1 /******************************************************************************
2 *
3 * Copyright (C) 2008-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /******************************************************************************
20 *
21 * this file contains the GATT server functions
22 *
23 ******************************************************************************/
24
25 #include "common/bt_target.h"
26 #include "osi/allocator.h"
27
28 #if BLE_INCLUDED == TRUE && GATTS_INCLUDED == TRUE
29 #include <string.h>
30 #include "gatt_int.h"
31 #include "stack/l2c_api.h"
32 #include "l2c_int.h"
33 #define GATT_MTU_REQ_MIN_LEN 2
34
35
36
37 /*******************************************************************************
38 **
39 ** Function gatt_send_packet
40 **
41 ** Description This function is called to send gatt packets directly
42
43 **
44 ** Returns status
45 **
46 *******************************************************************************/
gatt_send_packet(tGATT_TCB * p_tcb,UINT8 * p_data,UINT16 len)47 tGATT_STATUS gatt_send_packet (tGATT_TCB *p_tcb, UINT8 *p_data, UINT16 len)
48 {
49 BT_HDR *p_msg = NULL;
50 UINT8 *p_m = NULL;
51 UINT16 buf_len;
52 tGATT_STATUS status;
53
54 if (len > p_tcb->payload_size){
55 return GATT_ILLEGAL_PARAMETER;
56 }
57
58 buf_len = (UINT16)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET);
59 if ((p_msg = (BT_HDR *)osi_malloc(buf_len)) == NULL) {
60 return GATT_NO_RESOURCES;
61 }
62
63 memset(p_msg, 0, buf_len);
64 p_msg->len = len;
65 p_m = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET;
66 memcpy(p_m, p_data, len);
67
68 status = attp_send_sr_msg(p_tcb, p_msg);
69 return status;
70 }
71
72 /*******************************************************************************
73 **
74 ** Function gatt_sr_enqueue_cmd
75 **
76 ** Description This function enqueue the request from client which needs a
77 ** application response, and update the transaction ID.
78 **
79 ** Returns void
80 **
81 *******************************************************************************/
gatt_sr_enqueue_cmd(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 handle)82 UINT32 gatt_sr_enqueue_cmd (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 handle)
83 {
84 tGATT_SR_CMD *p_cmd = &p_tcb->sr_cmd;
85 UINT32 trans_id = 0;
86
87 if ( (p_cmd->op_code == 0) ||
88 (op_code == GATT_HANDLE_VALUE_CONF)) { /* no pending request */
89 if (op_code == GATT_CMD_WRITE ||
90 op_code == GATT_SIGN_CMD_WRITE ||
91 op_code == GATT_REQ_MTU ||
92 op_code == GATT_HANDLE_VALUE_CONF) {
93 trans_id = ++p_tcb->trans_id;
94 } else {
95 p_cmd->trans_id = ++p_tcb->trans_id;
96 p_cmd->op_code = op_code;
97 p_cmd->handle = handle;
98 p_cmd->status = GATT_NOT_FOUND;
99 p_tcb->trans_id %= GATT_TRANS_ID_MAX;
100 trans_id = p_cmd->trans_id;
101 }
102 }
103
104 return trans_id;
105 }
106
107 /*******************************************************************************
108 **
109 ** Function gatt_sr_cmd_empty
110 **
111 ** Description This function check the server command queue is empty or not.
112 **
113 ** Returns TRUE if empty, FALSE if there is pending command.
114 **
115 *******************************************************************************/
gatt_sr_cmd_empty(tGATT_TCB * p_tcb)116 BOOLEAN gatt_sr_cmd_empty (tGATT_TCB *p_tcb)
117 {
118 return (p_tcb->sr_cmd.op_code == 0);
119 }
120
121 /*******************************************************************************
122 **
123 ** Function gatt_dequeue_sr_cmd
124 **
125 ** Description This function dequeue the request from command queue.
126 **
127 ** Returns void
128 **
129 *******************************************************************************/
gatt_dequeue_sr_cmd(tGATT_TCB * p_tcb)130 void gatt_dequeue_sr_cmd (tGATT_TCB *p_tcb)
131 {
132 /* Double check in case any buffers are queued */
133 GATT_TRACE_DEBUG("gatt_dequeue_sr_cmd" );
134 if (p_tcb->sr_cmd.p_rsp_msg) {
135 GATT_TRACE_ERROR("%s free msg %p", __func__, p_tcb->sr_cmd.p_rsp_msg);
136
137 osi_free(p_tcb->sr_cmd.p_rsp_msg);
138 p_tcb->sr_cmd.p_rsp_msg = NULL;
139 }
140
141 if (p_tcb->sr_cmd.multi_rsp_q) {
142 while (!fixed_queue_is_empty(p_tcb->sr_cmd.multi_rsp_q)) {
143 osi_free(fixed_queue_dequeue(p_tcb->sr_cmd.multi_rsp_q, 0));
144 }
145 fixed_queue_free(p_tcb->sr_cmd.multi_rsp_q, NULL);
146 }
147
148 memset( &p_tcb->sr_cmd, 0, sizeof(tGATT_SR_CMD));
149 }
150
151 /*******************************************************************************
152 **
153 ** Function process_read_multi_rsp
154 **
155 ** Description This function check the read multiple response.
156 **
157 ** Returns BOOLEAN if all replies have been received
158 **
159 *******************************************************************************/
process_read_multi_rsp(tGATT_SR_CMD * p_cmd,tGATT_STATUS status,tGATTS_RSP * p_msg,UINT16 mtu)160 static BOOLEAN process_read_multi_rsp (tGATT_SR_CMD *p_cmd, tGATT_STATUS status,
161 tGATTS_RSP *p_msg, UINT16 mtu)
162 {
163 UINT16 ii, total_len, len;
164 UINT8 *p;
165 BOOLEAN is_overflow = FALSE;
166
167 GATT_TRACE_DEBUG ("process_read_multi_rsp status=%d mtu=%d", status, mtu);
168
169 if (p_cmd->multi_rsp_q == NULL) {
170 p_cmd->multi_rsp_q = fixed_queue_new(QUEUE_SIZE_MAX);
171 }
172
173 /* Enqueue the response */
174 BT_HDR *p_buf = (BT_HDR *)osi_malloc(sizeof(tGATTS_RSP));
175 if (p_buf == NULL) {
176 p_cmd->status = GATT_INSUF_RESOURCE;
177 return FALSE;
178 }
179 memcpy((void *)p_buf, (const void *)p_msg, sizeof(tGATTS_RSP));
180
181 fixed_queue_enqueue(p_cmd->multi_rsp_q, p_buf, FIXED_QUEUE_MAX_TIMEOUT);
182
183 p_cmd->status = status;
184 if (status == GATT_SUCCESS) {
185 GATT_TRACE_DEBUG ("Multi read count=%d num_hdls=%d",
186 fixed_queue_length(p_cmd->multi_rsp_q),
187 p_cmd->multi_req.num_handles);
188 /* Wait till we get all the responses */
189 if (fixed_queue_length(p_cmd->multi_rsp_q) == p_cmd->multi_req.num_handles) {
190 len = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + mtu;
191 if ((p_buf = (BT_HDR *)osi_calloc(len)) == NULL) {
192 p_cmd->status = GATT_INSUF_RESOURCE;
193 return (TRUE);
194 }
195
196 p_buf->offset = L2CAP_MIN_OFFSET;
197 p = (UINT8 *)(p_buf + 1) + p_buf->offset;
198
199 /* First byte in the response is the opcode */
200 *p++ = GATT_RSP_READ_MULTI;
201 p_buf->len = 1;
202
203 /* Now walk through the buffers puting the data into the response in order */
204 list_t *list = NULL;
205 const list_node_t *node = NULL;
206 if (! fixed_queue_is_empty(p_cmd->multi_rsp_q)) {
207 list = fixed_queue_get_list(p_cmd->multi_rsp_q);
208 }
209 for (ii = 0; ii < p_cmd->multi_req.num_handles; ii++) {
210 tGATTS_RSP *p_rsp = NULL;
211 if (list != NULL) {
212 if (ii == 0) {
213 node = list_begin(list);
214 } else {
215 node = list_next(node);
216 }
217 if (node != list_end(list)) {
218 p_rsp = (tGATTS_RSP *)list_node(node);
219 }
220 }
221
222 if (p_rsp != NULL) {
223
224 total_len = (p_buf->len + p_rsp->attr_value.len);
225
226 if (total_len > mtu) {
227 /* just send the partial response for the overflow case */
228 len = p_rsp->attr_value.len - (total_len - mtu);
229 is_overflow = TRUE;
230 GATT_TRACE_DEBUG ("multi read overflow available len=%d val_len=%d", len, p_rsp->attr_value.len );
231 } else {
232 len = p_rsp->attr_value.len;
233 }
234
235 if (p_rsp->attr_value.handle == p_cmd->multi_req.handles[ii]) {
236 memcpy (p, p_rsp->attr_value.value, len);
237 if (!is_overflow) {
238 p += len;
239 }
240 p_buf->len += len;
241 } else {
242 p_cmd->status = GATT_NOT_FOUND;
243 break;
244 }
245
246 if (is_overflow) {
247 break;
248 }
249
250 } else {
251 p_cmd->status = GATT_NOT_FOUND;
252 break;
253 }
254
255 } /* loop through all handles*/
256
257
258 /* Sanity check on the buffer length */
259 if (p_buf->len == 0) {
260 GATT_TRACE_ERROR("process_read_multi_rsp - nothing found!!");
261 p_cmd->status = GATT_NOT_FOUND;
262 osi_free (p_buf);
263 GATT_TRACE_DEBUG(" osi_free (p_buf)");
264 } else if (p_cmd->p_rsp_msg != NULL) {
265 osi_free (p_buf);
266 } else {
267 p_cmd->p_rsp_msg = p_buf;
268 }
269
270 return (TRUE);
271 }
272 } else { /* any handle read exception occurs, return error */
273 return (TRUE);
274 }
275
276 /* If here, still waiting */
277 return (FALSE);
278 }
279
process_read_multi_var_rsp(tGATT_SR_CMD * p_cmd,tGATT_STATUS status,tGATTS_RSP * p_msg,UINT16 mtu)280 static BOOLEAN process_read_multi_var_rsp (tGATT_SR_CMD *p_cmd, tGATT_STATUS status,
281 tGATTS_RSP *p_msg, UINT16 mtu)
282 {
283 UINT16 ii;
284 UINT16 total_len;
285 UINT16 len;
286 UINT8 *p;
287
288 GATT_TRACE_DEBUG ("process_read_multi_var rsp status=%d mtu=%d", status, mtu);
289
290 if (p_cmd->multi_rsp_q == NULL) {
291 p_cmd->multi_rsp_q = fixed_queue_new(QUEUE_SIZE_MAX);
292 }
293
294 /* Enqueue the response */
295 BT_HDR *p_buf = (BT_HDR *)osi_malloc(sizeof(tGATTS_RSP));
296 if (p_buf == NULL) {
297 p_cmd->status = GATT_INSUF_RESOURCE;
298 return FALSE;
299 }
300 memcpy((void *)p_buf, (const void *)p_msg, sizeof(tGATTS_RSP));
301
302 fixed_queue_enqueue(p_cmd->multi_rsp_q, p_buf, FIXED_QUEUE_MAX_TIMEOUT);
303
304 p_cmd->status = status;
305 if (status == GATT_SUCCESS) {
306 GATT_TRACE_DEBUG ("Multi var read count=%d num_hdls=%d",
307 fixed_queue_length(p_cmd->multi_rsp_q),
308 p_cmd->multi_req.num_handles);
309 /* Wait till we get all the responses */
310 if (fixed_queue_length(p_cmd->multi_rsp_q) == p_cmd->multi_req.num_handles) {
311 len = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + mtu;
312 if ((p_buf = (BT_HDR *)osi_calloc(len)) == NULL) {
313 p_cmd->status = GATT_INSUF_RESOURCE;
314 return (TRUE);
315 }
316
317 p_buf->offset = L2CAP_MIN_OFFSET;
318 p = (UINT8 *)(p_buf + 1) + p_buf->offset;
319
320 /* First byte in the response is the opcode */
321 *p++ = GATT_RSP_READ_MULTI_VAR;
322 p_buf->len = 1;
323
324 /* Now walk through the buffers puting the data into the response in order */
325 list_t *list = NULL;
326 const list_node_t *node = NULL;
327 if (! fixed_queue_is_empty(p_cmd->multi_rsp_q)) {
328 list = fixed_queue_get_list(p_cmd->multi_rsp_q);
329 }
330 for (ii = 0; ii < p_cmd->multi_req.num_handles; ii++) {
331 tGATTS_RSP *p_rsp = NULL;
332 if (list != NULL) {
333 if (ii == 0) {
334 node = list_begin(list);
335 } else {
336 node = list_next(node);
337 }
338 if (node != list_end(list)) {
339 p_rsp = (tGATTS_RSP *)list_node(node);
340 }
341 }
342
343 if (p_rsp != NULL) {
344
345 total_len = (p_buf->len + 2); // value length
346
347 if (total_len > mtu) {
348 GATT_TRACE_DEBUG ("multi read variable overflow available len=%d val_len=%d", len, p_rsp->attr_value.len );
349 break;
350 }
351 len = MIN(p_rsp->attr_value.len, (mtu - total_len)); // attribute value length
352
353 if (p_rsp->attr_value.handle == p_cmd->multi_req.handles[ii]) {
354 GATT_TRACE_DEBUG("%s handle %x len %u", __func__, p_rsp->attr_value.handle, p_rsp->attr_value.len);
355 UINT16_TO_STREAM(p, p_rsp->attr_value.len);
356 memcpy (p, p_rsp->attr_value.value, len);
357 p += len;
358 p_buf->len += (2+len);
359 } else {
360 p_cmd->status = GATT_NOT_FOUND;
361 break;
362 }
363 } else {
364 p_cmd->status = GATT_NOT_FOUND;
365 break;
366 }
367
368 } /* loop through all handles*/
369
370 /* Sanity check on the buffer length */
371 if (p_buf->len == 0) {
372 GATT_TRACE_ERROR("%s - nothing found!!", __func__);
373 p_cmd->status = GATT_NOT_FOUND;
374 osi_free (p_buf);
375 } else if (p_cmd->p_rsp_msg != NULL) {
376 osi_free (p_buf);
377 } else {
378 p_cmd->p_rsp_msg = p_buf;
379 }
380
381 return (TRUE);
382 }
383 } else { /* any handle read exception occurs, return error */
384 return (TRUE);
385 }
386
387 /* If here, still waiting */
388 return (FALSE);
389 }
390
391 /*******************************************************************************
392 **
393 ** Function gatt_sr_process_app_rsp
394 **
395 ** Description This function checks whether the response message from application
396 ** match any pending request or not.
397 **
398 ** Returns void
399 **
400 *******************************************************************************/
gatt_sr_process_app_rsp(tGATT_TCB * p_tcb,tGATT_IF gatt_if,UINT32 trans_id,UINT8 op_code,tGATT_STATUS status,tGATTS_RSP * p_msg)401 tGATT_STATUS gatt_sr_process_app_rsp (tGATT_TCB *p_tcb, tGATT_IF gatt_if,
402 UINT32 trans_id, UINT8 op_code,
403 tGATT_STATUS status, tGATTS_RSP *p_msg)
404 {
405 tGATT_STATUS ret_code = GATT_SUCCESS;
406 UNUSED(trans_id);
407
408 GATT_TRACE_DEBUG("gatt_sr_process_app_rsp gatt_if=%d\n", gatt_if);
409
410 gatt_sr_update_cback_cnt(p_tcb, gatt_if, FALSE, FALSE);
411
412 if (op_code == GATT_REQ_READ_MULTI) {
413 /* If no error and still waiting, just return */
414 if (!process_read_multi_rsp (&p_tcb->sr_cmd, status, p_msg, p_tcb->payload_size)) {
415 return (GATT_SUCCESS);
416 }
417 } else if (op_code == GATT_REQ_READ_MULTI_VAR) {
418 if (!process_read_multi_var_rsp(&p_tcb->sr_cmd, status, p_msg, p_tcb->payload_size)) {
419 return (GATT_SUCCESS);
420 }
421 } else {
422 if (op_code == GATT_REQ_PREPARE_WRITE && status == GATT_SUCCESS) {
423 gatt_sr_update_prep_cnt(p_tcb, gatt_if, TRUE, FALSE);
424 }
425
426 if (op_code == GATT_REQ_EXEC_WRITE && status != GATT_SUCCESS) {
427 gatt_sr_reset_cback_cnt(p_tcb);
428 }
429
430 p_tcb->sr_cmd.status = status;
431
432 if (gatt_sr_is_cback_cnt_zero(p_tcb)
433 && status == GATT_SUCCESS) {
434 if (p_tcb->sr_cmd.p_rsp_msg == NULL) {
435 p_tcb->sr_cmd.p_rsp_msg = attp_build_sr_msg (p_tcb, (UINT8)(op_code + 1), (tGATT_SR_MSG *)p_msg);
436 } else {
437 GATT_TRACE_ERROR("Exception!!! already has respond message\n");
438 }
439 }
440 }
441 if (gatt_sr_is_cback_cnt_zero(p_tcb)) {
442 if ( (p_tcb->sr_cmd.status == GATT_SUCCESS) && (p_tcb->sr_cmd.p_rsp_msg) ) {
443 ret_code = attp_send_sr_msg (p_tcb, p_tcb->sr_cmd.p_rsp_msg);
444 p_tcb->sr_cmd.p_rsp_msg = NULL;
445 } else {
446 if (p_tcb->sr_cmd.status == GATT_SUCCESS){
447 status = GATT_UNKNOWN_ERROR;
448 }
449 ret_code = gatt_send_error_rsp (p_tcb, status, op_code, p_tcb->sr_cmd.handle, FALSE);
450 }
451
452 gatt_dequeue_sr_cmd(p_tcb);
453 }
454
455 GATT_TRACE_DEBUG("gatt_sr_process_app_rsp ret_code=%d\n", ret_code);
456
457 return ret_code;
458 }
459
460 /*******************************************************************************
461 **
462 ** Function gatt_process_exec_write_req
463 **
464 ** Description This function is called to process the execute write request
465 ** from client.
466 **
467 ** Returns void
468 **
469 *******************************************************************************/
gatt_process_exec_write_req(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)470 void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data)
471 {
472 UINT8 *p = p_data, flag, i = 0;
473 UINT32 trans_id = 0;
474 tGATT_IF gatt_if;
475 UINT16 conn_id;
476 UINT16 queue_num = 0;
477 BOOLEAN is_first = TRUE;
478 BOOLEAN is_prepare_write_valid = FALSE;
479 BOOLEAN is_need_dequeue_sr_cmd = FALSE;
480 tGATT_PREPARE_WRITE_RECORD *prepare_record = NULL;
481 tGATT_PREPARE_WRITE_QUEUE_DATA * queue_data = NULL;
482 UNUSED(len);
483
484 #if GATT_CONFORMANCE_TESTING == TRUE
485 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
486 GATT_TRACE_DEBUG("Conformance tst: forced err rspv for Execute Write: error status=%d",
487 gatt_cb.err_status);
488
489 gatt_send_error_rsp (p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, gatt_cb.handle, FALSE);
490
491 return;
492 }
493 #endif
494
495 STREAM_TO_UINT8(flag, p);
496
497 /* mask the flag */
498 flag &= GATT_PREP_WRITE_EXEC;
499
500 prepare_record = &(p_tcb->prepare_write_record);
501 queue_num = fixed_queue_length(prepare_record->queue);
502
503 //if received prepare_write packets include stack_rsp and app_rsp,
504 //stack respond to execute_write only when stack_rsp handle has invalid_offset
505 //or invalid_length error;
506 //app need to respond to execute_write if it has received app_rsp handle packets
507 if (((prepare_record->error_code_app == GATT_SUCCESS) &&
508 (prepare_record->total_num == queue_num))
509 || (flag == GATT_PREP_WRITE_CANCEL)){
510 tGATT_EXEC_WRITE_RSP gatt_exec_write_rsp;
511 gatt_exec_write_rsp.op_code = GATT_RSP_EXEC_WRITE;
512 gatt_send_packet(p_tcb, (UINT8 *)(&gatt_exec_write_rsp), sizeof(gatt_exec_write_rsp));
513 gatt_dequeue_sr_cmd(p_tcb);
514 if (flag != GATT_PREP_WRITE_CANCEL){
515 is_prepare_write_valid = TRUE;
516 }
517 GATT_TRACE_DEBUG("Send execute_write_rsp\n");
518 } else if ((prepare_record->error_code_app == GATT_SUCCESS) &&
519 (prepare_record->total_num > queue_num)){
520 //No error for stack_rsp's handles and there exist some app_rsp's handles,
521 //so exec_write_rsp depends to app's response; but stack_rsp's data is valid
522 //TODO: there exist problem if stack_rsp's data is valid but app_rsp's data is not valid.
523 is_prepare_write_valid = TRUE;
524 } else if(prepare_record->total_num < queue_num) {
525 GATT_TRACE_ERROR("Error in %s, line=%d, prepare write total number (%d) \
526 should not smaller than prepare queue number (%d)\n", \
527 __func__, __LINE__,prepare_record->total_num, queue_num);
528 } else if (prepare_record->error_code_app != GATT_SUCCESS){
529 GATT_TRACE_DEBUG("Send error code for execute_write, code=0x%x\n", prepare_record->error_code_app);
530 is_need_dequeue_sr_cmd = (prepare_record->total_num == queue_num) ? TRUE : FALSE;
531 gatt_send_error_rsp(p_tcb, prepare_record->error_code_app, GATT_REQ_EXEC_WRITE, 0, is_need_dequeue_sr_cmd);
532 }
533
534 //dequeue prepare write data
535 while(fixed_queue_try_peek_first(prepare_record->queue)) {
536 queue_data = fixed_queue_dequeue(prepare_record->queue, FIXED_QUEUE_MAX_TIMEOUT);
537 if (is_prepare_write_valid){
538 if((queue_data->p_attr->p_value != NULL) && (queue_data->p_attr->p_value->attr_val.attr_val != NULL)){
539 if(is_first) {
540 //clear attr_val.attr_len before handle prepare write data
541 queue_data->p_attr->p_value->attr_val.attr_len = 0;
542 is_first = FALSE;
543 }
544 memcpy(queue_data->p_attr->p_value->attr_val.attr_val+queue_data->offset, queue_data->value, queue_data->len);
545 //don't forget to increase the attribute value length in the gatts database.
546 queue_data->p_attr->p_value->attr_val.attr_len += queue_data->len;
547 }
548 }
549 osi_free(queue_data);
550 }
551 fixed_queue_free(prepare_record->queue, NULL);
552 prepare_record->queue = NULL;
553
554 /* according to ble spec, even if there is no prep write queued,
555 * need to respond execute_write_response
556 * Note: exec_write_rsp callback should be called after all data has been written*/
557 if (!gatt_sr_is_prep_cnt_zero(p_tcb)) {
558 if (prepare_record->total_num > queue_num){
559 trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, 0);
560 gatt_sr_copy_prep_cnt_to_cback_cnt(p_tcb);
561 }
562
563 for (i = 0; i < GATT_MAX_APPS; i++) {
564 if (p_tcb->prep_cnt[i]) {
565 gatt_if = (tGATT_IF) (i + 1);
566 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, gatt_if);
567 gatt_sr_send_req_callback(conn_id,
568 trans_id,
569 GATTS_REQ_TYPE_WRITE_EXEC,
570 (tGATTS_DATA *)&flag);
571 p_tcb->prep_cnt[i] = 0;
572 }
573 }
574 }
575
576 prepare_record->total_num = 0;
577 prepare_record->error_code_app = GATT_SUCCESS;
578 }
579
580 /*******************************************************************************
581 **
582 ** Function gatt_process_read_multi_req
583 **
584 ** Description This function is called to process the read multiple request
585 ** from client.
586 **
587 ** Returns void
588 **
589 *******************************************************************************/
gatt_process_read_multi_req(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)590 void gatt_process_read_multi_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data)
591 {
592 UINT32 trans_id;
593 UINT16 handle = 0, ll = len;
594 UINT8 *p = p_data, i_rcb;
595 tGATT_STATUS err = GATT_SUCCESS;
596 UINT8 sec_flag, key_size;
597 tGATTS_RSP *p_msg;
598
599 GATT_TRACE_DEBUG("gatt_process_read_multi_req" );
600 p_tcb->sr_cmd.multi_req.num_handles = 0;
601
602 gatt_sr_get_sec_info(p_tcb->peer_bda,
603 p_tcb->transport,
604 &sec_flag,
605 &key_size);
606
607 #if GATT_CONFORMANCE_TESTING == TRUE
608 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
609 GATT_TRACE_DEBUG("Conformance tst: forced err rspvofr ReadMultiple: error status=%d\n", gatt_cb.err_status);
610
611 STREAM_TO_UINT16(handle, p);
612
613 gatt_send_error_rsp (p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, handle, FALSE);
614
615 return;
616 }
617 #endif
618
619 while (ll >= 2 && p_tcb->sr_cmd.multi_req.num_handles < GATT_MAX_READ_MULTI_HANDLES) {
620 STREAM_TO_UINT16(handle, p);
621
622 if ((i_rcb = gatt_sr_find_i_rcb_by_handle(handle)) < GATT_MAX_SR_PROFILES) {
623 p_tcb->sr_cmd.multi_req.handles[p_tcb->sr_cmd.multi_req.num_handles++] = handle;
624
625 /* check read permission */
626 if ((err = gatts_read_attr_perm_check( gatt_cb.sr_reg[i_rcb].p_db,
627 FALSE,
628 handle,
629 sec_flag,
630 key_size))
631 != GATT_SUCCESS) {
632 GATT_TRACE_ERROR("read permission denied : 0x%02x", err);
633 break;
634 }
635 } else {
636 /* invalid handle */
637 err = GATT_INVALID_HANDLE;
638 break;
639 }
640 ll -= 2;
641 }
642
643 if (err == GATT_SUCCESS) {
644 if (ll != 0) {
645 GATT_TRACE_ERROR("max attribute handle reached in ReadMultiple Request.");
646 err = GATT_INVALID_HANDLE;
647 }
648
649 if (p_tcb->sr_cmd.multi_req.num_handles == 0) {
650 err = GATT_INVALID_HANDLE;
651 }
652 }
653
654 if (err == GATT_SUCCESS) {
655 if ((trans_id = gatt_sr_enqueue_cmd (p_tcb, op_code, p_tcb->sr_cmd.multi_req.handles[0])) != 0) {
656 gatt_sr_reset_cback_cnt(p_tcb); /* read multiple use multi_rsp_q's count*/
657
658 for (ll = 0; ll < p_tcb->sr_cmd.multi_req.num_handles; ll ++) {
659 if ((p_msg = (tGATTS_RSP *)osi_malloc(sizeof(tGATTS_RSP))) != NULL) {
660 memset(p_msg, 0, sizeof(tGATTS_RSP))
661 ;
662 handle = p_tcb->sr_cmd.multi_req.handles[ll];
663 i_rcb = gatt_sr_find_i_rcb_by_handle(handle);
664
665 p_msg->attr_value.handle = handle;
666 err = gatts_read_attr_value_by_handle(p_tcb,
667 gatt_cb.sr_reg[i_rcb].p_db,
668 op_code,
669 handle,
670 0,
671 p_msg->attr_value.value,
672 &p_msg->attr_value.len,
673 GATT_MAX_ATTR_LEN,
674 sec_flag,
675 key_size,
676 trans_id);
677
678 if (err == GATT_SUCCESS || err == GATT_STACK_RSP) {
679 gatt_sr_process_app_rsp(p_tcb, gatt_cb.sr_reg[i_rcb].gatt_if , trans_id, op_code, GATT_SUCCESS, p_msg);
680 }
681 /* either not using or done using the buffer, release it now */
682 osi_free(p_msg);
683 } else {
684 err = GATT_NO_RESOURCES;
685 gatt_dequeue_sr_cmd(p_tcb);
686 break;
687 }
688 }
689 } else {
690 err = GATT_NO_RESOURCES;
691 }
692 }
693 /* in theroy BUSY is not possible(should already been checked), protected check */
694 if (err != GATT_SUCCESS && err != GATT_STACK_RSP && err != GATT_PENDING && err != GATT_BUSY) {
695 gatt_send_error_rsp(p_tcb, err, op_code, handle, FALSE);
696 }
697 }
698
699 /*******************************************************************************
700 **
701 ** Function gatt_build_primary_service_rsp
702 **
703 ** Description Primamry service request processed internally. Theretically
704 ** only deal with ReadByTypeVAlue and ReadByGroupType.
705 **
706 ** Returns void
707 **
708 *******************************************************************************/
gatt_build_primary_service_rsp(BT_HDR * p_msg,tGATT_TCB * p_tcb,UINT8 op_code,UINT16 s_hdl,UINT16 e_hdl,UINT8 * p_data,tBT_UUID value)709 static tGATT_STATUS gatt_build_primary_service_rsp (BT_HDR *p_msg, tGATT_TCB *p_tcb,
710 UINT8 op_code, UINT16 s_hdl,
711 UINT16 e_hdl, UINT8 *p_data, tBT_UUID value)
712 {
713 tGATT_STATUS status = GATT_NOT_FOUND;
714 UINT8 handle_len = 4, *p ;
715 tGATT_SR_REG *p_rcb;
716 tGATT_SRV_LIST_INFO *p_list = &gatt_cb.srv_list_info;
717 tGATT_SRV_LIST_ELEM *p_srv = NULL;
718 tBT_UUID *p_uuid;
719
720 UNUSED(p_data);
721
722 p = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET;
723
724 p_srv = p_list->p_first;
725
726 while (p_srv) {
727 p_rcb = GATT_GET_SR_REG_PTR(p_srv->i_sreg);
728
729 if (p_rcb->in_use &&
730 p_rcb->s_hdl >= s_hdl &&
731 p_rcb->s_hdl <= e_hdl &&
732 p_rcb->type == GATT_UUID_PRI_SERVICE) {
733 if ((p_uuid = gatts_get_service_uuid (p_rcb->p_db)) != NULL) {
734 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) {
735 handle_len = 4 + p_uuid->len;
736 }
737
738 /* get the length byte in the repsonse */
739 if (p_msg->offset == 0) {
740 *p ++ = op_code + 1;
741 p_msg->len ++;
742 p_msg->offset = handle_len;
743
744 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) {
745 *p ++ = (UINT8)p_msg->offset; /* length byte */
746 p_msg->len ++;
747 }
748 }
749
750 if (p_msg->len + p_msg->offset <= p_tcb->payload_size &&
751 handle_len == p_msg->offset) {
752 if (op_code != GATT_REQ_FIND_TYPE_VALUE ||
753 gatt_uuid_compare(value, *p_uuid)) {
754 UINT16_TO_STREAM(p, p_rcb->s_hdl);
755
756 if (p_list->p_last_primary == p_srv &&
757 p_list->p_last_primary == p_list->p_last) {
758 GATT_TRACE_DEBUG("Use 0xFFFF for the last primary attribute");
759 UINT16_TO_STREAM(p, 0xFFFF); /* see GATT ERRATA 4065, 4063, ATT ERRATA 4062 */
760 } else {
761 UINT16_TO_STREAM(p, p_rcb->e_hdl);
762 }
763
764 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) {
765 gatt_build_uuid_to_stream(&p, *p_uuid);
766 }
767
768 status = GATT_SUCCESS;
769 p_msg->len += p_msg->offset;
770 }
771 } else {
772 break;
773 }
774 }
775 }
776 p_srv = p_srv->p_next;
777 }
778 p_msg->offset = L2CAP_MIN_OFFSET;
779
780 return status;
781 }
782
783 /*******************************************************************************
784 **
785 ** Function gatt_build_find_info_rsp
786 **
787 ** Description fill the find information response information in the given
788 ** buffer.
789 **
790 ** Returns TRUE: if data filled successfully.
791 ** FALSE: packet full, or format mismatch.
792 **
793 *******************************************************************************/
gatt_build_find_info_rsp(tGATT_SR_REG * p_rcb,BT_HDR * p_msg,UINT16 * p_len,UINT16 s_hdl,UINT16 e_hdl)794 static tGATT_STATUS gatt_build_find_info_rsp(tGATT_SR_REG *p_rcb, BT_HDR *p_msg, UINT16 *p_len,
795 UINT16 s_hdl, UINT16 e_hdl)
796 {
797 tGATT_STATUS status = GATT_NOT_FOUND;
798 UINT8 *p;
799 UINT16 len = *p_len;
800 tGATT_ATTR16 *p_attr = NULL;
801 UINT8 info_pair_len[2] = {4, 18};
802
803 if (!p_rcb->p_db || !p_rcb->p_db->p_attr_list) {
804 return status;
805 }
806
807 /* check the attribute database */
808 p_attr = (tGATT_ATTR16 *) p_rcb->p_db->p_attr_list;
809
810 p = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET + p_msg->len;
811
812 while (p_attr) {
813 if (p_attr->handle > e_hdl) {
814 break;
815 }
816
817 if (p_attr->handle >= s_hdl) {
818 if (p_msg->offset == 0) {
819 p_msg->offset = (p_attr->uuid_type == GATT_ATTR_UUID_TYPE_16) ? GATT_INFO_TYPE_PAIR_16 : GATT_INFO_TYPE_PAIR_128;
820 }
821
822 if (len >= info_pair_len[p_msg->offset - 1]) {
823 if (p_msg->offset == GATT_INFO_TYPE_PAIR_16 && p_attr->uuid_type == GATT_ATTR_UUID_TYPE_16) {
824 UINT16_TO_STREAM(p, p_attr->handle);
825 UINT16_TO_STREAM(p, p_attr->uuid);
826 } else if (p_msg->offset == GATT_INFO_TYPE_PAIR_128 && p_attr->uuid_type == GATT_ATTR_UUID_TYPE_128 ) {
827 UINT16_TO_STREAM(p, p_attr->handle);
828 ARRAY_TO_STREAM (p, ((tGATT_ATTR128 *) p_attr)->uuid, LEN_UUID_128);
829 } else if (p_msg->offset == GATT_INFO_TYPE_PAIR_128 && p_attr->uuid_type == GATT_ATTR_UUID_TYPE_32) {
830 UINT16_TO_STREAM(p, p_attr->handle);
831 gatt_convert_uuid32_to_uuid128(p, ((tGATT_ATTR32 *) p_attr)->uuid);
832 p += LEN_UUID_128;
833 } else {
834 GATT_TRACE_ERROR("format mismatch");
835 status = GATT_NO_RESOURCES;
836 break;
837 /* format mismatch */
838 }
839 p_msg->len += info_pair_len[p_msg->offset - 1];
840 len -= info_pair_len[p_msg->offset - 1];
841 status = GATT_SUCCESS;
842
843 } else {
844 status = GATT_NO_RESOURCES;
845 break;
846 }
847 }
848 p_attr = (tGATT_ATTR16 *)p_attr->p_next;
849 }
850
851 *p_len = len;
852 return status;
853 }
854
855 /*******************************************************************************
856 **
857 ** Function gatts_internal_read_by_type_req
858 **
859 ** Description check to see if the ReadByType request can be handled internally.
860 **
861 ** Returns void
862 **
863 *******************************************************************************/
gatts_validate_packet_format(UINT8 op_code,UINT16 * p_len,UINT8 ** p_data,tBT_UUID * p_uuid_filter,UINT16 * p_s_hdl,UINT16 * p_e_hdl)864 static tGATT_STATUS gatts_validate_packet_format(UINT8 op_code, UINT16 *p_len,
865 UINT8 **p_data, tBT_UUID *p_uuid_filter,
866 UINT16 *p_s_hdl, UINT16 *p_e_hdl)
867 {
868 tGATT_STATUS reason = GATT_SUCCESS;
869 UINT16 uuid_len, s_hdl = 0, e_hdl = 0;
870 UINT16 len = *p_len;
871 UINT8 *p = *p_data;
872
873 if (len >= 4) {
874 /* obtain starting handle, and ending handle */
875 STREAM_TO_UINT16(s_hdl, p);
876 STREAM_TO_UINT16(e_hdl, p);
877 len -= 4;
878
879 if (s_hdl > e_hdl || !GATT_HANDLE_IS_VALID(s_hdl) || !GATT_HANDLE_IS_VALID(e_hdl)) {
880 reason = GATT_INVALID_HANDLE;
881 }
882 /* for these PDUs, uuid filter must present */
883 else if (op_code == GATT_REQ_READ_BY_GRP_TYPE ||
884 op_code == GATT_REQ_FIND_TYPE_VALUE ||
885 op_code == GATT_REQ_READ_BY_TYPE) {
886 if (len >= 2 && p_uuid_filter != NULL) {
887 uuid_len = (op_code == GATT_REQ_FIND_TYPE_VALUE) ? 2 : len;
888
889 /* parse uuid now */
890 if (gatt_parse_uuid_from_cmd (p_uuid_filter, uuid_len, &p) == FALSE ||
891 p_uuid_filter->len == 0) {
892 GATT_TRACE_DEBUG("UUID filter does not exsit");
893 reason = GATT_INVALID_PDU;
894 } else {
895 len -= p_uuid_filter->len;
896 }
897 } else {
898 reason = GATT_INVALID_PDU;
899 }
900 }
901 } else {
902 reason = GATT_INVALID_PDU;
903 }
904
905 *p_data = p;
906 *p_len = len;
907 *p_s_hdl = s_hdl;
908 *p_e_hdl = e_hdl;
909
910 return reason;
911 }
912
913 /*******************************************************************************
914 **
915 ** Function gatts_process_primary_service_req
916 **
917 ** Description process ReadByGroupType/ReadByTypeValue request, for discover
918 ** all primary services or discover primary service by UUID request.
919 **
920 ** Returns void
921 **
922 *******************************************************************************/
gatts_process_primary_service_req(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)923 void gatts_process_primary_service_req(tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data)
924 {
925 UINT8 reason = GATT_INVALID_PDU;
926 UINT16 s_hdl = 0, e_hdl = 0;
927 tBT_UUID uuid, value, primary_service = {LEN_UUID_16, {GATT_UUID_PRI_SERVICE}};
928 BT_HDR *p_msg = NULL;
929 UINT16 msg_len = (UINT16)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET);
930
931 memset (&value, 0, sizeof(tBT_UUID));
932 reason = gatts_validate_packet_format(op_code, &len, &p_data, &uuid, &s_hdl, &e_hdl);
933
934 if (reason == GATT_SUCCESS) {
935 if (gatt_uuid_compare(uuid, primary_service)) {
936 if (op_code == GATT_REQ_FIND_TYPE_VALUE) {
937 if (gatt_parse_uuid_from_cmd(&value, len, &p_data) == FALSE) {
938 reason = GATT_INVALID_PDU;
939 }
940 }
941
942 if (reason == GATT_SUCCESS) {
943 if ((p_msg = (BT_HDR *)osi_calloc(msg_len)) == NULL) {
944 GATT_TRACE_ERROR("gatts_process_primary_service_req failed. no resources.");
945 reason = GATT_NO_RESOURCES;
946 } else {
947 reason = gatt_build_primary_service_rsp (p_msg, p_tcb, op_code, s_hdl, e_hdl, p_data, value);
948 }
949 }
950 } else {
951 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) {
952 reason = GATT_UNSUPPORT_GRP_TYPE;
953 GATT_TRACE_DEBUG("unexpected ReadByGrpType Group: 0x%04x", uuid.uu.uuid16);
954 } else {
955 /* we do not support ReadByTypeValue with any non-primamry_service type */
956 reason = GATT_NOT_FOUND;
957 GATT_TRACE_DEBUG("unexpected ReadByTypeValue type: 0x%04x", uuid.uu.uuid16);
958 }
959 }
960 }
961
962 if (reason != GATT_SUCCESS) {
963 if (p_msg) {
964 osi_free(p_msg);
965 }
966 gatt_send_error_rsp (p_tcb, reason, op_code, s_hdl, FALSE);
967 } else {
968 attp_send_sr_msg(p_tcb, p_msg);
969 }
970
971 }
972
973 /*******************************************************************************
974 **
975 ** Function gatts_process_find_info
976 **
977 ** Description process find information request, for discover character
978 ** descriptors.
979 **
980 ** Returns void
981 **
982 *******************************************************************************/
gatts_process_find_info(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)983 static void gatts_process_find_info(tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data)
984 {
985 UINT8 reason = GATT_INVALID_PDU, *p;
986 UINT16 s_hdl = 0, e_hdl = 0, buf_len;
987 BT_HDR *p_msg = NULL;
988 tGATT_SR_REG *p_rcb;
989 tGATT_SRV_LIST_INFO *p_list = &gatt_cb.srv_list_info;
990 tGATT_SRV_LIST_ELEM *p_srv = NULL;
991
992 reason = gatts_validate_packet_format(op_code, &len, &p_data, NULL, &s_hdl, &e_hdl);
993
994 if (reason == GATT_SUCCESS) {
995 buf_len = (UINT16)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET);
996
997 if ((p_msg = (BT_HDR *)osi_calloc(buf_len)) == NULL) {
998 reason = GATT_NO_RESOURCES;
999 } else {
1000 reason = GATT_NOT_FOUND;
1001
1002 p = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET;
1003 *p ++ = op_code + 1;
1004 p_msg->len = 2;
1005
1006 buf_len = p_tcb->payload_size - 2;
1007
1008 p_srv = p_list->p_first;
1009
1010 while (p_srv) {
1011 p_rcb = GATT_GET_SR_REG_PTR(p_srv->i_sreg);
1012
1013 if (p_rcb->in_use &&
1014 !(p_rcb->s_hdl > e_hdl ||
1015 p_rcb->e_hdl < s_hdl)) {
1016 reason = gatt_build_find_info_rsp(p_rcb, p_msg, &buf_len, s_hdl, e_hdl);
1017 if (reason == GATT_NO_RESOURCES) {
1018 reason = GATT_SUCCESS;
1019 break;
1020 }
1021 }
1022 p_srv = p_srv->p_next;
1023 }
1024 *p = (UINT8)p_msg->offset;
1025
1026 p_msg->offset = L2CAP_MIN_OFFSET;
1027 }
1028 }
1029
1030 if (reason != GATT_SUCCESS) {
1031 if (p_msg) {
1032 osi_free(p_msg);
1033 }
1034 gatt_send_error_rsp (p_tcb, reason, op_code, s_hdl, FALSE);
1035 } else {
1036 attp_send_sr_msg(p_tcb, p_msg);
1037 }
1038
1039 }
1040
1041 /*******************************************************************************
1042 **
1043 ** Function gatts_process_mtu_req
1044 **
1045 ** Description This function is called to process excahnge MTU request.
1046 ** Only used on LE.
1047 **
1048 ** Returns void
1049 **
1050 *******************************************************************************/
gatts_process_mtu_req(tGATT_TCB * p_tcb,UINT16 len,UINT8 * p_data)1051 static void gatts_process_mtu_req (tGATT_TCB *p_tcb, UINT16 len, UINT8 *p_data)
1052 {
1053 UINT16 mtu = 0;
1054 UINT8 *p = p_data, i;
1055 BT_HDR *p_buf;
1056 UINT16 conn_id;
1057
1058 /* BR/EDR conenction, send error response */
1059 if (p_tcb->att_lcid != L2CAP_ATT_CID) {
1060 gatt_send_error_rsp (p_tcb, GATT_REQ_NOT_SUPPORTED, GATT_REQ_MTU, 0, FALSE);
1061 } else if (len < GATT_MTU_REQ_MIN_LEN) {
1062 GATT_TRACE_ERROR("invalid MTU request PDU received.\n");
1063 gatt_send_error_rsp (p_tcb, GATT_INVALID_PDU, GATT_REQ_MTU, 0, FALSE);
1064 } else {
1065 STREAM_TO_UINT16 (mtu, p);
1066 /* mtu must be greater than default MTU which is 23/48 */
1067 if (mtu < GATT_DEF_BLE_MTU_SIZE) {
1068 p_tcb->payload_size = GATT_DEF_BLE_MTU_SIZE;
1069 } else if (mtu > gatt_default.local_mtu) {
1070 p_tcb->payload_size = gatt_default.local_mtu;
1071 } else {
1072 p_tcb->payload_size = mtu;
1073 }
1074
1075 /* host will set packet data length to 251 automatically if remote device support set packet data length,
1076 so l2cble_set_fixed_channel_tx_data_length() is not necessary.
1077 l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, p_tcb->payload_size);
1078 */
1079
1080 if ((p_buf = attp_build_sr_msg(p_tcb, GATT_RSP_MTU, (tGATT_SR_MSG *) &p_tcb->payload_size)) != NULL) {
1081 attp_send_sr_msg (p_tcb, p_buf);
1082
1083 /* Notify all registered application with new MTU size. Us a transaction ID */
1084 /* of 0, as no response is allowed from applcations */
1085
1086 for (i = 0; i < GATT_MAX_APPS; i ++) {
1087 if (gatt_cb.cl_rcb[i].in_use ) {
1088 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, gatt_cb.cl_rcb[i].gatt_if);
1089 gatt_sr_send_req_callback(conn_id, 0, GATTS_REQ_TYPE_MTU,
1090 (tGATTS_DATA *)&p_tcb->payload_size);
1091 }
1092 }
1093
1094 }
1095 }
1096 }
1097
1098 /*******************************************************************************
1099 **
1100 ** Function gatts_process_read_by_type_req
1101 **
1102 ** Description process Read By type request.
1103 ** This PDU can be used to perform:
1104 ** - read characteristic value
1105 ** - read characteristic descriptor value
1106 ** - discover characteristic
1107 ** - discover characteristic by UUID
1108 ** - relationship discovery
1109 **
1110 ** Returns void
1111 **
1112 *******************************************************************************/
gatts_process_read_by_type_req(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)1113 void gatts_process_read_by_type_req(tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data)
1114 {
1115 tBT_UUID uuid;
1116 tGATT_SR_REG *p_rcb;
1117 UINT16 msg_len = (UINT16)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET),
1118 buf_len,
1119 s_hdl, e_hdl, err_hdl = 0;
1120 BT_HDR *p_msg = NULL;
1121 tGATT_STATUS reason, ret;
1122 UINT8 *p;
1123 UINT8 sec_flag, key_size;
1124 tGATT_SRV_LIST_INFO *p_list = &gatt_cb.srv_list_info;
1125 tGATT_SRV_LIST_ELEM *p_srv = NULL;
1126
1127 reason = gatts_validate_packet_format(op_code, &len, &p_data, &uuid, &s_hdl, &e_hdl);
1128 GATT_TRACE_DEBUG("%s, op_code =%x, len = %x\n", __func__, op_code, len);
1129 #if GATT_CONFORMANCE_TESTING == TRUE
1130 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
1131 GATT_TRACE_DEBUG("Conformance tst: forced err rsp for ReadByType: error status=%d\n", gatt_cb.err_status);
1132
1133 gatt_send_error_rsp (p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, s_hdl, FALSE);
1134
1135 return;
1136 }
1137 #endif
1138
1139 if (reason == GATT_SUCCESS) {
1140 if ((p_msg = (BT_HDR *)osi_calloc(msg_len)) == NULL) {
1141 GATT_TRACE_ERROR("gatts_process_find_info failed. no resources.\n");
1142
1143 reason = GATT_NO_RESOURCES;
1144 } else {
1145 p = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET;
1146
1147 *p ++ = op_code + 1;
1148 /* reserve length byte */
1149 p_msg->len = 2;
1150 buf_len = p_tcb->payload_size - 2;
1151
1152 reason = GATT_NOT_FOUND;
1153
1154 p_srv = p_list->p_first;
1155
1156 while (p_srv) {
1157 p_rcb = GATT_GET_SR_REG_PTR(p_srv->i_sreg);
1158
1159 if (p_rcb->in_use &&
1160 !(p_rcb->s_hdl > e_hdl ||
1161 p_rcb->e_hdl < s_hdl)) {
1162 gatt_sr_get_sec_info(p_tcb->peer_bda,
1163 p_tcb->transport,
1164 &sec_flag,
1165 &key_size);
1166
1167 ret = gatts_db_read_attr_value_by_type(p_tcb,
1168 p_rcb->p_db,
1169 op_code,
1170 p_msg,
1171 s_hdl,
1172 e_hdl,
1173 uuid,
1174 &buf_len,
1175 sec_flag,
1176 key_size,
1177 0,
1178 &err_hdl);
1179 if (ret != GATT_NOT_FOUND) {
1180 reason = ret;
1181
1182 if (ret == GATT_NO_RESOURCES) {
1183 reason = GATT_SUCCESS;
1184 }
1185 }
1186 if (ret != GATT_SUCCESS && ret != GATT_NOT_FOUND) {
1187 s_hdl = err_hdl;
1188 break;
1189 }
1190 }
1191 p_srv = p_srv->p_next;
1192 }
1193 *p = (UINT8)p_msg->offset;
1194 p_msg->offset = L2CAP_MIN_OFFSET;
1195 }
1196 }
1197 if (reason != GATT_SUCCESS && reason != GATT_STACK_RSP) {
1198 if (p_msg) {
1199 osi_free(p_msg);
1200 }
1201
1202 /* in theroy BUSY is not possible(should already been checked), protected check */
1203 if (reason != GATT_PENDING && reason != GATT_BUSY) {
1204 gatt_send_error_rsp (p_tcb, reason, op_code, s_hdl, FALSE);
1205 }
1206 } else {
1207 attp_send_sr_msg(p_tcb, p_msg);
1208 gatt_dequeue_sr_cmd(p_tcb);
1209 }
1210
1211 }
1212
1213 /*******************************************************************************
1214 **
1215 ** Function gatts_process_write_req
1216 **
1217 ** Description This function is called to process the write request
1218 ** from client.
1219 **
1220 ** Returns void
1221 **
1222 *******************************************************************************/
gatts_process_write_req(tGATT_TCB * p_tcb,UINT8 i_rcb,UINT16 handle,UINT8 op_code,UINT16 len,UINT8 * p_data)1223 void gatts_process_write_req (tGATT_TCB *p_tcb, UINT8 i_rcb, UINT16 handle,
1224 UINT8 op_code, UINT16 len, UINT8 *p_data)
1225 {
1226 tGATTS_DATA sr_data;
1227 UINT32 trans_id;
1228 tGATT_STATUS status;
1229 UINT8 sec_flag, key_size, *p = p_data;
1230 tGATT_SR_REG *p_sreg;
1231 UINT16 conn_id, offset = 0;
1232
1233 memset(&sr_data, 0, sizeof(tGATTS_DATA));
1234 sr_data.write_req.need_rsp = FALSE;
1235
1236 switch (op_code) {
1237 case GATT_SIGN_CMD_WRITE:
1238 if (op_code == GATT_SIGN_CMD_WRITE) {
1239 GATT_TRACE_DEBUG("Write CMD with data signing" );
1240 len -= GATT_AUTH_SIGN_LEN;
1241 }
1242 /* fall through */
1243 case GATT_CMD_WRITE:
1244 case GATT_REQ_WRITE:
1245 sr_data.write_req.handle = handle;
1246 sr_data.write_req.len = len;
1247 if (len != 0 && p != NULL) {
1248 memcpy (sr_data.write_req.value, p, len);
1249 }
1250 break;
1251 }
1252
1253 gatt_sr_get_sec_info(p_tcb->peer_bda,
1254 p_tcb->transport,
1255 &sec_flag,
1256 &key_size);
1257
1258 status = gatts_write_attr_perm_check (gatt_cb.sr_reg[i_rcb].p_db,
1259 op_code,
1260 handle,
1261 sr_data.write_req.offset,
1262 p,
1263 len,
1264 sec_flag,
1265 key_size);
1266
1267 if (status == GATT_SUCCESS) {
1268 if ((trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, handle)) != 0) {
1269 p_sreg = &gatt_cb.sr_reg[i_rcb];
1270 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_sreg->gatt_if);
1271 status = gatts_write_attr_value_by_handle(gatt_cb.sr_reg[i_rcb].p_db,
1272 handle, offset, p, len);
1273 if((op_code == GATT_REQ_WRITE) && (status == GATT_APP_RSP)){
1274 sr_data.write_req.need_rsp = TRUE;
1275 status = GATT_PENDING;
1276 }
1277
1278 gatt_sr_send_req_callback(conn_id,
1279 trans_id,
1280 GATTS_REQ_TYPE_WRITE,
1281 &sr_data);
1282 } else {
1283 GATT_TRACE_ERROR("Error in %s, line=%d, max pending command, send error\n", __func__, __LINE__);
1284 status = GATT_BUSY; /* max pending command, application error */
1285 }
1286 }
1287
1288 /* response should be sent only for write_request */
1289 if ((op_code == GATT_REQ_WRITE) && (sr_data.write_req.need_rsp == FALSE)){
1290 if (status == GATT_SUCCESS){
1291 tGATT_WRITE_REQ_RSP gatt_write_req_rsp;
1292 gatt_write_req_rsp.op_code = GATT_RSP_WRITE;
1293 gatt_send_packet(p_tcb, (UINT8 *)(&gatt_write_req_rsp), sizeof(gatt_write_req_rsp));
1294 gatt_dequeue_sr_cmd(p_tcb);
1295 } else if (status != GATT_PENDING){
1296 /* note: in case of GATT_BUSY, will respond this application error to remote device */
1297 gatt_send_error_rsp (p_tcb, status, op_code, handle, TRUE);
1298 }
1299 }
1300
1301 return;
1302 }
1303
1304
1305 /*******************************************************************************
1306 **
1307 ** Function gatts_attr_process_preapre_write
1308 **
1309 ** Description This function is called to process the prepare write request
1310 ** from client.
1311 **
1312 ** Returns void
1313 **
1314 *******************************************************************************/
gatt_attr_process_prepare_write(tGATT_TCB * p_tcb,UINT8 i_rcb,UINT16 handle,UINT8 op_code,UINT16 len,UINT8 * p_data)1315 void gatt_attr_process_prepare_write (tGATT_TCB *p_tcb, UINT8 i_rcb, UINT16 handle,
1316 UINT8 op_code, UINT16 len, UINT8 *p_data)
1317 {
1318 tGATT_STATUS status;
1319 tGATT_PREPARE_WRITE_QUEUE_DATA * queue_data = NULL;
1320 tGATT_ATTR16 *p_attr;
1321 tGATT_ATTR16 *p_attr_temp;
1322 tGATTS_DATA sr_data;
1323 UINT32 trans_id = 0;
1324 UINT8 sec_flag, key_size, *p = p_data;
1325 tGATT_SR_REG *p_sreg;
1326 UINT16 conn_id, offset = 0;
1327 tGATT_SVC_DB *p_db;
1328 BOOLEAN is_need_prepare_write_rsp = FALSE;
1329 BOOLEAN is_need_queue_data = FALSE;
1330 tGATT_PREPARE_WRITE_RECORD *prepare_record = NULL;
1331 memset(&sr_data, 0, sizeof(tGATTS_DATA));
1332
1333 if (len < 2) {
1334 GATT_TRACE_ERROR("%s: Prepare write request was invalid - missing offset, sending error response", __func__);
1335 gatt_send_error_rsp(p_tcb, GATT_INVALID_PDU, op_code, handle, FALSE);
1336 return;
1337 }
1338 //get offset from p_data
1339 STREAM_TO_UINT16(offset, p);
1340 len -= 2;
1341 p_sreg = &gatt_cb.sr_reg[i_rcb];
1342 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_sreg->gatt_if);
1343 //prepare_record = &(prepare_write_record);
1344 prepare_record = &(p_tcb->prepare_write_record);
1345
1346 gatt_sr_get_sec_info(p_tcb->peer_bda,
1347 p_tcb->transport,
1348 &sec_flag,
1349 &key_size);
1350
1351 status = gatts_write_attr_perm_check (gatt_cb.sr_reg[i_rcb].p_db,
1352 op_code,
1353 handle,
1354 sr_data.write_req.offset,
1355 p,
1356 len,
1357 sec_flag,
1358 key_size);
1359
1360 if (status == GATT_SUCCESS){
1361 if ((trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, handle)) != 0) {
1362 p_db = gatt_cb.sr_reg[i_rcb].p_db;
1363 if (p_db && p_db->p_attr_list) {
1364 p_attr = (tGATT_ATTR16 *)p_db->p_attr_list;
1365 while (p_attr && handle >= p_attr->handle) {
1366 if (p_attr->handle == handle ) {
1367 p_attr_temp = p_attr;
1368 if (p_attr->control.auto_rsp == GATT_RSP_BY_APP) {
1369 status = GATT_APP_RSP;
1370 } else if (p_attr->p_value != NULL &&
1371 offset > p_attr->p_value->attr_val.attr_max_len) {
1372 status = GATT_INVALID_OFFSET;
1373 is_need_prepare_write_rsp = TRUE;
1374 is_need_queue_data = TRUE;
1375 } else if (p_attr->p_value != NULL &&
1376 ((offset + len) > p_attr->p_value->attr_val.attr_max_len)){
1377 status = GATT_INVALID_ATTR_LEN;
1378 is_need_prepare_write_rsp = TRUE;
1379 is_need_queue_data = TRUE;
1380 } else if (p_attr->p_value == NULL) {
1381 GATT_TRACE_ERROR("Error in %s, attribute of handle 0x%x not allocate value buffer\n",
1382 __func__, handle);
1383 status = GATT_UNKNOWN_ERROR;
1384 } else {
1385 //valid prepare write request, need to send response and queue the data
1386 //status: GATT_SUCCESS
1387 is_need_prepare_write_rsp = TRUE;
1388 is_need_queue_data = TRUE;
1389 }
1390 }
1391 p_attr = (tGATT_ATTR16 *)p_attr->p_next;
1392 }
1393 }
1394 } else{
1395 status = GATT_UNKNOWN_ERROR;
1396 GATT_TRACE_ERROR("Error in %s, Line %d: GATT BUSY\n", __func__, __LINE__);
1397 }
1398 }
1399
1400 if (is_need_queue_data){
1401 queue_data = (tGATT_PREPARE_WRITE_QUEUE_DATA *)osi_malloc(len + sizeof(tGATT_PREPARE_WRITE_QUEUE_DATA));
1402 if (queue_data == NULL){
1403 status = GATT_PREPARE_Q_FULL;
1404 } else {
1405 queue_data->p_attr = p_attr_temp;
1406 queue_data->len = len;
1407 queue_data->handle = handle;
1408 queue_data->offset = offset;
1409 memcpy(queue_data->value, p, len);
1410 if (prepare_record->queue == NULL) {
1411 prepare_record->queue = fixed_queue_new(QUEUE_SIZE_MAX);
1412 }
1413 fixed_queue_enqueue(prepare_record->queue, queue_data, FIXED_QUEUE_MAX_TIMEOUT);
1414 }
1415 }
1416
1417 if (is_need_prepare_write_rsp){
1418 //send prepare write response
1419 if (queue_data != NULL){
1420 queue_data->op_code = op_code + 1;
1421 //5: op_code 1 + handle 2 + offset 2
1422 tGATT_STATUS rsp_send_status = gatt_send_packet(p_tcb, &(queue_data->op_code), queue_data->len + 5);
1423 gatt_sr_update_prep_cnt(p_tcb, p_sreg->gatt_if, TRUE, FALSE);
1424 gatt_dequeue_sr_cmd(p_tcb);
1425
1426 if (rsp_send_status != GATT_SUCCESS){
1427 GATT_TRACE_ERROR("Error in %s, line=%d, fail to send prepare_write_rsp, status=0x%x\n",
1428 __func__, __LINE__, rsp_send_status);
1429 }
1430 } else{
1431 GATT_TRACE_ERROR("Error in %s, line=%d, queue_data should not be NULL here, fail to send prepare_write_rsp\n",
1432 __func__, __LINE__);
1433 }
1434 }
1435
1436 if ((status == GATT_APP_RSP) || (is_need_prepare_write_rsp)){
1437 prepare_record->total_num++;
1438 memset(&sr_data, 0, sizeof(sr_data));
1439 sr_data.write_req.is_prep = TRUE;
1440 sr_data.write_req.handle = handle;
1441 sr_data.write_req.offset = offset;
1442 sr_data.write_req.len = len;
1443 sr_data.write_req.need_rsp = (status == GATT_APP_RSP) ? TRUE : FALSE;
1444 memcpy(sr_data.write_req.value, p, len);
1445 gatt_sr_send_req_callback(conn_id, trans_id, GATTS_REQ_TYPE_WRITE, &sr_data);
1446 } else{
1447 gatt_send_error_rsp(p_tcb, status, GATT_REQ_PREPARE_WRITE, handle, TRUE);
1448 }
1449
1450 if ((prepare_record->error_code_app == GATT_SUCCESS)
1451 // update prepare write status for excute write request
1452 && (status == GATT_INVALID_OFFSET || status == GATT_INVALID_ATTR_LEN || status == GATT_REQ_NOT_SUPPORTED)) {
1453 prepare_record->error_code_app = status;
1454 }
1455
1456 }
1457
1458 /*******************************************************************************
1459 **
1460 ** Function gatts_process_read_req
1461 **
1462 ** Description This function is called to process the read request
1463 ** from client.
1464 **
1465 ** Returns void
1466 **
1467 *******************************************************************************/
gatts_process_read_req(tGATT_TCB * p_tcb,tGATT_SR_REG * p_rcb,UINT8 op_code,UINT16 handle,UINT16 len,UINT8 * p_data)1468 static void gatts_process_read_req(tGATT_TCB *p_tcb, tGATT_SR_REG *p_rcb, UINT8 op_code,
1469 UINT16 handle, UINT16 len, UINT8 *p_data)
1470 {
1471 UINT16 buf_len = (UINT16)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET);
1472 tGATT_STATUS reason;
1473 BT_HDR *p_msg = NULL;
1474 UINT8 sec_flag, key_size, *p;
1475 UINT16 offset = 0, value_len = 0;
1476
1477 UNUSED (len);
1478 if ((p_msg = (BT_HDR *)osi_calloc(buf_len)) == NULL) {
1479 GATT_TRACE_ERROR("gatts_process_find_info failed. no resources.\n");
1480
1481 reason = GATT_NO_RESOURCES;
1482 } else {
1483 if (op_code == GATT_REQ_READ_BLOB) {
1484 STREAM_TO_UINT16(offset, p_data);
1485 }
1486
1487 p = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET;
1488 *p ++ = op_code + 1;
1489 p_msg->len = 1;
1490 buf_len = p_tcb->payload_size - 1;
1491
1492 gatt_sr_get_sec_info(p_tcb->peer_bda,
1493 p_tcb->transport,
1494 &sec_flag,
1495 &key_size);
1496
1497 reason = gatts_read_attr_value_by_handle(p_tcb,
1498 p_rcb->p_db,
1499 op_code,
1500 handle,
1501 offset,
1502 p,
1503 &value_len,
1504 buf_len,
1505 sec_flag,
1506 key_size,
1507 0);
1508
1509 p_msg->len += value_len;
1510 }
1511
1512
1513 if (reason != GATT_SUCCESS && reason != GATT_PENDING && reason != GATT_STACK_RSP) {
1514 if (p_msg) {
1515 osi_free(p_msg);
1516 }
1517
1518 /* in theroy BUSY is not possible(should already been checked), protected check */
1519 if (reason != GATT_BUSY) {
1520 gatt_send_error_rsp (p_tcb, reason, op_code, handle, FALSE);
1521 gatt_dequeue_sr_cmd(p_tcb);
1522 }
1523 } else if (reason == GATT_SUCCESS || reason == GATT_STACK_RSP) {
1524 attp_send_sr_msg(p_tcb, p_msg);
1525 gatt_dequeue_sr_cmd(p_tcb);
1526 } else {
1527 if (p_msg) {
1528 osi_free(p_msg);
1529 }
1530 }
1531
1532 }
1533
1534 /*******************************************************************************
1535 **
1536 ** Function gatts_process_attribute_req
1537 **
1538 ** Description This function is called to process the per attribute handle request
1539 ** from client.
1540 **
1541 ** Returns void
1542 **
1543 *******************************************************************************/
gatts_process_attribute_req(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)1544 void gatts_process_attribute_req (tGATT_TCB *p_tcb, UINT8 op_code,
1545 UINT16 len, UINT8 *p_data)
1546 {
1547 UINT16 handle = 0;
1548 UINT8 *p = p_data, i;
1549 tGATT_SR_REG *p_rcb = gatt_cb.sr_reg;
1550 tGATT_STATUS status = GATT_INVALID_HANDLE;
1551 tGATT_ATTR16 *p_attr;
1552
1553 if (len < 2) {
1554 GATT_TRACE_ERROR("Illegal PDU length, discard request\n");
1555 status = GATT_INVALID_PDU;
1556 } else {
1557 STREAM_TO_UINT16(handle, p);
1558 len -= 2;
1559 }
1560
1561 #if GATT_CONFORMANCE_TESTING == TRUE
1562 gatt_cb.handle = handle;
1563 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
1564 GATT_TRACE_DEBUG("Conformance tst: forced err rsp: error status=%d\n", gatt_cb.err_status);
1565
1566 gatt_send_error_rsp (p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, handle, FALSE);
1567
1568 return;
1569 }
1570 #endif
1571
1572 if (GATT_HANDLE_IS_VALID(handle)) {
1573 for (i = 0; i < GATT_MAX_SR_PROFILES; i ++, p_rcb ++) {
1574 if (p_rcb->in_use && p_rcb->s_hdl <= handle && p_rcb->e_hdl >= handle) {
1575 p_attr = (tGATT_ATTR16 *)p_rcb->p_db->p_attr_list;
1576
1577 while (p_attr) {
1578 if (p_attr->handle == handle) {
1579 switch (op_code) {
1580 case GATT_REQ_READ: /* read char/char descriptor value */
1581 case GATT_REQ_READ_BLOB:
1582 gatts_process_read_req(p_tcb, p_rcb, op_code, handle, len, p);
1583 break;
1584
1585 case GATT_REQ_WRITE: /* write char/char descriptor value */
1586 case GATT_CMD_WRITE:
1587 case GATT_SIGN_CMD_WRITE:
1588 gatts_process_write_req(p_tcb, i, handle, op_code, len, p);
1589 break;
1590
1591 case GATT_REQ_PREPARE_WRITE:
1592 gatt_attr_process_prepare_write (p_tcb, i, handle, op_code, len, p);
1593 default:
1594 break;
1595 }
1596 status = GATT_SUCCESS;
1597 break;
1598 }
1599 p_attr = (tGATT_ATTR16 *)p_attr->p_next;
1600 }
1601 break;
1602 }
1603 }
1604 }
1605
1606 if (status != GATT_SUCCESS && op_code != GATT_CMD_WRITE && op_code != GATT_SIGN_CMD_WRITE) {
1607 gatt_send_error_rsp (p_tcb, status, op_code, handle, FALSE);
1608 }
1609 }
1610
1611 /*******************************************************************************
1612 **
1613 ** Function gatts_proc_srv_chg_ind_ack
1614 **
1615 ** Description This function process the service changed indicaiton ACK
1616 **
1617 ** Returns void
1618 **
1619 *******************************************************************************/
gatts_proc_srv_chg_ind_ack(tGATT_TCB * p_tcb)1620 static void gatts_proc_srv_chg_ind_ack(tGATT_TCB *p_tcb )
1621 {
1622 tGATTS_SRV_CHG_REQ req;
1623 tGATTS_SRV_CHG *p_buf = NULL;
1624
1625 GATT_TRACE_DEBUG("gatts_proc_srv_chg_ind_ack");
1626
1627 if ((p_buf = gatt_is_bda_in_the_srv_chg_clt_list(p_tcb->peer_bda)) != NULL) {
1628 GATT_TRACE_DEBUG("NV update set srv chg = FALSE");
1629 p_buf->srv_changed = FALSE;
1630 memcpy(&req.srv_chg, p_buf, sizeof(tGATTS_SRV_CHG));
1631 if (gatt_cb.cb_info.p_srv_chg_callback) {
1632 (*gatt_cb.cb_info.p_srv_chg_callback)(GATTS_SRV_CHG_CMD_UPDATE_CLIENT, &req, NULL);
1633 }
1634 }
1635 }
1636
1637 /*******************************************************************************
1638 **
1639 ** Function gatts_chk_pending_ind
1640 **
1641 ** Description This function check any pending indication needs to be sent if
1642 ** there is a pending indication then sent the indication
1643 **
1644 ** Returns void
1645 **
1646 *******************************************************************************/
gatts_chk_pending_ind(tGATT_TCB * p_tcb)1647 static void gatts_chk_pending_ind(tGATT_TCB *p_tcb )
1648 {
1649 #if (GATTS_INCLUDED == TRUE)
1650 tGATT_VALUE *p_buf = (tGATT_VALUE *)fixed_queue_try_peek_first(p_tcb->pending_ind_q);
1651 GATT_TRACE_DEBUG("gatts_chk_pending_ind");
1652
1653 if (p_buf ) {
1654 GATTS_HandleValueIndication (p_buf->conn_id,
1655 p_buf->handle,
1656 p_buf->len,
1657 p_buf->value);
1658 osi_free(fixed_queue_try_remove_from_queue(p_tcb->pending_ind_q,
1659 p_buf));
1660 }
1661 #endif ///GATTS_INCLUDED == TRUE
1662 }
1663
1664 /*******************************************************************************
1665 **
1666 ** Function gatts_proc_ind_ack
1667 **
1668 ** Description This function process the Indication ack
1669 **
1670 ** Returns TRUE continue to process the indication ack by the aaplication
1671 ** if the ACk is not a Service Changed Indication Ack
1672 **
1673 *******************************************************************************/
gatts_proc_ind_ack(tGATT_TCB * p_tcb,UINT16 ack_handle)1674 static BOOLEAN gatts_proc_ind_ack(tGATT_TCB *p_tcb, UINT16 ack_handle)
1675 {
1676 BOOLEAN continue_processing = TRUE;
1677
1678 GATT_TRACE_DEBUG ("gatts_proc_ind_ack ack handle=%d", ack_handle);
1679
1680 if (ack_handle == gatt_cb.handle_of_h_r) {
1681 gatts_proc_srv_chg_ind_ack(p_tcb);
1682 /* there is no need to inform the application since srv chg is handled internally by GATT */
1683 continue_processing = FALSE;
1684 #if GATTS_ROBUST_CACHING_ENABLED
1685 /* after receiving ack of svc_chg_ind, reset client status */
1686 gatt_sr_update_cl_status(p_tcb, true);
1687 #endif /* GATTS_ROBUST_CACHING_ENABLED */
1688 }
1689
1690 gatts_chk_pending_ind(p_tcb);
1691 return continue_processing;
1692 }
1693
1694 /*******************************************************************************
1695 **
1696 ** Function gatts_process_value_conf
1697 **
1698 ** Description This function is called to process the handle value confirmation.
1699 **
1700 ** Returns void
1701 **
1702 *******************************************************************************/
gatts_process_value_conf(tGATT_TCB * p_tcb,UINT8 op_code)1703 void gatts_process_value_conf(tGATT_TCB *p_tcb, UINT8 op_code)
1704 {
1705 UINT16 handle = p_tcb->indicate_handle;
1706 UINT32 trans_id;
1707 UINT8 i;
1708 tGATT_SR_REG *p_rcb = gatt_cb.sr_reg;
1709 BOOLEAN continue_processing;
1710 UINT16 conn_id;
1711
1712 btu_stop_timer (&p_tcb->conf_timer_ent);
1713 if (GATT_HANDLE_IS_VALID(handle)) {
1714 p_tcb->indicate_handle = 0;
1715 continue_processing = gatts_proc_ind_ack(p_tcb, handle);
1716
1717 if (continue_processing) {
1718 for (i = 0; i < GATT_MAX_SR_PROFILES; i ++, p_rcb ++) {
1719 if (p_rcb->in_use && p_rcb->s_hdl <= handle && p_rcb->e_hdl >= handle) {
1720 trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, handle);
1721 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_rcb->gatt_if);
1722 tGATTS_DATA p_data = {0};
1723 p_data.handle = handle;
1724 gatt_sr_send_req_callback(conn_id,
1725 trans_id, GATTS_REQ_TYPE_CONF, &p_data);
1726 }
1727 }
1728 }
1729 } else {
1730 GATT_TRACE_ERROR("unexpected handle value confirmation");
1731 }
1732 }
1733
1734 #if GATTS_ROBUST_CACHING_ENABLED
gatts_handle_db_out_of_sync(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)1735 static BOOLEAN gatts_handle_db_out_of_sync(tGATT_TCB *p_tcb, UINT8 op_code,
1736 UINT16 len, UINT8 *p_data)
1737 {
1738 if (gatt_sr_is_cl_change_aware(p_tcb)) {
1739 return false;
1740 }
1741
1742 bool should_ignore = true;
1743 bool should_rsp = true;
1744
1745 switch (op_code) {
1746 case GATT_REQ_READ_BY_TYPE:
1747 {
1748 tBT_UUID uuid;
1749 UINT16 s_hdl = 0;
1750 UINT16 e_hdl = 0;
1751 UINT16 db_hash_handle = gatt_cb.handle_of_database_hash;
1752 tGATT_STATUS reason = gatts_validate_packet_format(op_code, &len, &p_data, &uuid, &s_hdl, &e_hdl);
1753 if (reason == GATT_SUCCESS &&
1754 (s_hdl <= db_hash_handle && db_hash_handle <= e_hdl) &&
1755 (uuid.uu.uuid16 == GATT_UUID_GATT_DATABASE_HASH)) {
1756 should_ignore = false;
1757 }
1758 break;
1759 }
1760 case GATT_REQ_READ:
1761 // for pts don't process read request
1762 #if 0
1763 {
1764 UINT16 handle = 0;
1765 UINT8 *p = p_data;
1766 tGATT_STATUS status = GATT_SUCCESS;
1767
1768 if (len < 2) {
1769 status = GATT_INVALID_PDU;
1770 } else {
1771 STREAM_TO_UINT16(handle, p);
1772 len -= 2;
1773 }
1774
1775 if (status == GATT_SUCCESS && handle == gatt_cb.handle_of_database_hash) {
1776 should_ignore = false;
1777 }
1778 break;
1779 }
1780 #endif
1781 case GATT_REQ_READ_BY_GRP_TYPE:
1782 case GATT_REQ_FIND_TYPE_VALUE:
1783 case GATT_REQ_FIND_INFO:
1784 case GATT_REQ_READ_BLOB:
1785 case GATT_REQ_READ_MULTI:
1786 case GATT_REQ_READ_MULTI_VAR:
1787 case GATT_REQ_WRITE:
1788 case GATT_REQ_PREPARE_WRITE:
1789 break;
1790 case GATT_CMD_WRITE:
1791 case GATT_SIGN_CMD_WRITE:
1792 should_rsp = false;
1793 break;
1794 case GATT_REQ_MTU:
1795 case GATT_REQ_EXEC_WRITE:
1796 case GATT_HANDLE_VALUE_CONF:
1797 default:
1798 should_ignore = false;
1799 break;
1800 }
1801
1802 if (should_ignore) {
1803 if (should_rsp) {
1804 gatt_send_error_rsp(p_tcb, GATT_DATABASE_OUT_OF_SYNC, op_code, 0x0000, false);
1805 }
1806
1807 GATT_TRACE_ERROR("database out of sync op_code %x, should_rsp %d", op_code, should_rsp);
1808 gatt_sr_update_cl_status(p_tcb, should_rsp);
1809 }
1810
1811 return should_ignore;
1812 }
1813
1814 #endif /* GATTS_ROBUST_CACHING_ENABLED */
1815 /*******************************************************************************
1816 **
1817 ** Function gatt_server_handle_client_req
1818 **
1819 ** Description This function is called to handle the client requests to
1820 ** server.
1821 **
1822 **
1823 ** Returns void
1824 **
1825 *******************************************************************************/
gatt_server_handle_client_req(tGATT_TCB * p_tcb,UINT8 op_code,UINT16 len,UINT8 * p_data)1826 void gatt_server_handle_client_req (tGATT_TCB *p_tcb, UINT8 op_code,
1827 UINT16 len, UINT8 *p_data)
1828 {
1829 /* there is pending command, discard this one */
1830 if (!gatt_sr_cmd_empty(p_tcb) && op_code != GATT_HANDLE_VALUE_CONF) {
1831 return;
1832 }
1833
1834 /* the size of the message may not be bigger than the local max PDU size*/
1835 /* The message has to be smaller than the agreed MTU, len does not include op code */
1836 if (len >= p_tcb->payload_size) {
1837 GATT_TRACE_ERROR("server receive invalid PDU size:%d pdu size:%d", len + 1, p_tcb->payload_size );
1838 /* for invalid request expecting response, send it now */
1839 if (op_code != GATT_CMD_WRITE &&
1840 op_code != GATT_SIGN_CMD_WRITE &&
1841 op_code != GATT_HANDLE_VALUE_CONF) {
1842 gatt_send_error_rsp (p_tcb, GATT_INVALID_PDU, op_code, 0, FALSE);
1843 }
1844 /* otherwise, ignore the pkt */
1845 } else {
1846 #if GATTS_ROBUST_CACHING_ENABLED
1847 // handle database out of sync
1848 if (gatts_handle_db_out_of_sync(p_tcb, op_code, len, p_data)) {
1849 return;
1850 }
1851 #endif /* GATTS_ROBUST_CACHING_ENABLED */
1852 switch (op_code) {
1853 case GATT_REQ_READ_BY_GRP_TYPE: /* discover primary services */
1854 case GATT_REQ_FIND_TYPE_VALUE: /* discover service by UUID */
1855 gatts_process_primary_service_req (p_tcb, op_code, len, p_data);
1856 break;
1857
1858 case GATT_REQ_FIND_INFO: /* discover char descrptor */
1859 gatts_process_find_info(p_tcb, op_code, len, p_data);
1860 break;
1861
1862 case GATT_REQ_READ_BY_TYPE: /* read characteristic value, char descriptor value */
1863 /* discover characteristic, discover char by UUID */
1864 gatts_process_read_by_type_req(p_tcb, op_code, len, p_data);
1865 break;
1866
1867
1868 case GATT_REQ_READ: /* read char/char descriptor value */
1869 case GATT_REQ_READ_BLOB:
1870 case GATT_REQ_WRITE: /* write char/char descriptor value */
1871 case GATT_CMD_WRITE:
1872 case GATT_SIGN_CMD_WRITE:
1873 case GATT_REQ_PREPARE_WRITE:
1874 gatts_process_attribute_req (p_tcb, op_code, len, p_data);
1875 break;
1876
1877 case GATT_HANDLE_VALUE_CONF:
1878 gatts_process_value_conf (p_tcb, op_code);
1879 break;
1880
1881 case GATT_REQ_MTU:
1882 gatts_process_mtu_req (p_tcb, len, p_data);
1883 break;
1884
1885 case GATT_REQ_EXEC_WRITE:
1886 gatt_process_exec_write_req (p_tcb, op_code, len, p_data);
1887 break;
1888
1889 case GATT_REQ_READ_MULTI:
1890 case GATT_REQ_READ_MULTI_VAR:
1891 gatt_process_read_multi_req (p_tcb, op_code, len, p_data);
1892 break;
1893
1894 default:
1895 break;
1896 }
1897 }
1898 }
1899
1900 #endif /* BLE_INCLUDED == TRUE && GATTS_INCLUDED == TRUE */
1901
