1 /******************************************************************************
2  *
3  *  Copyright (C) 2008-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /******************************************************************************
20  *
21  *  this file contains the GATT server functions
22  *
23  ******************************************************************************/
24 
25 #include "common/bt_target.h"
26 #include "osi/allocator.h"
27 
28 #if BLE_INCLUDED == TRUE && GATTS_INCLUDED == TRUE
29 #include <string.h>
30 #include "gatt_int.h"
31 #include "stack/l2c_api.h"
32 #include "l2c_int.h"
33 #define GATT_MTU_REQ_MIN_LEN        2
34 
35 
36 
37 /*******************************************************************************
38 **
39 ** Function         gatt_send_packet
40 **
41 ** Description      This function is called to send gatt packets directly
42 
43 **
44 ** Returns          status
45 **
46 *******************************************************************************/
gatt_send_packet(tGATT_TCB * p_tcb,UINT8 * p_data,UINT16 len)47 tGATT_STATUS gatt_send_packet (tGATT_TCB *p_tcb, UINT8 *p_data, UINT16 len)
48 {
49     BT_HDR          *p_msg = NULL;
50     UINT8           *p_m = NULL;
51     UINT16          buf_len;
52     tGATT_STATUS    status;
53 
54     if (len > p_tcb->payload_size){
55         return  GATT_ILLEGAL_PARAMETER;
56     }
57 
58     buf_len = (UINT16)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET);
59     if ((p_msg = (BT_HDR *)osi_malloc(buf_len)) == NULL) {
60         return GATT_NO_RESOURCES;
61     }
62 
63     memset(p_msg, 0, buf_len);
64     p_msg->len = len;
65     p_m = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET;
66     memcpy(p_m, p_data, len);
67 
68     status = attp_send_sr_msg(p_tcb, p_msg);
69     return status;
70 }
71 
72 /*******************************************************************************
73 **
74 ** Function         gatt_sr_enqueue_cmd
75 **
76 ** Description      This function enqueue the request from client which needs a
77 **                  application response, and update the transaction ID.
78 **
79 ** Returns          void
80 **
81 *******************************************************************************/
gatt_sr_enqueue_cmd(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 handle)82 UINT32 gatt_sr_enqueue_cmd (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 handle)
83 {
84     tGATT_SR_CMD   *p_cmd = &p_tcb->sr_cmd;
85     UINT32          trans_id = 0;
86 
87     if ( (p_cmd->op_code == 0) ||
88             (op_code == GATT_HANDLE_VALUE_CONF)) { /* no pending request */
89         if (op_code == GATT_CMD_WRITE ||
90                 op_code == GATT_SIGN_CMD_WRITE  ||
91                 op_code == GATT_REQ_MTU ||
92                 op_code == GATT_HANDLE_VALUE_CONF) {
93             trans_id = ++p_tcb->trans_id;
94         } else {
95             p_cmd->trans_id   = ++p_tcb->trans_id;
96             p_cmd->op_code    = op_code;
97             p_cmd->handle     = handle;
98             p_cmd->status     = GATT_NOT_FOUND;
99             p_tcb->trans_id %= GATT_TRANS_ID_MAX;
100             trans_id = p_cmd->trans_id;
101         }
102     }
103 
104     return trans_id;
105 }
106 
107 /*******************************************************************************
108 **
109 ** Function         gatt_sr_cmd_empty
110 **
111 ** Description      This function check the server command queue is empty or not.
112 **
113 ** Returns          TRUE if empty, FALSE if there is pending command.
114 **
115 *******************************************************************************/
gatt_sr_cmd_empty(tGATT_TCB * p_tcb)116 BOOLEAN gatt_sr_cmd_empty (tGATT_TCB *p_tcb)
117 {
118     return (p_tcb->sr_cmd.op_code == 0);
119 }
120 
121 /*******************************************************************************
122 **
123 ** Function         gatt_dequeue_sr_cmd
124 **
125 ** Description      This function dequeue the request from command queue.
126 **
127 ** Returns          void
128 **
129 *******************************************************************************/
gatt_dequeue_sr_cmd(tGATT_TCB * p_tcb)130 void gatt_dequeue_sr_cmd (tGATT_TCB *p_tcb)
131 {
132     /* Double check in case any buffers are queued */
133     GATT_TRACE_DEBUG("gatt_dequeue_sr_cmd" );
134     if (p_tcb->sr_cmd.p_rsp_msg) {
135         GATT_TRACE_ERROR("%s free msg %p", __func__, p_tcb->sr_cmd.p_rsp_msg);
136 
137         osi_free(p_tcb->sr_cmd.p_rsp_msg);
138         p_tcb->sr_cmd.p_rsp_msg = NULL;
139     }
140 
141     if (p_tcb->sr_cmd.multi_rsp_q) {
142         while (!fixed_queue_is_empty(p_tcb->sr_cmd.multi_rsp_q)) {
143             osi_free(fixed_queue_dequeue(p_tcb->sr_cmd.multi_rsp_q, 0));
144         }
145         fixed_queue_free(p_tcb->sr_cmd.multi_rsp_q, NULL);
146     }
147 
148     memset( &p_tcb->sr_cmd, 0, sizeof(tGATT_SR_CMD));
149 }
150 
151 /*******************************************************************************
152 **
153 ** Function         process_read_multi_rsp
154 **
155 ** Description      This function check the read multiple response.
156 **
157 ** Returns          BOOLEAN if all replies have been received
158 **
159 *******************************************************************************/
process_read_multi_rsp(tGATT_SR_CMD * p_cmd,tGATT_STATUS status,tGATTS_RSP * p_msg,UINT16 mtu)160 static BOOLEAN process_read_multi_rsp (tGATT_SR_CMD *p_cmd, tGATT_STATUS status,
161                                        tGATTS_RSP *p_msg, UINT16 mtu)
162 {
163     UINT16          ii, total_len, len;
164     UINT8           *p;
165     BOOLEAN         is_overflow = FALSE;
166 
167     GATT_TRACE_DEBUG ("process_read_multi_rsp status=%d mtu=%d", status, mtu);
168 
169 	if (p_cmd->multi_rsp_q == NULL) {
170         p_cmd->multi_rsp_q = fixed_queue_new(QUEUE_SIZE_MAX);
171 	}
172 
173     /* Enqueue the response */
174     BT_HDR  *p_buf = (BT_HDR *)osi_malloc(sizeof(tGATTS_RSP));
175     if (p_buf == NULL) {
176         p_cmd->status = GATT_INSUF_RESOURCE;
177         return FALSE;
178     }
179     memcpy((void *)p_buf, (const void *)p_msg, sizeof(tGATTS_RSP));
180 
181     fixed_queue_enqueue(p_cmd->multi_rsp_q, p_buf, FIXED_QUEUE_MAX_TIMEOUT);
182 
183     p_cmd->status = status;
184     if (status == GATT_SUCCESS) {
185         GATT_TRACE_DEBUG ("Multi read count=%d num_hdls=%d",
186                          fixed_queue_length(p_cmd->multi_rsp_q),
187                          p_cmd->multi_req.num_handles);
188         /* Wait till we get all the responses */
189         if (fixed_queue_length(p_cmd->multi_rsp_q) == p_cmd->multi_req.num_handles) {
190             len = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + mtu;
191             if ((p_buf = (BT_HDR *)osi_calloc(len)) == NULL) {
192                 p_cmd->status = GATT_INSUF_RESOURCE;
193                 return (TRUE);
194             }
195 
196             p_buf->offset = L2CAP_MIN_OFFSET;
197             p = (UINT8 *)(p_buf + 1) + p_buf->offset;
198 
199             /* First byte in the response is the opcode */
200             *p++ = GATT_RSP_READ_MULTI;
201             p_buf->len = 1;
202 
203             /* Now walk through the buffers puting the data into the response in order */
204             list_t *list = NULL;
205             const list_node_t *node = NULL;
206             if (! fixed_queue_is_empty(p_cmd->multi_rsp_q)) {
207                 list = fixed_queue_get_list(p_cmd->multi_rsp_q);
208 			}
209             for (ii = 0; ii < p_cmd->multi_req.num_handles; ii++) {
210                 tGATTS_RSP *p_rsp = NULL;
211                 if (list != NULL) {
212                     if (ii == 0) {
213                         node = list_begin(list);
214                     } else {
215                         node = list_next(node);
216 					}
217                     if (node != list_end(list)) {
218                         p_rsp = (tGATTS_RSP *)list_node(node);
219 					}
220                 }
221 
222                 if (p_rsp != NULL) {
223 
224                     total_len = (p_buf->len + p_rsp->attr_value.len);
225 
226                     if (total_len >  mtu) {
227                         /* just send the partial response for the overflow case */
228                         len = p_rsp->attr_value.len - (total_len - mtu);
229                         is_overflow = TRUE;
230                         GATT_TRACE_DEBUG ("multi read overflow available len=%d val_len=%d", len, p_rsp->attr_value.len );
231                     } else {
232                         len = p_rsp->attr_value.len;
233                     }
234 
235                     if (p_rsp->attr_value.handle == p_cmd->multi_req.handles[ii]) {
236                         memcpy (p, p_rsp->attr_value.value, len);
237                         if (!is_overflow) {
238                             p += len;
239                         }
240                         p_buf->len += len;
241                     } else {
242                         p_cmd->status        = GATT_NOT_FOUND;
243                         break;
244                     }
245 
246                     if (is_overflow) {
247                         break;
248                     }
249 
250                 } else {
251                     p_cmd->status        = GATT_NOT_FOUND;
252                     break;
253                 }
254 
255             } /* loop through all handles*/
256 
257 
258             /* Sanity check on the buffer length */
259             if (p_buf->len == 0) {
260                 GATT_TRACE_ERROR("process_read_multi_rsp - nothing found!!");
261                 p_cmd->status = GATT_NOT_FOUND;
262                 osi_free (p_buf);
263                 GATT_TRACE_DEBUG(" osi_free (p_buf)");
264             } else if (p_cmd->p_rsp_msg != NULL) {
265                 osi_free (p_buf);
266             } else {
267                 p_cmd->p_rsp_msg = p_buf;
268             }
269 
270             return (TRUE);
271         }
272     } else { /* any handle read exception occurs, return error */
273         return (TRUE);
274     }
275 
276     /* If here, still waiting */
277     return (FALSE);
278 }
279 
process_read_multi_var_rsp(tGATT_SR_CMD * p_cmd,tGATT_STATUS status,tGATTS_RSP * p_msg,UINT16 mtu)280 static BOOLEAN process_read_multi_var_rsp (tGATT_SR_CMD *p_cmd, tGATT_STATUS status,
281                                        tGATTS_RSP *p_msg, UINT16 mtu)
282 {
283     UINT16          ii;
284     UINT16          total_len;
285     UINT16          len;
286     UINT8           *p;
287 
288     GATT_TRACE_DEBUG ("process_read_multi_var rsp status=%d mtu=%d", status, mtu);
289 
290 	if (p_cmd->multi_rsp_q == NULL) {
291         p_cmd->multi_rsp_q = fixed_queue_new(QUEUE_SIZE_MAX);
292 	}
293 
294     /* Enqueue the response */
295     BT_HDR  *p_buf = (BT_HDR *)osi_malloc(sizeof(tGATTS_RSP));
296     if (p_buf == NULL) {
297         p_cmd->status = GATT_INSUF_RESOURCE;
298         return FALSE;
299     }
300     memcpy((void *)p_buf, (const void *)p_msg, sizeof(tGATTS_RSP));
301 
302     fixed_queue_enqueue(p_cmd->multi_rsp_q, p_buf, FIXED_QUEUE_MAX_TIMEOUT);
303 
304     p_cmd->status = status;
305     if (status == GATT_SUCCESS) {
306         GATT_TRACE_DEBUG ("Multi var read count=%d num_hdls=%d",
307                          fixed_queue_length(p_cmd->multi_rsp_q),
308                          p_cmd->multi_req.num_handles);
309         /* Wait till we get all the responses */
310         if (fixed_queue_length(p_cmd->multi_rsp_q) == p_cmd->multi_req.num_handles) {
311             len = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + mtu;
312             if ((p_buf = (BT_HDR *)osi_calloc(len)) == NULL) {
313                 p_cmd->status = GATT_INSUF_RESOURCE;
314                 return (TRUE);
315             }
316 
317             p_buf->offset = L2CAP_MIN_OFFSET;
318             p = (UINT8 *)(p_buf + 1) + p_buf->offset;
319 
320             /* First byte in the response is the opcode */
321             *p++ = GATT_RSP_READ_MULTI_VAR;
322             p_buf->len = 1;
323 
324             /* Now walk through the buffers puting the data into the response in order */
325             list_t *list = NULL;
326             const list_node_t *node = NULL;
327             if (! fixed_queue_is_empty(p_cmd->multi_rsp_q)) {
328                 list = fixed_queue_get_list(p_cmd->multi_rsp_q);
329 			}
330             for (ii = 0; ii < p_cmd->multi_req.num_handles; ii++) {
331                 tGATTS_RSP *p_rsp = NULL;
332                 if (list != NULL) {
333                     if (ii == 0) {
334                         node = list_begin(list);
335                     } else {
336                         node = list_next(node);
337 					}
338                     if (node != list_end(list)) {
339                         p_rsp = (tGATTS_RSP *)list_node(node);
340 					}
341                 }
342 
343                 if (p_rsp != NULL) {
344 
345                     total_len = (p_buf->len + 2);  // value length
346 
347                     if (total_len > mtu) {
348                         GATT_TRACE_DEBUG ("multi read variable overflow available len=%d val_len=%d", len, p_rsp->attr_value.len );
349                         break;
350                     }
351                     len = MIN(p_rsp->attr_value.len, (mtu - total_len));  // attribute value length
352 
353                     if (p_rsp->attr_value.handle == p_cmd->multi_req.handles[ii]) {
354                         GATT_TRACE_DEBUG("%s handle %x len %u", __func__, p_rsp->attr_value.handle, p_rsp->attr_value.len);
355                         UINT16_TO_STREAM(p, p_rsp->attr_value.len);
356                         memcpy (p, p_rsp->attr_value.value, len);
357                         p += len;
358                         p_buf->len += (2+len);
359                     } else {
360                         p_cmd->status = GATT_NOT_FOUND;
361                         break;
362                     }
363                 } else {
364                     p_cmd->status = GATT_NOT_FOUND;
365                     break;
366                 }
367 
368             } /* loop through all handles*/
369 
370             /* Sanity check on the buffer length */
371             if (p_buf->len == 0) {
372                 GATT_TRACE_ERROR("%s - nothing found!!", __func__);
373                 p_cmd->status = GATT_NOT_FOUND;
374                 osi_free (p_buf);
375             } else if (p_cmd->p_rsp_msg != NULL) {
376                 osi_free (p_buf);
377             } else {
378                 p_cmd->p_rsp_msg = p_buf;
379             }
380 
381             return (TRUE);
382         }
383     } else { /* any handle read exception occurs, return error */
384         return (TRUE);
385     }
386 
387     /* If here, still waiting */
388     return (FALSE);
389 }
390 
391 /*******************************************************************************
392 **
393 ** Function         gatt_sr_process_app_rsp
394 **
395 ** Description      This function checks whether the response message from application
396 **                  match any pending request or not.
397 **
398 ** Returns          void
399 **
400 *******************************************************************************/
gatt_sr_process_app_rsp(tGATT_TCB * p_tcb,tGATT_IF gatt_if,UINT32 trans_id,UINT8 op_code,tGATT_STATUS status,tGATTS_RSP * p_msg)401 tGATT_STATUS gatt_sr_process_app_rsp (tGATT_TCB *p_tcb, tGATT_IF gatt_if,
402                                       UINT32 trans_id, UINT8 op_code,
403                                       tGATT_STATUS status, tGATTS_RSP *p_msg)
404 {
405     tGATT_STATUS    ret_code = GATT_SUCCESS;
406     UNUSED(trans_id);
407 
408     GATT_TRACE_DEBUG("gatt_sr_process_app_rsp gatt_if=%d\n", gatt_if);
409 
410     gatt_sr_update_cback_cnt(p_tcb, gatt_if, FALSE, FALSE);
411 
412     if (op_code == GATT_REQ_READ_MULTI) {
413         /* If no error and still waiting, just return */
414         if (!process_read_multi_rsp (&p_tcb->sr_cmd, status, p_msg, p_tcb->payload_size)) {
415             return (GATT_SUCCESS);
416         }
417     } else if (op_code == GATT_REQ_READ_MULTI_VAR) {
418         if (!process_read_multi_var_rsp(&p_tcb->sr_cmd, status, p_msg, p_tcb->payload_size)) {
419             return (GATT_SUCCESS);
420         }
421     } else {
422         if (op_code == GATT_REQ_PREPARE_WRITE && status == GATT_SUCCESS) {
423             gatt_sr_update_prep_cnt(p_tcb, gatt_if, TRUE, FALSE);
424         }
425 
426         if (op_code == GATT_REQ_EXEC_WRITE && status != GATT_SUCCESS) {
427             gatt_sr_reset_cback_cnt(p_tcb);
428         }
429 
430         p_tcb->sr_cmd.status = status;
431 
432         if (gatt_sr_is_cback_cnt_zero(p_tcb)
433                 && status == GATT_SUCCESS) {
434             if (p_tcb->sr_cmd.p_rsp_msg == NULL) {
435                 p_tcb->sr_cmd.p_rsp_msg = attp_build_sr_msg (p_tcb, (UINT8)(op_code + 1), (tGATT_SR_MSG *)p_msg);
436             } else {
437                 GATT_TRACE_ERROR("Exception!!! already has respond message\n");
438             }
439         }
440     }
441     if (gatt_sr_is_cback_cnt_zero(p_tcb)) {
442         if ( (p_tcb->sr_cmd.status == GATT_SUCCESS) && (p_tcb->sr_cmd.p_rsp_msg) ) {
443             ret_code = attp_send_sr_msg (p_tcb, p_tcb->sr_cmd.p_rsp_msg);
444             p_tcb->sr_cmd.p_rsp_msg = NULL;
445         } else {
446             if (p_tcb->sr_cmd.status == GATT_SUCCESS){
447                 status = GATT_UNKNOWN_ERROR;
448             }
449             ret_code = gatt_send_error_rsp (p_tcb, status, op_code, p_tcb->sr_cmd.handle, FALSE);
450         }
451 
452         gatt_dequeue_sr_cmd(p_tcb);
453     }
454 
455     GATT_TRACE_DEBUG("gatt_sr_process_app_rsp ret_code=%d\n", ret_code);
456 
457     return ret_code;
458 }
459 
460 /*******************************************************************************
461 **
462 ** Function         gatt_process_exec_write_req
463 **
464 ** Description      This function is called to process the execute write request
465 **                  from client.
466 **
467 ** Returns          void
468 **
469 *******************************************************************************/
gatt_process_exec_write_req(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)470 void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data)
471 {
472     UINT8   *p = p_data, flag, i = 0;
473     UINT32  trans_id = 0;
474     tGATT_IF gatt_if;
475     UINT16  conn_id;
476     UINT16  queue_num = 0;
477     BOOLEAN is_first = TRUE;
478     BOOLEAN is_prepare_write_valid = FALSE;
479     BOOLEAN is_need_dequeue_sr_cmd = FALSE;
480     tGATT_PREPARE_WRITE_RECORD *prepare_record = NULL;
481     tGATT_PREPARE_WRITE_QUEUE_DATA * queue_data = NULL;
482     UNUSED(len);
483 
484 #if GATT_CONFORMANCE_TESTING == TRUE
485     if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
486         GATT_TRACE_DEBUG("Conformance tst: forced err rspv for Execute Write: error status=%d",
487                          gatt_cb.err_status);
488 
489         gatt_send_error_rsp (p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, gatt_cb.handle, FALSE);
490 
491         return;
492     }
493 #endif
494 
495     STREAM_TO_UINT8(flag, p);
496 
497     /* mask the flag */
498     flag &= GATT_PREP_WRITE_EXEC;
499 
500     prepare_record = &(p_tcb->prepare_write_record);
501     queue_num = fixed_queue_length(prepare_record->queue);
502 
503     //if received prepare_write packets include stack_rsp and app_rsp,
504     //stack respond to execute_write only when stack_rsp handle has invalid_offset
505     //or invalid_length error;
506     //app need to respond to execute_write if it has received app_rsp handle packets
507     if (((prepare_record->error_code_app == GATT_SUCCESS) &&
508         (prepare_record->total_num == queue_num))
509         || (flag == GATT_PREP_WRITE_CANCEL)){
510         tGATT_EXEC_WRITE_RSP gatt_exec_write_rsp;
511         gatt_exec_write_rsp.op_code = GATT_RSP_EXEC_WRITE;
512         gatt_send_packet(p_tcb, (UINT8 *)(&gatt_exec_write_rsp), sizeof(gatt_exec_write_rsp));
513         gatt_dequeue_sr_cmd(p_tcb);
514         if (flag != GATT_PREP_WRITE_CANCEL){
515             is_prepare_write_valid = TRUE;
516         }
517         GATT_TRACE_DEBUG("Send execute_write_rsp\n");
518     } else if ((prepare_record->error_code_app == GATT_SUCCESS) &&
519         (prepare_record->total_num > queue_num)){
520         //No error for stack_rsp's handles and there exist some app_rsp's handles,
521         //so exec_write_rsp depends to app's response; but stack_rsp's data is valid
522         //TODO: there exist problem if stack_rsp's data is valid but app_rsp's data is not valid.
523         is_prepare_write_valid = TRUE;
524     } else if(prepare_record->total_num < queue_num) {
525         GATT_TRACE_ERROR("Error in %s, line=%d, prepare write total number (%d) \
526                         should not smaller than prepare queue number (%d)\n", \
527                         __func__, __LINE__,prepare_record->total_num, queue_num);
528     } else if (prepare_record->error_code_app != GATT_SUCCESS){
529         GATT_TRACE_DEBUG("Send error code for execute_write, code=0x%x\n", prepare_record->error_code_app);
530         is_need_dequeue_sr_cmd = (prepare_record->total_num == queue_num) ? TRUE : FALSE;
531         gatt_send_error_rsp(p_tcb, prepare_record->error_code_app, GATT_REQ_EXEC_WRITE, 0, is_need_dequeue_sr_cmd);
532     }
533 
534     //dequeue prepare write data
535     while(fixed_queue_try_peek_first(prepare_record->queue)) {
536         queue_data = fixed_queue_dequeue(prepare_record->queue, FIXED_QUEUE_MAX_TIMEOUT);
537         if (is_prepare_write_valid){
538             if((queue_data->p_attr->p_value != NULL) && (queue_data->p_attr->p_value->attr_val.attr_val != NULL)){
539                 if(is_first) {
540                     //clear attr_val.attr_len before handle prepare write data
541                     queue_data->p_attr->p_value->attr_val.attr_len = 0;
542                     is_first = FALSE;
543                 }
544                 memcpy(queue_data->p_attr->p_value->attr_val.attr_val+queue_data->offset, queue_data->value, queue_data->len);
545                 //don't forget to increase the attribute value length in the gatts database.
546                 queue_data->p_attr->p_value->attr_val.attr_len += queue_data->len;
547             }
548         }
549         osi_free(queue_data);
550     }
551     fixed_queue_free(prepare_record->queue, NULL);
552     prepare_record->queue = NULL;
553 
554     /* according to ble spec, even if there is no prep write queued,
555      * need to respond execute_write_response
556      * Note: exec_write_rsp callback should be called after all data has been written*/
557     if (!gatt_sr_is_prep_cnt_zero(p_tcb)) {
558         if (prepare_record->total_num > queue_num){
559             trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, 0);
560             gatt_sr_copy_prep_cnt_to_cback_cnt(p_tcb);
561         }
562 
563         for (i = 0; i < GATT_MAX_APPS; i++) {
564             if (p_tcb->prep_cnt[i]) {
565                 gatt_if = (tGATT_IF) (i + 1);
566                 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, gatt_if);
567                 gatt_sr_send_req_callback(conn_id,
568                                           trans_id,
569                                           GATTS_REQ_TYPE_WRITE_EXEC,
570                                           (tGATTS_DATA *)&flag);
571                 p_tcb->prep_cnt[i] = 0;
572             }
573         }
574     }
575 
576     prepare_record->total_num = 0;
577     prepare_record->error_code_app = GATT_SUCCESS;
578 }
579 
580 /*******************************************************************************
581 **
582 ** Function         gatt_process_read_multi_req
583 **
584 ** Description      This function is called to process the read multiple request
585 **                  from client.
586 **
587 ** Returns          void
588 **
589 *******************************************************************************/
gatt_process_read_multi_req(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)590 void gatt_process_read_multi_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data)
591 {
592     UINT32          trans_id;
593     UINT16          handle = 0, ll = len;
594     UINT8           *p = p_data, i_rcb;
595     tGATT_STATUS    err = GATT_SUCCESS;
596     UINT8           sec_flag, key_size;
597     tGATTS_RSP       *p_msg;
598 
599     GATT_TRACE_DEBUG("gatt_process_read_multi_req" );
600     p_tcb->sr_cmd.multi_req.num_handles = 0;
601 
602     gatt_sr_get_sec_info(p_tcb->peer_bda,
603                          p_tcb->transport,
604                          &sec_flag,
605                          &key_size);
606 
607 #if GATT_CONFORMANCE_TESTING == TRUE
608     if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
609         GATT_TRACE_DEBUG("Conformance tst: forced err rspvofr ReadMultiple: error status=%d\n", gatt_cb.err_status);
610 
611         STREAM_TO_UINT16(handle, p);
612 
613         gatt_send_error_rsp (p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, handle, FALSE);
614 
615         return;
616     }
617 #endif
618 
619     while (ll >= 2 && p_tcb->sr_cmd.multi_req.num_handles < GATT_MAX_READ_MULTI_HANDLES) {
620         STREAM_TO_UINT16(handle, p);
621 
622         if ((i_rcb = gatt_sr_find_i_rcb_by_handle(handle)) < GATT_MAX_SR_PROFILES) {
623             p_tcb->sr_cmd.multi_req.handles[p_tcb->sr_cmd.multi_req.num_handles++] = handle;
624 
625             /* check read permission */
626             if ((err = gatts_read_attr_perm_check(   gatt_cb.sr_reg[i_rcb].p_db,
627                        FALSE,
628                        handle,
629                        sec_flag,
630                        key_size))
631                     != GATT_SUCCESS) {
632                 GATT_TRACE_ERROR("read permission denied : 0x%02x", err);
633                 break;
634             }
635         } else {
636             /* invalid handle */
637             err = GATT_INVALID_HANDLE;
638             break;
639         }
640         ll -= 2;
641     }
642 
643     if (err == GATT_SUCCESS) {
644         if (ll != 0) {
645             GATT_TRACE_ERROR("max attribute handle reached in ReadMultiple Request.");
646             err = GATT_INVALID_HANDLE;
647         }
648 
649         if (p_tcb->sr_cmd.multi_req.num_handles == 0) {
650             err = GATT_INVALID_HANDLE;
651         }
652     }
653 
654     if (err == GATT_SUCCESS) {
655         if ((trans_id = gatt_sr_enqueue_cmd (p_tcb, op_code, p_tcb->sr_cmd.multi_req.handles[0])) != 0) {
656             gatt_sr_reset_cback_cnt(p_tcb); /* read multiple use multi_rsp_q's count*/
657 
658             for (ll = 0; ll < p_tcb->sr_cmd.multi_req.num_handles; ll ++) {
659                 if ((p_msg = (tGATTS_RSP *)osi_malloc(sizeof(tGATTS_RSP))) != NULL) {
660                     memset(p_msg, 0, sizeof(tGATTS_RSP))
661                     ;
662                     handle = p_tcb->sr_cmd.multi_req.handles[ll];
663                     i_rcb = gatt_sr_find_i_rcb_by_handle(handle);
664 
665                     p_msg->attr_value.handle = handle;
666                     err = gatts_read_attr_value_by_handle(p_tcb,
667                                                           gatt_cb.sr_reg[i_rcb].p_db,
668                                                           op_code,
669                                                           handle,
670                                                           0,
671                                                           p_msg->attr_value.value,
672                                                           &p_msg->attr_value.len,
673                                                           GATT_MAX_ATTR_LEN,
674                                                           sec_flag,
675                                                           key_size,
676                                                           trans_id);
677 
678                     if (err == GATT_SUCCESS || err == GATT_STACK_RSP) {
679                         gatt_sr_process_app_rsp(p_tcb, gatt_cb.sr_reg[i_rcb].gatt_if , trans_id, op_code, GATT_SUCCESS, p_msg);
680                     }
681                     /* either not using or done using the buffer, release it now */
682                     osi_free(p_msg);
683                 } else {
684                     err = GATT_NO_RESOURCES;
685                     gatt_dequeue_sr_cmd(p_tcb);
686                     break;
687                 }
688             }
689         } else {
690             err = GATT_NO_RESOURCES;
691         }
692     }
693     /* in theroy BUSY is not possible(should already been checked), protected check */
694     if (err != GATT_SUCCESS && err != GATT_STACK_RSP && err != GATT_PENDING && err != GATT_BUSY) {
695         gatt_send_error_rsp(p_tcb, err, op_code, handle, FALSE);
696     }
697 }
698 
699 /*******************************************************************************
700 **
701 ** Function         gatt_build_primary_service_rsp
702 **
703 ** Description      Primamry service request processed internally. Theretically
704 **                  only deal with ReadByTypeVAlue and ReadByGroupType.
705 **
706 ** Returns          void
707 **
708 *******************************************************************************/
gatt_build_primary_service_rsp(BT_HDR * p_msg,tGATT_TCB * p_tcb,UINT8 op_code,UINT16 s_hdl,UINT16 e_hdl,UINT8 * p_data,tBT_UUID value)709 static tGATT_STATUS gatt_build_primary_service_rsp (BT_HDR *p_msg, tGATT_TCB *p_tcb,
710         UINT8 op_code, UINT16 s_hdl,
711         UINT16 e_hdl, UINT8 *p_data, tBT_UUID value)
712 {
713     tGATT_STATUS    status = GATT_NOT_FOUND;
714     UINT8           handle_len = 4, *p ;
715     tGATT_SR_REG    *p_rcb;
716     tGATT_SRV_LIST_INFO *p_list = &gatt_cb.srv_list_info;
717     tGATT_SRV_LIST_ELEM  *p_srv = NULL;
718     tBT_UUID       *p_uuid;
719 
720     UNUSED(p_data);
721 
722     p = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET;
723 
724     p_srv = p_list->p_first;
725 
726     while (p_srv) {
727         p_rcb = GATT_GET_SR_REG_PTR(p_srv->i_sreg);
728 
729         if (p_rcb->in_use &&
730                 p_rcb->s_hdl >= s_hdl &&
731                 p_rcb->s_hdl <= e_hdl &&
732                 p_rcb->type == GATT_UUID_PRI_SERVICE) {
733             if ((p_uuid = gatts_get_service_uuid (p_rcb->p_db)) != NULL) {
734                 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) {
735                     handle_len = 4 + p_uuid->len;
736                 }
737 
738                 /* get the length byte in the repsonse */
739                 if (p_msg->offset == 0) {
740                     *p ++ = op_code + 1;
741                     p_msg->len ++;
742                     p_msg->offset = handle_len;
743 
744                     if (op_code == GATT_REQ_READ_BY_GRP_TYPE) {
745                         *p ++ =  (UINT8)p_msg->offset; /* length byte */
746                         p_msg->len ++;
747                     }
748                 }
749 
750                 if (p_msg->len + p_msg->offset <= p_tcb->payload_size &&
751                         handle_len == p_msg->offset) {
752                     if (op_code != GATT_REQ_FIND_TYPE_VALUE ||
753                             gatt_uuid_compare(value, *p_uuid)) {
754                         UINT16_TO_STREAM(p, p_rcb->s_hdl);
755 
756                         if (p_list->p_last_primary == p_srv &&
757                                 p_list->p_last_primary == p_list->p_last) {
758                             GATT_TRACE_DEBUG("Use 0xFFFF for the last primary attribute");
759                             UINT16_TO_STREAM(p, 0xFFFF); /* see GATT ERRATA 4065, 4063, ATT ERRATA 4062 */
760                         } else {
761                             UINT16_TO_STREAM(p, p_rcb->e_hdl);
762                         }
763 
764                         if (op_code == GATT_REQ_READ_BY_GRP_TYPE) {
765                             gatt_build_uuid_to_stream(&p, *p_uuid);
766                         }
767 
768                         status = GATT_SUCCESS;
769                         p_msg->len += p_msg->offset;
770                     }
771                 } else {
772                     break;
773                 }
774             }
775         }
776         p_srv = p_srv->p_next;
777     }
778     p_msg->offset = L2CAP_MIN_OFFSET;
779 
780     return status;
781 }
782 
783 /*******************************************************************************
784 **
785 ** Function         gatt_build_find_info_rsp
786 **
787 ** Description      fill the find information response information in the given
788 **                  buffer.
789 **
790 ** Returns          TRUE: if data filled successfully.
791 **                  FALSE: packet full, or format mismatch.
792 **
793 *******************************************************************************/
gatt_build_find_info_rsp(tGATT_SR_REG * p_rcb,BT_HDR * p_msg,UINT16 * p_len,UINT16 s_hdl,UINT16 e_hdl)794 static tGATT_STATUS gatt_build_find_info_rsp(tGATT_SR_REG *p_rcb, BT_HDR *p_msg, UINT16 *p_len,
795         UINT16 s_hdl, UINT16 e_hdl)
796 {
797     tGATT_STATUS        status = GATT_NOT_FOUND;
798     UINT8               *p;
799     UINT16              len = *p_len;
800     tGATT_ATTR16        *p_attr = NULL;
801     UINT8               info_pair_len[2] = {4, 18};
802 
803     if (!p_rcb->p_db || !p_rcb->p_db->p_attr_list) {
804         return status;
805     }
806 
807     /* check the attribute database */
808     p_attr = (tGATT_ATTR16 *) p_rcb->p_db->p_attr_list;
809 
810     p = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET + p_msg->len;
811 
812     while (p_attr) {
813         if (p_attr->handle > e_hdl) {
814             break;
815         }
816 
817         if (p_attr->handle >= s_hdl) {
818             if (p_msg->offset == 0) {
819                 p_msg->offset = (p_attr->uuid_type == GATT_ATTR_UUID_TYPE_16) ? GATT_INFO_TYPE_PAIR_16 : GATT_INFO_TYPE_PAIR_128;
820             }
821 
822             if (len >= info_pair_len[p_msg->offset - 1]) {
823                 if (p_msg->offset == GATT_INFO_TYPE_PAIR_16 && p_attr->uuid_type == GATT_ATTR_UUID_TYPE_16) {
824                     UINT16_TO_STREAM(p, p_attr->handle);
825                     UINT16_TO_STREAM(p, p_attr->uuid);
826                 } else if (p_msg->offset == GATT_INFO_TYPE_PAIR_128 && p_attr->uuid_type == GATT_ATTR_UUID_TYPE_128  ) {
827                     UINT16_TO_STREAM(p, p_attr->handle);
828                     ARRAY_TO_STREAM (p, ((tGATT_ATTR128 *) p_attr)->uuid, LEN_UUID_128);
829                 } else if (p_msg->offset == GATT_INFO_TYPE_PAIR_128 && p_attr->uuid_type == GATT_ATTR_UUID_TYPE_32) {
830                     UINT16_TO_STREAM(p, p_attr->handle);
831                     gatt_convert_uuid32_to_uuid128(p, ((tGATT_ATTR32 *) p_attr)->uuid);
832                     p += LEN_UUID_128;
833                 } else {
834                     GATT_TRACE_ERROR("format mismatch");
835                     status = GATT_NO_RESOURCES;
836                     break;
837                     /* format mismatch */
838                 }
839                 p_msg->len += info_pair_len[p_msg->offset - 1];
840                 len -= info_pair_len[p_msg->offset - 1];
841                 status = GATT_SUCCESS;
842 
843             } else {
844                 status = GATT_NO_RESOURCES;
845                 break;
846             }
847         }
848         p_attr = (tGATT_ATTR16 *)p_attr->p_next;
849     }
850 
851     *p_len = len;
852     return status;
853 }
854 
855 /*******************************************************************************
856 **
857 ** Function         gatts_internal_read_by_type_req
858 **
859 ** Description      check to see if the ReadByType request can be handled internally.
860 **
861 ** Returns          void
862 **
863 *******************************************************************************/
gatts_validate_packet_format(UINT8 op_code,UINT16 * p_len,UINT8 ** p_data,tBT_UUID * p_uuid_filter,UINT16 * p_s_hdl,UINT16 * p_e_hdl)864 static tGATT_STATUS gatts_validate_packet_format(UINT8 op_code, UINT16 *p_len,
865         UINT8 **p_data, tBT_UUID *p_uuid_filter,
866         UINT16 *p_s_hdl, UINT16 *p_e_hdl)
867 {
868     tGATT_STATUS    reason = GATT_SUCCESS;
869     UINT16          uuid_len, s_hdl = 0, e_hdl = 0;
870     UINT16          len = *p_len;
871     UINT8           *p = *p_data;
872 
873     if (len >= 4) {
874         /* obtain starting handle, and ending handle */
875         STREAM_TO_UINT16(s_hdl, p);
876         STREAM_TO_UINT16(e_hdl, p);
877         len -= 4;
878 
879         if (s_hdl > e_hdl || !GATT_HANDLE_IS_VALID(s_hdl) || !GATT_HANDLE_IS_VALID(e_hdl)) {
880             reason = GATT_INVALID_HANDLE;
881         }
882         /* for these PDUs, uuid filter must present */
883         else if (op_code == GATT_REQ_READ_BY_GRP_TYPE ||
884                  op_code == GATT_REQ_FIND_TYPE_VALUE ||
885                  op_code == GATT_REQ_READ_BY_TYPE) {
886             if (len >= 2 && p_uuid_filter != NULL) {
887                 uuid_len = (op_code == GATT_REQ_FIND_TYPE_VALUE) ? 2 : len;
888 
889                 /* parse uuid now */
890                 if (gatt_parse_uuid_from_cmd (p_uuid_filter, uuid_len, &p) == FALSE ||
891                         p_uuid_filter->len == 0) {
892                     GATT_TRACE_DEBUG("UUID filter does not exsit");
893                     reason = GATT_INVALID_PDU;
894                 } else {
895                     len -= p_uuid_filter->len;
896                 }
897             } else {
898                 reason = GATT_INVALID_PDU;
899             }
900         }
901     } else {
902         reason = GATT_INVALID_PDU;
903     }
904 
905     *p_data     = p;
906     *p_len      = len;
907     *p_s_hdl    = s_hdl;
908     *p_e_hdl    = e_hdl;
909 
910     return reason;
911 }
912 
913 /*******************************************************************************
914 **
915 ** Function         gatts_process_primary_service_req
916 **
917 ** Description      process ReadByGroupType/ReadByTypeValue request, for discover
918 **                  all primary services or discover primary service by UUID request.
919 **
920 ** Returns          void
921 **
922 *******************************************************************************/
gatts_process_primary_service_req(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)923 void gatts_process_primary_service_req(tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data)
924 {
925     UINT8           reason = GATT_INVALID_PDU;
926     UINT16          s_hdl = 0, e_hdl = 0;
927     tBT_UUID        uuid, value, primary_service = {LEN_UUID_16, {GATT_UUID_PRI_SERVICE}};
928     BT_HDR          *p_msg = NULL;
929     UINT16          msg_len = (UINT16)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET);
930 
931     memset (&value, 0, sizeof(tBT_UUID));
932     reason = gatts_validate_packet_format(op_code, &len, &p_data, &uuid, &s_hdl, &e_hdl);
933 
934     if (reason == GATT_SUCCESS) {
935         if (gatt_uuid_compare(uuid, primary_service)) {
936             if (op_code == GATT_REQ_FIND_TYPE_VALUE) {
937                 if (gatt_parse_uuid_from_cmd(&value, len, &p_data) == FALSE) {
938                     reason = GATT_INVALID_PDU;
939                 }
940             }
941 
942             if (reason == GATT_SUCCESS) {
943                 if ((p_msg =  (BT_HDR *)osi_calloc(msg_len)) == NULL) {
944                     GATT_TRACE_ERROR("gatts_process_primary_service_req failed. no resources.");
945                     reason = GATT_NO_RESOURCES;
946                 } else {
947                     reason = gatt_build_primary_service_rsp (p_msg, p_tcb, op_code, s_hdl, e_hdl, p_data, value);
948                 }
949             }
950         } else {
951             if (op_code == GATT_REQ_READ_BY_GRP_TYPE) {
952                 reason = GATT_UNSUPPORT_GRP_TYPE;
953                 GATT_TRACE_DEBUG("unexpected ReadByGrpType Group: 0x%04x", uuid.uu.uuid16);
954             } else {
955                 /* we do not support ReadByTypeValue with any non-primamry_service type */
956                 reason = GATT_NOT_FOUND;
957                 GATT_TRACE_DEBUG("unexpected ReadByTypeValue type: 0x%04x", uuid.uu.uuid16);
958             }
959         }
960     }
961 
962     if (reason != GATT_SUCCESS) {
963         if (p_msg) {
964             osi_free(p_msg);
965         }
966         gatt_send_error_rsp (p_tcb, reason, op_code, s_hdl, FALSE);
967     } else {
968         attp_send_sr_msg(p_tcb, p_msg);
969     }
970 
971 }
972 
973 /*******************************************************************************
974 **
975 ** Function         gatts_process_find_info
976 **
977 ** Description      process find information request, for discover character
978 **                  descriptors.
979 **
980 ** Returns          void
981 **
982 *******************************************************************************/
gatts_process_find_info(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)983 static void gatts_process_find_info(tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data)
984 {
985     UINT8           reason = GATT_INVALID_PDU, *p;
986     UINT16          s_hdl = 0, e_hdl = 0, buf_len;
987     BT_HDR          *p_msg = NULL;
988     tGATT_SR_REG    *p_rcb;
989     tGATT_SRV_LIST_INFO *p_list = &gatt_cb.srv_list_info;
990     tGATT_SRV_LIST_ELEM  *p_srv = NULL;
991 
992     reason = gatts_validate_packet_format(op_code, &len, &p_data, NULL, &s_hdl, &e_hdl);
993 
994     if (reason == GATT_SUCCESS) {
995         buf_len = (UINT16)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET);
996 
997         if ((p_msg =  (BT_HDR *)osi_calloc(buf_len)) == NULL) {
998             reason = GATT_NO_RESOURCES;
999         } else {
1000             reason = GATT_NOT_FOUND;
1001 
1002             p = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET;
1003             *p ++ = op_code + 1;
1004             p_msg->len = 2;
1005 
1006             buf_len = p_tcb->payload_size - 2;
1007 
1008             p_srv = p_list->p_first;
1009 
1010             while (p_srv) {
1011                 p_rcb = GATT_GET_SR_REG_PTR(p_srv->i_sreg);
1012 
1013                 if (p_rcb->in_use &&
1014                         !(p_rcb->s_hdl > e_hdl ||
1015                           p_rcb->e_hdl < s_hdl)) {
1016                     reason = gatt_build_find_info_rsp(p_rcb, p_msg, &buf_len, s_hdl, e_hdl);
1017                     if (reason == GATT_NO_RESOURCES) {
1018                         reason = GATT_SUCCESS;
1019                         break;
1020                     }
1021                 }
1022                 p_srv = p_srv->p_next;
1023             }
1024             *p = (UINT8)p_msg->offset;
1025 
1026             p_msg->offset = L2CAP_MIN_OFFSET;
1027         }
1028     }
1029 
1030     if (reason != GATT_SUCCESS) {
1031         if (p_msg) {
1032             osi_free(p_msg);
1033         }
1034         gatt_send_error_rsp (p_tcb, reason, op_code, s_hdl, FALSE);
1035     } else {
1036         attp_send_sr_msg(p_tcb, p_msg);
1037     }
1038 
1039 }
1040 
1041 /*******************************************************************************
1042 **
1043 ** Function         gatts_process_mtu_req
1044 **
1045 ** Description      This function is called to process excahnge MTU request.
1046 **                  Only used on LE.
1047 **
1048 ** Returns          void
1049 **
1050 *******************************************************************************/
gatts_process_mtu_req(tGATT_TCB * p_tcb,UINT16 len,UINT8 * p_data)1051 static void gatts_process_mtu_req (tGATT_TCB *p_tcb, UINT16 len, UINT8 *p_data)
1052 {
1053     UINT16        mtu = 0;
1054     UINT8         *p = p_data, i;
1055     BT_HDR        *p_buf;
1056     UINT16   conn_id;
1057 
1058     /* BR/EDR conenction, send error response */
1059     if (p_tcb->att_lcid != L2CAP_ATT_CID) {
1060         gatt_send_error_rsp (p_tcb, GATT_REQ_NOT_SUPPORTED, GATT_REQ_MTU, 0, FALSE);
1061     } else if (len < GATT_MTU_REQ_MIN_LEN) {
1062         GATT_TRACE_ERROR("invalid MTU request PDU received.\n");
1063         gatt_send_error_rsp (p_tcb, GATT_INVALID_PDU, GATT_REQ_MTU, 0, FALSE);
1064     } else {
1065         STREAM_TO_UINT16 (mtu, p);
1066         /* mtu must be greater than default MTU which is 23/48 */
1067         if (mtu < GATT_DEF_BLE_MTU_SIZE) {
1068             p_tcb->payload_size = GATT_DEF_BLE_MTU_SIZE;
1069         } else if (mtu > gatt_default.local_mtu) {
1070             p_tcb->payload_size = gatt_default.local_mtu;
1071         } else {
1072             p_tcb->payload_size = mtu;
1073         }
1074 
1075         /* host will set packet data length to 251 automatically if remote device support set packet data length,
1076             so l2cble_set_fixed_channel_tx_data_length() is not necessary.
1077             l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, p_tcb->payload_size);
1078         */
1079 
1080         if ((p_buf = attp_build_sr_msg(p_tcb, GATT_RSP_MTU, (tGATT_SR_MSG *) &p_tcb->payload_size)) != NULL) {
1081             attp_send_sr_msg (p_tcb, p_buf);
1082 
1083             /* Notify all registered application with new MTU size. Us a transaction ID */
1084             /* of 0, as no response is allowed from applcations                    */
1085 
1086             for (i = 0; i < GATT_MAX_APPS; i ++) {
1087                 if (gatt_cb.cl_rcb[i].in_use ) {
1088                     conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, gatt_cb.cl_rcb[i].gatt_if);
1089                     gatt_sr_send_req_callback(conn_id, 0, GATTS_REQ_TYPE_MTU,
1090                                               (tGATTS_DATA *)&p_tcb->payload_size);
1091                 }
1092             }
1093 
1094         }
1095     }
1096 }
1097 
1098 /*******************************************************************************
1099 **
1100 ** Function         gatts_process_read_by_type_req
1101 **
1102 ** Description      process Read By type request.
1103 **                  This PDU can be used to perform:
1104 **                  - read characteristic value
1105 **                  - read characteristic descriptor value
1106 **                  - discover characteristic
1107 **                  - discover characteristic by UUID
1108 **                  - relationship discovery
1109 **
1110 ** Returns          void
1111 **
1112 *******************************************************************************/
gatts_process_read_by_type_req(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)1113 void gatts_process_read_by_type_req(tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data)
1114 {
1115     tBT_UUID            uuid;
1116     tGATT_SR_REG        *p_rcb;
1117     UINT16              msg_len = (UINT16)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET),
1118                         buf_len,
1119                         s_hdl, e_hdl, err_hdl = 0;
1120     BT_HDR              *p_msg = NULL;
1121     tGATT_STATUS        reason, ret;
1122     UINT8               *p;
1123     UINT8               sec_flag, key_size;
1124     tGATT_SRV_LIST_INFO *p_list = &gatt_cb.srv_list_info;
1125     tGATT_SRV_LIST_ELEM  *p_srv = NULL;
1126 
1127     reason = gatts_validate_packet_format(op_code, &len, &p_data, &uuid, &s_hdl, &e_hdl);
1128     GATT_TRACE_DEBUG("%s, op_code =%x, len = %x\n", __func__, op_code, len);
1129 #if GATT_CONFORMANCE_TESTING == TRUE
1130     if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
1131         GATT_TRACE_DEBUG("Conformance tst: forced err rsp for ReadByType: error status=%d\n", gatt_cb.err_status);
1132 
1133         gatt_send_error_rsp (p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, s_hdl, FALSE);
1134 
1135         return;
1136     }
1137 #endif
1138 
1139     if (reason == GATT_SUCCESS) {
1140         if ((p_msg =  (BT_HDR *)osi_calloc(msg_len)) == NULL) {
1141             GATT_TRACE_ERROR("gatts_process_find_info failed. no resources.\n");
1142 
1143             reason = GATT_NO_RESOURCES;
1144         } else {
1145             p = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET;
1146 
1147             *p ++ = op_code + 1;
1148             /* reserve length byte */
1149             p_msg->len = 2;
1150             buf_len = p_tcb->payload_size - 2;
1151 
1152             reason = GATT_NOT_FOUND;
1153 
1154             p_srv = p_list->p_first;
1155 
1156             while (p_srv) {
1157                 p_rcb = GATT_GET_SR_REG_PTR(p_srv->i_sreg);
1158 
1159                 if (p_rcb->in_use &&
1160                         !(p_rcb->s_hdl > e_hdl ||
1161                           p_rcb->e_hdl < s_hdl)) {
1162                     gatt_sr_get_sec_info(p_tcb->peer_bda,
1163                                          p_tcb->transport,
1164                                          &sec_flag,
1165                                          &key_size);
1166 
1167                     ret = gatts_db_read_attr_value_by_type(p_tcb,
1168                                                            p_rcb->p_db,
1169                                                            op_code,
1170                                                            p_msg,
1171                                                            s_hdl,
1172                                                            e_hdl,
1173                                                            uuid,
1174                                                            &buf_len,
1175                                                            sec_flag,
1176                                                            key_size,
1177                                                            0,
1178                                                            &err_hdl);
1179                     if (ret != GATT_NOT_FOUND) {
1180                         reason = ret;
1181 
1182                         if (ret == GATT_NO_RESOURCES) {
1183                             reason = GATT_SUCCESS;
1184                         }
1185                     }
1186                     if (ret != GATT_SUCCESS && ret != GATT_NOT_FOUND) {
1187                         s_hdl = err_hdl;
1188                         break;
1189                     }
1190                 }
1191                 p_srv = p_srv->p_next;
1192             }
1193             *p              = (UINT8)p_msg->offset;
1194             p_msg->offset   = L2CAP_MIN_OFFSET;
1195         }
1196     }
1197     if (reason != GATT_SUCCESS && reason != GATT_STACK_RSP) {
1198         if (p_msg) {
1199             osi_free(p_msg);
1200         }
1201 
1202         /* in theroy BUSY is not possible(should already been checked), protected check */
1203         if (reason != GATT_PENDING && reason != GATT_BUSY) {
1204             gatt_send_error_rsp (p_tcb, reason, op_code, s_hdl, FALSE);
1205         }
1206     } else {
1207         attp_send_sr_msg(p_tcb, p_msg);
1208         gatt_dequeue_sr_cmd(p_tcb);
1209     }
1210 
1211 }
1212 
1213 /*******************************************************************************
1214 **
1215 ** Function         gatts_process_write_req
1216 **
1217 ** Description      This function is called to process the write request
1218 **                  from client.
1219 **
1220 ** Returns          void
1221 **
1222 *******************************************************************************/
gatts_process_write_req(tGATT_TCB * p_tcb,UINT8 i_rcb,UINT16 handle,UINT8 op_code,UINT16 len,UINT8 * p_data)1223 void gatts_process_write_req (tGATT_TCB *p_tcb, UINT8 i_rcb, UINT16 handle,
1224                               UINT8 op_code, UINT16 len, UINT8 *p_data)
1225 {
1226     tGATTS_DATA     sr_data;
1227     UINT32          trans_id;
1228     tGATT_STATUS    status;
1229     UINT8           sec_flag, key_size, *p = p_data;
1230     tGATT_SR_REG    *p_sreg;
1231     UINT16          conn_id, offset = 0;
1232 
1233     memset(&sr_data, 0, sizeof(tGATTS_DATA));
1234     sr_data.write_req.need_rsp = FALSE;
1235 
1236     switch (op_code) {
1237     case GATT_SIGN_CMD_WRITE:
1238         if (op_code == GATT_SIGN_CMD_WRITE) {
1239             GATT_TRACE_DEBUG("Write CMD with data signing" );
1240             len -= GATT_AUTH_SIGN_LEN;
1241         }
1242     /* fall through */
1243     case GATT_CMD_WRITE:
1244     case GATT_REQ_WRITE:
1245         sr_data.write_req.handle = handle;
1246         sr_data.write_req.len = len;
1247         if (len != 0 && p != NULL) {
1248             memcpy (sr_data.write_req.value, p, len);
1249         }
1250         break;
1251     }
1252 
1253     gatt_sr_get_sec_info(p_tcb->peer_bda,
1254                          p_tcb->transport,
1255                          &sec_flag,
1256                          &key_size);
1257 
1258     status = gatts_write_attr_perm_check (gatt_cb.sr_reg[i_rcb].p_db,
1259                                           op_code,
1260                                           handle,
1261                                           sr_data.write_req.offset,
1262                                           p,
1263                                           len,
1264                                           sec_flag,
1265                                           key_size);
1266 
1267     if (status == GATT_SUCCESS) {
1268         if ((trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, handle)) != 0) {
1269             p_sreg = &gatt_cb.sr_reg[i_rcb];
1270             conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_sreg->gatt_if);
1271             status = gatts_write_attr_value_by_handle(gatt_cb.sr_reg[i_rcb].p_db,
1272                     handle, offset, p, len);
1273             if((op_code == GATT_REQ_WRITE) && (status == GATT_APP_RSP)){
1274                 sr_data.write_req.need_rsp = TRUE;
1275                 status = GATT_PENDING;
1276             }
1277 
1278             gatt_sr_send_req_callback(conn_id,
1279                     trans_id,
1280                     GATTS_REQ_TYPE_WRITE,
1281                     &sr_data);
1282         } else {
1283             GATT_TRACE_ERROR("Error in %s, line=%d, max pending command, send error\n", __func__, __LINE__);
1284             status = GATT_BUSY; /* max pending command, application error */
1285         }
1286     }
1287 
1288     /* response should be sent only for write_request */
1289     if ((op_code == GATT_REQ_WRITE) && (sr_data.write_req.need_rsp == FALSE)){
1290         if (status == GATT_SUCCESS){
1291             tGATT_WRITE_REQ_RSP gatt_write_req_rsp;
1292             gatt_write_req_rsp.op_code = GATT_RSP_WRITE;
1293             gatt_send_packet(p_tcb, (UINT8 *)(&gatt_write_req_rsp), sizeof(gatt_write_req_rsp));
1294             gatt_dequeue_sr_cmd(p_tcb);
1295         } else if (status != GATT_PENDING){
1296             /* note: in case of GATT_BUSY, will respond this application error to remote device */
1297             gatt_send_error_rsp (p_tcb, status, op_code, handle, TRUE);
1298         }
1299     }
1300 
1301     return;
1302 }
1303 
1304 
1305 /*******************************************************************************
1306  **
1307  ** Function         gatts_attr_process_preapre_write
1308  **
1309  ** Description      This function is called to process the prepare write request
1310  **                  from client.
1311  **
1312  ** Returns          void
1313  **
1314  *******************************************************************************/
gatt_attr_process_prepare_write(tGATT_TCB * p_tcb,UINT8 i_rcb,UINT16 handle,UINT8 op_code,UINT16 len,UINT8 * p_data)1315 void gatt_attr_process_prepare_write (tGATT_TCB *p_tcb, UINT8 i_rcb, UINT16 handle,
1316                                      UINT8 op_code, UINT16 len, UINT8 *p_data)
1317 {
1318     tGATT_STATUS status;
1319     tGATT_PREPARE_WRITE_QUEUE_DATA * queue_data = NULL;
1320     tGATT_ATTR16  *p_attr;
1321     tGATT_ATTR16  *p_attr_temp;
1322     tGATTS_DATA     sr_data;
1323     UINT32          trans_id = 0;
1324     UINT8           sec_flag, key_size, *p = p_data;
1325     tGATT_SR_REG    *p_sreg;
1326     UINT16          conn_id, offset = 0;
1327     tGATT_SVC_DB    *p_db;
1328     BOOLEAN is_need_prepare_write_rsp = FALSE;
1329     BOOLEAN is_need_queue_data = FALSE;
1330     tGATT_PREPARE_WRITE_RECORD *prepare_record = NULL;
1331     memset(&sr_data, 0, sizeof(tGATTS_DATA));
1332 
1333     if (len < 2) {
1334         GATT_TRACE_ERROR("%s: Prepare write request was invalid - missing offset, sending error response", __func__);
1335         gatt_send_error_rsp(p_tcb, GATT_INVALID_PDU, op_code, handle, FALSE);
1336         return;
1337     }
1338     //get offset from p_data
1339     STREAM_TO_UINT16(offset, p);
1340     len -= 2;
1341     p_sreg = &gatt_cb.sr_reg[i_rcb];
1342     conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_sreg->gatt_if);
1343     //prepare_record = &(prepare_write_record);
1344     prepare_record = &(p_tcb->prepare_write_record);
1345 
1346     gatt_sr_get_sec_info(p_tcb->peer_bda,
1347                          p_tcb->transport,
1348                          &sec_flag,
1349                          &key_size);
1350 
1351     status = gatts_write_attr_perm_check (gatt_cb.sr_reg[i_rcb].p_db,
1352                                           op_code,
1353                                           handle,
1354                                           sr_data.write_req.offset,
1355                                           p,
1356                                           len,
1357                                           sec_flag,
1358                                           key_size);
1359 
1360     if (status == GATT_SUCCESS){
1361         if ((trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, handle)) != 0) {
1362             p_db = gatt_cb.sr_reg[i_rcb].p_db;
1363             if (p_db && p_db->p_attr_list) {
1364                 p_attr = (tGATT_ATTR16 *)p_db->p_attr_list;
1365                 while (p_attr && handle >= p_attr->handle) {
1366                     if (p_attr->handle == handle ) {
1367                         p_attr_temp = p_attr;
1368                         if (p_attr->control.auto_rsp == GATT_RSP_BY_APP) {
1369                             status = GATT_APP_RSP;
1370                         } else if (p_attr->p_value != NULL &&
1371                             offset > p_attr->p_value->attr_val.attr_max_len) {
1372                             status = GATT_INVALID_OFFSET;
1373                              is_need_prepare_write_rsp = TRUE;
1374                              is_need_queue_data = TRUE;
1375                         } else if (p_attr->p_value != NULL &&
1376                             ((offset + len) > p_attr->p_value->attr_val.attr_max_len)){
1377                             status = GATT_INVALID_ATTR_LEN;
1378                             is_need_prepare_write_rsp = TRUE;
1379                             is_need_queue_data = TRUE;
1380                         } else if (p_attr->p_value == NULL) {
1381                             GATT_TRACE_ERROR("Error in %s, attribute of handle 0x%x not allocate value buffer\n",
1382                                         __func__, handle);
1383                             status = GATT_UNKNOWN_ERROR;
1384                         } else {
1385                              //valid prepare write request, need to send response and queue the data
1386                              //status: GATT_SUCCESS
1387                              is_need_prepare_write_rsp = TRUE;
1388                              is_need_queue_data = TRUE;
1389                          }
1390                     }
1391                     p_attr = (tGATT_ATTR16 *)p_attr->p_next;
1392                 }
1393             }
1394         } else{
1395             status = GATT_UNKNOWN_ERROR;
1396             GATT_TRACE_ERROR("Error in %s, Line %d: GATT BUSY\n", __func__, __LINE__);
1397         }
1398     }
1399 
1400     if (is_need_queue_data){
1401         queue_data = (tGATT_PREPARE_WRITE_QUEUE_DATA *)osi_malloc(len + sizeof(tGATT_PREPARE_WRITE_QUEUE_DATA));
1402         if (queue_data == NULL){
1403             status = GATT_PREPARE_Q_FULL;
1404         } else {
1405             queue_data->p_attr = p_attr_temp;
1406             queue_data->len = len;
1407             queue_data->handle = handle;
1408             queue_data->offset = offset;
1409             memcpy(queue_data->value, p, len);
1410             if (prepare_record->queue == NULL) {
1411                 prepare_record->queue = fixed_queue_new(QUEUE_SIZE_MAX);
1412             }
1413             fixed_queue_enqueue(prepare_record->queue, queue_data, FIXED_QUEUE_MAX_TIMEOUT);
1414         }
1415     }
1416 
1417     if (is_need_prepare_write_rsp){
1418         //send prepare write response
1419         if (queue_data != NULL){
1420             queue_data->op_code = op_code + 1;
1421             //5: op_code 1 + handle 2 + offset 2
1422             tGATT_STATUS rsp_send_status = gatt_send_packet(p_tcb, &(queue_data->op_code), queue_data->len + 5);
1423             gatt_sr_update_prep_cnt(p_tcb, p_sreg->gatt_if, TRUE, FALSE);
1424             gatt_dequeue_sr_cmd(p_tcb);
1425 
1426             if (rsp_send_status != GATT_SUCCESS){
1427                 GATT_TRACE_ERROR("Error in %s, line=%d, fail to send prepare_write_rsp, status=0x%x\n",
1428                             __func__, __LINE__, rsp_send_status);
1429             }
1430         } else{
1431             GATT_TRACE_ERROR("Error in %s, line=%d, queue_data should not be NULL here, fail to send prepare_write_rsp\n",
1432                         __func__, __LINE__);
1433         }
1434     }
1435 
1436     if ((status == GATT_APP_RSP) || (is_need_prepare_write_rsp)){
1437         prepare_record->total_num++;
1438         memset(&sr_data, 0, sizeof(sr_data));
1439         sr_data.write_req.is_prep = TRUE;
1440         sr_data.write_req.handle = handle;
1441         sr_data.write_req.offset = offset;
1442         sr_data.write_req.len = len;
1443         sr_data.write_req.need_rsp = (status == GATT_APP_RSP) ? TRUE : FALSE;
1444         memcpy(sr_data.write_req.value, p, len);
1445         gatt_sr_send_req_callback(conn_id, trans_id, GATTS_REQ_TYPE_WRITE, &sr_data);
1446     } else{
1447         gatt_send_error_rsp(p_tcb, status, GATT_REQ_PREPARE_WRITE, handle, TRUE);
1448     }
1449 
1450     if ((prepare_record->error_code_app == GATT_SUCCESS)
1451         // update prepare write status for excute write request
1452         && (status == GATT_INVALID_OFFSET || status == GATT_INVALID_ATTR_LEN || status == GATT_REQ_NOT_SUPPORTED)) {
1453         prepare_record->error_code_app = status;
1454     }
1455 
1456 }
1457 
1458 /*******************************************************************************
1459  **
1460  ** Function         gatts_process_read_req
1461  **
1462  ** Description      This function is called to process the read request
1463  **                  from client.
1464  **
1465  ** Returns          void
1466  **
1467  *******************************************************************************/
gatts_process_read_req(tGATT_TCB * p_tcb,tGATT_SR_REG * p_rcb,UINT8 op_code,UINT16 handle,UINT16 len,UINT8 * p_data)1468 static void gatts_process_read_req(tGATT_TCB *p_tcb, tGATT_SR_REG *p_rcb, UINT8 op_code,
1469                                    UINT16 handle, UINT16 len, UINT8 *p_data)
1470 {
1471     UINT16       buf_len = (UINT16)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET);
1472     tGATT_STATUS reason;
1473     BT_HDR       *p_msg = NULL;
1474     UINT8        sec_flag, key_size, *p;
1475     UINT16       offset = 0, value_len = 0;
1476 
1477     UNUSED (len);
1478     if ((p_msg =  (BT_HDR *)osi_calloc(buf_len)) == NULL) {
1479         GATT_TRACE_ERROR("gatts_process_find_info failed. no resources.\n");
1480 
1481         reason = GATT_NO_RESOURCES;
1482     } else {
1483         if (op_code == GATT_REQ_READ_BLOB) {
1484             STREAM_TO_UINT16(offset, p_data);
1485         }
1486 
1487         p = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET;
1488         *p ++ = op_code + 1;
1489         p_msg->len = 1;
1490         buf_len = p_tcb->payload_size - 1;
1491 
1492         gatt_sr_get_sec_info(p_tcb->peer_bda,
1493                              p_tcb->transport,
1494                              &sec_flag,
1495                              &key_size);
1496 
1497         reason = gatts_read_attr_value_by_handle(p_tcb,
1498                  p_rcb->p_db,
1499                  op_code,
1500                  handle,
1501                  offset,
1502                  p,
1503                  &value_len,
1504                  buf_len,
1505                  sec_flag,
1506                  key_size,
1507                  0);
1508 
1509         p_msg->len += value_len;
1510     }
1511 
1512 
1513     if (reason != GATT_SUCCESS && reason != GATT_PENDING && reason != GATT_STACK_RSP) {
1514         if (p_msg) {
1515             osi_free(p_msg);
1516         }
1517 
1518         /* in theroy BUSY is not possible(should already been checked), protected check */
1519         if (reason != GATT_BUSY) {
1520             gatt_send_error_rsp (p_tcb, reason, op_code, handle, FALSE);
1521             gatt_dequeue_sr_cmd(p_tcb);
1522         }
1523     } else if (reason == GATT_SUCCESS || reason == GATT_STACK_RSP) {
1524         attp_send_sr_msg(p_tcb, p_msg);
1525         gatt_dequeue_sr_cmd(p_tcb);
1526     } else {
1527         if (p_msg) {
1528             osi_free(p_msg);
1529         }
1530     }
1531 
1532 }
1533 
1534 /*******************************************************************************
1535 **
1536 ** Function         gatts_process_attribute_req
1537 **
1538 ** Description      This function is called to process the per attribute handle request
1539 **                  from client.
1540 **
1541 ** Returns          void
1542 **
1543 *******************************************************************************/
gatts_process_attribute_req(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)1544 void gatts_process_attribute_req (tGATT_TCB *p_tcb, UINT8 op_code,
1545                                   UINT16 len, UINT8 *p_data)
1546 {
1547     UINT16          handle = 0;
1548     UINT8           *p = p_data, i;
1549     tGATT_SR_REG    *p_rcb = gatt_cb.sr_reg;
1550     tGATT_STATUS    status = GATT_INVALID_HANDLE;
1551     tGATT_ATTR16    *p_attr;
1552 
1553     if (len < 2) {
1554         GATT_TRACE_ERROR("Illegal PDU length, discard request\n");
1555         status = GATT_INVALID_PDU;
1556     } else {
1557         STREAM_TO_UINT16(handle, p);
1558         len -= 2;
1559     }
1560 
1561 #if GATT_CONFORMANCE_TESTING == TRUE
1562     gatt_cb.handle = handle;
1563     if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
1564         GATT_TRACE_DEBUG("Conformance tst: forced err rsp: error status=%d\n", gatt_cb.err_status);
1565 
1566         gatt_send_error_rsp (p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, handle, FALSE);
1567 
1568         return;
1569     }
1570 #endif
1571 
1572     if (GATT_HANDLE_IS_VALID(handle)) {
1573         for (i = 0; i < GATT_MAX_SR_PROFILES; i ++, p_rcb ++) {
1574             if (p_rcb->in_use && p_rcb->s_hdl <= handle && p_rcb->e_hdl >= handle) {
1575                 p_attr = (tGATT_ATTR16 *)p_rcb->p_db->p_attr_list;
1576 
1577                 while (p_attr) {
1578                     if (p_attr->handle == handle) {
1579                         switch (op_code) {
1580                         case GATT_REQ_READ: /* read char/char descriptor value */
1581                         case GATT_REQ_READ_BLOB:
1582                             gatts_process_read_req(p_tcb, p_rcb, op_code, handle, len, p);
1583                             break;
1584 
1585                         case GATT_REQ_WRITE: /* write char/char descriptor value */
1586                         case GATT_CMD_WRITE:
1587                         case GATT_SIGN_CMD_WRITE:
1588                             gatts_process_write_req(p_tcb, i, handle, op_code, len, p);
1589                             break;
1590 
1591                         case GATT_REQ_PREPARE_WRITE:
1592                             gatt_attr_process_prepare_write (p_tcb, i, handle, op_code, len, p);
1593                         default:
1594                             break;
1595                         }
1596                         status = GATT_SUCCESS;
1597                         break;
1598                     }
1599                     p_attr = (tGATT_ATTR16 *)p_attr->p_next;
1600                 }
1601                 break;
1602             }
1603         }
1604     }
1605 
1606     if (status != GATT_SUCCESS && op_code != GATT_CMD_WRITE && op_code != GATT_SIGN_CMD_WRITE) {
1607         gatt_send_error_rsp (p_tcb, status, op_code, handle, FALSE);
1608     }
1609 }
1610 
1611 /*******************************************************************************
1612 **
1613 ** Function         gatts_proc_srv_chg_ind_ack
1614 **
1615 ** Description      This function process the service changed indicaiton ACK
1616 **
1617 ** Returns          void
1618 **
1619 *******************************************************************************/
gatts_proc_srv_chg_ind_ack(tGATT_TCB * p_tcb)1620 static void gatts_proc_srv_chg_ind_ack(tGATT_TCB *p_tcb )
1621 {
1622     tGATTS_SRV_CHG_REQ  req;
1623     tGATTS_SRV_CHG      *p_buf = NULL;
1624 
1625     GATT_TRACE_DEBUG("gatts_proc_srv_chg_ind_ack");
1626 
1627     if ((p_buf = gatt_is_bda_in_the_srv_chg_clt_list(p_tcb->peer_bda)) != NULL) {
1628         GATT_TRACE_DEBUG("NV update set srv chg = FALSE");
1629         p_buf->srv_changed = FALSE;
1630         memcpy(&req.srv_chg, p_buf, sizeof(tGATTS_SRV_CHG));
1631         if (gatt_cb.cb_info.p_srv_chg_callback) {
1632             (*gatt_cb.cb_info.p_srv_chg_callback)(GATTS_SRV_CHG_CMD_UPDATE_CLIENT, &req, NULL);
1633         }
1634     }
1635 }
1636 
1637 /*******************************************************************************
1638 **
1639 ** Function         gatts_chk_pending_ind
1640 **
1641 ** Description      This function check any pending indication needs to be sent if
1642 **                  there is a pending indication then sent the indication
1643 **
1644 ** Returns          void
1645 **
1646 *******************************************************************************/
gatts_chk_pending_ind(tGATT_TCB * p_tcb)1647 static void gatts_chk_pending_ind(tGATT_TCB *p_tcb )
1648 {
1649 #if (GATTS_INCLUDED == TRUE)
1650     tGATT_VALUE *p_buf = (tGATT_VALUE *)fixed_queue_try_peek_first(p_tcb->pending_ind_q);
1651     GATT_TRACE_DEBUG("gatts_chk_pending_ind");
1652 
1653     if (p_buf ) {
1654         GATTS_HandleValueIndication (p_buf->conn_id,
1655                                      p_buf->handle,
1656                                      p_buf->len,
1657                                      p_buf->value);
1658         osi_free(fixed_queue_try_remove_from_queue(p_tcb->pending_ind_q,
1659                                                       p_buf));
1660     }
1661 #endif  ///GATTS_INCLUDED == TRUE
1662 }
1663 
1664 /*******************************************************************************
1665 **
1666 ** Function         gatts_proc_ind_ack
1667 **
1668 ** Description      This function process the Indication ack
1669 **
1670 ** Returns          TRUE continue to process the indication ack by the aaplication
1671 **                  if the ACk is not a Service Changed Indication Ack
1672 **
1673 *******************************************************************************/
gatts_proc_ind_ack(tGATT_TCB * p_tcb,UINT16 ack_handle)1674 static BOOLEAN gatts_proc_ind_ack(tGATT_TCB *p_tcb, UINT16 ack_handle)
1675 {
1676     BOOLEAN continue_processing = TRUE;
1677 
1678     GATT_TRACE_DEBUG ("gatts_proc_ind_ack ack handle=%d", ack_handle);
1679 
1680     if (ack_handle == gatt_cb.handle_of_h_r) {
1681         gatts_proc_srv_chg_ind_ack(p_tcb);
1682         /* there is no need to inform the application since srv chg is handled internally by GATT */
1683         continue_processing = FALSE;
1684 #if GATTS_ROBUST_CACHING_ENABLED
1685         /* after receiving ack of svc_chg_ind, reset client status */
1686         gatt_sr_update_cl_status(p_tcb, true);
1687 #endif /* GATTS_ROBUST_CACHING_ENABLED */
1688     }
1689 
1690     gatts_chk_pending_ind(p_tcb);
1691     return continue_processing;
1692 }
1693 
1694 /*******************************************************************************
1695 **
1696 ** Function         gatts_process_value_conf
1697 **
1698 ** Description      This function is called to process the handle value confirmation.
1699 **
1700 ** Returns          void
1701 **
1702 *******************************************************************************/
gatts_process_value_conf(tGATT_TCB * p_tcb,UINT8 op_code)1703 void gatts_process_value_conf(tGATT_TCB *p_tcb, UINT8 op_code)
1704 {
1705     UINT16          handle = p_tcb->indicate_handle;
1706     UINT32          trans_id;
1707     UINT8           i;
1708     tGATT_SR_REG    *p_rcb = gatt_cb.sr_reg;
1709     BOOLEAN         continue_processing;
1710     UINT16          conn_id;
1711 
1712     btu_stop_timer (&p_tcb->conf_timer_ent);
1713     if (GATT_HANDLE_IS_VALID(handle)) {
1714         p_tcb->indicate_handle = 0;
1715         continue_processing = gatts_proc_ind_ack(p_tcb, handle);
1716 
1717         if (continue_processing) {
1718             for (i = 0; i < GATT_MAX_SR_PROFILES; i ++, p_rcb ++) {
1719                 if (p_rcb->in_use && p_rcb->s_hdl <= handle && p_rcb->e_hdl >= handle) {
1720                     trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, handle);
1721                     conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_rcb->gatt_if);
1722                     tGATTS_DATA p_data = {0};
1723                     p_data.handle = handle;
1724                     gatt_sr_send_req_callback(conn_id,
1725                                               trans_id, GATTS_REQ_TYPE_CONF, &p_data);
1726                 }
1727             }
1728         }
1729     } else {
1730         GATT_TRACE_ERROR("unexpected handle value confirmation");
1731     }
1732 }
1733 
1734 #if GATTS_ROBUST_CACHING_ENABLED
gatts_handle_db_out_of_sync(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)1735 static BOOLEAN gatts_handle_db_out_of_sync(tGATT_TCB *p_tcb, UINT8 op_code,
1736                                     UINT16 len, UINT8 *p_data)
1737 {
1738     if (gatt_sr_is_cl_change_aware(p_tcb)) {
1739         return false;
1740     }
1741 
1742     bool should_ignore = true;
1743     bool should_rsp = true;
1744 
1745     switch (op_code) {
1746         case GATT_REQ_READ_BY_TYPE:
1747         {
1748             tBT_UUID uuid;
1749             UINT16 s_hdl = 0;
1750             UINT16 e_hdl = 0;
1751             UINT16 db_hash_handle = gatt_cb.handle_of_database_hash;
1752             tGATT_STATUS reason = gatts_validate_packet_format(op_code, &len, &p_data, &uuid, &s_hdl, &e_hdl);
1753             if (reason == GATT_SUCCESS &&
1754                     (s_hdl <= db_hash_handle && db_hash_handle <= e_hdl) &&
1755                     (uuid.uu.uuid16 == GATT_UUID_GATT_DATABASE_HASH)) {
1756                 should_ignore = false;
1757             }
1758             break;
1759         }
1760         case GATT_REQ_READ:
1761         // for pts don't process read request
1762         #if 0
1763         {
1764             UINT16 handle = 0;
1765             UINT8 *p = p_data;
1766             tGATT_STATUS status = GATT_SUCCESS;
1767 
1768             if (len < 2) {
1769                 status = GATT_INVALID_PDU;
1770             } else {
1771                 STREAM_TO_UINT16(handle, p);
1772                 len -= 2;
1773             }
1774 
1775             if (status == GATT_SUCCESS && handle == gatt_cb.handle_of_database_hash) {
1776                 should_ignore = false;
1777             }
1778             break;
1779         }
1780         #endif
1781         case GATT_REQ_READ_BY_GRP_TYPE:
1782         case GATT_REQ_FIND_TYPE_VALUE:
1783         case GATT_REQ_FIND_INFO:
1784         case GATT_REQ_READ_BLOB:
1785         case GATT_REQ_READ_MULTI:
1786         case GATT_REQ_READ_MULTI_VAR:
1787         case GATT_REQ_WRITE:
1788         case GATT_REQ_PREPARE_WRITE:
1789             break;
1790         case GATT_CMD_WRITE:
1791         case GATT_SIGN_CMD_WRITE:
1792             should_rsp = false;
1793             break;
1794         case GATT_REQ_MTU:
1795         case GATT_REQ_EXEC_WRITE:
1796         case GATT_HANDLE_VALUE_CONF:
1797         default:
1798             should_ignore = false;
1799             break;
1800     }
1801 
1802     if (should_ignore) {
1803         if (should_rsp) {
1804             gatt_send_error_rsp(p_tcb, GATT_DATABASE_OUT_OF_SYNC, op_code, 0x0000, false);
1805         }
1806 
1807         GATT_TRACE_ERROR("database out of sync op_code %x, should_rsp %d", op_code, should_rsp);
1808         gatt_sr_update_cl_status(p_tcb, should_rsp);
1809     }
1810 
1811     return should_ignore;
1812 }
1813 
1814 #endif /* GATTS_ROBUST_CACHING_ENABLED */
1815 /*******************************************************************************
1816 **
1817 ** Function         gatt_server_handle_client_req
1818 **
1819 ** Description      This function is called to handle the client requests to
1820 **                  server.
1821 **
1822 **
1823 ** Returns          void
1824 **
1825 *******************************************************************************/
gatt_server_handle_client_req(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)1826 void gatt_server_handle_client_req (tGATT_TCB *p_tcb, UINT8 op_code,
1827                                     UINT16 len, UINT8 *p_data)
1828 {
1829     /* there is pending command, discard this one */
1830     if (!gatt_sr_cmd_empty(p_tcb) && op_code != GATT_HANDLE_VALUE_CONF) {
1831         return;
1832     }
1833 
1834     /* the size of the message may not be bigger than the local max PDU size*/
1835     /* The message has to be smaller than the agreed MTU, len does not include op code */
1836     if (len >= p_tcb->payload_size) {
1837         GATT_TRACE_ERROR("server receive invalid PDU size:%d pdu size:%d", len + 1, p_tcb->payload_size );
1838         /* for invalid request expecting response, send it now */
1839         if (op_code != GATT_CMD_WRITE &&
1840                 op_code != GATT_SIGN_CMD_WRITE &&
1841                 op_code != GATT_HANDLE_VALUE_CONF) {
1842             gatt_send_error_rsp (p_tcb, GATT_INVALID_PDU, op_code, 0, FALSE);
1843         }
1844         /* otherwise, ignore the pkt */
1845     } else {
1846 #if GATTS_ROBUST_CACHING_ENABLED
1847         // handle database out of sync
1848         if (gatts_handle_db_out_of_sync(p_tcb, op_code, len, p_data)) {
1849             return;
1850         }
1851 #endif /* GATTS_ROBUST_CACHING_ENABLED */
1852         switch (op_code) {
1853         case GATT_REQ_READ_BY_GRP_TYPE:         /* discover primary services */
1854         case GATT_REQ_FIND_TYPE_VALUE:          /* discover service by UUID */
1855             gatts_process_primary_service_req (p_tcb, op_code, len, p_data);
1856             break;
1857 
1858         case GATT_REQ_FIND_INFO:                /* discover char descrptor */
1859             gatts_process_find_info(p_tcb, op_code, len, p_data);
1860             break;
1861 
1862         case GATT_REQ_READ_BY_TYPE:             /* read characteristic value, char descriptor value */
1863             /* discover characteristic, discover char by UUID */
1864             gatts_process_read_by_type_req(p_tcb, op_code, len, p_data);
1865             break;
1866 
1867 
1868         case GATT_REQ_READ:                     /* read char/char descriptor value */
1869         case GATT_REQ_READ_BLOB:
1870         case GATT_REQ_WRITE:                    /* write char/char descriptor value */
1871         case GATT_CMD_WRITE:
1872         case GATT_SIGN_CMD_WRITE:
1873         case GATT_REQ_PREPARE_WRITE:
1874             gatts_process_attribute_req (p_tcb, op_code, len, p_data);
1875             break;
1876 
1877         case GATT_HANDLE_VALUE_CONF:
1878             gatts_process_value_conf (p_tcb, op_code);
1879             break;
1880 
1881         case GATT_REQ_MTU:
1882             gatts_process_mtu_req (p_tcb, len, p_data);
1883             break;
1884 
1885         case GATT_REQ_EXEC_WRITE:
1886             gatt_process_exec_write_req (p_tcb, op_code, len, p_data);
1887             break;
1888 
1889         case GATT_REQ_READ_MULTI:
1890         case GATT_REQ_READ_MULTI_VAR:
1891             gatt_process_read_multi_req (p_tcb, op_code, len, p_data);
1892             break;
1893 
1894         default:
1895             break;
1896         }
1897     }
1898 }
1899 
1900 #endif /* BLE_INCLUDED == TRUE && GATTS_INCLUDED == TRUE */
1901