK callback function.
+**
+**                  Input Parameters:
+**                      handle: Handle of this connection.
+**
+**                      label: Transaction label.
+**
+**                      page: Specifies which part of the subunit type table
+**                      is requested.  For AVRCP it is typically zero.
+**                      Value range is 0-7.
+**
+**                  Output Parameters:
+**                      None.
+**
+** Returns          AVRC_SUCCESS if successful.
+**                  AVRC_BAD_HANDLE if handle is invalid.
+**
+******************************************************************************/
+UINT16 AVRC_SubCmd(UINT8 handle, UINT8 label, UINT8 page)
+{
+    BT_HDR  *p_cmd;
+    UINT8   *p_data;
+
+    if ((p_cmd = (BT_HDR *) GKI_getpoolbuf(AVRC_CMD_POOL_ID)) != NULL)
+    {
+        p_cmd->offset   = AVCT_MSG_OFFSET;
+        p_data          = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
+        *p_data++       = AVRC_CMD_STATUS;
+        /* unit & id ignore */
+        *p_data++       = (AVRC_SUB_UNIT << AVRC_SUBTYPE_SHIFT) | AVRC_SUBID_IGNORE;
+        *p_data++       = AVRC_OP_SUB_INFO;
+        *p_data++       = ((page&AVRC_SUB_PAGE_MASK) << AVRC_SUB_PAGE_SHIFT) | AVRC_SUB_EXT_CODE;
+        memset(p_data, AVRC_CMD_OPRND_PAD, AVRC_SUB_OPRND_BYTES);
+        p_cmd->len      = p_data + AVRC_SUB_OPRND_BYTES - (UINT8 *)(p_cmd + 1) - p_cmd->offset;
+        p_cmd->layer_specific   = AVCT_DATA_CTRL;
+    }
+    return AVCT_MsgReq( handle, label, AVCT_CMD, p_cmd);
+}
+
+/******************************************************************************
+**
+** Function         AVRC_VendorCmd
+**
+** Description      Send a VENDOR DEPENDENT command to the peer device.  This
+**                  function can only be called for controller role connections.
+**                  Any response message from the peer is passed back through
+**                  the tAVRC_MSG_CBACK callback function.
+**
+**                  Input Parameters:
+**                      handle: Handle of this connection.
+**
+**                      label: Transaction label.
+**
+**                      p_msg: Pointer to VENDOR DEPENDENT message structure.
+**
+**                  Output Parameters:
+**                      None.
+**
+** Returns          AVRC_SUCCESS if successful.
+**                  AVRC_BAD_HANDLE if handle is invalid.
+**
+******************************************************************************/
+UINT16 AVRC_VendorCmd(UINT8  handle, UINT8  label, tAVRC_MSG_VENDOR *p_msg)
+{
+    BT_HDR *p_buf = avrc_vendor_msg(p_msg);
+    if (p_buf)
+        return AVCT_MsgReq( handle, label, AVCT_CMD, p_buf);
+    else
+        return AVCT_NO_RESOURCES;
+}
+
+
+/******************************************************************************
+**
+** Function         AVRC_VendorRsp
+**
+** Description      Send a VENDOR DEPENDENT response to the peer device.  This
+**                  function can only be called for target role connections.
+**                  This function must be called when a VENDOR DEPENDENT
+**                  command message is received from the peer through the
+**                  tAVRC_MSG_CBACK callback function.
+**
+**                  Input Parameters:
+**                      handle: Handle of this connection.
+**
+**                      label: Transaction label.  Must be the same value as
+**                      passed with the command message in the callback function.
+**
+**                      p_msg: Pointer to VENDOR DEPENDENT message structure.
+**
+**                  Output Parameters:
+**                      None.
+**
+** Returns          AVRC_SUCCESS if successful.
+**                  AVRC_BAD_HANDLE if handle is invalid.
+**
+******************************************************************************/
+UINT16 AVRC_VendorRsp(UINT8  handle, UINT8  label, tAVRC_MSG_VENDOR *p_msg)
+{
+    BT_HDR *p_buf = avrc_vendor_msg(p_msg);
+    if (p_buf)
+        return AVCT_MsgReq( handle, label, AVCT_RSP, p_buf);
+    else
+        return AVCT_NO_RESOURCES;
+}
+
+
+
diff --git a/stack/avrc/avrc_pars_ct.c b/stack/avrc/avrc_pars_ct.c
new file mode 100644
index 0000000..4feb256
--- /dev/null
+++ b/stack/avrc/avrc_pars_ct.c
@@ -0,0 +1,663 @@
+/*****************************************************************************
+**
+**  Name:       avrc_pars_ct.c
+**
+**  Description:Interface to AVRCP parse message functions for the Control Role
+**
+**  Copyright (c) 2008-2008, Broadcom Corp., All Rights Reserved.
+**  Broadcom Bluetooth Core. Proprietary and confidential.
+**
+*****************************************************************************/
+#include <string.h>
+
+#include "gki.h"
+#include "avrc_api.h"
+#include "avrc_defs.h"
+#include "avrc_int.h"
+
+/*****************************************************************************
+**  Global data
+*****************************************************************************/
+
+#if (AVRC_METADATA_INCLUDED == TRUE)
+
+/*******************************************************************************
+**
+** Function         avrc_pars_vendor_rsp
+**
+** Description      This function parses the vendor specific commands defined by
+**                  Bluetooth SIG
+**
+** Returns          AVRC_STS_NO_ERROR, if the message in p_data is parsed successfully.
+**                  Otherwise, the error code defined by AVRCP 1.4
+**
+*******************************************************************************/
+static tAVRC_STS avrc_pars_vendor_rsp(tAVRC_MSG_VENDOR *p_msg, tAVRC_RESPONSE *p_result, UINT8 *p_buf, UINT16 buf_len)
+{
+    tAVRC_STS  status = AVRC_STS_NO_ERROR;
+    UINT8   *p = p_msg->p_vendor_data;
+    UINT16  len;
+    UINT8   xx, yy;
+    tAVRC_NOTIF_RSP_PARAM   *p_param;
+    tAVRC_APP_SETTING       *p_app_set;
+    tAVRC_APP_SETTING_TEXT  *p_app_txt;
+    tAVRC_ATTR_ENTRY        *p_entry;
+    UINT32  *p_u32;
+    UINT8   *p_u8;
+    UINT16  size_needed;
+
+    BE_STREAM_TO_UINT8 (p_result->pdu, p);
+    p++; /* skip the reserved/packe_type byte */
+    BE_STREAM_TO_UINT16 (len, p);
+    AVRC_TRACE_DEBUG4("avrc_pars_vendor_rsp() ctype:0x%x pdu:0x%x, len:%d/0x%x", p_msg->hdr.ctype, p_result->pdu, len, len);
+    if (p_msg->hdr.ctype == AVRC_RSP_REJ)
+    {
+        p_result->rsp.status = *p;
+        return p_result->rsp.status;
+    }
+
+    switch (p_result->pdu)
+    {
+    case AVRC_PDU_GET_CAPABILITIES:         /* 0x10 */
+        p_result->get_caps.capability_id = *p++;
+        if (AVRC_IS_VALID_CAP_ID(p_result->get_caps.capability_id))
+        {
+            p_result->get_caps.count = *p++;
+            if (p_result->get_caps.capability_id == AVRC_CAP_COMPANY_ID)
+            {
+                p_u32 = p_result->get_caps.param.company_id;
+                for (xx=0; xx<p_result->get_caps.count; xx++)
+                {
+                    AVRC_BE_STREAM_TO_CO_ID (p_u32[xx], p);
+                }
+            }
+            else
+            {
+                p_u8 = p_result->get_caps.param.event_id;
+                for (xx=0; xx<p_result->get_caps.count; xx++)
+                {
+                    BE_STREAM_TO_UINT8 (p_u8[xx], p);
+                }
+            }
+        }
+        else
+            status = AVRC_STS_BAD_PARAM;
+        break;
+
+    case AVRC_PDU_LIST_PLAYER_APP_ATTR:     /* 0x11 */
+        BE_STREAM_TO_UINT8 (p_result->list_app_attr.num_attr, p);
+        p_u8 = p_result->list_app_attr.attrs;
+        for(xx=0, yy=0; xx< p_result->list_app_attr.num_attr; xx++)
+        {
+            /* only report the valid player app attributes */
+            if (AVRC_IsValidPlayerAttr(*p))
+                p_u8[yy++] = *p;
+            p++;
+        }
+        p_result->list_app_attr.num_attr = yy;
+        break;
+
+    case AVRC_PDU_LIST_PLAYER_APP_VALUES:   /* 0x12 */
+        BE_STREAM_TO_UINT8 (p_result->list_app_values.num_val, p);
+        p_u8 = p_result->list_app_values.vals;
+        for(xx=0; xx< p_result->list_app_values.num_val; xx++)
+        {
+            p_u8[xx] = *p++;
+        }
+        break;
+
+    case AVRC_PDU_GET_CUR_PLAYER_APP_VALUE: /* 0x13 */
+        BE_STREAM_TO_UINT8 (p_result->get_cur_app_val.num_val, p);
+        size_needed = sizeof(tAVRC_APP_SETTING);
+        if (p_buf)
+        {
+            p_result->get_cur_app_val.p_vals = (tAVRC_APP_SETTING *)p_buf;
+            p_app_set = p_result->get_cur_app_val.p_vals;
+            for(xx=0; ((xx< p_result->get_cur_app_val.num_val) && (buf_len > size_needed)); xx++)
+            {
+                buf_len -= size_needed;
+                BE_STREAM_TO_UINT8  (p_app_set[xx].attr_id, p);
+                BE_STREAM_TO_UINT8  (p_app_set[xx].attr_val, p);
+            }
+            if (xx != p_result->get_cur_app_val.num_val)
+            {
+                AVRC_TRACE_ERROR2("GET_CUR_PLAYER_APP_VALUE not enough room:%d orig num_val:%d",
+                    xx, p_result->get_cur_app_val.num_val);
+                p_result->get_cur_app_val.num_val = xx;
+            }
+        }
+        else
+        {
+            AVRC_TRACE_ERROR2("GET_CUR_PLAYER_APP_VALUE not enough room:len: %d needed for struct: %d", buf_len, size_needed);
+            status = AVRC_STS_INTERNAL_ERR;
+        }
+        break;
+
+    case AVRC_PDU_SET_PLAYER_APP_VALUE:     /* 0x14 */
+    case AVRC_PDU_INFORM_DISPLAY_CHARSET:  /* 0x17 */
+    case AVRC_PDU_INFORM_BATTERY_STAT_OF_CT:/* 0x18 */
+        /* no additional parameters */
+        if (len != 0)
+            status = AVRC_STS_INTERNAL_ERR;
+        break;
+
+    case AVRC_PDU_GET_PLAYER_APP_ATTR_TEXT: /* 0x15 */
+    case AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT:/* 0x16 */
+        BE_STREAM_TO_UINT8 (p_result->get_app_attr_txt.num_attr, p);
+        size_needed = sizeof(tAVRC_APP_SETTING_TEXT) * p_result->get_app_attr_txt.num_attr;
+        if (p_buf && (buf_len > size_needed))
+        {
+            p_result->get_app_attr_txt.p_attrs = (tAVRC_APP_SETTING_TEXT *)p_buf;
+            p_app_txt = p_result->get_app_attr_txt.p_attrs;
+            p_u8 = p_buf + size_needed;
+            buf_len -= size_needed;
+            for(xx=0; xx< p_result->get_app_attr_txt.num_attr; xx++)
+            {
+                BE_STREAM_TO_UINT8  (p_app_txt[xx].attr_id, p);
+                BE_STREAM_TO_UINT16 (p_app_txt[xx].charset_id, p);
+                BE_STREAM_TO_UINT8  (p_app_txt[xx].str_len, p);
+                p_app_txt[xx].p_str = p_u8;
+                if (buf_len > p_app_txt[xx].str_len)
+                {
+                    BE_STREAM_TO_ARRAY(p, p_u8, p_app_txt[xx].str_len);
+                    p_u8 += p_app_txt[xx].str_len;
+                    buf_len -= p_app_txt[xx].str_len;
+                }
+                else
+                {
+                    AVRC_TRACE_ERROR4("GET_CUR_PLAYER_APP_VALUE not enough room:[%d] len orig/left: %d/%d, orig num_attr:%d",
+                        xx, p_app_txt[xx].str_len, buf_len, p_result->get_app_attr_txt.num_attr);
+                    p_app_txt[xx].str_len = (UINT8)buf_len;
+                    BE_STREAM_TO_ARRAY(p, p_u8, p_app_txt[xx].str_len);
+                    p_result->get_app_attr_txt.num_attr = xx+1;
+                    status = AVRC_STS_INTERNAL_ERR;
+                    break;
+                }
+            }
+        }
+        else
+        {
+            AVRC_TRACE_ERROR2("GET_CUR_PLAYER_APP_VALUE not enough room:len: %d needed for struct: %d", buf_len, size_needed);
+            status = AVRC_STS_INTERNAL_ERR;
+        }
+        break;
+
+    case AVRC_PDU_GET_ELEMENT_ATTR:         /* 0x20 */
+        BE_STREAM_TO_UINT8 (p_result->get_elem_attrs.num_attr, p);
+        size_needed = sizeof(tAVRC_ATTR_ENTRY) * p_result->get_elem_attrs.num_attr;
+        if (p_buf && (buf_len > size_needed))
+        {
+            p_result->get_elem_attrs.p_attrs = (tAVRC_ATTR_ENTRY *)p_buf;
+            p_entry = p_result->get_elem_attrs.p_attrs;
+            p_u8 = p_buf + size_needed;
+            buf_len -= size_needed;
+            for(xx=0; xx< p_result->get_elem_attrs.num_attr; xx++)
+            {
+                BE_STREAM_TO_UINT32 (p_entry[xx].attr_id, p);
+                BE_STREAM_TO_UINT16 (p_entry[xx].name.charset_id, p);
+                BE_STREAM_TO_UINT16 (p_entry[xx].name.str_len, p);
+                p_entry[xx].name.p_str = p_u8;
+                if (buf_len > p_entry[xx].name.str_len)
+                {
+                    BE_STREAM_TO_ARRAY(p, p_u8, p_entry[xx].name.str_len);
+                    p_u8 += p_entry[xx].name.str_len;
+                    buf_len -= p_entry[xx].name.str_len;
+                }
+                else
+                {
+                    AVRC_TRACE_ERROR4("GET_ELEMENT_ATTR not enough room:[%d] len orig/left: %d/%d, orig num_attr:%d",
+                        xx, p_entry[xx].name.str_len, buf_len, p_result->get_elem_attrs.num_attr);
+                    p_entry[xx].name.str_len = buf_len;
+                    BE_STREAM_TO_ARRAY(p, p_u8, p_entry[xx].name.str_len);
+                    p_result->get_elem_attrs.num_attr = xx + 1;
+                    status = AVRC_STS_INTERNAL_ERR;
+                    break;
+                }
+            }
+        }
+        else
+        {
+            AVRC_TRACE_ERROR2("GET_ELEMENT_ATTR not enough room:len: %d needed for struct: %d", buf_len, size_needed);
+            status = AVRC_STS_INTERNAL_ERR;
+        }
+        break;
+
+    case AVRC_PDU_GET_PLAY_STATUS:          /* 0x30 */
+        BE_STREAM_TO_UINT32 (p_result->get_play_status.song_len, p);
+        BE_STREAM_TO_UINT32 (p_result->get_play_status.song_pos, p);
+        BE_STREAM_TO_UINT8 (p_result->get_play_status.play_status, p);
+        if (len != 9)
+            status = AVRC_STS_INTERNAL_ERR;
+        break;
+
+    case AVRC_PDU_REGISTER_NOTIFICATION:    /* 0x31 */
+        BE_STREAM_TO_UINT8 (p_result->reg_notif.event_id, p);
+        p_param = &p_result->reg_notif.param;
+        switch (p_result->reg_notif.event_id)
+        {
+        case AVRC_EVT_PLAY_STATUS_CHANGE:   /* 0x01 */
+            BE_STREAM_TO_UINT8 (p_param->play_status, p);
+            if ((p_param->play_status > AVRC_PLAYSTATE_REV_SEEK) &&
+                (p_param->play_status != AVRC_PLAYSTATE_ERROR) )
+            {
+                status = AVRC_STS_BAD_PARAM;
+            }
+            break;
+
+        case AVRC_EVT_TRACK_CHANGE:         /* 0x02 */
+            BE_STREAM_TO_ARRAY (p, p_param->track, AVRC_UID_SIZE);
+            break;
+
+        case AVRC_EVT_TRACK_REACHED_END:    /* 0x03 */
+        case AVRC_EVT_TRACK_REACHED_START:  /* 0x04 */
+#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
+        case AVRC_EVT_NOW_PLAYING_CHANGE:   /* 0x09 */
+        case AVRC_EVT_AVAL_PLAYERS_CHANGE:  /* 0x0a */
+#endif /* (AVRC_ADV_CTRL_INCLUDED == TRUE) */
+            /* these events do not have additional parameters */
+            break;
+
+        case AVRC_EVT_PLAY_POS_CHANGED:     /* 0x05 */
+            BE_STREAM_TO_UINT32 (p_param->play_pos, p);
+            break;
+
+        case AVRC_EVT_BATTERY_STATUS_CHANGE:/* 0x06 */
+            BE_STREAM_TO_UINT8 (p_param->battery_status, p);
+            if (!AVRC_IS_VALID_BATTERY_STATUS(p_param->battery_status))
+            {
+                status = AVRC_STS_BAD_PARAM;
+            }
+            break;
+
+        case AVRC_EVT_SYSTEM_STATUS_CHANGE: /* 0x07 */
+            BE_STREAM_TO_UINT8 (p_param->system_status, p);
+            if (!AVRC_IS_VALID_SYSTEM_STATUS(p_param->system_status))
+            {
+                status = AVRC_STS_BAD_PARAM;
+            }
+            break;
+
+        case AVRC_EVT_APP_SETTING_CHANGE:   /* 0x08 */
+            BE_STREAM_TO_UINT8 (p_param->player_setting.num_attr, p);
+            if (p_param->player_setting.num_attr > AVRC_MAX_APP_SETTINGS)
+                p_param->player_setting.num_attr = AVRC_MAX_APP_SETTINGS;
+            for (xx=0; xx<p_param->player_setting.num_attr; xx++)
+            {
+                BE_STREAM_TO_UINT8 (p_param->player_setting.attr_id[xx], p);
+                BE_STREAM_TO_UINT8 (p_param->player_setting.attr_value[xx], p);
+                if (!avrc_is_valid_player_attrib_value(p_param->player_setting.attr_id[xx], p_param->player_setting.attr_value[xx]))
+                {
+                    status = AVRC_STS_BAD_PARAM;
+                    break;
+                }
+            }
+            break;
+
+#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
+        case AVRC_EVT_ADDR_PLAYER_CHANGE:   /* 0x0b */
+            BE_STREAM_TO_UINT16 (p_param->addr_player.player_id, p);
+            BE_STREAM_TO_UINT16 (p_param->addr_player.uid_counter, p);
+            break;
+
+        case AVRC_EVT_UIDS_CHANGE:          /* 0x0c */
+            BE_STREAM_TO_UINT16 (p_param->uid_counter, p);
+            break;
+
+        case AVRC_EVT_VOLUME_CHANGE:        /* 0x0d */
+            BE_STREAM_TO_UINT8 (p_param->volume, p);
+            break;
+#endif /* (AVRC_ADV_CTRL_INCLUDED == TRUE) */
+
+        default:
+            status = AVRC_STS_BAD_PARAM;
+            break;
+        }
+        break;
+
+    /* case AVRC_PDU_REQUEST_CONTINUATION_RSP: 0x40 */
+    /* case AVRC_PDU_ABORT_CONTINUATION_RSP:   0x41 */
+
+#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
+    case AVRC_PDU_SET_ABSOLUTE_VOLUME:      /* 0x50 */
+    case AVRC_PDU_SET_ADDRESSED_PLAYER:     /* 0x60 */
+    case AVRC_PDU_PLAY_ITEM:                /* 0x74 */
+    case AVRC_PDU_ADD_TO_NOW_PLAYING:       /* 0x90 */
+        BE_STREAM_TO_UINT8 (p_result->volume.volume, p);
+        if (len != 1)
+            status = AVRC_STS_INTERNAL_ERR;
+        break;
+#endif /* (AVRC_ADV_CTRL_INCLUDED == TRUE) */
+
+    default:
+        status = AVRC_STS_BAD_CMD;
+        break;
+    }
+
+    return status;
+}
+
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+/*******************************************************************************
+**
+** Function         avrc_pars_browsing_rsp
+**
+** Description      This function parses the commands that go through the
+**                  browsing channel
+**
+** Returns          AVRC_STS_NO_ERROR, if the message in p_data is parsed successfully.
+**                  Otherwise, the error code defined by AVRCP 1.4
+**
+*******************************************************************************/
+static tAVRC_STS avrc_pars_browsing_rsp(tAVRC_MSG_BROWSE *p_msg, tAVRC_RESPONSE *p_result, UINT8 *p_buf, UINT16 buf_len)
+{
+    tAVRC_STS  status = AVRC_STS_NO_ERROR;
+    UINT8   *p = p_msg->p_browse_data;
+    UINT16  len;
+    int     i, count;
+    UINT8   *p_left = p_buf;
+    tAVRC_ITEM  *p_item;
+    tAVRC_ITEM_PLAYER   *p_player;
+    tAVRC_ITEM_FOLDER   *p_folder;
+    tAVRC_ITEM_MEDIA    *p_media;
+    tAVRC_ATTR_ENTRY    *p_attrs;
+    UINT16  item_len;
+    UINT8   xx;
+    UINT16  size_needed;
+
+    p_result->pdu = *p++;
+    BE_STREAM_TO_UINT16 (len, p);
+    BE_STREAM_TO_UINT8 (status, p);
+    AVRC_TRACE_DEBUG4("avrc_pars_browsing_rsp() pdu:0x%x, len:%d/0x%x, status:0x%x", p_result->pdu, len, len, status);
+    if (status != AVRC_STS_NO_ERROR)
+        return status;
+
+    switch (p_result->pdu)
+    {
+    case AVRC_PDU_SET_BROWSED_PLAYER:   /* 0x70 */
+        BE_STREAM_TO_UINT16 (p_result->br_player.uid_counter, p);
+        BE_STREAM_TO_UINT32 (p_result->br_player.num_items, p);
+        BE_STREAM_TO_UINT16 (p_result->br_player.charset_id, p);
+        BE_STREAM_TO_UINT8 (p_result->br_player.folder_depth, p);
+        p_result->br_player.p_folders = NULL;
+        if (p_result->br_player.folder_depth == 0)
+            return status;
+
+        size_needed = sizeof(tAVRC_NAME) * p_result->br_player.folder_depth;
+        if (p_buf && (buf_len > size_needed))
+        {
+            p_result->br_player.p_folders = (tAVRC_NAME *)p_buf;
+            p_left = p_buf + size_needed;
+            count = p_result->br_player.folder_depth;
+            buf_len -= size_needed;
+            for (i=0; i<count; i++)
+            {
+                p_result->br_player.p_folders[i].p_str = p_left;
+                BE_STREAM_TO_UINT16 (p_result->br_player.p_folders[i].str_len, p);
+                if (buf_len > p_result->br_player.p_folders[i].str_len)
+                {
+                    BE_STREAM_TO_ARRAY (p, p_result->br_player.p_folders[i].p_str, p_result->br_player.p_folders[i].str_len);
+                    p_left += p_result->br_player.p_folders[i].str_len;
+                    buf_len -= p_result->br_player.p_folders[i].str_len;
+                }
+                else
+                {
+                    AVRC_TRACE_ERROR4("SET_BROWSED_PLAYER not enough room:[%d] len orig/left: %d/%d, orig depth:%d",
+                        i, p_result->br_player.p_folders[i].str_len, buf_len, p_result->br_player.folder_depth);
+                    p_result->br_player.p_folders[i].str_len = buf_len;
+                    BE_STREAM_TO_ARRAY (p, p_result->br_player.p_folders[i].p_str, p_result->br_player.p_folders[i].str_len);
+                    p_result->br_player.folder_depth = i+1;
+                    status = AVRC_STS_INTERNAL_ERR;
+                    break;
+                }
+            }
+        }
+        else
+        {
+            AVRC_TRACE_ERROR2("SET_BROWSED_PLAYER not enough room:len: %d needed for struct: %d", buf_len, size_needed);
+            status = AVRC_STS_INTERNAL_ERR;
+        }
+        break;
+
+    case AVRC_PDU_GET_FOLDER_ITEMS:     /* 0x71 */
+        BE_STREAM_TO_UINT16 (p_result->get_items.uid_counter, p);
+        BE_STREAM_TO_UINT16 (p_result->get_items.item_count, p);
+        p_result->get_items.p_item_list = NULL;
+        if (p_result->get_items.item_count == 0)
+            return status;
+        size_needed = sizeof(tAVRC_ITEM) * p_result->get_items.item_count;
+        if (p_buf && (buf_len > size_needed))
+        {
+            p_result->get_items.p_item_list = p_item = (tAVRC_ITEM *)p_buf;
+            p_left = p_buf + size_needed;
+            count = p_result->get_items.item_count;
+            buf_len -= size_needed;
+            for (i=0; i<count; i++)
+            {
+                BE_STREAM_TO_UINT8 (p_item[i].item_type, p);
+                BE_STREAM_TO_UINT16 (item_len, p);
+                AVRC_TRACE_DEBUG3("[%d] type:%d len left:%d", i, p_item[i].item_type, buf_len);
+                switch(p_item[i].item_type)
+                {
+                case AVRC_ITEM_PLAYER:
+                    p_player = &p_item[i].u.player;
+                    BE_STREAM_TO_UINT16 (p_player->player_id, p);
+                    BE_STREAM_TO_UINT8 (p_player->major_type, p);
+                    BE_STREAM_TO_UINT32 (p_player->sub_type, p);
+                    BE_STREAM_TO_UINT8 (p_player->play_status, p);
+                    BE_STREAM_TO_ARRAY (p, p_player->features, AVRC_FEATURE_MASK_SIZE);
+                    BE_STREAM_TO_UINT16 (p_player->name.charset_id, p);
+                    BE_STREAM_TO_UINT16 (p_player->name.str_len, p);
+                    p_player->name.p_str = p_left;
+                    if (buf_len > p_player->name.str_len)
+                    {
+                        p_left += p_player->name.str_len;
+                        BE_STREAM_TO_ARRAY (p, p_player->name.p_str, p_player->name.str_len);
+                        buf_len -= p_player->name.str_len;
+                    }
+                    else
+                    {
+                        AVRC_TRACE_ERROR4("GET_FOLDER_ITEMS player not enough room:[%d] len orig/left: %d/%d, orig item count:%d",
+                            i, p_player->name.str_len, buf_len, p_result->get_items.item_count);
+                        p_player->name.str_len = buf_len;
+                        BE_STREAM_TO_ARRAY (p, p_player->name.p_str, p_player->name.str_len);
+                        p_result->get_items.item_count = i+1;
+                        return AVRC_STS_INTERNAL_ERR;
+                    }
+                    break;
+
+                case AVRC_ITEM_FOLDER:
+                    p_folder = &p_item[i].u.folder;
+                    BE_STREAM_TO_ARRAY (p, p_folder->uid, AVRC_UID_SIZE);
+                    BE_STREAM_TO_UINT8 (p_folder->type, p);
+                    BE_STREAM_TO_UINT8 (p_folder->playable, p);
+                    BE_STREAM_TO_UINT16 (p_folder->name.charset_id, p);
+                    BE_STREAM_TO_UINT16 (p_folder->name.str_len, p);
+                    p_folder->name.p_str = p_left;
+                    if (buf_len > p_folder->name.str_len)
+                    {
+                        p_left += p_folder->name.str_len;
+                        BE_STREAM_TO_ARRAY (p, p_folder->name.p_str, p_folder->name.str_len);
+                        buf_len -= p_folder->name.str_len;
+                    }
+                    else
+                    {
+                        AVRC_TRACE_ERROR4("GET_FOLDER_ITEMS folder not enough room:[%d] len orig/left: %d/%d, orig item count:%d",
+                            i, p_folder->name.str_len, buf_len, p_result->get_items.item_count);
+                        p_folder->name.str_len = buf_len;
+                        BE_STREAM_TO_ARRAY (p, p_folder->name.p_str, p_folder->name.str_len);
+                        p_result->get_items.item_count = i+1;
+                        return AVRC_STS_INTERNAL_ERR;
+                    }
+                    break;
+
+                case AVRC_ITEM_MEDIA:
+                    p_media = &p_item[i].u.media;
+                    BE_STREAM_TO_ARRAY (p, p_media->uid, AVRC_UID_SIZE);
+                    BE_STREAM_TO_UINT8 (p_media->type, p);
+                    BE_STREAM_TO_UINT16 (p_media->name.charset_id, p);
+                    BE_STREAM_TO_UINT16 (p_media->name.str_len, p);
+                    p_media->name.p_str = p_left;
+                    if (buf_len < p_media->name.str_len)
+                    {
+                        AVRC_TRACE_ERROR4("GET_FOLDER_ITEMS media not enough room:[%d] len orig/left: %d/%d, orig item count:%d",
+                            i, p_media->name.str_len, buf_len, p_result->get_items.item_count);
+                        p_media->name.str_len = buf_len;
+                        BE_STREAM_TO_ARRAY (p, p_media->name.p_str, p_media->name.str_len);
+                        p_media->attr_count = 0;
+                        p_media->p_attr_list = NULL;
+                        p_result->get_items.item_count = i+1;
+                        return AVRC_STS_INTERNAL_ERR;
+                    }
+                    p_left += p_media->name.str_len;
+                    buf_len -= p_media->name.str_len;
+                    BE_STREAM_TO_ARRAY (p, p_media->name.p_str, p_media->name.str_len);
+                    BE_STREAM_TO_UINT8 (p_media->attr_count, p);
+                    size_needed = sizeof(tAVRC_ATTR_ENTRY) * p_media->attr_count;
+                    if (buf_len < size_needed)
+                    {
+                        AVRC_TRACE_ERROR4("GET_FOLDER_ITEMS media not enough room:[%d] attr_count orig/left: %d/%d, orig item count:%d",
+                            i, p_media->attr_count, buf_len, p_result->get_items.item_count);
+                        p_media->name.str_len = buf_len;
+                        BE_STREAM_TO_ARRAY (p, p_media->name.p_str, p_media->name.str_len);
+                        p_media->attr_count = 0;
+                        p_media->p_attr_list = NULL;
+                        p_result->get_items.item_count = i+1;
+                        return AVRC_STS_INTERNAL_ERR;
+                    }
+                    p_media->p_attr_list = p_attrs = (tAVRC_ATTR_ENTRY *)p_left;
+                    p_left += size_needed;
+                    buf_len -= size_needed;
+                    for (xx= 0; xx<p_media->attr_count; xx++)
+                    {
+                        BE_STREAM_TO_UINT32 (p_attrs[xx].attr_id, p);
+                        BE_STREAM_TO_UINT16 (p_attrs[xx].name.charset_id, p);
+                        BE_STREAM_TO_UINT16 (p_attrs[xx].name.str_len, p);
+                        p_attrs[xx].name.p_str = p_left;
+                        if (buf_len > p_attrs[xx].name.str_len)
+                        {
+                            p_left += p_attrs[xx].name.str_len;
+                            BE_STREAM_TO_ARRAY (p, p_attrs[xx].name.p_str, p_attrs[xx].name.str_len);
+                            buf_len -= p_attrs[xx].name.str_len;
+                        }
+                        else
+                        {
+                            AVRC_TRACE_ERROR4("GET_FOLDER_ITEMS media not enough room:[%d] attr name len orig/left: %d/%d, orig item count:%d",
+                                i, p_attrs[xx].name.str_len, buf_len, p_result->get_items.item_count);
+                            p_attrs[xx].name.str_len = buf_len;
+                            BE_STREAM_TO_ARRAY (p, p_attrs[xx].name.p_str, p_attrs[xx].name.str_len);
+                            p_media->attr_count = xx+1;
+                            p_result->get_items.item_count = i+1;
+                            return AVRC_STS_INTERNAL_ERR;
+                        }
+                    }
+                    break;
+                }
+            }
+        }
+        break;
+
+    case AVRC_PDU_CHANGE_PATH:          /* 0x72 */
+        BE_STREAM_TO_UINT32 (p_result->chg_path.num_items, p);
+        break;
+
+    case AVRC_PDU_GET_ITEM_ATTRIBUTES:  /* 0x73 */
+        BE_STREAM_TO_UINT8 (p_result->get_attrs.attr_count, p);
+        p_result->get_attrs.p_attr_list = p_attrs = NULL;
+        if (p_result->get_attrs.attr_count == 0)
+            return status;
+
+        size_needed = sizeof(tAVRC_ATTR_ENTRY) * p_result->get_attrs.attr_count;
+        if (p_buf && (buf_len > size_needed))
+        {
+            p_result->get_attrs.p_attr_list = p_attrs = (tAVRC_ATTR_ENTRY *)p_left;
+            p_left += size_needed;
+            buf_len -= size_needed;
+            for (xx= 0; xx<p_result->get_attrs.attr_count; xx++)
+            {
+                BE_STREAM_TO_UINT32 (p_attrs[xx].attr_id, p);
+                BE_STREAM_TO_UINT16 (p_attrs[xx].name.charset_id, p);
+                BE_STREAM_TO_UINT16 (p_attrs[xx].name.str_len, p);
+                p_attrs[xx].name.p_str = p_left;
+                if (buf_len > p_attrs[xx].name.str_len)
+                {
+                    p_left += p_attrs[xx].name.str_len;
+                    BE_STREAM_TO_ARRAY (p, p_attrs[xx].name.p_str, p_attrs[xx].name.str_len);
+                    buf_len -= p_attrs[xx].name.str_len;
+                }
+                else
+                {
+                    AVRC_TRACE_ERROR4("GET_ITEM_ATTRIBUTES not enough room:[%d] len orig/left: %d/%d, orig attr_count:%d",
+                        xx, p_attrs[xx].name.str_len, buf_len, p_result->get_attrs.attr_count);
+                    p_attrs[xx].name.str_len = buf_len;
+                    BE_STREAM_TO_ARRAY (p, p_attrs[xx].name.p_str, p_attrs[xx].name.str_len);
+                    p_result->get_attrs.attr_count = xx+1;
+                    status = AVRC_STS_INTERNAL_ERR;
+                    break;
+                }
+            }
+        }
+        break;
+
+    case AVRC_PDU_SEARCH:               /* 0x80 */
+        BE_STREAM_TO_UINT16 (p_result->search.uid_counter, p);
+        BE_STREAM_TO_UINT32 (p_result->search.num_items, p);
+        break;
+
+    default:
+        status = AVRC_STS_BAD_CMD;
+        break;
+    }
+
+    return status;
+}
+#endif /* (AVCT_BROWSE_INCLUDED == TRUE)*/
+
+/*******************************************************************************
+**
+** Function         AVRC_ParsResponse
+**
+** Description      This function is a superset of AVRC_ParsMetadata to parse the response.
+**
+** Returns          AVRC_STS_NO_ERROR, if the message in p_data is parsed successfully.
+**                  Otherwise, the error code defined by AVRCP 1.4
+**
+*******************************************************************************/
+tAVRC_STS AVRC_ParsResponse (tAVRC_MSG *p_msg, tAVRC_RESPONSE *p_result, UINT8 *p_buf, UINT16 buf_len)
+{
+    tAVRC_STS  status = AVRC_STS_INTERNAL_ERR;
+    UINT16  id;
+
+    if (p_msg && p_result)
+    {
+        switch (p_msg->hdr.opcode)
+        {
+        case AVRC_OP_VENDOR:     /*  0x00    Vendor-dependent commands */
+            status = avrc_pars_vendor_rsp(&p_msg->vendor, p_result, p_buf, buf_len);
+            break;
+
+        case AVRC_OP_PASS_THRU:  /*  0x7C    panel subunit opcode */
+            status = avrc_pars_pass_thru(&p_msg->pass, &id);
+            if (status == AVRC_STS_NO_ERROR)
+            {
+                p_result->pdu = (UINT8)id;
+            }
+            break;
+
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+        case AVRC_OP_BROWSE:
+            status = avrc_pars_browsing_rsp(&p_msg->browse, p_result, p_buf, buf_len);
+            break;
+#endif /* (AVCT_BROWSE_INCLUDED == TRUE) */
+
+        default:
+            AVRC_TRACE_ERROR1("AVRC_ParsCommand() unknown opcode:0x%x", p_msg->hdr.opcode);
+            break;
+        }
+        p_result->rsp.opcode = p_msg->hdr.opcode;
+    p_result->rsp.status = status;
+    }
+    return status;
+}
+
+
+#endif /* (AVRC_METADATA_INCLUDED == TRUE) */
diff --git a/stack/avrc/avrc_pars_tg.c b/stack/avrc/avrc_pars_tg.c
new file mode 100644
index 0000000..8237655
--- /dev/null
+++ b/stack/avrc/avrc_pars_tg.c
@@ -0,0 +1,452 @@
+/*****************************************************************************
+**
+**  Name:       avrc_pars_tg.c
+**
+**  Description:Interface to AVRCP parse message functions for the Target Role
+**
+**  Copyright (c) 2008-2008, Broadcom Corp., All Rights Reserved.
+**  Broadcom Bluetooth Core. Proprietary and confidential.
+**
+*****************************************************************************/
+#include <string.h>
+
+#include "gki.h"
+#include "avrc_api.h"
+#include "avrc_defs.h"
+#include "avrc_int.h"
+
+/*****************************************************************************
+**  Global data
+*****************************************************************************/
+#if (AVRC_METADATA_INCLUDED == TRUE)
+
+/*******************************************************************************
+**
+** Function         avrc_pars_vendor_cmd
+**
+** Description      This function parses the vendor specific commands defined by
+**                  Bluetooth SIG
+**
+** Returns          AVRC_STS_NO_ERROR, if the message in p_data is parsed successfully.
+**                  Otherwise, the error code defined by AVRCP 1.4
+**
+*******************************************************************************/
+static tAVRC_STS avrc_pars_vendor_cmd(tAVRC_MSG_VENDOR *p_msg, tAVRC_COMMAND *p_result, UINT8 *p_buf, UINT16 buf_len)
+{
+    tAVRC_STS  status = AVRC_STS_NO_ERROR;
+    UINT8   *p = p_msg->p_vendor_data;
+    UINT16  len;
+    UINT8   xx, yy;
+    UINT8   *p_u8;
+    UINT16  *p_u16;
+    UINT32  u32, u32_2, *p_u32;
+    tAVRC_APP_SETTING       *p_app_set;
+    UINT16  size_needed;
+
+    p_result->pdu = *p++;
+    AVRC_TRACE_DEBUG1("avrc_pars_vendor_cmd() pdu:0x%x", p_result->pdu);
+    if (!AVRC_IsValidAvcType (p_result->pdu, p_msg->hdr.ctype))
+    {
+        AVRC_TRACE_DEBUG0("avrc_pars_vendor_cmd() detects wrong AV/C type!");
+        status = AVRC_STS_BAD_CMD;
+    }
+
+    p++; /* skip the reserved byte */
+    BE_STREAM_TO_UINT16 (len, p);
+    if ((len+4) != (p_msg->vendor_len))
+    {
+        status = AVRC_STS_INTERNAL_ERR;
+    }
+
+    if (status != AVRC_STS_NO_ERROR)
+        return status;
+
+    switch (p_result->pdu)
+    {
+    case AVRC_PDU_GET_CAPABILITIES:         /* 0x10 */
+        p_result->get_caps.capability_id = *p++;
+        if (!AVRC_IS_VALID_CAP_ID(p_result->get_caps.capability_id))
+            status = AVRC_STS_BAD_PARAM;
+        else if (len != 1)
+            status = AVRC_STS_INTERNAL_ERR;
+        break;
+
+    case AVRC_PDU_LIST_PLAYER_APP_ATTR:     /* 0x11 */
+        /* no additional parameters */
+        if (len != 0)
+            status = AVRC_STS_INTERNAL_ERR;
+        break;
+
+    case AVRC_PDU_LIST_PLAYER_APP_VALUES:   /* 0x12 */
+        p_result->list_app_values.attr_id = *p++;
+        if (!AVRC_IS_VALID_ATTRIBUTE(p_result->list_app_values.attr_id))
+            status = AVRC_STS_BAD_PARAM;
+        else if (len != 1)
+            status = AVRC_STS_INTERNAL_ERR;
+        break;
+
+    case AVRC_PDU_GET_CUR_PLAYER_APP_VALUE: /* 0x13 */
+    case AVRC_PDU_GET_PLAYER_APP_ATTR_TEXT: /* 0x15 */
+        BE_STREAM_TO_UINT8 (p_result->get_cur_app_val.num_attr, p);
+        if (len != (p_result->get_cur_app_val.num_attr+1))
+        {
+            status = AVRC_STS_INTERNAL_ERR;
+            break;
+        }
+        p_u8 = p_result->get_cur_app_val.attrs;
+        for (xx=0, yy=0; xx< p_result->get_cur_app_val.num_attr; xx++)
+        {
+            /* only report the valid player app attributes */
+            if (AVRC_IsValidPlayerAttr(*p))
+                p_u8[yy++] = *p;
+            p++;
+        }
+        p_result->get_cur_app_val.num_attr = yy;
+        if (yy == 0)
+        {
+            status = AVRC_STS_BAD_PARAM;
+        }
+        break;
+
+    case AVRC_PDU_SET_PLAYER_APP_VALUE:     /* 0x14 */
+        BE_STREAM_TO_UINT8 (p_result->set_app_val.num_val, p);
+        size_needed = sizeof(tAVRC_APP_SETTING);
+        if (p_buf && (len == ((p_result->set_app_val.num_val<<1) + 1)))
+        {
+            p_result->set_app_val.p_vals = (tAVRC_APP_SETTING *)p_buf;
+            p_app_set = p_result->set_app_val.p_vals;
+            for (xx=0; ((xx< p_result->set_app_val.num_val) && (buf_len > size_needed)); xx++)
+            {
+                p_app_set[xx].attr_id = *p++;
+                p_app_set[xx].attr_val = *p++;
+                if (!avrc_is_valid_player_attrib_value(p_app_set[xx].attr_id, p_app_set[xx].attr_val))
+                    status = AVRC_STS_BAD_PARAM;
+            }
+            if (xx != p_result->set_app_val.num_val)
+            {
+                AVRC_TRACE_ERROR2("AVRC_PDU_SET_PLAYER_APP_VALUE not enough room:%d orig num_val:%d",
+                    xx, p_result->set_app_val.num_val);
+                p_result->set_app_val.num_val = xx;
+            }
+        }
+        else
+        {
+            AVRC_TRACE_ERROR0("AVRC_PDU_SET_PLAYER_APP_VALUE NULL decode buffer or bad len");
+            status = AVRC_STS_INTERNAL_ERR;
+        }
+        break;
+
+    case AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT:/* 0x16 */
+        if (len < 3)
+            status = AVRC_STS_INTERNAL_ERR;
+        else
+        {
+            BE_STREAM_TO_UINT8 (p_result->get_app_val_txt.attr_id, p);
+            if (!AVRC_IS_VALID_ATTRIBUTE(p_result->get_app_val_txt.attr_id))
+                status = AVRC_STS_BAD_PARAM;
+            else
+            {
+                BE_STREAM_TO_UINT8 (p_result->get_app_val_txt.num_val, p);
+                if ( (len - 2/* attr_id & num_val */) != p_result->get_app_val_txt.num_val)
+                    status = AVRC_STS_INTERNAL_ERR;
+                else
+                {
+                    p_u8 = p_result->get_app_val_txt.vals;
+                    for (xx=0; xx< p_result->get_app_val_txt.num_val; xx++)
+                    {
+                        p_u8[xx] = *p++;
+                        if (!avrc_is_valid_player_attrib_value(p_result->get_app_val_txt.attr_id, p_u8[xx]))
+                        {
+                            status = AVRC_STS_BAD_PARAM;
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+        break;
+
+    case AVRC_PDU_INFORM_DISPLAY_CHARSET:  /* 0x17 */
+        if (len < 3)
+            status = AVRC_STS_INTERNAL_ERR;
+        else
+        {
+            BE_STREAM_TO_UINT8 (p_result->inform_charset.num_id, p);
+            if ( (len - 1/* num_id */) != p_result->inform_charset.num_id * 2)
+                status = AVRC_STS_INTERNAL_ERR;
+            else
+            {
+                p_u16 = p_result->inform_charset.charsets;
+                if (p_result->inform_charset.num_id > AVRC_MAX_CHARSET_SIZE)
+                    p_result->inform_charset.num_id = AVRC_MAX_CHARSET_SIZE;
+                for (xx=0; xx< p_result->inform_charset.num_id; xx++)
+                {
+                    BE_STREAM_TO_UINT16 (p_u16[xx], p);
+                }
+            }
+        }
+        break;
+
+    case AVRC_PDU_INFORM_BATTERY_STAT_OF_CT:/* 0x18 */
+        if (len != 1)
+            status = AVRC_STS_INTERNAL_ERR;
+        else
+        {
+            p_result->inform_battery_status.battery_status = *p++;
+            if (!AVRC_IS_VALID_BATTERY_STATUS(p_result->inform_battery_status.battery_status))
+                status = AVRC_STS_BAD_PARAM;
+        }
+        break;
+
+    case AVRC_PDU_GET_ELEMENT_ATTR:         /* 0x20 */
+        if (len < 9) /* UID/8 and num_attr/1 */
+            status = AVRC_STS_INTERNAL_ERR;
+        else
+        {
+            BE_STREAM_TO_UINT32 (u32, p);
+            BE_STREAM_TO_UINT32 (u32_2, p);
+            if (u32== 0 && u32_2 == 0)
+            {
+                BE_STREAM_TO_UINT8 (p_result->get_elem_attrs.num_attr, p);
+                if ( (len - 9/* UID/8 and num_attr/1 */) != (p_result->get_elem_attrs.num_attr * 4))
+                    status = AVRC_STS_INTERNAL_ERR;
+                else
+                {
+                    p_u32 = p_result->get_elem_attrs.attrs;
+                    if (p_result->get_elem_attrs.num_attr > AVRC_MAX_ELEM_ATTR_SIZE)
+                        p_result->get_elem_attrs.num_attr = AVRC_MAX_ELEM_ATTR_SIZE;
+                    for (xx=0; xx< p_result->get_elem_attrs.num_attr; xx++)
+                    {
+                        BE_STREAM_TO_UINT32 (p_u32[xx], p);
+                    }
+                }
+            }
+            else
+                status = AVRC_STS_NOT_FOUND;
+        }
+        break;
+
+    case AVRC_PDU_GET_PLAY_STATUS:          /* 0x30 */
+        /* no additional parameters */
+        if (len != 0)
+            status = AVRC_STS_INTERNAL_ERR;
+        break;
+
+    case AVRC_PDU_REGISTER_NOTIFICATION:    /* 0x31 */
+        if (len != 5)
+            status = AVRC_STS_INTERNAL_ERR;
+        BE_STREAM_TO_UINT8 (p_result->reg_notif.event_id, p);
+        BE_STREAM_TO_UINT32 (p_result->reg_notif.param, p);
+        break;
+
+    /* case AVRC_PDU_REQUEST_CONTINUATION_RSP: 0x40 */
+    /* case AVRC_PDU_ABORT_CONTINUATION_RSP:   0x41 */
+
+#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
+    case AVRC_PDU_SET_ABSOLUTE_VOLUME:      /* 0x50 */
+        if (len != 1)
+            status = AVRC_STS_INTERNAL_ERR;
+        p_result->volume.volume = *p++;
+        break;
+
+    case AVRC_PDU_SET_ADDRESSED_PLAYER:     /* 0x60 */
+        if (len != 2)
+            status = AVRC_STS_INTERNAL_ERR;
+        BE_STREAM_TO_UINT16 (p_result->addr_player.player_id, p);
+        break;
+
+    case AVRC_PDU_PLAY_ITEM:                /* 0x74 */
+    case AVRC_PDU_ADD_TO_NOW_PLAYING:       /* 0x90 */
+        if (len != (AVRC_UID_SIZE + 3))
+            status = AVRC_STS_INTERNAL_ERR;
+        BE_STREAM_TO_UINT8 (p_result->play_item.scope, p);
+        if (p_result->play_item.scope > AVRC_SCOPE_NOW_PLAYING)
+        {
+            status = AVRC_STS_BAD_SCOPE;
+        }
+        BE_STREAM_TO_ARRAY (p, p_result->play_item.uid, AVRC_UID_SIZE);
+        BE_STREAM_TO_UINT16 (p_result->play_item.uid_counter, p);
+        break;
+#endif /* (AVRC_ADV_CTRL_INCLUDED == TRUE) */
+
+    default:
+        status = AVRC_STS_BAD_CMD;
+        break;
+    }
+
+    return status;
+}
+
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+/*******************************************************************************
+**
+** Function         avrc_pars_browsing
+**
+** Description      This function parses the commands that go through the
+**                  browsing channel
+**
+** Returns          AVRC_STS_NO_ERROR, if the message in p_data is parsed successfully.
+**                  Otherwise, the error code defined by AVRCP+1
+**
+*******************************************************************************/
+static tAVRC_STS avrc_pars_browsing_cmd(tAVRC_MSG_BROWSE *p_msg, tAVRC_COMMAND *p_result, UINT8 *p_buf, UINT16 buf_len)
+{
+    tAVRC_STS  status = AVRC_STS_NO_ERROR;
+    UINT8   *p = p_msg->p_browse_data;
+    UINT16  len;
+    int     i, count;
+
+    p_result->pdu = *p++;
+    AVRC_TRACE_DEBUG1("avrc_pars_browsing_cmd() pdu:0x%x", p_result->pdu);
+    BE_STREAM_TO_UINT16 (len, p);
+    switch (p_result->pdu)
+    {
+    case AVRC_PDU_SET_BROWSED_PLAYER:   /* 0x70 */
+        BE_STREAM_TO_UINT16 (p_result->br_player.player_id, p);
+        break;
+
+    case AVRC_PDU_GET_FOLDER_ITEMS:     /* 0x71 */
+        BE_STREAM_TO_UINT8 (p_result->get_items.scope, p);
+        if (p_result->get_items.scope > AVRC_SCOPE_NOW_PLAYING)
+        {
+            status = AVRC_STS_BAD_SCOPE;
+        }
+        BE_STREAM_TO_UINT32 (p_result->get_items.start_item, p);
+        BE_STREAM_TO_UINT32 (p_result->get_items.end_item, p);
+        if (p_result->get_items.start_item > p_result->get_items.end_item)
+        {
+            status = AVRC_STS_BAD_RANGE;
+        }
+        BE_STREAM_TO_UINT8 (p_result->get_items.attr_count, p);
+        p_result->get_items.p_attr_list = NULL;
+        if (p_result->get_items.attr_count && p_buf && 
+            (p_result->get_items.attr_count != AVRC_FOLDER_ITEM_COUNT_NONE))
+        {
+            p_result->get_items.p_attr_list = (UINT32 *)p_buf;
+            count = p_result->get_items.attr_count;
+            if (buf_len < (count<<2))
+                p_result->get_items.attr_count = count = (buf_len >> 2);
+            for (i=0; i<count; i++)
+            {
+                BE_STREAM_TO_UINT32 (p_result->get_items.p_attr_list[i], p);
+            }
+        }
+        break;
+
+    case AVRC_PDU_CHANGE_PATH:          /* 0x72 */
+        BE_STREAM_TO_UINT16 (p_result->chg_path.uid_counter, p);
+        BE_STREAM_TO_UINT8 (p_result->chg_path.direction, p);
+        if (p_result->chg_path.direction != AVRC_DIR_UP && p_result->chg_path.direction != AVRC_DIR_DOWN)
+        {
+            status = AVRC_STS_BAD_DIR;
+        }
+        BE_STREAM_TO_ARRAY (p, p_result->chg_path.folder_uid, AVRC_UID_SIZE);
+        break;
+
+    case AVRC_PDU_GET_ITEM_ATTRIBUTES:  /* 0x73 */
+        BE_STREAM_TO_UINT8 (p_result->get_attrs.scope, p);
+        if (p_result->get_attrs.scope > AVRC_SCOPE_NOW_PLAYING)
+        {
+            status = AVRC_STS_BAD_SCOPE;
+            break;
+        }
+        BE_STREAM_TO_ARRAY (p, p_result->get_attrs.uid, AVRC_UID_SIZE);
+        BE_STREAM_TO_UINT16 (p_result->get_attrs.uid_counter, p);
+        BE_STREAM_TO_UINT8 (p_result->get_attrs.attr_count, p);
+        p_result->get_attrs.p_attr_list = NULL;
+        if (p_result->get_attrs.attr_count && p_buf)
+        {
+            p_result->get_attrs.p_attr_list = (UINT32 *)p_buf;
+            count = p_result->get_attrs.attr_count;
+            if (buf_len < (count<<2))
+                p_result->get_attrs.attr_count = count = (buf_len >> 2);
+            for (i=0, count=0; i<p_result->get_attrs.attr_count; i++)
+            {
+                BE_STREAM_TO_UINT32 (p_result->get_attrs.p_attr_list[count], p);
+                if (AVRC_IS_VALID_MEDIA_ATTRIBUTE(p_result->get_attrs.p_attr_list[count]))
+                {
+                    count++;
+                }
+            }
+
+            if (p_result->get_attrs.attr_count != count && count == 0)
+                status = AVRC_STS_BAD_PARAM;
+            else
+                p_result->get_attrs.attr_count = count;
+        }
+        break;
+
+    case AVRC_PDU_SEARCH:               /* 0x80 */
+        BE_STREAM_TO_UINT16 (p_result->search.string.charset_id, p);
+        BE_STREAM_TO_UINT16 (p_result->search.string.str_len, p);
+        p_result->search.string.p_str = p_buf;
+        if (p_buf)
+        {
+            if (buf_len > p_result->search.string.str_len)
+                buf_len = p_result->search.string.str_len;
+            BE_STREAM_TO_ARRAY (p, p_buf, p_result->search.string.str_len);
+        }
+        else
+        {
+            status = AVRC_STS_INTERNAL_ERR;
+        }
+        break;
+
+    default:
+        status = AVRC_STS_BAD_CMD;
+        break;
+    }
+    return status;
+}
+#endif /* AVCT_BROWSE_INCLUDED == TRUE*/
+
+/*******************************************************************************
+**
+** Function         AVRC_ParsCommand
+**
+** Description      This function is a superset of AVRC_ParsMetadata to parse the command.
+**
+** Returns          AVRC_STS_NO_ERROR, if the message in p_data is parsed successfully.
+**                  Otherwise, the error code defined by AVRCP 1.4
+**
+*******************************************************************************/
+tAVRC_STS AVRC_ParsCommand (tAVRC_MSG *p_msg, tAVRC_COMMAND *p_result, UINT8 *p_buf, UINT16 buf_len)
+{
+    tAVRC_STS  status = AVRC_STS_INTERNAL_ERR;
+    UINT16  id;
+
+    if (p_msg && p_result)
+    {
+        switch (p_msg->hdr.opcode)
+        {
+        case AVRC_OP_VENDOR:     /*  0x00    Vendor-dependent commands */
+            status = avrc_pars_vendor_cmd(&p_msg->vendor, p_result, p_buf, buf_len);
+            break;
+
+        case AVRC_OP_PASS_THRU:  /*  0x7C    panel subunit opcode */
+            status = avrc_pars_pass_thru(&p_msg->pass, &id);
+            if (status == AVRC_STS_NO_ERROR)
+            {
+                p_result->pdu = (UINT8)id;
+            }
+            break;
+
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+        case AVRC_OP_BROWSE:
+            status = avrc_pars_browsing_cmd(&p_msg->browse, p_result, p_buf, buf_len);
+            break;
+#endif /*(AVCT_BROWSE_INCLUDED == TRUE)*/
+
+        default:
+            AVRC_TRACE_ERROR1("AVRC_ParsCommand() unknown opcode:0x%x", p_msg->hdr.opcode);
+            break;
+        }
+        p_result->cmd.opcode = p_msg->hdr.opcode;
+        p_result->cmd.status = status;
+    }
+    AVRC_TRACE_DEBUG1("AVRC_ParsCommand() return status:0x%x", status);
+    return status;
+}
+
+#endif /* (AVRC_METADATA_INCLUDED == TRUE) */
+
diff --git a/stack/avrc/avrc_sdp.c b/stack/avrc/avrc_sdp.c
new file mode 100644
index 0000000..ad2024e
--- /dev/null
+++ b/stack/avrc/avrc_sdp.c
@@ -0,0 +1,318 @@
+/*****************************************************************************
+**
+**  Name:       avrc_sdp.c
+**
+**  Description: AVRCP SDP related functions
+**
+**  Copyright (c) 2003-2006, Broadcom Corp., All Rights Reserved.
+**  Broadcom Bluetooth Core. Proprietary and confidential.
+**
+*****************************************************************************/
+#include <string.h>
+
+#include "gki.h"
+#include "avrc_api.h"
+#include "avrc_int.h"
+
+/*****************************************************************************
+**  Global data
+*****************************************************************************/
+#if AVRC_DYNAMIC_MEMORY == FALSE
+tAVRC_CB avrc_cb;
+#endif
+
+/* update AVRC_NUM_PROTO_ELEMS if this constant is changed */
+const tSDP_PROTOCOL_ELEM  avrc_proto_list [] = 
+{
+    {UUID_PROTOCOL_L2CAP, 1, {AVCT_PSM, 0} },
+#if AVRC_ADV_CTRL_INCLUDED == TRUE
+    {UUID_PROTOCOL_AVCTP, 1, {AVCT_REV_1_3, 0}  }
+#else
+#if AVRC_METADATA_INCLUDED == TRUE
+    {UUID_PROTOCOL_AVCTP, 1, {AVCT_REV_1_2, 0}  }
+#else
+    {UUID_PROTOCOL_AVCTP, 1, {AVCT_REV_1_0, 0}  }
+#endif
+#endif
+};
+
+#if AVRC_ADV_CTRL_INCLUDED == TRUE
+const tSDP_PROTO_LIST_ELEM  avrc_add_proto_list [] = 
+{
+    {AVRC_NUM_PROTO_ELEMS,
+    {
+    {UUID_PROTOCOL_L2CAP, 1, {AVCT_BR_PSM, 0} },
+    {UUID_PROTOCOL_AVCTP, 1, {AVCT_REV_1_3, 0}  }}}
+};
+#endif
+
+
+/******************************************************************************
+**
+** Function         avrc_sdp_cback
+**
+** Description      This is the SDP callback function used by A2D_FindService.
+**                  This function will be executed by SDP when the service
+**                  search is completed.  If the search is successful, it
+**                  finds the first record in the database that matches the
+**                  UUID of the search.  Then retrieves various parameters
+**                  from the record.  When it is finished it calls the
+**                  application callback function.
+**
+** Returns          Nothing.
+**
+******************************************************************************/
+static void avrc_sdp_cback(UINT16 status)
+{
+    AVRC_TRACE_API1("avrc_sdp_cback status: %d", status);
+
+    /* reset service_uuid, so can start another find service */
+    avrc_cb.service_uuid = 0;
+
+    /* return info from sdp record in app callback function */
+    (*avrc_cb.p_cback) (status);
+
+    return;
+}
+
+/******************************************************************************
+**
+** Function         AVRC_FindService
+**
+** Description      This function is called by the application to perform service
+**                  discovery and retrieve AVRCP SDP record information from a
+**                  peer device.  Information is returned for the first service
+**                  record found on the server that matches the service UUID.  
+**                  The callback function will be executed when service discovery
+**                  is complete.  There can only be one outstanding call to
+**                  AVRC_FindService() at a time; the application must wait for
+**                  the callback before it makes another call to the function.
+**                  The application is responsible for allocating memory for the
+**                  discovery database.  It is recommended that the size of the
+**                  discovery database be at least 300 bytes.  The application
+**                  can deallocate the memory after the callback function has
+**                  executed.
+**
+**                  Input Parameters:
+**                      service_uuid: Indicates TG(UUID_SERVCLASS_AV_REM_CTRL_TARGET)
+**                                           or CT(UUID_SERVCLASS_AV_REMOTE_CONTROL)
+**
+**                      bd_addr:  BD address of the peer device.
+**
+**                      p_db:  SDP discovery database parameters.
+**                      
+**                      p_cback:  Pointer to the callback function.
+**
+**                  Output Parameters:
+**                      None.
+**
+** Returns          AVRC_SUCCESS if successful.
+**                  AVRC_BAD_PARAMS if discovery database parameters are invalid.
+**                  AVRC_NO_RESOURCES if there are not enough resources to
+**                                    perform the service search.
+**
+******************************************************************************/
+UINT16 AVRC_FindService(UINT16 service_uuid, BD_ADDR bd_addr,
+                tAVRC_SDP_DB_PARAMS *p_db, tAVRC_FIND_CBACK *p_cback)
+{
+    tSDP_UUID   uuid_list;
+    BOOLEAN     result = TRUE;
+    UINT16      a2d_attr_list[] = {ATTR_ID_SERVICE_CLASS_ID_LIST, /* update AVRC_NUM_ATTR, if changed */
+                                   ATTR_ID_PROTOCOL_DESC_LIST,
+                                   ATTR_ID_BT_PROFILE_DESC_LIST,
+                                   ATTR_ID_SERVICE_NAME,
+                                   ATTR_ID_SUPPORTED_FEATURES,
+                                   ATTR_ID_PROVIDER_NAME};
+
+    AVRC_TRACE_API1("AVRC_FindService uuid: %x", service_uuid);
+    if( (service_uuid != UUID_SERVCLASS_AV_REM_CTRL_TARGET && service_uuid != UUID_SERVCLASS_AV_REMOTE_CONTROL) ||
+        p_db == NULL || p_db->p_db == NULL || p_cback == NULL)
+        return AVRC_BAD_PARAM;
+
+    /* check if it is busy */
+    if( avrc_cb.service_uuid == UUID_SERVCLASS_AV_REM_CTRL_TARGET || 
+        avrc_cb.service_uuid == UUID_SERVCLASS_AV_REMOTE_CONTROL)
+        return AVRC_NO_RESOURCES;
+
+    /* set up discovery database */
+    uuid_list.len = LEN_UUID_16;
+    uuid_list.uu.uuid16 = service_uuid;
+
+    if(p_db->p_attrs == NULL || p_db->num_attr == 0)
+    {
+        p_db->p_attrs  = a2d_attr_list;
+        p_db->num_attr = AVRC_NUM_ATTR;
+    }
+
+    result = SDP_InitDiscoveryDb(p_db->p_db, p_db->db_len, 1, &uuid_list, p_db->num_attr,
+                                 p_db->p_attrs);
+
+    if (result == TRUE)
+    {
+        /* store service_uuid and discovery db pointer */
+        avrc_cb.p_db = p_db->p_db;
+        avrc_cb.service_uuid = service_uuid;
+        avrc_cb.p_cback = p_cback;
+
+        /* perform service search */
+        result = SDP_ServiceSearchAttributeRequest(bd_addr, p_db->p_db, avrc_sdp_cback);
+    }
+
+    return (result ? AVRC_SUCCESS : AVRC_FAIL);
+}
+
+/******************************************************************************
+**
+** Function         AVRC_AddRecord
+**
+** Description      This function is called to build an AVRCP SDP record.
+**                  Prior to calling this function the application must 
+**                  call SDP_CreateRecord() to create an SDP record.
+**
+**                  Input Parameters:
+**                      service_uuid:  Indicates TG(UUID_SERVCLASS_AV_REM_CTRL_TARGET)
+**                                            or CT(UUID_SERVCLASS_AV_REMOTE_CONTROL)
+**
+**                      p_service_name:  Pointer to a null-terminated character
+**                      string containing the service name.
+**                      If service name is not used set this to NULL.
+**
+**                      p_provider_name:  Pointer to a null-terminated character
+**                      string containing the provider name.
+**                      If provider name is not used set this to NULL.
+**
+**                      categories:  Supported categories.
+**
+**                      sdp_handle:  SDP handle returned by SDP_CreateRecord().
+**
+**                  Output Parameters:
+**                      None.
+**
+** Returns          AVRC_SUCCESS if successful.
+**                  AVRC_NO_RESOURCES if not enough resources to build the SDP record.
+**
+******************************************************************************/
+UINT16 AVRC_AddRecord(UINT16 service_uuid, char *p_service_name,
+                char *p_provider_name, UINT16 categories, UINT32 sdp_handle)
+{
+    UINT16      browse_list[1];
+    BOOLEAN     result = TRUE;
+    UINT8       temp[8];
+    UINT8       *p;
+    UINT16      count = 1;
+    UINT16      class_list[2];
+
+
+    AVRC_TRACE_API1("AVRC_AddRecord uuid: %x", service_uuid);
+
+    if( service_uuid != UUID_SERVCLASS_AV_REM_CTRL_TARGET && service_uuid != UUID_SERVCLASS_AV_REMOTE_CONTROL )
+        return AVRC_BAD_PARAM;
+
+    /* add service class id list */
+    class_list[0] = service_uuid;
+#if AVRC_ADV_CTRL_INCLUDED == TRUE
+    if( service_uuid == UUID_SERVCLASS_AV_REMOTE_CONTROL )
+    {
+        class_list[1] = UUID_SERVCLASS_AV_REM_CTRL_CONTROL;
+        count = 2;
+    }
+#endif
+    result &= SDP_AddServiceClassIdList(sdp_handle, count, class_list);
+
+    /* add protocol descriptor list   */
+    result &= SDP_AddProtocolList(sdp_handle, AVRC_NUM_PROTO_ELEMS, (tSDP_PROTOCOL_ELEM *)avrc_proto_list);
+
+    /* add profile descriptor list   */
+#if AVRC_ADV_CTRL_INCLUDED == TRUE
+    result &= SDP_AddProfileDescriptorList(sdp_handle, UUID_SERVCLASS_AV_REMOTE_CONTROL, AVRC_REV_1_4);
+    /* additional protocol list to include browsing channel */
+    result &= SDP_AddAdditionProtoLists( sdp_handle, 1, (tSDP_PROTO_LIST_ELEM *)avrc_add_proto_list);
+#else
+#if AVRC_METADATA_INCLUDED == TRUE
+    result &= SDP_AddProfileDescriptorList(sdp_handle, UUID_SERVCLASS_AV_REMOTE_CONTROL, AVRC_REV_1_3);
+#else
+    result &= SDP_AddProfileDescriptorList(sdp_handle, UUID_SERVCLASS_AV_REMOTE_CONTROL, AVRC_REV_1_0);
+#endif
+#endif
+
+    /* add supported categories */
+    p = temp;
+    UINT16_TO_BE_STREAM(p, categories);
+    result &= SDP_AddAttribute(sdp_handle, ATTR_ID_SUPPORTED_FEATURES, UINT_DESC_TYPE,
+              (UINT32)2, (UINT8*)temp);
+
+    /* add provider name */
+    if (p_provider_name != NULL)
+    {
+        result &= SDP_AddAttribute(sdp_handle, ATTR_ID_PROVIDER_NAME, TEXT_STR_DESC_TYPE,
+                    (UINT32)(strlen(p_provider_name)+1), (UINT8 *) p_provider_name);
+    }
+
+    /* add service name */
+    if (p_service_name != NULL)
+    {
+        result &= SDP_AddAttribute(sdp_handle, ATTR_ID_SERVICE_NAME, TEXT_STR_DESC_TYPE,
+                    (UINT32)(strlen(p_service_name)+1), (UINT8 *) p_service_name);
+    }
+
+    /* add browse group list */
+    browse_list[0] = UUID_SERVCLASS_PUBLIC_BROWSE_GROUP;
+    result &= SDP_AddUuidSequence(sdp_handle, ATTR_ID_BROWSE_GROUP_LIST, 1, browse_list);
+
+
+    return (result ? AVRC_SUCCESS : AVRC_FAIL);
+}
+
+
+
+/******************************************************************************
+**
+** Function         AVRC_SetTraceLevel
+**
+** Description      Sets the trace level for AVRC. If 0xff is passed, the
+**                  current trace level is returned.
+**
+**                  Input Parameters:
+**                      new_level:  The level to set the AVRC tracing to:
+**                      0xff-returns the current setting.
+**                      0-turns off tracing.
+**                      >= 1-Errors.
+**                      >= 2-Warnings.
+**                      >= 3-APIs.
+**                      >= 4-Events.
+**                      >= 5-Debug.
+**
+** Returns          The new trace level or current trace level if
+**                  the input parameter is 0xff.
+**
+******************************************************************************/
+UINT8 AVRC_SetTraceLevel (UINT8 new_level)
+{
+    if (new_level != 0xFF)
+        avrc_cb.trace_level = new_level;
+
+    return (avrc_cb.trace_level);
+}
+
+/*******************************************************************************
+**
+** Function         AVRC_Init
+**
+** Description      This function is called at stack startup to allocate the
+**                  control block (if using dynamic memory), and initializes the
+**                  control block and tracing level.
+**
+** Returns          void
+**
+*******************************************************************************/
+void AVRC_Init(void)
+{
+    memset(&avrc_cb, 0, sizeof(tAVRC_CB));
+
+#if defined(AVRC_INITIAL_TRACE_LEVEL)
+    avrc_cb.trace_level  = AVRC_INITIAL_TRACE_LEVEL;
+#else
+    avrc_cb.trace_level  = BT_TRACE_LEVEL_NONE;
+#endif
+}
+
diff --git a/stack/avrc/avrc_utils.c b/stack/avrc/avrc_utils.c
new file mode 100644
index 0000000..b9eef9b
--- /dev/null
+++ b/stack/avrc/avrc_utils.c
@@ -0,0 +1,254 @@
+/*****************************************************************************
+**
+**  Name:       avrc_utils.c
+**
+**  Description: Utility functions to validate AVRC command/response paramaters
+**
+**  Copyright (c) 2003-2008, Broadcom Corp., All Rights Reserved.
+**  Broadcom Bluetooth Core. Proprietary and confidential.
+**
+*****************************************************************************/
+#include <string.h>
+
+#include "gki.h"
+#include "avrc_api.h"
+#include "avrc_int.h"
+
+
+#if (AVRC_METADATA_INCLUDED == TRUE)
+
+/**************************************************************************
+**
+** Function         AVRC_IsValidAvcType
+**
+** Description      Check if correct AVC type is specified
+**
+** Returns          returns TRUE if it is valid
+**
+**
+*******************************************************************************/
+BOOLEAN AVRC_IsValidAvcType(UINT8 pdu_id, UINT8 avc_type)
+{
+    BOOLEAN result=FALSE;
+
+    if (avc_type < AVRC_RSP_NOT_IMPL) /* command msg */
+    {
+        switch (pdu_id)
+        {
+        case AVRC_PDU_GET_CAPABILITIES:            /* 0x10 */  
+        case AVRC_PDU_LIST_PLAYER_APP_ATTR:        /* 0x11 */ 
+        case AVRC_PDU_LIST_PLAYER_APP_VALUES:      /* 0x12 */
+        case AVRC_PDU_GET_CUR_PLAYER_APP_VALUE:    /* 0x13 */
+        case AVRC_PDU_GET_PLAYER_APP_ATTR_TEXT:    /* 0x15 */
+        case AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT:   /* 0x16 */ 
+        case AVRC_PDU_GET_ELEMENT_ATTR:            /* 0x20 */  
+        case AVRC_PDU_GET_PLAY_STATUS:             /* 0x30 */                 
+             if (avc_type == AVRC_CMD_STATUS)
+                result=TRUE;
+             break;
+
+        case AVRC_PDU_SET_PLAYER_APP_VALUE:        /* 0x14 */
+        case AVRC_PDU_INFORM_DISPLAY_CHARSET:      /* 0x17 */
+        case AVRC_PDU_INFORM_BATTERY_STAT_OF_CT:   /* 0x18 */
+        case AVRC_PDU_REQUEST_CONTINUATION_RSP:    /* 0x40 */
+        case AVRC_PDU_ABORT_CONTINUATION_RSP:      /* 0x41 */ 
+             if (avc_type == AVRC_CMD_CTRL)
+                result=TRUE;
+             break;
+
+        case AVRC_PDU_REGISTER_NOTIFICATION:       /* 0x31 */
+             if (avc_type == AVRC_CMD_NOTIF)
+                result=TRUE;
+             break;
+
+#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
+        case AVRC_PDU_SET_ABSOLUTE_VOLUME:         /* 0x50 */
+        case AVRC_PDU_SET_ADDRESSED_PLAYER:        /* 0x60 */    
+        case AVRC_PDU_PLAY_ITEM:                   /* 0x74 */    
+        case AVRC_PDU_ADD_TO_NOW_PLAYING:          /* 0x90 */    
+             if (avc_type == AVRC_CMD_CTRL)
+                result=TRUE;
+             break;
+#endif
+        }
+    }
+    else  /* response msg */
+    {
+        if (avc_type >= AVRC_RSP_NOT_IMPL  &&
+           avc_type <= AVRC_RSP_INTERIM    )
+           result=TRUE;
+    }
+
+    return result;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_is_valid_player_attrib_value
+**
+** Description      Check if the given attrib value is valid for its attribute
+**                  
+**
+** Returns          returns TRUE if it is valid
+**  
+*******************************************************************************/
+BOOLEAN avrc_is_valid_player_attrib_value(UINT8 attrib, UINT8 value)
+{
+    BOOLEAN result=FALSE;
+
+    switch(attrib)
+    {
+    case AVRC_PLAYER_SETTING_EQUALIZER:   
+         if ((value > 0)  && 
+            (value <= AVRC_PLAYER_VAL_ON))
+            result=TRUE;
+         break;
+
+    case AVRC_PLAYER_SETTING_REPEAT:
+         if ((value > 0)  && 
+            (value <= AVRC_PLAYER_VAL_GROUP_REPEAT))
+            result=TRUE;
+         break;
+
+    case AVRC_PLAYER_SETTING_SHUFFLE:
+    case AVRC_PLAYER_SETTING_SCAN:
+         if ((value > 0)  && 
+            (value <= AVRC_PLAYER_VAL_GROUP_SHUFFLE))
+            result=TRUE;
+         break;
+    }
+
+    if (attrib >= AVRC_PLAYER_SETTING_LOW_MENU_EXT &&
+       attrib <= AVRC_PLAYER_SETTING_HIGH_MENU_EXT)
+       result = TRUE;
+
+    if (!result)
+        AVRC_TRACE_ERROR2("avrc_is_valid_player_attrib_value() found not matching attrib(x%x)-value(x%x) pair!", attrib, value);
+
+    return result;
+}
+
+/*******************************************************************************
+**
+** Function         AVRC_IsValidPlayerAttr
+**
+** Description      Check if the given attrib value is a valid one
+**                  
+**
+** Returns          returns TRUE if it is valid
+**  
+*******************************************************************************/
+BOOLEAN AVRC_IsValidPlayerAttr(UINT8 attr)
+{
+    BOOLEAN result=FALSE;
+
+    if ( (attr >= AVRC_PLAYER_SETTING_EQUALIZER && attr <= AVRC_PLAYER_SETTING_SCAN) ||
+         (attr >= AVRC_PLAYER_SETTING_LOW_MENU_EXT && attr <= AVRC_PLAYER_SETTING_HIGH_MENU_EXT) )
+    {
+       result = TRUE;
+    }
+
+    return result;
+}
+
+
+
+/*******************************************************************************
+**
+** Function         avrc_pars_pass_thru
+**
+** Description      This function parses the pass thru commands defined by
+**                  Bluetooth SIG
+**
+** Returns          AVRC_STS_NO_ERROR, if the message in p_data is parsed successfully.
+**                  Otherwise, the error code defined by AVRCP 1.4
+**
+*******************************************************************************/
+tAVRC_STS avrc_pars_pass_thru(tAVRC_MSG_PASS *p_msg, UINT16 *p_vendor_unique_id)
+{
+    UINT8      *p_data;
+    UINT32      co_id;
+    UINT16      id;
+    tAVRC_STS  status = AVRC_STS_BAD_CMD;
+
+    if (p_msg->op_id == AVRC_ID_VENDOR && p_msg->pass_len == AVRC_PASS_THRU_GROUP_LEN)
+    {
+        p_data = p_msg->p_pass_data;
+        AVRC_BE_STREAM_TO_CO_ID (co_id, p_data);
+        if (co_id == AVRC_CO_METADATA)
+        {
+            BE_STREAM_TO_UINT16 (id, p_data);
+            if (AVRC_IS_VALID_GROUP(id))
+            {
+                *p_vendor_unique_id = id;
+                status = AVRC_STS_NO_ERROR;
+            }
+        }
+    }
+    return status;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_opcode_from_pdu
+**
+** Description      This function returns the opcode of the given pdu
+**
+** Returns          AVRC_OP_VENDOR, AVRC_OP_PASS_THRU or AVRC_OP_BROWSE
+**
+*******************************************************************************/
+UINT8 avrc_opcode_from_pdu(UINT8 pdu)
+{
+    UINT8 opcode = 0;
+
+    switch (pdu)
+    {
+#if (AVCT_BROWSE_INCLUDED == TRUE)
+    case AVRC_PDU_SET_BROWSED_PLAYER:
+    case AVRC_PDU_GET_FOLDER_ITEMS:
+    case AVRC_PDU_CHANGE_PATH:
+    case AVRC_PDU_GET_ITEM_ATTRIBUTES:
+    case AVRC_PDU_SEARCH:
+    case AVRC_PDU_GENERAL_REJECT:
+        opcode  = AVRC_OP_BROWSE;
+        break;
+#endif /* AVCT_BROWSE_INCLUDED */
+
+    case AVRC_PDU_NEXT_GROUP:
+    case AVRC_PDU_PREV_GROUP: /* pass thru */
+        opcode  = AVRC_OP_PASS_THRU;
+        break;
+
+    default: /* vendor */
+        opcode  = AVRC_OP_VENDOR;
+        break;
+    }
+
+    return opcode;
+}
+
+/*******************************************************************************
+**
+** Function         avrc_is_valid_opcode
+**
+** Description      This function returns the opcode of the given pdu
+**
+** Returns          AVRC_OP_VENDOR, AVRC_OP_PASS_THRU or AVRC_OP_BROWSE
+**
+*******************************************************************************/
+BOOLEAN avrc_is_valid_opcode(UINT8 opcode)
+{
+    BOOLEAN is_valid = FALSE;
+    switch (opcode)
+    {
+    case AVRC_OP_BROWSE:
+    case AVRC_OP_PASS_THRU:
+    case AVRC_OP_VENDOR:
+        is_valid = TRUE;
+        break;
+    }
+    return is_valid;
+}
+
+#endif /* (AVRC_METADATA_INCLUDED == TRUE) */
+