1 /******************************************************************************
2 *
3 * Copyright (C) 2008-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /******************************************************************************
20 *
21 * this file contains the GATT server functions
22 *
23 ******************************************************************************/
24
25 #include "bt_target.h"
26 #include "bt_utils.h"
27 #include "osi/include/osi.h"
28
29 #include <string.h>
30 #include "gatt_int.h"
31 #include "l2c_api.h"
32 #include "l2c_int.h"
33 #define GATT_MTU_REQ_MIN_LEN 2
34
35 /*******************************************************************************
36 *
37 * Function gatt_sr_enqueue_cmd
38 *
39 * Description This function enqueue the request from client which needs a
40 * application response, and update the transaction ID.
41 *
42 * Returns void
43 *
44 ******************************************************************************/
gatt_sr_enqueue_cmd(tGATT_TCB * p_tcb,uint8_t op_code,uint16_t handle)45 uint32_t gatt_sr_enqueue_cmd(tGATT_TCB* p_tcb, uint8_t op_code,
46 uint16_t handle) {
47 tGATT_SR_CMD* p_cmd = &p_tcb->sr_cmd;
48 uint32_t trans_id = 0;
49
50 if ((p_cmd->op_code == 0) ||
51 (op_code == GATT_HANDLE_VALUE_CONF)) /* no pending request */
52 {
53 if (op_code == GATT_CMD_WRITE || op_code == GATT_SIGN_CMD_WRITE ||
54 op_code == GATT_REQ_MTU || op_code == GATT_HANDLE_VALUE_CONF) {
55 trans_id = ++p_tcb->trans_id;
56 } else {
57 p_cmd->trans_id = ++p_tcb->trans_id;
58 p_cmd->op_code = op_code;
59 p_cmd->handle = handle;
60 p_cmd->status = GATT_NOT_FOUND;
61 p_tcb->trans_id %= GATT_TRANS_ID_MAX;
62 trans_id = p_cmd->trans_id;
63 }
64 }
65
66 return trans_id;
67 }
68
69 /*******************************************************************************
70 *
71 * Function gatt_sr_cmd_empty
72 *
73 * Description This function checks if the server command queue is empty.
74 *
75 * Returns true if empty, false if there is pending command.
76 *
77 ******************************************************************************/
gatt_sr_cmd_empty(tGATT_TCB * p_tcb)78 bool gatt_sr_cmd_empty(tGATT_TCB* p_tcb) {
79 return (p_tcb->sr_cmd.op_code == 0);
80 }
81
82 /*******************************************************************************
83 *
84 * Function gatt_dequeue_sr_cmd
85 *
86 * Description This function dequeue the request from command queue.
87 *
88 * Returns void
89 *
90 ******************************************************************************/
gatt_dequeue_sr_cmd(tGATT_TCB * p_tcb)91 void gatt_dequeue_sr_cmd(tGATT_TCB* p_tcb) {
92 /* Double check in case any buffers are queued */
93 GATT_TRACE_DEBUG("gatt_dequeue_sr_cmd");
94 if (p_tcb->sr_cmd.p_rsp_msg)
95 GATT_TRACE_ERROR("free p_tcb->sr_cmd.p_rsp_msg = %d",
96 p_tcb->sr_cmd.p_rsp_msg);
97 osi_free_and_reset((void**)&p_tcb->sr_cmd.p_rsp_msg);
98
99 while (!fixed_queue_is_empty(p_tcb->sr_cmd.multi_rsp_q))
100 osi_free(fixed_queue_try_dequeue(p_tcb->sr_cmd.multi_rsp_q));
101 fixed_queue_free(p_tcb->sr_cmd.multi_rsp_q, NULL);
102 memset(&p_tcb->sr_cmd, 0, sizeof(tGATT_SR_CMD));
103 }
104
105 /*******************************************************************************
106 *
107 * Function process_read_multi_rsp
108 *
109 * Description This function check the read multiple response.
110 *
111 * Returns bool if all replies have been received
112 *
113 ******************************************************************************/
process_read_multi_rsp(tGATT_SR_CMD * p_cmd,tGATT_STATUS status,tGATTS_RSP * p_msg,uint16_t mtu)114 static bool process_read_multi_rsp(tGATT_SR_CMD* p_cmd, tGATT_STATUS status,
115 tGATTS_RSP* p_msg, uint16_t mtu) {
116 uint16_t ii, total_len, len;
117 uint8_t* p;
118 bool is_overflow = false;
119
120 GATT_TRACE_DEBUG("%s status=%d mtu=%d", __func__, status, mtu);
121
122 if (p_cmd->multi_rsp_q == NULL)
123 p_cmd->multi_rsp_q = fixed_queue_new(SIZE_MAX);
124
125 /* Enqueue the response */
126 BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(tGATTS_RSP));
127 memcpy((void*)p_buf, (const void*)p_msg, sizeof(tGATTS_RSP));
128 fixed_queue_enqueue(p_cmd->multi_rsp_q, p_buf);
129
130 p_cmd->status = status;
131 if (status == GATT_SUCCESS) {
132 GATT_TRACE_DEBUG("Multi read count=%d num_hdls=%d",
133 fixed_queue_length(p_cmd->multi_rsp_q),
134 p_cmd->multi_req.num_handles);
135 /* Wait till we get all the responses */
136 if (fixed_queue_length(p_cmd->multi_rsp_q) ==
137 p_cmd->multi_req.num_handles) {
138 len = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + mtu;
139 p_buf = (BT_HDR*)osi_calloc(len);
140 p_buf->offset = L2CAP_MIN_OFFSET;
141 p = (uint8_t*)(p_buf + 1) + p_buf->offset;
142
143 /* First byte in the response is the opcode */
144 *p++ = GATT_RSP_READ_MULTI;
145 p_buf->len = 1;
146
147 /* Now walk through the buffers puting the data into the response in order
148 */
149 list_t* list = NULL;
150 const list_node_t* node = NULL;
151 if (!fixed_queue_is_empty(p_cmd->multi_rsp_q))
152 list = fixed_queue_get_list(p_cmd->multi_rsp_q);
153 for (ii = 0; ii < p_cmd->multi_req.num_handles; ii++) {
154 tGATTS_RSP* p_rsp = NULL;
155
156 if (list != NULL) {
157 if (ii == 0)
158 node = list_begin(list);
159 else
160 node = list_next(node);
161 if (node != list_end(list)) p_rsp = (tGATTS_RSP*)list_node(node);
162 }
163
164 if (p_rsp != NULL) {
165 total_len = (p_buf->len + p_rsp->attr_value.len);
166
167 if (total_len > mtu) {
168 /* just send the partial response for the overflow case */
169 len = p_rsp->attr_value.len - (total_len - mtu);
170 is_overflow = true;
171 GATT_TRACE_DEBUG("multi read overflow available len=%d val_len=%d",
172 len, p_rsp->attr_value.len);
173 } else {
174 len = p_rsp->attr_value.len;
175 }
176
177 if (p_rsp->attr_value.handle == p_cmd->multi_req.handles[ii]) {
178 memcpy(p, p_rsp->attr_value.value, len);
179 if (!is_overflow) p += len;
180 p_buf->len += len;
181 } else {
182 p_cmd->status = GATT_NOT_FOUND;
183 break;
184 }
185
186 if (is_overflow) break;
187
188 } else {
189 p_cmd->status = GATT_NOT_FOUND;
190 break;
191 }
192
193 } /* loop through all handles*/
194
195 /* Sanity check on the buffer length */
196 if (p_buf->len == 0) {
197 GATT_TRACE_ERROR("process_read_multi_rsp - nothing found!!");
198 p_cmd->status = GATT_NOT_FOUND;
199 osi_free(p_buf);
200 GATT_TRACE_DEBUG("osi_free(p_buf)");
201 } else if (p_cmd->p_rsp_msg != NULL) {
202 osi_free(p_buf);
203 } else {
204 p_cmd->p_rsp_msg = p_buf;
205 }
206
207 return (true);
208 }
209 } else /* any handle read exception occurs, return error */
210 {
211 return (true);
212 }
213
214 /* If here, still waiting */
215 return (false);
216 }
217
218 /*******************************************************************************
219 *
220 * Function gatt_sr_process_app_rsp
221 *
222 * Description This function checks whether the response message from
223 * application matches any pending request.
224 *
225 * Returns void
226 *
227 ******************************************************************************/
gatt_sr_process_app_rsp(tGATT_TCB * p_tcb,tGATT_IF gatt_if,UNUSED_ATTR uint32_t trans_id,uint8_t op_code,tGATT_STATUS status,tGATTS_RSP * p_msg)228 tGATT_STATUS gatt_sr_process_app_rsp(tGATT_TCB* p_tcb, tGATT_IF gatt_if,
229 UNUSED_ATTR uint32_t trans_id,
230 uint8_t op_code, tGATT_STATUS status,
231 tGATTS_RSP* p_msg) {
232 tGATT_STATUS ret_code = GATT_SUCCESS;
233
234 GATT_TRACE_DEBUG("gatt_sr_process_app_rsp gatt_if=%d", gatt_if);
235
236 gatt_sr_update_cback_cnt(p_tcb, gatt_if, false, false);
237
238 if (op_code == GATT_REQ_READ_MULTI) {
239 /* If no error and still waiting, just return */
240 if (!process_read_multi_rsp(&p_tcb->sr_cmd, status, p_msg,
241 p_tcb->payload_size))
242 return (GATT_SUCCESS);
243 } else {
244 if (op_code == GATT_REQ_PREPARE_WRITE && status == GATT_SUCCESS)
245 gatt_sr_update_prep_cnt(p_tcb, gatt_if, true, false);
246
247 if (op_code == GATT_REQ_EXEC_WRITE && status != GATT_SUCCESS)
248 gatt_sr_reset_cback_cnt(p_tcb);
249
250 p_tcb->sr_cmd.status = status;
251
252 if (gatt_sr_is_cback_cnt_zero(p_tcb) && status == GATT_SUCCESS) {
253 if (p_tcb->sr_cmd.p_rsp_msg == NULL) {
254 p_tcb->sr_cmd.p_rsp_msg = attp_build_sr_msg(
255 p_tcb, (uint8_t)(op_code + 1), (tGATT_SR_MSG*)p_msg);
256 } else {
257 GATT_TRACE_ERROR("Exception!!! already has respond message");
258 }
259 }
260 }
261 if (gatt_sr_is_cback_cnt_zero(p_tcb)) {
262 if ((p_tcb->sr_cmd.status == GATT_SUCCESS) && (p_tcb->sr_cmd.p_rsp_msg)) {
263 ret_code = attp_send_sr_msg(p_tcb, p_tcb->sr_cmd.p_rsp_msg);
264 p_tcb->sr_cmd.p_rsp_msg = NULL;
265 } else {
266 ret_code = gatt_send_error_rsp(p_tcb, status, op_code,
267 p_tcb->sr_cmd.handle, false);
268 }
269
270 gatt_dequeue_sr_cmd(p_tcb);
271 }
272
273 GATT_TRACE_DEBUG("gatt_sr_process_app_rsp ret_code=%d", ret_code);
274
275 return ret_code;
276 }
277
278 /*******************************************************************************
279 *
280 * Function gatt_process_exec_write_req
281 *
282 * Description This function is called to process the execute write request
283 * from client.
284 *
285 * Returns void
286 *
287 ******************************************************************************/
gatt_process_exec_write_req(tGATT_TCB * p_tcb,uint8_t op_code,UNUSED_ATTR uint16_t len,uint8_t * p_data)288 void gatt_process_exec_write_req(tGATT_TCB* p_tcb, uint8_t op_code,
289 UNUSED_ATTR uint16_t len, uint8_t* p_data) {
290 uint8_t *p = p_data, flag, i = 0;
291 uint32_t trans_id = 0;
292 tGATT_IF gatt_if;
293 uint16_t conn_id;
294
295 #if (GATT_CONFORMANCE_TESTING == TRUE)
296 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
297 GATT_TRACE_DEBUG(
298 "Conformance tst: forced err rspv for Execute Write: error status=%d",
299 gatt_cb.err_status);
300
301 gatt_send_error_rsp(p_tcb, gatt_cb.err_status, gatt_cb.req_op_code,
302 gatt_cb.handle, false);
303
304 return;
305 }
306 #endif
307
308 STREAM_TO_UINT8(flag, p);
309
310 /* mask the flag */
311 flag &= GATT_PREP_WRITE_EXEC;
312
313 /* no prep write is queued */
314 if (!gatt_sr_is_prep_cnt_zero(p_tcb)) {
315 trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, 0);
316 gatt_sr_copy_prep_cnt_to_cback_cnt(p_tcb);
317
318 for (i = 0; i < GATT_MAX_APPS; i++) {
319 if (p_tcb->prep_cnt[i]) {
320 gatt_if = (tGATT_IF)(i + 1);
321 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, gatt_if);
322 gatt_sr_send_req_callback(conn_id, trans_id, GATTS_REQ_TYPE_WRITE_EXEC,
323 (tGATTS_DATA*)&flag);
324 p_tcb->prep_cnt[i] = 0;
325 }
326 }
327 } else /* nothing needs to be executed , send response now */
328 {
329 GATT_TRACE_ERROR("gatt_process_exec_write_req: no prepare write pending");
330 gatt_send_error_rsp(p_tcb, GATT_ERROR, GATT_REQ_EXEC_WRITE, 0, false);
331 }
332 }
333
334 /*******************************************************************************
335 *
336 * Function gatt_process_read_multi_req
337 *
338 * Description This function is called to process the read multiple request
339 * from client.
340 *
341 * Returns void
342 *
343 ******************************************************************************/
gatt_process_read_multi_req(tGATT_TCB * p_tcb,uint8_t op_code,uint16_t len,uint8_t * p_data)344 void gatt_process_read_multi_req(tGATT_TCB* p_tcb, uint8_t op_code,
345 uint16_t len, uint8_t* p_data) {
346 uint32_t trans_id;
347 uint16_t handle = 0, ll = len;
348 uint8_t* p = p_data;
349 tGATT_STATUS err = GATT_SUCCESS;
350 uint8_t sec_flag, key_size;
351
352 GATT_TRACE_DEBUG("gatt_process_read_multi_req");
353 p_tcb->sr_cmd.multi_req.num_handles = 0;
354
355 gatt_sr_get_sec_info(p_tcb->peer_bda, p_tcb->transport, &sec_flag, &key_size);
356
357 #if (GATT_CONFORMANCE_TESTING == TRUE)
358 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
359 GATT_TRACE_DEBUG(
360 "Conformance tst: forced err rspvofr ReadMultiple: error status=%d",
361 gatt_cb.err_status);
362
363 STREAM_TO_UINT16(handle, p);
364
365 gatt_send_error_rsp(p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, handle,
366 false);
367
368 return;
369 }
370 #endif
371
372 while (ll >= 2 &&
373 p_tcb->sr_cmd.multi_req.num_handles < GATT_MAX_READ_MULTI_HANDLES) {
374 STREAM_TO_UINT16(handle, p);
375
376 auto it = gatt_sr_find_i_rcb_by_handle(handle);
377 if (it != gatt_cb.srv_list_info->end()) {
378 p_tcb->sr_cmd.multi_req.handles[p_tcb->sr_cmd.multi_req.num_handles++] =
379 handle;
380
381 /* check read permission */
382 err = gatts_read_attr_perm_check(it->p_db, false, handle, sec_flag,
383 key_size);
384 if (err != GATT_SUCCESS) {
385 GATT_TRACE_DEBUG("read permission denied : 0x%02x", err);
386 break;
387 }
388 } else {
389 /* invalid handle */
390 err = GATT_INVALID_HANDLE;
391 break;
392 }
393 ll -= 2;
394 }
395
396 if (ll != 0) {
397 GATT_TRACE_ERROR("max attribute handle reached in ReadMultiple Request.");
398 }
399
400 if (p_tcb->sr_cmd.multi_req.num_handles == 0) err = GATT_INVALID_HANDLE;
401
402 if (err == GATT_SUCCESS) {
403 trans_id =
404 gatt_sr_enqueue_cmd(p_tcb, op_code, p_tcb->sr_cmd.multi_req.handles[0]);
405 if (trans_id != 0) {
406 gatt_sr_reset_cback_cnt(p_tcb); /* read multiple use multi_rsp_q's count*/
407
408 for (ll = 0; ll < p_tcb->sr_cmd.multi_req.num_handles; ll++) {
409 tGATTS_RSP* p_msg = (tGATTS_RSP*)osi_calloc(sizeof(tGATTS_RSP));
410 handle = p_tcb->sr_cmd.multi_req.handles[ll];
411 auto it = gatt_sr_find_i_rcb_by_handle(handle);
412
413 p_msg->attr_value.handle = handle;
414 err = gatts_read_attr_value_by_handle(
415 p_tcb, it->p_db, op_code, handle, 0, p_msg->attr_value.value,
416 &p_msg->attr_value.len, GATT_MAX_ATTR_LEN, sec_flag, key_size,
417 trans_id);
418
419 if (err == GATT_SUCCESS) {
420 gatt_sr_process_app_rsp(p_tcb, it->gatt_if, trans_id, op_code,
421 GATT_SUCCESS, p_msg);
422 }
423 /* either not using or done using the buffer, release it now */
424 osi_free(p_msg);
425 }
426 } else
427 err = GATT_NO_RESOURCES;
428 }
429
430 /* in theroy BUSY is not possible(should already been checked), protected
431 * check */
432 if (err != GATT_SUCCESS && err != GATT_PENDING && err != GATT_BUSY)
433 gatt_send_error_rsp(p_tcb, err, op_code, handle, false);
434 }
435
436 /*******************************************************************************
437 *
438 * Function gatt_build_primary_service_rsp
439 *
440 * Description Primamry service request processed internally. Theretically
441 * only deal with ReadByTypeVAlue and ReadByGroupType.
442 *
443 * Returns void
444 *
445 ******************************************************************************/
gatt_build_primary_service_rsp(BT_HDR * p_msg,tGATT_TCB * p_tcb,uint8_t op_code,uint16_t s_hdl,uint16_t e_hdl,UNUSED_ATTR uint8_t * p_data,tBT_UUID value)446 static tGATT_STATUS gatt_build_primary_service_rsp(
447 BT_HDR* p_msg, tGATT_TCB* p_tcb, uint8_t op_code, uint16_t s_hdl,
448 uint16_t e_hdl, UNUSED_ATTR uint8_t* p_data, tBT_UUID value) {
449 tGATT_STATUS status = GATT_NOT_FOUND;
450 uint8_t handle_len = 4, *p;
451 tBT_UUID* p_uuid;
452
453 p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET;
454
455 for (tGATT_SRV_LIST_ELEM& el : *gatt_cb.srv_list_info) {
456 if (el.s_hdl >= s_hdl && el.s_hdl <= e_hdl &&
457 el.type == GATT_UUID_PRI_SERVICE) {
458 p_uuid = gatts_get_service_uuid(el.p_db);
459 if (p_uuid != NULL) {
460 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) handle_len = 4 + p_uuid->len;
461
462 /* get the length byte in the repsonse */
463 if (p_msg->offset == 0) {
464 *p++ = op_code + 1;
465 p_msg->len++;
466 p_msg->offset = handle_len;
467
468 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) {
469 *p++ = (uint8_t)p_msg->offset; /* length byte */
470 p_msg->len++;
471 }
472 }
473
474 if (p_msg->len + p_msg->offset <= p_tcb->payload_size &&
475 handle_len == p_msg->offset) {
476 if (op_code != GATT_REQ_FIND_TYPE_VALUE ||
477 gatt_uuid_compare(value, *p_uuid)) {
478 UINT16_TO_STREAM(p, el.s_hdl);
479
480 if (gatt_cb.last_primary_s_handle &&
481 gatt_cb.last_primary_s_handle == el.s_hdl) {
482 GATT_TRACE_DEBUG("Use 0xFFFF for the last primary attribute");
483 /* see GATT ERRATA 4065, 4063, ATT ERRATA 4062 */
484 UINT16_TO_STREAM(p, 0xFFFF);
485 } else {
486 UINT16_TO_STREAM(p, el.e_hdl);
487 }
488
489 if (op_code == GATT_REQ_READ_BY_GRP_TYPE)
490 gatt_build_uuid_to_stream(&p, *p_uuid);
491
492 status = GATT_SUCCESS;
493 p_msg->len += p_msg->offset;
494 }
495 } else
496 break;
497 }
498 }
499 }
500 p_msg->offset = L2CAP_MIN_OFFSET;
501
502 return status;
503 }
504
505 /**
506 * fill the find information response information in the given buffer.
507 *
508 * Returns true: if data filled sucessfully.
509 * false: packet full, or format mismatch.
510 */
gatt_build_find_info_rsp(tGATT_SRV_LIST_ELEM & el,BT_HDR * p_msg,uint16_t * p_len,uint16_t s_hdl,uint16_t e_hdl)511 static tGATT_STATUS gatt_build_find_info_rsp(tGATT_SRV_LIST_ELEM& el,
512 BT_HDR* p_msg, uint16_t* p_len,
513 uint16_t s_hdl, uint16_t e_hdl) {
514 tGATT_STATUS status = GATT_NOT_FOUND;
515 uint8_t* p;
516 uint16_t len = *p_len;
517 uint8_t info_pair_len[2] = {4, 18};
518
519 if (!el.p_db) return status;
520
521 /* check the attribute database */
522
523 p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET + p_msg->len;
524
525 for (auto& attr : el.p_db->attr_list) {
526 if (attr.handle > e_hdl) {
527 break;
528 }
529
530 if (attr.handle >= s_hdl) {
531 if (p_msg->offset == 0)
532 p_msg->offset = (attr.uuid.len == LEN_UUID_16)
533 ? GATT_INFO_TYPE_PAIR_16
534 : GATT_INFO_TYPE_PAIR_128;
535
536 if (len >= info_pair_len[p_msg->offset - 1]) {
537 if (p_msg->offset == GATT_INFO_TYPE_PAIR_16 &&
538 attr.uuid.len == LEN_UUID_16) {
539 UINT16_TO_STREAM(p, attr.handle);
540 UINT16_TO_STREAM(p, attr.uuid.uu.uuid16);
541 } else if (p_msg->offset == GATT_INFO_TYPE_PAIR_128 &&
542 attr.uuid.len == LEN_UUID_128) {
543 UINT16_TO_STREAM(p, attr.handle);
544 ARRAY_TO_STREAM(p, attr.uuid.uu.uuid128, LEN_UUID_128);
545 } else if (p_msg->offset == GATT_INFO_TYPE_PAIR_128 &&
546 attr.uuid.len == LEN_UUID_32) {
547 UINT16_TO_STREAM(p, attr.handle);
548 gatt_convert_uuid32_to_uuid128(p, attr.uuid.uu.uuid32);
549 p += LEN_UUID_128;
550 } else {
551 GATT_TRACE_ERROR("format mismatch");
552 status = GATT_NO_RESOURCES;
553 break;
554 /* format mismatch */
555 }
556 p_msg->len += info_pair_len[p_msg->offset - 1];
557 len -= info_pair_len[p_msg->offset - 1];
558 status = GATT_SUCCESS;
559
560 } else {
561 status = GATT_NO_RESOURCES;
562 break;
563 }
564 }
565 }
566
567 *p_len = len;
568 return status;
569 }
570
571 /*******************************************************************************
572 *
573 * Function gatts_internal_read_by_type_req
574 *
575 * Description Check to see if the ReadByType request can be handled
576 * internally.
577 *
578 * Returns void
579 *
580 ******************************************************************************/
gatts_validate_packet_format(uint8_t op_code,uint16_t * p_len,uint8_t ** p_data,tBT_UUID * p_uuid_filter,uint16_t * p_s_hdl,uint16_t * p_e_hdl)581 static tGATT_STATUS gatts_validate_packet_format(
582 uint8_t op_code, uint16_t* p_len, uint8_t** p_data, tBT_UUID* p_uuid_filter,
583 uint16_t* p_s_hdl, uint16_t* p_e_hdl) {
584 tGATT_STATUS reason = GATT_SUCCESS;
585 uint16_t uuid_len, s_hdl = 0, e_hdl = 0;
586 uint16_t len = *p_len;
587 uint8_t* p = *p_data;
588
589 if (len >= 4) {
590 /* obtain starting handle, and ending handle */
591 STREAM_TO_UINT16(s_hdl, p);
592 STREAM_TO_UINT16(e_hdl, p);
593 len -= 4;
594
595 if (s_hdl > e_hdl || !GATT_HANDLE_IS_VALID(s_hdl) ||
596 !GATT_HANDLE_IS_VALID(e_hdl)) {
597 reason = GATT_INVALID_HANDLE;
598 }
599 /* for these PDUs, uuid filter must present */
600 else if (op_code == GATT_REQ_READ_BY_GRP_TYPE ||
601 op_code == GATT_REQ_FIND_TYPE_VALUE ||
602 op_code == GATT_REQ_READ_BY_TYPE) {
603 if (len >= 2 && p_uuid_filter != NULL) {
604 uuid_len = (op_code == GATT_REQ_FIND_TYPE_VALUE) ? 2 : len;
605
606 /* parse uuid now */
607 if (gatt_parse_uuid_from_cmd(p_uuid_filter, uuid_len, &p) == false ||
608 p_uuid_filter->len == 0) {
609 GATT_TRACE_DEBUG("UUID filter does not exsit");
610 reason = GATT_INVALID_PDU;
611 } else
612 len -= p_uuid_filter->len;
613 } else
614 reason = GATT_INVALID_PDU;
615 }
616 } else
617 reason = GATT_INVALID_PDU;
618
619 *p_data = p;
620 *p_len = len;
621 *p_s_hdl = s_hdl;
622 *p_e_hdl = e_hdl;
623
624 return reason;
625 }
626
627 /*******************************************************************************
628 *
629 * Function gatts_process_primary_service_req
630 *
631 * Description Process ReadByGroupType/ReadByTypeValue request, for
632 * discovering all primary services or discover primary service
633 * by UUID request.
634 *
635 * Returns void
636 *
637 ******************************************************************************/
gatts_process_primary_service_req(tGATT_TCB * p_tcb,uint8_t op_code,uint16_t len,uint8_t * p_data)638 void gatts_process_primary_service_req(tGATT_TCB* p_tcb, uint8_t op_code,
639 uint16_t len, uint8_t* p_data) {
640 uint8_t reason = GATT_INVALID_PDU;
641 uint16_t s_hdl = 0, e_hdl = 0;
642 tBT_UUID uuid, value,
643 primary_service = {LEN_UUID_16, {GATT_UUID_PRI_SERVICE}};
644 BT_HDR* p_msg = NULL;
645 uint16_t msg_len =
646 (uint16_t)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET);
647
648 memset(&value, 0, sizeof(tBT_UUID));
649 reason = gatts_validate_packet_format(op_code, &len, &p_data, &uuid, &s_hdl,
650 &e_hdl);
651
652 if (reason == GATT_SUCCESS) {
653 if (gatt_uuid_compare(uuid, primary_service)) {
654 if (op_code == GATT_REQ_FIND_TYPE_VALUE) {
655 if (gatt_parse_uuid_from_cmd(&value, len, &p_data) == false)
656 reason = GATT_INVALID_PDU;
657 }
658
659 if (reason == GATT_SUCCESS) {
660 p_msg = (BT_HDR*)osi_calloc(msg_len);
661 reason = gatt_build_primary_service_rsp(p_msg, p_tcb, op_code, s_hdl,
662 e_hdl, p_data, value);
663 }
664 } else {
665 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) {
666 reason = GATT_UNSUPPORT_GRP_TYPE;
667 GATT_TRACE_DEBUG("unexpected ReadByGrpType Group: 0x%04x",
668 uuid.uu.uuid16);
669 } else {
670 /* we do not support ReadByTypeValue with any non-primamry_service type
671 */
672 reason = GATT_NOT_FOUND;
673 GATT_TRACE_DEBUG("unexpected ReadByTypeValue type: 0x%04x",
674 uuid.uu.uuid16);
675 }
676 }
677 }
678
679 if (reason != GATT_SUCCESS) {
680 osi_free(p_msg);
681 gatt_send_error_rsp(p_tcb, reason, op_code, s_hdl, false);
682 } else
683 attp_send_sr_msg(p_tcb, p_msg);
684 }
685
686 /*******************************************************************************
687 *
688 * Function gatts_process_find_info
689 *
690 * Description process find information request, for discover character
691 * descriptors.
692 *
693 * Returns void
694 *
695 ******************************************************************************/
gatts_process_find_info(tGATT_TCB * p_tcb,uint8_t op_code,uint16_t len,uint8_t * p_data)696 static void gatts_process_find_info(tGATT_TCB* p_tcb, uint8_t op_code,
697 uint16_t len, uint8_t* p_data) {
698 uint8_t reason = GATT_INVALID_PDU, *p;
699 uint16_t s_hdl = 0, e_hdl = 0, buf_len;
700 BT_HDR* p_msg = NULL;
701
702 reason = gatts_validate_packet_format(op_code, &len, &p_data, NULL, &s_hdl,
703 &e_hdl);
704
705 if (reason == GATT_SUCCESS) {
706 buf_len =
707 (uint16_t)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET);
708
709 p_msg = (BT_HDR*)osi_calloc(buf_len);
710 reason = GATT_NOT_FOUND;
711
712 p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET;
713 *p++ = op_code + 1;
714 p_msg->len = 2;
715
716 buf_len = p_tcb->payload_size - 2;
717
718 for (tGATT_SRV_LIST_ELEM& el : *gatt_cb.srv_list_info) {
719 if (el.s_hdl <= e_hdl && el.e_hdl >= s_hdl) {
720 reason = gatt_build_find_info_rsp(el, p_msg, &buf_len, s_hdl, e_hdl);
721 if (reason == GATT_NO_RESOURCES) {
722 reason = GATT_SUCCESS;
723 break;
724 }
725 }
726 }
727
728 *p = (uint8_t)p_msg->offset;
729
730 p_msg->offset = L2CAP_MIN_OFFSET;
731 }
732
733 if (reason != GATT_SUCCESS) {
734 osi_free(p_msg);
735 gatt_send_error_rsp(p_tcb, reason, op_code, s_hdl, false);
736 } else
737 attp_send_sr_msg(p_tcb, p_msg);
738 }
739
740 /*******************************************************************************
741 *
742 * Function gatts_process_mtu_req
743 *
744 * Description This function is called to process excahnge MTU request.
745 * Only used on LE.
746 *
747 * Returns void
748 *
749 ******************************************************************************/
gatts_process_mtu_req(tGATT_TCB * p_tcb,uint16_t len,uint8_t * p_data)750 static void gatts_process_mtu_req(tGATT_TCB* p_tcb, uint16_t len,
751 uint8_t* p_data) {
752 uint16_t mtu = 0;
753 uint8_t *p = p_data, i;
754 BT_HDR* p_buf;
755 uint16_t conn_id;
756
757 /* BR/EDR conenction, send error response */
758 if (p_tcb->att_lcid != L2CAP_ATT_CID) {
759 gatt_send_error_rsp(p_tcb, GATT_REQ_NOT_SUPPORTED, GATT_REQ_MTU, 0, false);
760 } else if (len < GATT_MTU_REQ_MIN_LEN) {
761 GATT_TRACE_ERROR("invalid MTU request PDU received.");
762 gatt_send_error_rsp(p_tcb, GATT_INVALID_PDU, GATT_REQ_MTU, 0, false);
763 } else {
764 STREAM_TO_UINT16(mtu, p);
765 /* mtu must be greater than default MTU which is 23/48 */
766 if (mtu < GATT_DEF_BLE_MTU_SIZE)
767 p_tcb->payload_size = GATT_DEF_BLE_MTU_SIZE;
768 else if (mtu > GATT_MAX_MTU_SIZE)
769 p_tcb->payload_size = GATT_MAX_MTU_SIZE;
770 else
771 p_tcb->payload_size = mtu;
772
773 GATT_TRACE_ERROR("MTU request PDU with MTU size %d", p_tcb->payload_size);
774
775 l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID,
776 p_tcb->payload_size);
777
778 p_buf = attp_build_sr_msg(p_tcb, GATT_RSP_MTU,
779 (tGATT_SR_MSG*)&p_tcb->payload_size);
780 if (p_buf != NULL) {
781 attp_send_sr_msg(p_tcb, p_buf);
782
783 /* Notify all registered applicaiton with new MTU size. Us a transaction
784 * ID */
785 /* of 0, as no response is allowed from applcations */
786
787 for (i = 0; i < GATT_MAX_APPS; i++) {
788 if (gatt_cb.cl_rcb[i].in_use) {
789 conn_id =
790 GATT_CREATE_CONN_ID(p_tcb->tcb_idx, gatt_cb.cl_rcb[i].gatt_if);
791 gatt_sr_send_req_callback(conn_id, 0, GATTS_REQ_TYPE_MTU,
792 (tGATTS_DATA*)&p_tcb->payload_size);
793 }
794 }
795 }
796 }
797 }
798
799 /*******************************************************************************
800 *
801 * Function gatts_process_read_by_type_req
802 *
803 * Description process Read By type request.
804 * This PDU can be used to perform:
805 * - read characteristic value
806 * - read characteristic descriptor value
807 * - discover characteristic
808 * - discover characteristic by UUID
809 * - relationship discovery
810 *
811 * Returns void
812 *
813 ******************************************************************************/
gatts_process_read_by_type_req(tGATT_TCB * p_tcb,uint8_t op_code,uint16_t len,uint8_t * p_data)814 void gatts_process_read_by_type_req(tGATT_TCB* p_tcb, uint8_t op_code,
815 uint16_t len, uint8_t* p_data) {
816 tBT_UUID uuid;
817 size_t msg_len = sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET;
818 uint16_t buf_len, s_hdl, e_hdl, err_hdl = 0;
819 BT_HDR* p_msg = NULL;
820 tGATT_STATUS reason, ret;
821 uint8_t* p;
822 uint8_t sec_flag, key_size;
823
824 reason = gatts_validate_packet_format(op_code, &len, &p_data, &uuid, &s_hdl,
825 &e_hdl);
826
827 #if (GATT_CONFORMANCE_TESTING == TRUE)
828 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
829 GATT_TRACE_DEBUG(
830 "Conformance tst: forced err rsp for ReadByType: error status=%d",
831 gatt_cb.err_status);
832
833 gatt_send_error_rsp(p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, s_hdl,
834 false);
835
836 return;
837 }
838 #endif
839
840 if (reason == GATT_SUCCESS) {
841 p_msg = (BT_HDR*)osi_calloc(msg_len);
842 p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET;
843
844 *p++ = op_code + 1;
845 /* reserve length byte */
846 p_msg->len = 2;
847 buf_len = p_tcb->payload_size - 2;
848
849 reason = GATT_NOT_FOUND;
850
851 for (tGATT_SRV_LIST_ELEM& el : *gatt_cb.srv_list_info) {
852 if (el.s_hdl <= e_hdl && el.e_hdl >= s_hdl) {
853 gatt_sr_get_sec_info(p_tcb->peer_bda, p_tcb->transport, &sec_flag,
854 &key_size);
855
856 ret = gatts_db_read_attr_value_by_type(p_tcb, el.p_db, op_code, p_msg,
857 s_hdl, e_hdl, uuid, &buf_len,
858 sec_flag, key_size, 0, &err_hdl);
859 if (ret != GATT_NOT_FOUND) {
860 reason = ret;
861
862 if (ret == GATT_NO_RESOURCES) reason = GATT_SUCCESS;
863 }
864 if (ret != GATT_SUCCESS && ret != GATT_NOT_FOUND) {
865 s_hdl = err_hdl;
866 break;
867 }
868 }
869 }
870 *p = (uint8_t)p_msg->offset;
871 p_msg->offset = L2CAP_MIN_OFFSET;
872 }
873 if (reason != GATT_SUCCESS) {
874 osi_free(p_msg);
875
876 /* in theroy BUSY is not possible(should already been checked), protected
877 * check */
878 if (reason != GATT_PENDING && reason != GATT_BUSY)
879 gatt_send_error_rsp(p_tcb, reason, op_code, s_hdl, false);
880 } else
881 attp_send_sr_msg(p_tcb, p_msg);
882 }
883
884 /**
885 * This function is called to process the write request from client.
886 */
gatts_process_write_req(tGATT_TCB * p_tcb,tGATT_SRV_LIST_ELEM & el,uint16_t handle,uint8_t op_code,uint16_t len,uint8_t * p_data,bt_gatt_db_attribute_type_t gatt_type)887 void gatts_process_write_req(tGATT_TCB* p_tcb, tGATT_SRV_LIST_ELEM& el,
888 uint16_t handle, uint8_t op_code, uint16_t len,
889 uint8_t* p_data,
890 bt_gatt_db_attribute_type_t gatt_type) {
891 tGATTS_DATA sr_data;
892 uint32_t trans_id;
893 tGATT_STATUS status;
894 uint8_t sec_flag, key_size, *p = p_data;
895 uint16_t conn_id;
896
897 memset(&sr_data, 0, sizeof(tGATTS_DATA));
898
899 switch (op_code) {
900 case GATT_REQ_PREPARE_WRITE:
901 if (len < 2) {
902 GATT_TRACE_ERROR(
903 "%s: Prepare write request was invalid - missing offset, sending "
904 "error response",
905 __func__);
906 gatt_send_error_rsp(p_tcb, GATT_INVALID_PDU, op_code, handle, false);
907 return;
908 }
909 sr_data.write_req.is_prep = true;
910 STREAM_TO_UINT16(sr_data.write_req.offset, p);
911 len -= 2;
912 /* fall through */
913 case GATT_SIGN_CMD_WRITE:
914 if (op_code == GATT_SIGN_CMD_WRITE) {
915 GATT_TRACE_DEBUG("Write CMD with data sigining");
916 len -= GATT_AUTH_SIGN_LEN;
917 }
918 /* fall through */
919 case GATT_CMD_WRITE:
920 case GATT_REQ_WRITE:
921 if (op_code == GATT_REQ_WRITE || op_code == GATT_REQ_PREPARE_WRITE)
922 sr_data.write_req.need_rsp = true;
923 sr_data.write_req.handle = handle;
924 sr_data.write_req.len = len;
925 if (len != 0 && p != NULL) {
926 memcpy(sr_data.write_req.value, p, len);
927 }
928 break;
929 }
930
931 gatt_sr_get_sec_info(p_tcb->peer_bda, p_tcb->transport, &sec_flag, &key_size);
932
933 status = gatts_write_attr_perm_check(el.p_db, op_code, handle,
934 sr_data.write_req.offset, p, len,
935 sec_flag, key_size);
936
937 if (status == GATT_SUCCESS) {
938 trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, handle);
939 if (trans_id != 0) {
940 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, el.gatt_if);
941
942 uint8_t opcode = 0;
943 if (gatt_type == BTGATT_DB_DESCRIPTOR) {
944 opcode = GATTS_REQ_TYPE_WRITE_DESCRIPTOR;
945 } else if (gatt_type == BTGATT_DB_CHARACTERISTIC) {
946 opcode = GATTS_REQ_TYPE_WRITE_CHARACTERISTIC;
947 } else {
948 GATT_TRACE_ERROR(
949 "%s: Attempt to write attribute that's not tied with"
950 " characteristic or descriptor value.",
951 __func__);
952 status = GATT_ERROR;
953 }
954
955 if (opcode) {
956 gatt_sr_send_req_callback(conn_id, trans_id, opcode, &sr_data);
957 status = GATT_PENDING;
958 }
959 } else {
960 GATT_TRACE_ERROR("max pending command, send error");
961 status = GATT_BUSY; /* max pending command, application error */
962 }
963 }
964
965 /* in theroy BUSY is not possible(should already been checked), protected
966 * check */
967 if (status != GATT_PENDING && status != GATT_BUSY &&
968 (op_code == GATT_REQ_PREPARE_WRITE || op_code == GATT_REQ_WRITE)) {
969 gatt_send_error_rsp(p_tcb, status, op_code, handle, false);
970 }
971 return;
972 }
973
974 /**
975 * This function is called to process the read request from client.
976 */
gatts_process_read_req(tGATT_TCB * p_tcb,tGATT_SRV_LIST_ELEM & el,uint8_t op_code,uint16_t handle,UNUSED_ATTR uint16_t len,uint8_t * p_data)977 static void gatts_process_read_req(tGATT_TCB* p_tcb, tGATT_SRV_LIST_ELEM& el,
978 uint8_t op_code, uint16_t handle,
979 UNUSED_ATTR uint16_t len, uint8_t* p_data) {
980 size_t buf_len = sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET;
981 tGATT_STATUS reason;
982 uint8_t sec_flag, key_size, *p;
983 uint16_t offset = 0, value_len = 0;
984 BT_HDR* p_msg = (BT_HDR*)osi_calloc(buf_len);
985
986 if (op_code == GATT_REQ_READ_BLOB) STREAM_TO_UINT16(offset, p_data);
987
988 p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET;
989 *p++ = op_code + 1;
990 p_msg->len = 1;
991 buf_len = p_tcb->payload_size - 1;
992
993 gatt_sr_get_sec_info(p_tcb->peer_bda, p_tcb->transport, &sec_flag, &key_size);
994
995 reason = gatts_read_attr_value_by_handle(
996 p_tcb, el.p_db, op_code, handle, offset, p, &value_len, (uint16_t)buf_len,
997 sec_flag, key_size, 0);
998
999 p_msg->len += value_len;
1000
1001 if (reason != GATT_SUCCESS) {
1002 osi_free(p_msg);
1003
1004 /* in theroy BUSY is not possible(should already been checked), protected
1005 * check */
1006 if (reason != GATT_PENDING && reason != GATT_BUSY)
1007 gatt_send_error_rsp(p_tcb, reason, op_code, handle, false);
1008 } else
1009 attp_send_sr_msg(p_tcb, p_msg);
1010 }
1011
1012 /*******************************************************************************
1013 *
1014 * Function gatts_process_attribute_req
1015 *
1016 * Description This function is called to process the per attribute handle
1017 * request from client.
1018 *
1019 * Returns void
1020 *
1021 ******************************************************************************/
gatts_process_attribute_req(tGATT_TCB * p_tcb,uint8_t op_code,uint16_t len,uint8_t * p_data)1022 void gatts_process_attribute_req(tGATT_TCB* p_tcb, uint8_t op_code,
1023 uint16_t len, uint8_t* p_data) {
1024 uint16_t handle = 0;
1025 uint8_t* p = p_data;
1026 tGATT_STATUS status = GATT_INVALID_HANDLE;
1027
1028 if (len < 2) {
1029 GATT_TRACE_ERROR("Illegal PDU length, discard request");
1030 status = GATT_INVALID_PDU;
1031 } else {
1032 STREAM_TO_UINT16(handle, p);
1033 len -= 2;
1034 }
1035
1036 #if (GATT_CONFORMANCE_TESTING == TRUE)
1037 gatt_cb.handle = handle;
1038 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
1039 GATT_TRACE_DEBUG("Conformance tst: forced err rsp: error status=%d",
1040 gatt_cb.err_status);
1041
1042 gatt_send_error_rsp(p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, handle,
1043 false);
1044
1045 return;
1046 }
1047 #endif
1048
1049 if (GATT_HANDLE_IS_VALID(handle)) {
1050 for (auto& el : *gatt_cb.srv_list_info) {
1051 if (el.s_hdl <= handle && el.e_hdl >= handle) {
1052 for (const auto& attr : el.p_db->attr_list) {
1053 if (attr.handle == handle) {
1054 switch (op_code) {
1055 case GATT_REQ_READ: /* read char/char descriptor value */
1056 case GATT_REQ_READ_BLOB:
1057 gatts_process_read_req(p_tcb, el, op_code, handle, len, p);
1058 break;
1059
1060 case GATT_REQ_WRITE: /* write char/char descriptor value */
1061 case GATT_CMD_WRITE:
1062 case GATT_SIGN_CMD_WRITE:
1063 case GATT_REQ_PREPARE_WRITE:
1064 gatts_process_write_req(p_tcb, el, handle, op_code, len, p,
1065 attr.gatt_type);
1066 break;
1067 default:
1068 break;
1069 }
1070 status = GATT_SUCCESS;
1071 break;
1072 }
1073 }
1074 break;
1075 }
1076 }
1077 }
1078
1079 if (status != GATT_SUCCESS && op_code != GATT_CMD_WRITE &&
1080 op_code != GATT_SIGN_CMD_WRITE)
1081 gatt_send_error_rsp(p_tcb, status, op_code, handle, false);
1082 }
1083
1084 /*******************************************************************************
1085 *
1086 * Function gatts_proc_srv_chg_ind_ack
1087 *
1088 * Description This function process the service changed indicaiton ACK
1089 *
1090 * Returns void
1091 *
1092 ******************************************************************************/
gatts_proc_srv_chg_ind_ack(tGATT_TCB * p_tcb)1093 static void gatts_proc_srv_chg_ind_ack(tGATT_TCB* p_tcb) {
1094 tGATTS_SRV_CHG_REQ req;
1095 tGATTS_SRV_CHG* p_buf = NULL;
1096
1097 GATT_TRACE_DEBUG("gatts_proc_srv_chg_ind_ack");
1098
1099 p_buf = gatt_is_bda_in_the_srv_chg_clt_list(p_tcb->peer_bda);
1100 if (p_buf != NULL) {
1101 GATT_TRACE_DEBUG("NV update set srv chg = false");
1102 p_buf->srv_changed = false;
1103 memcpy(&req.srv_chg, p_buf, sizeof(tGATTS_SRV_CHG));
1104 if (gatt_cb.cb_info.p_srv_chg_callback)
1105 (*gatt_cb.cb_info.p_srv_chg_callback)(GATTS_SRV_CHG_CMD_UPDATE_CLIENT,
1106 &req, NULL);
1107 }
1108 }
1109
1110 /*******************************************************************************
1111 *
1112 * Function gatts_chk_pending_ind
1113 *
1114 * Description This function check any pending indication needs to be sent
1115 * if there is a pending indication then sent the indication
1116 *
1117 * Returns void
1118 *
1119 ******************************************************************************/
gatts_chk_pending_ind(tGATT_TCB * p_tcb)1120 static void gatts_chk_pending_ind(tGATT_TCB* p_tcb) {
1121 GATT_TRACE_DEBUG("%s", __func__);
1122
1123 tGATT_VALUE* p_buf =
1124 (tGATT_VALUE*)fixed_queue_try_peek_first(p_tcb->pending_ind_q);
1125 if (p_buf != NULL) {
1126 GATTS_HandleValueIndication(p_buf->conn_id, p_buf->handle, p_buf->len,
1127 p_buf->value);
1128 osi_free(fixed_queue_try_remove_from_queue(p_tcb->pending_ind_q, p_buf));
1129 }
1130 }
1131
1132 /*******************************************************************************
1133 *
1134 * Function gatts_proc_ind_ack
1135 *
1136 * Description This function processes the Indication ack
1137 *
1138 * Returns true continue to process the indication ack by the
1139 * application if the ACK is not a Service Changed Indication
1140 *
1141 ******************************************************************************/
gatts_proc_ind_ack(tGATT_TCB * p_tcb,uint16_t ack_handle)1142 static bool gatts_proc_ind_ack(tGATT_TCB* p_tcb, uint16_t ack_handle) {
1143 bool continue_processing = true;
1144
1145 GATT_TRACE_DEBUG("gatts_proc_ind_ack ack handle=%d", ack_handle);
1146
1147 if (ack_handle == gatt_cb.handle_of_h_r) {
1148 gatts_proc_srv_chg_ind_ack(p_tcb);
1149 /* there is no need to inform the application since srv chg is handled
1150 * internally by GATT */
1151 continue_processing = false;
1152 }
1153
1154 gatts_chk_pending_ind(p_tcb);
1155 return continue_processing;
1156 }
1157
1158 /*******************************************************************************
1159 *
1160 * Function gatts_process_value_conf
1161 *
1162 * Description This function is called to process the handle value
1163 * confirmation.
1164 *
1165 * Returns void
1166 *
1167 ******************************************************************************/
gatts_process_value_conf(tGATT_TCB * p_tcb,uint8_t op_code)1168 void gatts_process_value_conf(tGATT_TCB* p_tcb, uint8_t op_code) {
1169 uint16_t handle = p_tcb->indicate_handle;
1170 uint32_t trans_id;
1171 bool continue_processing;
1172 uint16_t conn_id;
1173
1174 alarm_cancel(p_tcb->conf_timer);
1175 if (GATT_HANDLE_IS_VALID(handle)) {
1176 p_tcb->indicate_handle = 0;
1177 continue_processing = gatts_proc_ind_ack(p_tcb, handle);
1178
1179 if (continue_processing) {
1180 for (auto& el : *gatt_cb.srv_list_info) {
1181 if (el.s_hdl <= handle && el.e_hdl >= handle) {
1182 trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, handle);
1183 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, el.gatt_if);
1184 gatt_sr_send_req_callback(conn_id, trans_id, GATTS_REQ_TYPE_CONF,
1185 (tGATTS_DATA*)&handle);
1186 }
1187 }
1188 }
1189 } else {
1190 GATT_TRACE_ERROR("unexpected handle value confirmation");
1191 }
1192 }
1193
1194 /*******************************************************************************
1195 *
1196 * Function gatt_server_handle_client_req
1197 *
1198 * Description This function is called to handle the client requests to
1199 * server.
1200 *
1201 *
1202 * Returns void
1203 *
1204 ******************************************************************************/
gatt_server_handle_client_req(tGATT_TCB * p_tcb,uint8_t op_code,uint16_t len,uint8_t * p_data)1205 void gatt_server_handle_client_req(tGATT_TCB* p_tcb, uint8_t op_code,
1206 uint16_t len, uint8_t* p_data) {
1207 /* there is pending command, discard this one */
1208 if (!gatt_sr_cmd_empty(p_tcb) && op_code != GATT_HANDLE_VALUE_CONF) return;
1209
1210 /* the size of the message may not be bigger than the local max PDU size*/
1211 /* The message has to be smaller than the agreed MTU, len does not include op
1212 * code */
1213 if (len >= p_tcb->payload_size) {
1214 GATT_TRACE_ERROR("server receive invalid PDU size:%d pdu size:%d", len + 1,
1215 p_tcb->payload_size);
1216 /* for invalid request expecting response, send it now */
1217 if (op_code != GATT_CMD_WRITE && op_code != GATT_SIGN_CMD_WRITE &&
1218 op_code != GATT_HANDLE_VALUE_CONF) {
1219 gatt_send_error_rsp(p_tcb, GATT_INVALID_PDU, op_code, 0, false);
1220 }
1221 /* otherwise, ignore the pkt */
1222 } else {
1223 switch (op_code) {
1224 case GATT_REQ_READ_BY_GRP_TYPE: /* discover primary services */
1225 case GATT_REQ_FIND_TYPE_VALUE: /* discover service by UUID */
1226 gatts_process_primary_service_req(p_tcb, op_code, len, p_data);
1227 break;
1228
1229 case GATT_REQ_FIND_INFO: /* discover char descrptor */
1230 gatts_process_find_info(p_tcb, op_code, len, p_data);
1231 break;
1232
1233 case GATT_REQ_READ_BY_TYPE: /* read characteristic value, char descriptor
1234 value */
1235 /* discover characteristic, discover char by UUID */
1236 gatts_process_read_by_type_req(p_tcb, op_code, len, p_data);
1237 break;
1238
1239 case GATT_REQ_READ: /* read char/char descriptor value */
1240 case GATT_REQ_READ_BLOB:
1241 case GATT_REQ_WRITE: /* write char/char descriptor value */
1242 case GATT_CMD_WRITE:
1243 case GATT_SIGN_CMD_WRITE:
1244 case GATT_REQ_PREPARE_WRITE:
1245 gatts_process_attribute_req(p_tcb, op_code, len, p_data);
1246 break;
1247
1248 case GATT_HANDLE_VALUE_CONF:
1249 gatts_process_value_conf(p_tcb, op_code);
1250 break;
1251
1252 case GATT_REQ_MTU:
1253 gatts_process_mtu_req(p_tcb, len, p_data);
1254 break;
1255
1256 case GATT_REQ_EXEC_WRITE:
1257 gatt_process_exec_write_req(p_tcb, op_code, len, p_data);
1258 break;
1259
1260 case GATT_REQ_READ_MULTI:
1261 gatt_process_read_multi_req(p_tcb, op_code, len, p_data);
1262 break;
1263
1264 default:
1265 break;
1266 }
1267 }
1268 }
1269