1 /******************************************************************************
2 *
3 * Copyright (C) 2008-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /******************************************************************************
20 *
21 * this file contains the GATT server functions
22 *
23 ******************************************************************************/
24
25 #include <log/log.h>
26 #include "bt_target.h"
27 #include "bt_utils.h"
28 #include "osi/include/osi.h"
29
30 #include <string.h>
31 #include "gatt_int.h"
32 #include "l2c_api.h"
33 #include "l2c_int.h"
34 #define GATT_MTU_REQ_MIN_LEN 2
35
36 using base::StringPrintf;
37 /*******************************************************************************
38 *
39 * Function gatt_sr_enqueue_cmd
40 *
41 * Description This function enqueue the request from client which needs a
42 * application response, and update the transaction ID.
43 *
44 * Returns void
45 *
46 ******************************************************************************/
gatt_sr_enqueue_cmd(tGATT_TCB & tcb,uint8_t op_code,uint16_t handle)47 uint32_t gatt_sr_enqueue_cmd(tGATT_TCB& tcb, uint8_t op_code, uint16_t handle) {
48 tGATT_SR_CMD* p_cmd = &tcb.sr_cmd;
49 uint32_t trans_id = 0;
50
51 if ((p_cmd->op_code == 0) ||
52 (op_code == GATT_HANDLE_VALUE_CONF)) /* no pending request */
53 {
54 if (op_code == GATT_CMD_WRITE || op_code == GATT_SIGN_CMD_WRITE ||
55 op_code == GATT_REQ_MTU || op_code == GATT_HANDLE_VALUE_CONF) {
56 trans_id = ++tcb.trans_id;
57 } else {
58 p_cmd->trans_id = ++tcb.trans_id;
59 p_cmd->op_code = op_code;
60 p_cmd->handle = handle;
61 p_cmd->status = GATT_NOT_FOUND;
62 tcb.trans_id %= GATT_TRANS_ID_MAX;
63 trans_id = p_cmd->trans_id;
64 }
65 }
66
67 return trans_id;
68 }
69
70 /*******************************************************************************
71 *
72 * Function gatt_sr_cmd_empty
73 *
74 * Description This function checks if the server command queue is empty.
75 *
76 * Returns true if empty, false if there is pending command.
77 *
78 ******************************************************************************/
gatt_sr_cmd_empty(tGATT_TCB & tcb)79 bool gatt_sr_cmd_empty(tGATT_TCB& tcb) { return (tcb.sr_cmd.op_code == 0); }
80
81 /*******************************************************************************
82 *
83 * Function gatt_dequeue_sr_cmd
84 *
85 * Description This function dequeue the request from command queue.
86 *
87 * Returns void
88 *
89 ******************************************************************************/
gatt_dequeue_sr_cmd(tGATT_TCB & tcb)90 void gatt_dequeue_sr_cmd(tGATT_TCB& tcb) {
91 /* Double check in case any buffers are queued */
92 VLOG(1) << "gatt_dequeue_sr_cmd";
93 if (tcb.sr_cmd.p_rsp_msg)
94 LOG(ERROR) << "free tcb.sr_cmd.p_rsp_msg = " << tcb.sr_cmd.p_rsp_msg;
95 osi_free_and_reset((void**)&tcb.sr_cmd.p_rsp_msg);
96
97 while (!fixed_queue_is_empty(tcb.sr_cmd.multi_rsp_q))
98 osi_free(fixed_queue_try_dequeue(tcb.sr_cmd.multi_rsp_q));
99 fixed_queue_free(tcb.sr_cmd.multi_rsp_q, NULL);
100 memset(&tcb.sr_cmd, 0, sizeof(tGATT_SR_CMD));
101 }
102
103 /*******************************************************************************
104 *
105 * Function process_read_multi_rsp
106 *
107 * Description This function check the read multiple response.
108 *
109 * Returns bool if all replies have been received
110 *
111 ******************************************************************************/
process_read_multi_rsp(tGATT_SR_CMD * p_cmd,tGATT_STATUS status,tGATTS_RSP * p_msg,uint16_t mtu)112 static bool process_read_multi_rsp(tGATT_SR_CMD* p_cmd, tGATT_STATUS status,
113 tGATTS_RSP* p_msg, uint16_t mtu) {
114 uint16_t ii, total_len, len;
115 uint8_t* p;
116 bool is_overflow = false;
117
118 VLOG(1) << StringPrintf("%s status=%d mtu=%d", __func__, status, mtu);
119
120 if (p_cmd->multi_rsp_q == NULL)
121 p_cmd->multi_rsp_q = fixed_queue_new(SIZE_MAX);
122
123 /* Enqueue the response */
124 BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(tGATTS_RSP));
125 memcpy((void*)p_buf, (const void*)p_msg, sizeof(tGATTS_RSP));
126 fixed_queue_enqueue(p_cmd->multi_rsp_q, p_buf);
127
128 p_cmd->status = status;
129 if (status == GATT_SUCCESS) {
130 VLOG(1) << "Multi read count=" << fixed_queue_length(p_cmd->multi_rsp_q)
131 << " num_hdls=" << p_cmd->multi_req.num_handles;
132 /* Wait till we get all the responses */
133 if (fixed_queue_length(p_cmd->multi_rsp_q) ==
134 p_cmd->multi_req.num_handles) {
135 len = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + mtu;
136 p_buf = (BT_HDR*)osi_calloc(len);
137 p_buf->offset = L2CAP_MIN_OFFSET;
138 p = (uint8_t*)(p_buf + 1) + p_buf->offset;
139
140 /* First byte in the response is the opcode */
141 *p++ = GATT_RSP_READ_MULTI;
142 p_buf->len = 1;
143
144 /* Now walk through the buffers puting the data into the response in order
145 */
146 list_t* list = NULL;
147 const list_node_t* node = NULL;
148 if (!fixed_queue_is_empty(p_cmd->multi_rsp_q))
149 list = fixed_queue_get_list(p_cmd->multi_rsp_q);
150 for (ii = 0; ii < p_cmd->multi_req.num_handles; ii++) {
151 tGATTS_RSP* p_rsp = NULL;
152
153 if (list != NULL) {
154 if (ii == 0)
155 node = list_begin(list);
156 else
157 node = list_next(node);
158 if (node != list_end(list)) p_rsp = (tGATTS_RSP*)list_node(node);
159 }
160
161 if (p_rsp != NULL) {
162 total_len = (p_buf->len + p_rsp->attr_value.len);
163
164 if (total_len > mtu) {
165 /* just send the partial response for the overflow case */
166 len = p_rsp->attr_value.len - (total_len - mtu);
167 is_overflow = true;
168 VLOG(1) << StringPrintf(
169 "multi read overflow available len=%d val_len=%d", len,
170 p_rsp->attr_value.len);
171 } else {
172 len = p_rsp->attr_value.len;
173 }
174
175 if (p_rsp->attr_value.handle == p_cmd->multi_req.handles[ii]) {
176 memcpy(p, p_rsp->attr_value.value, len);
177 if (!is_overflow) p += len;
178 p_buf->len += len;
179 } else {
180 p_cmd->status = GATT_NOT_FOUND;
181 break;
182 }
183
184 if (is_overflow) break;
185
186 } else {
187 p_cmd->status = GATT_NOT_FOUND;
188 break;
189 }
190
191 } /* loop through all handles*/
192
193 /* Sanity check on the buffer length */
194 if (p_buf->len == 0) {
195 LOG(ERROR) << __func__ << " nothing found!!";
196 p_cmd->status = GATT_NOT_FOUND;
197 osi_free(p_buf);
198 VLOG(1) << __func__ << "osi_free(p_buf)";
199 } else if (p_cmd->p_rsp_msg != NULL) {
200 osi_free(p_buf);
201 } else {
202 p_cmd->p_rsp_msg = p_buf;
203 }
204
205 return (true);
206 }
207 } else /* any handle read exception occurs, return error */
208 {
209 return (true);
210 }
211
212 /* If here, still waiting */
213 return (false);
214 }
215
216 /*******************************************************************************
217 *
218 * Function gatt_sr_process_app_rsp
219 *
220 * Description This function checks whether the response message from
221 * application matches any pending request.
222 *
223 * Returns void
224 *
225 ******************************************************************************/
gatt_sr_process_app_rsp(tGATT_TCB & tcb,tGATT_IF gatt_if,UNUSED_ATTR uint32_t trans_id,uint8_t op_code,tGATT_STATUS status,tGATTS_RSP * p_msg)226 tGATT_STATUS gatt_sr_process_app_rsp(tGATT_TCB& tcb, tGATT_IF gatt_if,
227 UNUSED_ATTR uint32_t trans_id,
228 uint8_t op_code, tGATT_STATUS status,
229 tGATTS_RSP* p_msg) {
230 tGATT_STATUS ret_code = GATT_SUCCESS;
231
232 VLOG(1) << __func__ << " gatt_if=" << +gatt_if;
233
234 gatt_sr_update_cback_cnt(tcb, gatt_if, false, false);
235
236 if (op_code == GATT_REQ_READ_MULTI) {
237 /* If no error and still waiting, just return */
238 if (!process_read_multi_rsp(&tcb.sr_cmd, status, p_msg, tcb.payload_size))
239 return (GATT_SUCCESS);
240 } else {
241 if (op_code == GATT_REQ_PREPARE_WRITE && status == GATT_SUCCESS)
242 gatt_sr_update_prep_cnt(tcb, gatt_if, true, false);
243
244 if (op_code == GATT_REQ_EXEC_WRITE && status != GATT_SUCCESS)
245 gatt_sr_reset_cback_cnt(tcb);
246
247 tcb.sr_cmd.status = status;
248
249 if (gatt_sr_is_cback_cnt_zero(tcb) && status == GATT_SUCCESS) {
250 if (tcb.sr_cmd.p_rsp_msg == NULL) {
251 tcb.sr_cmd.p_rsp_msg = attp_build_sr_msg(tcb, (uint8_t)(op_code + 1),
252 (tGATT_SR_MSG*)p_msg);
253 } else {
254 LOG(ERROR) << "Exception!!! already has respond message";
255 }
256 }
257 }
258 if (gatt_sr_is_cback_cnt_zero(tcb)) {
259 if ((tcb.sr_cmd.status == GATT_SUCCESS) && (tcb.sr_cmd.p_rsp_msg)) {
260 ret_code = attp_send_sr_msg(tcb, tcb.sr_cmd.p_rsp_msg);
261 tcb.sr_cmd.p_rsp_msg = NULL;
262 } else {
263 ret_code =
264 gatt_send_error_rsp(tcb, status, op_code, tcb.sr_cmd.handle, false);
265 }
266
267 gatt_dequeue_sr_cmd(tcb);
268 }
269
270 VLOG(1) << __func__ << " ret_code=" << +ret_code;
271
272 return ret_code;
273 }
274
275 /*******************************************************************************
276 *
277 * Function gatt_process_exec_write_req
278 *
279 * Description This function is called to process the execute write request
280 * from client.
281 *
282 * Returns void
283 *
284 ******************************************************************************/
gatt_process_exec_write_req(tGATT_TCB & tcb,uint8_t op_code,uint16_t len,uint8_t * p_data)285 void gatt_process_exec_write_req(tGATT_TCB& tcb, uint8_t op_code, uint16_t len,
286 uint8_t* p_data) {
287 uint8_t *p = p_data, flag, i = 0;
288 uint32_t trans_id = 0;
289 tGATT_IF gatt_if;
290 uint16_t conn_id;
291
292 #if (GATT_CONFORMANCE_TESTING == TRUE)
293 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
294 VLOG(1)
295 << "Conformance tst: forced err rspv for Execute Write: error status="
296 << +gatt_cb.err_status;
297
298 gatt_send_error_rsp(tcb, gatt_cb.err_status, gatt_cb.req_op_code,
299 gatt_cb.handle, false);
300
301 return;
302 }
303 #endif
304
305 if (len < sizeof(flag)) {
306 android_errorWriteLog(0x534e4554, "73172115");
307 LOG(ERROR) << __func__ << "invalid length";
308 gatt_send_error_rsp(tcb, GATT_INVALID_PDU, GATT_REQ_EXEC_WRITE, 0, false);
309 return;
310 }
311
312 STREAM_TO_UINT8(flag, p);
313
314 /* mask the flag */
315 flag &= GATT_PREP_WRITE_EXEC;
316
317 /* no prep write is queued */
318 if (!gatt_sr_is_prep_cnt_zero(tcb)) {
319 trans_id = gatt_sr_enqueue_cmd(tcb, op_code, 0);
320 gatt_sr_copy_prep_cnt_to_cback_cnt(tcb);
321
322 for (i = 0; i < GATT_MAX_APPS; i++) {
323 if (tcb.prep_cnt[i]) {
324 gatt_if = (tGATT_IF)(i + 1);
325 conn_id = GATT_CREATE_CONN_ID(tcb.tcb_idx, gatt_if);
326 tGATTS_DATA gatts_data;
327 gatts_data.exec_write = flag;
328 gatt_sr_send_req_callback(conn_id, trans_id, GATTS_REQ_TYPE_WRITE_EXEC,
329 &gatts_data);
330 tcb.prep_cnt[i] = 0;
331 }
332 }
333 } else /* nothing needs to be executed , send response now */
334 {
335 LOG(ERROR) << "gatt_process_exec_write_req: no prepare write pending";
336 gatt_send_error_rsp(tcb, GATT_ERROR, GATT_REQ_EXEC_WRITE, 0, false);
337 }
338 }
339
340 /*******************************************************************************
341 *
342 * Function gatt_process_read_multi_req
343 *
344 * Description This function is called to process the read multiple request
345 * from client.
346 *
347 * Returns void
348 *
349 ******************************************************************************/
gatt_process_read_multi_req(tGATT_TCB & tcb,uint8_t op_code,uint16_t len,uint8_t * p_data)350 void gatt_process_read_multi_req(tGATT_TCB& tcb, uint8_t op_code, uint16_t len,
351 uint8_t* p_data) {
352 uint32_t trans_id;
353 uint16_t handle = 0, ll = len;
354 uint8_t* p = p_data;
355 tGATT_STATUS err = GATT_SUCCESS;
356 uint8_t sec_flag, key_size;
357
358 VLOG(1) << __func__;
359 tcb.sr_cmd.multi_req.num_handles = 0;
360
361 gatt_sr_get_sec_info(tcb.peer_bda, tcb.transport, &sec_flag, &key_size);
362
363 #if (GATT_CONFORMANCE_TESTING == TRUE)
364 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
365 VLOG(1) << "Conformance tst: forced err rspvofr ReadMultiple: error status="
366 << +gatt_cb.err_status;
367
368 STREAM_TO_UINT16(handle, p);
369
370 gatt_send_error_rsp(tcb, gatt_cb.err_status, gatt_cb.req_op_code, handle,
371 false);
372
373 return;
374 }
375 #endif
376
377 while (ll >= 2 &&
378 tcb.sr_cmd.multi_req.num_handles < GATT_MAX_READ_MULTI_HANDLES) {
379 STREAM_TO_UINT16(handle, p);
380
381 auto it = gatt_sr_find_i_rcb_by_handle(handle);
382 if (it != gatt_cb.srv_list_info->end()) {
383 tcb.sr_cmd.multi_req.handles[tcb.sr_cmd.multi_req.num_handles++] = handle;
384
385 /* check read permission */
386 err = gatts_read_attr_perm_check(it->p_db, false, handle, sec_flag,
387 key_size);
388 if (err != GATT_SUCCESS) {
389 VLOG(1) << StringPrintf("read permission denied : 0x%02x", err);
390 break;
391 }
392 } else {
393 /* invalid handle */
394 err = GATT_INVALID_HANDLE;
395 break;
396 }
397 ll -= 2;
398 }
399
400 if (ll != 0) {
401 LOG(ERROR) << "max attribute handle reached in ReadMultiple Request.";
402 }
403
404 if (tcb.sr_cmd.multi_req.num_handles == 0) err = GATT_INVALID_HANDLE;
405
406 if (err == GATT_SUCCESS) {
407 trans_id =
408 gatt_sr_enqueue_cmd(tcb, op_code, tcb.sr_cmd.multi_req.handles[0]);
409 if (trans_id != 0) {
410 gatt_sr_reset_cback_cnt(tcb); /* read multiple use multi_rsp_q's count*/
411
412 for (ll = 0; ll < tcb.sr_cmd.multi_req.num_handles; ll++) {
413 tGATTS_RSP* p_msg = (tGATTS_RSP*)osi_calloc(sizeof(tGATTS_RSP));
414 handle = tcb.sr_cmd.multi_req.handles[ll];
415 auto it = gatt_sr_find_i_rcb_by_handle(handle);
416
417 p_msg->attr_value.handle = handle;
418 err = gatts_read_attr_value_by_handle(
419 tcb, it->p_db, op_code, handle, 0, p_msg->attr_value.value,
420 &p_msg->attr_value.len, GATT_MAX_ATTR_LEN, sec_flag, key_size,
421 trans_id);
422
423 if (err == GATT_SUCCESS) {
424 gatt_sr_process_app_rsp(tcb, it->gatt_if, trans_id, op_code,
425 GATT_SUCCESS, p_msg);
426 }
427 /* either not using or done using the buffer, release it now */
428 osi_free(p_msg);
429 }
430 } else
431 err = GATT_NO_RESOURCES;
432 }
433
434 /* in theroy BUSY is not possible(should already been checked), protected
435 * check */
436 if (err != GATT_SUCCESS && err != GATT_PENDING && err != GATT_BUSY)
437 gatt_send_error_rsp(tcb, err, op_code, handle, false);
438 }
439
440 /*******************************************************************************
441 *
442 * Function gatt_build_primary_service_rsp
443 *
444 * Description Primamry service request processed internally. Theretically
445 * only deal with ReadByTypeVAlue and ReadByGroupType.
446 *
447 * Returns void
448 *
449 ******************************************************************************/
gatt_build_primary_service_rsp(BT_HDR * p_msg,tGATT_TCB & tcb,uint8_t op_code,uint16_t s_hdl,uint16_t e_hdl,UNUSED_ATTR uint8_t * p_data,tBT_UUID value)450 static tGATT_STATUS gatt_build_primary_service_rsp(
451 BT_HDR* p_msg, tGATT_TCB& tcb, uint8_t op_code, uint16_t s_hdl,
452 uint16_t e_hdl, UNUSED_ATTR uint8_t* p_data, tBT_UUID value) {
453 tGATT_STATUS status = GATT_NOT_FOUND;
454 uint8_t handle_len = 4, *p;
455 tBT_UUID* p_uuid;
456
457 p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET;
458
459 for (tGATT_SRV_LIST_ELEM& el : *gatt_cb.srv_list_info) {
460 if (el.s_hdl >= s_hdl && el.s_hdl <= e_hdl &&
461 el.type == GATT_UUID_PRI_SERVICE) {
462 p_uuid = gatts_get_service_uuid(el.p_db);
463 if (p_uuid != NULL) {
464 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) handle_len = 4 + p_uuid->len;
465
466 /* get the length byte in the repsonse */
467 if (p_msg->offset == 0) {
468 *p++ = op_code + 1;
469 p_msg->len++;
470 p_msg->offset = handle_len;
471
472 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) {
473 *p++ = (uint8_t)p_msg->offset; /* length byte */
474 p_msg->len++;
475 }
476 }
477
478 if (p_msg->len + p_msg->offset <= tcb.payload_size &&
479 handle_len == p_msg->offset) {
480 if (op_code != GATT_REQ_FIND_TYPE_VALUE ||
481 gatt_uuid_compare(value, *p_uuid)) {
482 UINT16_TO_STREAM(p, el.s_hdl);
483
484 if (gatt_cb.last_primary_s_handle &&
485 gatt_cb.last_primary_s_handle == el.s_hdl) {
486 VLOG(1) << "Use 0xFFFF for the last primary attribute";
487 /* see GATT ERRATA 4065, 4063, ATT ERRATA 4062 */
488 UINT16_TO_STREAM(p, 0xFFFF);
489 } else {
490 UINT16_TO_STREAM(p, el.e_hdl);
491 }
492
493 if (op_code == GATT_REQ_READ_BY_GRP_TYPE)
494 gatt_build_uuid_to_stream(&p, *p_uuid);
495
496 status = GATT_SUCCESS;
497 p_msg->len += p_msg->offset;
498 }
499 } else
500 break;
501 }
502 }
503 }
504 p_msg->offset = L2CAP_MIN_OFFSET;
505
506 return status;
507 }
508
509 /**
510 * fill the find information response information in the given buffer.
511 *
512 * Returns true: if data filled sucessfully.
513 * false: packet full, or format mismatch.
514 */
gatt_build_find_info_rsp(tGATT_SRV_LIST_ELEM & el,BT_HDR * p_msg,uint16_t & len,uint16_t s_hdl,uint16_t e_hdl)515 static tGATT_STATUS gatt_build_find_info_rsp(tGATT_SRV_LIST_ELEM& el,
516 BT_HDR* p_msg, uint16_t& len,
517 uint16_t s_hdl, uint16_t e_hdl) {
518 uint8_t info_pair_len[2] = {4, 18};
519
520 if (!el.p_db) return GATT_NOT_FOUND;
521
522 /* check the attribute database */
523
524 uint8_t* p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET + p_msg->len;
525
526 for (auto& attr : el.p_db->attr_list) {
527 if (attr.handle > e_hdl) break;
528
529 if (attr.handle < s_hdl) continue;
530
531 if (p_msg->offset == 0)
532 p_msg->offset = (attr.uuid.len == LEN_UUID_16) ? GATT_INFO_TYPE_PAIR_16
533 : GATT_INFO_TYPE_PAIR_128;
534
535 if (len < info_pair_len[p_msg->offset - 1]) return GATT_NO_RESOURCES;
536
537 if (p_msg->offset == GATT_INFO_TYPE_PAIR_16 &&
538 attr.uuid.len == LEN_UUID_16) {
539 UINT16_TO_STREAM(p, attr.handle);
540 UINT16_TO_STREAM(p, attr.uuid.uu.uuid16);
541 } else if (p_msg->offset == GATT_INFO_TYPE_PAIR_128 &&
542 attr.uuid.len == LEN_UUID_128) {
543 UINT16_TO_STREAM(p, attr.handle);
544 ARRAY_TO_STREAM(p, attr.uuid.uu.uuid128, LEN_UUID_128);
545 } else if (p_msg->offset == GATT_INFO_TYPE_PAIR_128 &&
546 attr.uuid.len == LEN_UUID_32) {
547 UINT16_TO_STREAM(p, attr.handle);
548 gatt_convert_uuid32_to_uuid128(p, attr.uuid.uu.uuid32);
549 p += LEN_UUID_128;
550 } else {
551 LOG(ERROR) << "format mismatch";
552 return GATT_NO_RESOURCES;
553 /* format mismatch */
554 }
555 p_msg->len += info_pair_len[p_msg->offset - 1];
556 len -= info_pair_len[p_msg->offset - 1];
557 return GATT_SUCCESS;
558 }
559
560 return GATT_NOT_FOUND;
561 }
562
read_handles(uint16_t & len,uint8_t * & p,uint16_t & s_hdl,uint16_t & e_hdl)563 static tGATT_STATUS read_handles(uint16_t& len, uint8_t*& p, uint16_t& s_hdl,
564 uint16_t& e_hdl) {
565 if (len < 4) return GATT_INVALID_PDU;
566
567 /* obtain starting handle, and ending handle */
568 STREAM_TO_UINT16(s_hdl, p);
569 STREAM_TO_UINT16(e_hdl, p);
570 len -= 4;
571
572 if (s_hdl > e_hdl || !GATT_HANDLE_IS_VALID(s_hdl) ||
573 !GATT_HANDLE_IS_VALID(e_hdl)) {
574 return GATT_INVALID_PDU;
575 }
576
577 return GATT_SUCCESS;
578 }
579
gatts_validate_packet_format(uint8_t op_code,uint16_t & len,uint8_t * & p,tBT_UUID * p_uuid,uint16_t & s_hdl,uint16_t & e_hdl)580 static tGATT_STATUS gatts_validate_packet_format(uint8_t op_code, uint16_t& len,
581 uint8_t*& p, tBT_UUID* p_uuid,
582 uint16_t& s_hdl,
583 uint16_t& e_hdl) {
584 tGATT_STATUS ret = read_handles(len, p, s_hdl, e_hdl);
585 if (ret != GATT_SUCCESS) return ret;
586
587 if (len < 2) return GATT_INVALID_PDU;
588
589 /* parse uuid now */
590 CHECK(p_uuid);
591 uint16_t uuid_len = (op_code == GATT_REQ_FIND_TYPE_VALUE) ? 2 : len;
592 if (!gatt_parse_uuid_from_cmd(p_uuid, uuid_len, &p)) {
593 VLOG(1) << "Bad UUID";
594 return GATT_INVALID_PDU;
595 }
596
597 len -= uuid_len;
598 return GATT_SUCCESS;
599 }
600
601 /*******************************************************************************
602 *
603 * Function gatts_process_primary_service_req
604 *
605 * Description Process ReadByGroupType/ReadByTypeValue request, for
606 * discovering all primary services or discover primary service
607 * by UUID request.
608 *
609 * Returns void
610 *
611 ******************************************************************************/
gatts_process_primary_service_req(tGATT_TCB & tcb,uint8_t op_code,uint16_t len,uint8_t * p_data)612 void gatts_process_primary_service_req(tGATT_TCB& tcb, uint8_t op_code,
613 uint16_t len, uint8_t* p_data) {
614 uint16_t s_hdl = 0, e_hdl = 0;
615 tBT_UUID uuid;
616
617 uint8_t reason =
618 gatts_validate_packet_format(op_code, len, p_data, &uuid, s_hdl, e_hdl);
619 if (reason != GATT_SUCCESS) {
620 gatt_send_error_rsp(tcb, reason, op_code, s_hdl, false);
621 return;
622 }
623
624 tBT_UUID primary_service = {LEN_UUID_16, {GATT_UUID_PRI_SERVICE}};
625 if (!gatt_uuid_compare(uuid, primary_service)) {
626 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) {
627 gatt_send_error_rsp(tcb, GATT_UNSUPPORT_GRP_TYPE, op_code, s_hdl, false);
628 VLOG(1) << StringPrintf("unexpected ReadByGrpType Group: 0x%04x",
629 uuid.uu.uuid16);
630 return;
631 }
632
633 // we do not support ReadByTypeValue with any non-primamry_service type
634 gatt_send_error_rsp(tcb, GATT_NOT_FOUND, op_code, s_hdl, false);
635 VLOG(1) << StringPrintf("unexpected ReadByTypeValue type: 0x%04x",
636 uuid.uu.uuid16);
637 return;
638 }
639
640 // TODO: we assume theh value is UUID, there is no such requirement in spec
641 tBT_UUID value;
642 memset(&value, 0, sizeof(tBT_UUID));
643 if (op_code == GATT_REQ_FIND_TYPE_VALUE) {
644 if (gatt_parse_uuid_from_cmd(&value, len, &p_data) == false) {
645 gatt_send_error_rsp(tcb, GATT_INVALID_PDU, op_code, s_hdl, false);
646 }
647 }
648
649 uint16_t msg_len =
650 (uint16_t)(sizeof(BT_HDR) + tcb.payload_size + L2CAP_MIN_OFFSET);
651 BT_HDR* p_msg = (BT_HDR*)osi_calloc(msg_len);
652 reason = gatt_build_primary_service_rsp(p_msg, tcb, op_code, s_hdl, e_hdl,
653 p_data, value);
654 if (reason != GATT_SUCCESS) {
655 osi_free(p_msg);
656 gatt_send_error_rsp(tcb, reason, op_code, s_hdl, false);
657 return;
658 }
659
660 attp_send_sr_msg(tcb, p_msg);
661 }
662
663 /*******************************************************************************
664 *
665 * Function gatts_process_find_info
666 *
667 * Description process find information request, for discover character
668 * descriptors.
669 *
670 * Returns void
671 *
672 ******************************************************************************/
gatts_process_find_info(tGATT_TCB & tcb,uint8_t op_code,uint16_t len,uint8_t * p_data)673 static void gatts_process_find_info(tGATT_TCB& tcb, uint8_t op_code,
674 uint16_t len, uint8_t* p_data) {
675 uint16_t s_hdl = 0, e_hdl = 0;
676 uint8_t reason = read_handles(len, p_data, s_hdl, e_hdl);
677 if (reason != GATT_SUCCESS) {
678 gatt_send_error_rsp(tcb, reason, op_code, s_hdl, false);
679 return;
680 }
681
682 uint16_t buf_len =
683 (uint16_t)(sizeof(BT_HDR) + tcb.payload_size + L2CAP_MIN_OFFSET);
684
685 BT_HDR* p_msg = (BT_HDR*)osi_calloc(buf_len);
686 reason = GATT_NOT_FOUND;
687
688 uint8_t* p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET;
689 *p++ = op_code + 1;
690 p_msg->len = 2;
691
692 buf_len = tcb.payload_size - 2;
693
694 for (tGATT_SRV_LIST_ELEM& el : *gatt_cb.srv_list_info) {
695 if (el.s_hdl <= e_hdl && el.e_hdl >= s_hdl) {
696 reason = gatt_build_find_info_rsp(el, p_msg, buf_len, s_hdl, e_hdl);
697 if (reason == GATT_NO_RESOURCES) {
698 reason = GATT_SUCCESS;
699 break;
700 }
701 }
702 }
703
704 *p = (uint8_t)p_msg->offset;
705
706 p_msg->offset = L2CAP_MIN_OFFSET;
707
708 if (reason != GATT_SUCCESS) {
709 osi_free(p_msg);
710 gatt_send_error_rsp(tcb, reason, op_code, s_hdl, false);
711 } else
712 attp_send_sr_msg(tcb, p_msg);
713 }
714
715 /*******************************************************************************
716 *
717 * Function gatts_process_mtu_req
718 *
719 * Description This function is called to process excahnge MTU request.
720 * Only used on LE.
721 *
722 * Returns void
723 *
724 ******************************************************************************/
gatts_process_mtu_req(tGATT_TCB & tcb,uint16_t len,uint8_t * p_data)725 static void gatts_process_mtu_req(tGATT_TCB& tcb, uint16_t len,
726 uint8_t* p_data) {
727 /* BR/EDR conenction, send error response */
728 if (tcb.att_lcid != L2CAP_ATT_CID) {
729 gatt_send_error_rsp(tcb, GATT_REQ_NOT_SUPPORTED, GATT_REQ_MTU, 0, false);
730 return;
731 }
732
733 if (len < GATT_MTU_REQ_MIN_LEN) {
734 LOG(ERROR) << "invalid MTU request PDU received.";
735 gatt_send_error_rsp(tcb, GATT_INVALID_PDU, GATT_REQ_MTU, 0, false);
736 return;
737 }
738
739 uint16_t mtu = 0;
740 uint8_t* p = p_data;
741 STREAM_TO_UINT16(mtu, p);
742 /* mtu must be greater than default MTU which is 23/48 */
743 if (mtu < GATT_DEF_BLE_MTU_SIZE)
744 tcb.payload_size = GATT_DEF_BLE_MTU_SIZE;
745 else if (mtu > GATT_MAX_MTU_SIZE)
746 tcb.payload_size = GATT_MAX_MTU_SIZE;
747 else
748 tcb.payload_size = mtu;
749
750 LOG(ERROR) << "MTU request PDU with MTU size " << +tcb.payload_size;
751
752 l2cble_set_fixed_channel_tx_data_length(tcb.peer_bda, L2CAP_ATT_CID,
753 tcb.payload_size);
754
755 tGATT_SR_MSG gatt_sr_msg;
756 gatt_sr_msg.mtu = tcb.payload_size;
757 BT_HDR* p_buf = attp_build_sr_msg(tcb, GATT_RSP_MTU, &gatt_sr_msg);
758 attp_send_sr_msg(tcb, p_buf);
759
760 tGATTS_DATA gatts_data;
761 gatts_data.mtu = tcb.payload_size;
762 /* Notify all registered applicaiton with new MTU size. Us a transaction ID */
763 /* of 0, as no response is allowed from applcations */
764 for (int i = 0; i < GATT_MAX_APPS; i++) {
765 if (gatt_cb.cl_rcb[i].in_use) {
766 uint16_t conn_id =
767 GATT_CREATE_CONN_ID(tcb.tcb_idx, gatt_cb.cl_rcb[i].gatt_if);
768 gatt_sr_send_req_callback(conn_id, 0, GATTS_REQ_TYPE_MTU, &gatts_data);
769 }
770 }
771 }
772
773 /*******************************************************************************
774 *
775 * Function gatts_process_read_by_type_req
776 *
777 * Description process Read By type request.
778 * This PDU can be used to perform:
779 * - read characteristic value
780 * - read characteristic descriptor value
781 * - discover characteristic
782 * - discover characteristic by UUID
783 * - relationship discovery
784 *
785 * Returns void
786 *
787 ******************************************************************************/
gatts_process_read_by_type_req(tGATT_TCB & tcb,uint8_t op_code,uint16_t len,uint8_t * p_data)788 void gatts_process_read_by_type_req(tGATT_TCB& tcb, uint8_t op_code,
789 uint16_t len, uint8_t* p_data) {
790 tBT_UUID uuid;
791 uint16_t s_hdl = 0, e_hdl = 0, err_hdl = 0;
792 if (len < 4) android_errorWriteLog(0x534e4554, "73125709");
793 tGATT_STATUS reason =
794 gatts_validate_packet_format(op_code, len, p_data, &uuid, s_hdl, e_hdl);
795
796 #if (GATT_CONFORMANCE_TESTING == TRUE)
797 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
798 VLOG(1) << "Conformance tst: forced err rsp for ReadByType: error status="
799 << +gatt_cb.err_status;
800
801 gatt_send_error_rsp(tcb, gatt_cb.err_status, gatt_cb.req_op_code, s_hdl,
802 false);
803
804 return;
805 }
806 #endif
807
808 if (reason != GATT_SUCCESS) {
809 gatt_send_error_rsp(tcb, reason, op_code, s_hdl, false);
810 return;
811 }
812
813 size_t msg_len = sizeof(BT_HDR) + tcb.payload_size + L2CAP_MIN_OFFSET;
814 BT_HDR* p_msg = (BT_HDR*)osi_calloc(msg_len);
815 uint8_t* p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET;
816
817 *p++ = op_code + 1;
818 /* reserve length byte */
819 p_msg->len = 2;
820 uint16_t buf_len = tcb.payload_size - 2;
821
822 reason = GATT_NOT_FOUND;
823 for (tGATT_SRV_LIST_ELEM& el : *gatt_cb.srv_list_info) {
824 if (el.s_hdl <= e_hdl && el.e_hdl >= s_hdl) {
825 uint8_t sec_flag, key_size;
826 gatt_sr_get_sec_info(tcb.peer_bda, tcb.transport, &sec_flag, &key_size);
827
828 tGATT_STATUS ret = gatts_db_read_attr_value_by_type(
829 tcb, el.p_db, op_code, p_msg, s_hdl, e_hdl, uuid, &buf_len, sec_flag,
830 key_size, 0, &err_hdl);
831 if (ret != GATT_NOT_FOUND) {
832 reason = ret;
833 if (ret == GATT_NO_RESOURCES) reason = GATT_SUCCESS;
834 }
835
836 if (ret != GATT_SUCCESS && ret != GATT_NOT_FOUND) {
837 s_hdl = err_hdl;
838 break;
839 }
840 }
841 }
842 *p = (uint8_t)p_msg->offset;
843 p_msg->offset = L2CAP_MIN_OFFSET;
844
845 if (reason != GATT_SUCCESS) {
846 osi_free(p_msg);
847
848 /* in theroy BUSY is not possible(should already been checked), protected
849 * check */
850 if (reason != GATT_PENDING && reason != GATT_BUSY)
851 gatt_send_error_rsp(tcb, reason, op_code, s_hdl, false);
852
853 return;
854 }
855
856 attp_send_sr_msg(tcb, p_msg);
857 }
858
859 /**
860 * This function is called to process the write request from client.
861 */
gatts_process_write_req(tGATT_TCB & tcb,tGATT_SRV_LIST_ELEM & el,uint16_t handle,uint8_t op_code,uint16_t len,uint8_t * p_data,bt_gatt_db_attribute_type_t gatt_type)862 void gatts_process_write_req(tGATT_TCB& tcb, tGATT_SRV_LIST_ELEM& el,
863 uint16_t handle, uint8_t op_code, uint16_t len,
864 uint8_t* p_data,
865 bt_gatt_db_attribute_type_t gatt_type) {
866 tGATTS_DATA sr_data;
867 uint32_t trans_id;
868 tGATT_STATUS status;
869 uint8_t sec_flag, key_size, *p = p_data;
870 uint16_t conn_id;
871
872 memset(&sr_data, 0, sizeof(tGATTS_DATA));
873
874 switch (op_code) {
875 case GATT_REQ_PREPARE_WRITE:
876 if (len < 2) {
877 LOG(ERROR) << __func__
878 << ": Prepare write request was invalid - missing offset, "
879 "sending error response";
880 gatt_send_error_rsp(tcb, GATT_INVALID_PDU, op_code, handle, false);
881 return;
882 }
883 sr_data.write_req.is_prep = true;
884 STREAM_TO_UINT16(sr_data.write_req.offset, p);
885 len -= 2;
886 /* fall through */
887 case GATT_SIGN_CMD_WRITE:
888 if (op_code == GATT_SIGN_CMD_WRITE) {
889 VLOG(1) << "Write CMD with data sigining";
890 len -= GATT_AUTH_SIGN_LEN;
891 }
892 /* fall through */
893 case GATT_CMD_WRITE:
894 case GATT_REQ_WRITE:
895 if (op_code == GATT_REQ_WRITE || op_code == GATT_REQ_PREPARE_WRITE)
896 sr_data.write_req.need_rsp = true;
897 sr_data.write_req.handle = handle;
898 sr_data.write_req.len = len;
899 if (len != 0 && p != NULL) {
900 memcpy(sr_data.write_req.value, p, len);
901 }
902 break;
903 }
904
905 gatt_sr_get_sec_info(tcb.peer_bda, tcb.transport, &sec_flag, &key_size);
906
907 status = gatts_write_attr_perm_check(el.p_db, op_code, handle,
908 sr_data.write_req.offset, p, len,
909 sec_flag, key_size);
910
911 if (status == GATT_SUCCESS) {
912 trans_id = gatt_sr_enqueue_cmd(tcb, op_code, handle);
913 if (trans_id != 0) {
914 conn_id = GATT_CREATE_CONN_ID(tcb.tcb_idx, el.gatt_if);
915
916 uint8_t opcode = 0;
917 if (gatt_type == BTGATT_DB_DESCRIPTOR) {
918 opcode = GATTS_REQ_TYPE_WRITE_DESCRIPTOR;
919 } else if (gatt_type == BTGATT_DB_CHARACTERISTIC) {
920 opcode = GATTS_REQ_TYPE_WRITE_CHARACTERISTIC;
921 } else {
922 LOG(ERROR) << __func__
923 << "%s: Attempt to write attribute that's not tied with"
924 " characteristic or descriptor value.";
925 status = GATT_ERROR;
926 }
927
928 if (opcode) {
929 gatt_sr_send_req_callback(conn_id, trans_id, opcode, &sr_data);
930 status = GATT_PENDING;
931 }
932 } else {
933 LOG(ERROR) << "max pending command, send error";
934 status = GATT_BUSY; /* max pending command, application error */
935 }
936 }
937
938 /* in theroy BUSY is not possible(should already been checked), protected
939 * check */
940 if (status != GATT_PENDING && status != GATT_BUSY &&
941 (op_code == GATT_REQ_PREPARE_WRITE || op_code == GATT_REQ_WRITE)) {
942 gatt_send_error_rsp(tcb, status, op_code, handle, false);
943 }
944 return;
945 }
946
947 /**
948 * This function is called to process the read request from client.
949 */
gatts_process_read_req(tGATT_TCB & tcb,tGATT_SRV_LIST_ELEM & el,uint8_t op_code,uint16_t handle,uint16_t len,uint8_t * p_data)950 static void gatts_process_read_req(tGATT_TCB& tcb, tGATT_SRV_LIST_ELEM& el,
951 uint8_t op_code, uint16_t handle,
952 uint16_t len, uint8_t* p_data) {
953 size_t buf_len = sizeof(BT_HDR) + tcb.payload_size + L2CAP_MIN_OFFSET;
954 uint16_t offset = 0;
955
956 if (op_code == GATT_REQ_READ_BLOB && len < sizeof(uint16_t)) {
957 /* Error: packet length is too short */
958 LOG(ERROR) << __func__ << ": packet length=" << len
959 << " too short. min=" << sizeof(uint16_t);
960 android_errorWriteWithInfoLog(0x534e4554, "73172115", -1, NULL, 0);
961 gatt_send_error_rsp(tcb, GATT_INVALID_PDU, op_code, 0, false);
962 return;
963 }
964
965 BT_HDR* p_msg = (BT_HDR*)osi_calloc(buf_len);
966
967 if (op_code == GATT_REQ_READ_BLOB) STREAM_TO_UINT16(offset, p_data);
968
969 uint8_t* p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET;
970 *p++ = op_code + 1;
971 p_msg->len = 1;
972 buf_len = tcb.payload_size - 1;
973
974 uint8_t sec_flag, key_size;
975 gatt_sr_get_sec_info(tcb.peer_bda, tcb.transport, &sec_flag, &key_size);
976
977 uint16_t value_len = 0;
978 tGATT_STATUS reason = gatts_read_attr_value_by_handle(
979 tcb, el.p_db, op_code, handle, offset, p, &value_len, (uint16_t)buf_len,
980 sec_flag, key_size, 0);
981 p_msg->len += value_len;
982
983 if (reason != GATT_SUCCESS) {
984 osi_free(p_msg);
985
986 /* in theory BUSY is not possible(should already been checked), protected
987 * check */
988 if (reason != GATT_PENDING && reason != GATT_BUSY)
989 gatt_send_error_rsp(tcb, reason, op_code, handle, false);
990
991 return;
992 }
993
994 attp_send_sr_msg(tcb, p_msg);
995 }
996
997 /*******************************************************************************
998 *
999 * Function gatts_process_attribute_req
1000 *
1001 * Description This function is called to process the per attribute handle
1002 * request from client.
1003 *
1004 * Returns void
1005 *
1006 ******************************************************************************/
gatts_process_attribute_req(tGATT_TCB & tcb,uint8_t op_code,uint16_t len,uint8_t * p_data)1007 void gatts_process_attribute_req(tGATT_TCB& tcb, uint8_t op_code, uint16_t len,
1008 uint8_t* p_data) {
1009 uint16_t handle = 0;
1010 uint8_t* p = p_data;
1011 tGATT_STATUS status = GATT_INVALID_HANDLE;
1012
1013 if (len < 2) {
1014 LOG(ERROR) << "Illegal PDU length, discard request";
1015 status = GATT_INVALID_PDU;
1016 } else {
1017 STREAM_TO_UINT16(handle, p);
1018 len -= 2;
1019 }
1020
1021 #if (GATT_CONFORMANCE_TESTING == TRUE)
1022 gatt_cb.handle = handle;
1023 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) {
1024 VLOG(1) << "Conformance tst: forced err rsp: error status="
1025 << +gatt_cb.err_status;
1026
1027 gatt_send_error_rsp(tcb, gatt_cb.err_status, gatt_cb.req_op_code, handle,
1028 false);
1029
1030 return;
1031 }
1032 #endif
1033
1034 if (GATT_HANDLE_IS_VALID(handle)) {
1035 for (auto& el : *gatt_cb.srv_list_info) {
1036 if (el.s_hdl <= handle && el.e_hdl >= handle) {
1037 for (const auto& attr : el.p_db->attr_list) {
1038 if (attr.handle == handle) {
1039 switch (op_code) {
1040 case GATT_REQ_READ: /* read char/char descriptor value */
1041 case GATT_REQ_READ_BLOB:
1042 gatts_process_read_req(tcb, el, op_code, handle, len, p);
1043 break;
1044
1045 case GATT_REQ_WRITE: /* write char/char descriptor value */
1046 case GATT_CMD_WRITE:
1047 case GATT_SIGN_CMD_WRITE:
1048 case GATT_REQ_PREPARE_WRITE:
1049 gatts_process_write_req(tcb, el, handle, op_code, len, p,
1050 attr.gatt_type);
1051 break;
1052 default:
1053 break;
1054 }
1055 status = GATT_SUCCESS;
1056 break;
1057 }
1058 }
1059 break;
1060 }
1061 }
1062 }
1063
1064 if (status != GATT_SUCCESS && op_code != GATT_CMD_WRITE &&
1065 op_code != GATT_SIGN_CMD_WRITE)
1066 gatt_send_error_rsp(tcb, status, op_code, handle, false);
1067 }
1068
1069 /*******************************************************************************
1070 *
1071 * Function gatts_proc_srv_chg_ind_ack
1072 *
1073 * Description This function process the service changed indicaiton ACK
1074 *
1075 * Returns void
1076 *
1077 ******************************************************************************/
gatts_proc_srv_chg_ind_ack(tGATT_TCB tcb)1078 static void gatts_proc_srv_chg_ind_ack(tGATT_TCB tcb) {
1079 tGATTS_SRV_CHG_REQ req;
1080 tGATTS_SRV_CHG* p_buf = NULL;
1081
1082 VLOG(1) << __func__;
1083
1084 p_buf = gatt_is_bda_in_the_srv_chg_clt_list(tcb.peer_bda);
1085 if (p_buf != NULL) {
1086 VLOG(1) << "NV update set srv chg = false";
1087 p_buf->srv_changed = false;
1088 memcpy(&req.srv_chg, p_buf, sizeof(tGATTS_SRV_CHG));
1089 if (gatt_cb.cb_info.p_srv_chg_callback)
1090 (*gatt_cb.cb_info.p_srv_chg_callback)(GATTS_SRV_CHG_CMD_UPDATE_CLIENT,
1091 &req, NULL);
1092 }
1093 }
1094
1095 /*******************************************************************************
1096 *
1097 * Function gatts_chk_pending_ind
1098 *
1099 * Description This function check any pending indication needs to be sent
1100 * if there is a pending indication then sent the indication
1101 *
1102 * Returns void
1103 *
1104 ******************************************************************************/
gatts_chk_pending_ind(tGATT_TCB & tcb)1105 static void gatts_chk_pending_ind(tGATT_TCB& tcb) {
1106 VLOG(1) << __func__;
1107
1108 tGATT_VALUE* p_buf =
1109 (tGATT_VALUE*)fixed_queue_try_peek_first(tcb.pending_ind_q);
1110 if (p_buf != NULL) {
1111 GATTS_HandleValueIndication(p_buf->conn_id, p_buf->handle, p_buf->len,
1112 p_buf->value);
1113 osi_free(fixed_queue_try_remove_from_queue(tcb.pending_ind_q, p_buf));
1114 }
1115 }
1116
1117 /*******************************************************************************
1118 *
1119 * Function gatts_proc_ind_ack
1120 *
1121 * Description This function processes the Indication ack
1122 *
1123 * Returns true continue to process the indication ack by the
1124 * application if the ACK is not a Service Changed Indication
1125 *
1126 ******************************************************************************/
gatts_proc_ind_ack(tGATT_TCB & tcb,uint16_t ack_handle)1127 static bool gatts_proc_ind_ack(tGATT_TCB& tcb, uint16_t ack_handle) {
1128 bool continue_processing = true;
1129
1130 VLOG(1) << __func__ << " ack handle=%d" << ack_handle;
1131
1132 if (ack_handle == gatt_cb.handle_of_h_r) {
1133 gatts_proc_srv_chg_ind_ack(tcb);
1134 /* there is no need to inform the application since srv chg is handled
1135 * internally by GATT */
1136 continue_processing = false;
1137 }
1138
1139 gatts_chk_pending_ind(tcb);
1140 return continue_processing;
1141 }
1142
1143 /*******************************************************************************
1144 *
1145 * Function gatts_process_value_conf
1146 *
1147 * Description This function is called to process the handle value
1148 * confirmation.
1149 *
1150 * Returns void
1151 *
1152 ******************************************************************************/
gatts_process_value_conf(tGATT_TCB & tcb,uint8_t op_code)1153 void gatts_process_value_conf(tGATT_TCB& tcb, uint8_t op_code) {
1154 uint16_t handle = tcb.indicate_handle;
1155
1156 alarm_cancel(tcb.conf_timer);
1157 if (!GATT_HANDLE_IS_VALID(handle)) {
1158 LOG(ERROR) << "unexpected handle value confirmation";
1159 return;
1160 }
1161
1162 tcb.indicate_handle = 0;
1163 bool continue_processing = gatts_proc_ind_ack(tcb, handle);
1164
1165 if (continue_processing) {
1166 tGATTS_DATA gatts_data;
1167 gatts_data.handle = handle;
1168 for (auto& el : *gatt_cb.srv_list_info) {
1169 if (el.s_hdl <= handle && el.e_hdl >= handle) {
1170 uint32_t trans_id = gatt_sr_enqueue_cmd(tcb, op_code, handle);
1171 uint16_t conn_id = GATT_CREATE_CONN_ID(tcb.tcb_idx, el.gatt_if);
1172 gatt_sr_send_req_callback(conn_id, trans_id, GATTS_REQ_TYPE_CONF,
1173 &gatts_data);
1174 }
1175 }
1176 }
1177 }
1178
1179 /** This function is called to handle the client requests to server */
gatt_server_handle_client_req(tGATT_TCB & tcb,uint8_t op_code,uint16_t len,uint8_t * p_data)1180 void gatt_server_handle_client_req(tGATT_TCB& tcb, uint8_t op_code,
1181 uint16_t len, uint8_t* p_data) {
1182 /* there is pending command, discard this one */
1183 if (!gatt_sr_cmd_empty(tcb) && op_code != GATT_HANDLE_VALUE_CONF) return;
1184
1185 /* the size of the message may not be bigger than the local max PDU size*/
1186 /* The message has to be smaller than the agreed MTU, len does not include op
1187 * code */
1188 if (len >= tcb.payload_size) {
1189 LOG(ERROR) << StringPrintf("server receive invalid PDU size:%d pdu size:%d",
1190 len + 1, tcb.payload_size);
1191 /* for invalid request expecting response, send it now */
1192 if (op_code != GATT_CMD_WRITE && op_code != GATT_SIGN_CMD_WRITE &&
1193 op_code != GATT_HANDLE_VALUE_CONF) {
1194 gatt_send_error_rsp(tcb, GATT_INVALID_PDU, op_code, 0, false);
1195 }
1196 /* otherwise, ignore the pkt */
1197 } else {
1198 switch (op_code) {
1199 case GATT_REQ_READ_BY_GRP_TYPE: /* discover primary services */
1200 case GATT_REQ_FIND_TYPE_VALUE: /* discover service by UUID */
1201 gatts_process_primary_service_req(tcb, op_code, len, p_data);
1202 break;
1203
1204 case GATT_REQ_FIND_INFO: /* discover char descrptor */
1205 gatts_process_find_info(tcb, op_code, len, p_data);
1206 break;
1207
1208 case GATT_REQ_READ_BY_TYPE: /* read characteristic value, char descriptor
1209 value */
1210 /* discover characteristic, discover char by UUID */
1211 gatts_process_read_by_type_req(tcb, op_code, len, p_data);
1212 break;
1213
1214 case GATT_REQ_READ: /* read char/char descriptor value */
1215 case GATT_REQ_READ_BLOB:
1216 case GATT_REQ_WRITE: /* write char/char descriptor value */
1217 case GATT_CMD_WRITE:
1218 case GATT_SIGN_CMD_WRITE:
1219 case GATT_REQ_PREPARE_WRITE:
1220 gatts_process_attribute_req(tcb, op_code, len, p_data);
1221 break;
1222
1223 case GATT_HANDLE_VALUE_CONF:
1224 gatts_process_value_conf(tcb, op_code);
1225 break;
1226
1227 case GATT_REQ_MTU:
1228 gatts_process_mtu_req(tcb, len, p_data);
1229 break;
1230
1231 case GATT_REQ_EXEC_WRITE:
1232 gatt_process_exec_write_req(tcb, op_code, len, p_data);
1233 break;
1234
1235 case GATT_REQ_READ_MULTI:
1236 gatt_process_read_multi_req(tcb, op_code, len, p_data);
1237 break;
1238
1239 default:
1240 break;
1241 }
1242 }
1243 }
1244