1 /****************************************************************************** 2 * 3 * Copyright (C) 2008-2012 Broadcom Corporation 4 * 5 * Licensed under the Apache License, Version 2.0 (the "License"); 6 * you may not use this file except in compliance with the License. 7 * You may obtain a copy of the License at: 8 * 9 * http://www.apache.org/licenses/LICENSE-2.0 10 * 11 * Unless required by applicable law or agreed to in writing, software 12 * distributed under the License is distributed on an "AS IS" BASIS, 13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 * See the License for the specific language governing permissions and 15 * limitations under the License. 16 * 17 ******************************************************************************/ 18 19 /****************************************************************************** 20 * 21 * this file contains the GATT server functions 22 * 23 ******************************************************************************/ 24 25 #include "bt_target.h" 26 #include "bt_utils.h" 27 28 #if BLE_INCLUDED == TRUE 29 #include <string.h> 30 #include "gatt_int.h" 31 #include "l2c_api.h" 32 #include "l2c_int.h" 33 #define GATT_MTU_REQ_MIN_LEN 2 34 35 36 /******************************************************************************* 37 ** 38 ** Function gatt_sr_enqueue_cmd 39 ** 40 ** Description This function enqueue the request from client which needs a 41 ** application response, and update the transaction ID. 42 ** 43 ** Returns void 44 ** 45 *******************************************************************************/ 46 UINT32 gatt_sr_enqueue_cmd (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 handle) 47 { 48 tGATT_SR_CMD *p_cmd = &p_tcb->sr_cmd; 49 UINT32 trans_id = 0; 50 51 if ( (p_cmd->op_code == 0) || 52 (op_code == GATT_HANDLE_VALUE_CONF)) /* no pending request */ 53 { 54 if (op_code == GATT_CMD_WRITE || 55 op_code == GATT_SIGN_CMD_WRITE || 56 op_code == GATT_REQ_MTU || 57 op_code == GATT_HANDLE_VALUE_CONF) 58 { 59 trans_id = ++p_tcb->trans_id; 60 } 61 else 62 { 63 p_cmd->trans_id = ++p_tcb->trans_id; 64 p_cmd->op_code = op_code; 65 p_cmd->handle = handle; 66 p_cmd->status = GATT_NOT_FOUND; 67 p_tcb->trans_id %= GATT_TRANS_ID_MAX; 68 trans_id = p_cmd->trans_id; 69 } 70 } 71 72 return trans_id; 73 } 74 75 /******************************************************************************* 76 ** 77 ** Function gatt_sr_cmd_empty 78 ** 79 ** Description This function check the server command queue is empty or not. 80 ** 81 ** Returns TRUE if empty, FALSE if there is pending command. 82 ** 83 *******************************************************************************/ 84 BOOLEAN gatt_sr_cmd_empty (tGATT_TCB *p_tcb) 85 { 86 return(p_tcb->sr_cmd.op_code == 0); 87 } 88 89 /******************************************************************************* 90 ** 91 ** Function gatt_dequeue_sr_cmd 92 ** 93 ** Description This function dequeue the request from command queue. 94 ** 95 ** Returns void 96 ** 97 *******************************************************************************/ 98 void gatt_dequeue_sr_cmd (tGATT_TCB *p_tcb) 99 { 100 /* Double check in case any buffers are queued */ 101 GATT_TRACE_DEBUG("gatt_dequeue_sr_cmd" ); 102 if (p_tcb->sr_cmd.p_rsp_msg) 103 GATT_TRACE_ERROR("free p_tcb->sr_cmd.p_rsp_msg = %d", p_tcb->sr_cmd.p_rsp_msg); 104 osi_free_and_reset((void **)&p_tcb->sr_cmd.p_rsp_msg); 105 106 while (!fixed_queue_is_empty(p_tcb->sr_cmd.multi_rsp_q)) 107 osi_free(fixed_queue_try_dequeue(p_tcb->sr_cmd.multi_rsp_q)); 108 fixed_queue_free(p_tcb->sr_cmd.multi_rsp_q, NULL); 109 memset( &p_tcb->sr_cmd, 0, sizeof(tGATT_SR_CMD)); 110 } 111 112 /******************************************************************************* 113 ** 114 ** Function process_read_multi_rsp 115 ** 116 ** Description This function check the read multiple response. 117 ** 118 ** Returns BOOLEAN if all replies have been received 119 ** 120 *******************************************************************************/ 121 static BOOLEAN process_read_multi_rsp (tGATT_SR_CMD *p_cmd, tGATT_STATUS status, 122 tGATTS_RSP *p_msg, UINT16 mtu) 123 { 124 UINT16 ii, total_len, len; 125 BT_HDR *p_buf = (BT_HDR *)osi_malloc(sizeof(tGATTS_RSP)); 126 UINT8 *p; 127 BOOLEAN is_overflow = FALSE; 128 129 GATT_TRACE_DEBUG ("process_read_multi_rsp status=%d mtu=%d", status, mtu); 130 131 /* Enqueue the response */ 132 memcpy((void *)p_buf, (const void *)p_msg, sizeof(tGATTS_RSP)); 133 fixed_queue_enqueue(p_cmd->multi_rsp_q, p_buf); 134 135 p_cmd->status = status; 136 if (status == GATT_SUCCESS) 137 { 138 GATT_TRACE_DEBUG("Multi read count=%d num_hdls=%d", 139 fixed_queue_length(p_cmd->multi_rsp_q), 140 p_cmd->multi_req.num_handles); 141 /* Wait till we get all the responses */ 142 if (fixed_queue_length(p_cmd->multi_rsp_q) == p_cmd->multi_req.num_handles) 143 { 144 len = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + mtu; 145 p_buf = (BT_HDR *)osi_calloc(len); 146 p_buf->offset = L2CAP_MIN_OFFSET; 147 p = (UINT8 *)(p_buf + 1) + p_buf->offset; 148 149 /* First byte in the response is the opcode */ 150 *p++ = GATT_RSP_READ_MULTI; 151 p_buf->len = 1; 152 153 /* Now walk through the buffers puting the data into the response in order */ 154 list_t *list = NULL; 155 const list_node_t *node = NULL; 156 if (! fixed_queue_is_empty(p_cmd->multi_rsp_q)) 157 list = fixed_queue_get_list(p_cmd->multi_rsp_q); 158 for (ii = 0; ii < p_cmd->multi_req.num_handles; ii++) 159 { 160 tGATTS_RSP *p_rsp = NULL; 161 162 if (list != NULL) { 163 if (ii == 0) 164 node = list_begin(list); 165 else 166 node = list_next(node); 167 if (node != list_end(list)) 168 p_rsp = (tGATTS_RSP *)list_node(node); 169 } 170 171 if (p_rsp != NULL) 172 { 173 174 total_len = (p_buf->len + p_rsp->attr_value.len); 175 176 if (total_len > mtu) 177 { 178 /* just send the partial response for the overflow case */ 179 len = p_rsp->attr_value.len - (total_len - mtu); 180 is_overflow = TRUE; 181 GATT_TRACE_DEBUG ("multi read overflow available len=%d val_len=%d", len, p_rsp->attr_value.len ); 182 } 183 else 184 { 185 len = p_rsp->attr_value.len; 186 } 187 188 if (p_rsp->attr_value.handle == p_cmd->multi_req.handles[ii]) 189 { 190 memcpy (p, p_rsp->attr_value.value, len); 191 if (!is_overflow) 192 p += len; 193 p_buf->len += len; 194 } 195 else 196 { 197 p_cmd->status = GATT_NOT_FOUND; 198 break; 199 } 200 201 if (is_overflow) 202 break; 203 204 } 205 else 206 { 207 p_cmd->status = GATT_NOT_FOUND; 208 break; 209 } 210 211 } /* loop through all handles*/ 212 213 214 /* Sanity check on the buffer length */ 215 if (p_buf->len == 0) 216 { 217 GATT_TRACE_ERROR("process_read_multi_rsp - nothing found!!"); 218 p_cmd->status = GATT_NOT_FOUND; 219 osi_free(p_buf); 220 GATT_TRACE_DEBUG("osi_free(p_buf)"); 221 } 222 else if (p_cmd->p_rsp_msg != NULL) 223 { 224 osi_free(p_buf); 225 } 226 else 227 { 228 p_cmd->p_rsp_msg = p_buf; 229 } 230 231 return(TRUE); 232 } 233 } 234 else /* any handle read exception occurs, return error */ 235 { 236 return(TRUE); 237 } 238 239 /* If here, still waiting */ 240 return(FALSE); 241 } 242 243 /******************************************************************************* 244 ** 245 ** Function gatt_sr_process_app_rsp 246 ** 247 ** Description This function checks whether the response message from application 248 ** match any pending request or not. 249 ** 250 ** Returns void 251 ** 252 *******************************************************************************/ 253 tGATT_STATUS gatt_sr_process_app_rsp (tGATT_TCB *p_tcb, tGATT_IF gatt_if, 254 UINT32 trans_id, UINT8 op_code, 255 tGATT_STATUS status, tGATTS_RSP *p_msg) 256 { 257 tGATT_STATUS ret_code = GATT_SUCCESS; 258 UNUSED(trans_id); 259 260 GATT_TRACE_DEBUG("gatt_sr_process_app_rsp gatt_if=%d", gatt_if); 261 262 gatt_sr_update_cback_cnt(p_tcb, gatt_if, FALSE, FALSE); 263 264 if (op_code == GATT_REQ_READ_MULTI) 265 { 266 /* If no error and still waiting, just return */ 267 if (!process_read_multi_rsp (&p_tcb->sr_cmd, status, p_msg, p_tcb->payload_size)) 268 return(GATT_SUCCESS); 269 } 270 else 271 { 272 if (op_code == GATT_REQ_PREPARE_WRITE && status == GATT_SUCCESS) 273 gatt_sr_update_prep_cnt(p_tcb, gatt_if, TRUE, FALSE); 274 275 if (op_code == GATT_REQ_EXEC_WRITE && status != GATT_SUCCESS) 276 gatt_sr_reset_cback_cnt(p_tcb); 277 278 p_tcb->sr_cmd.status = status; 279 280 if (gatt_sr_is_cback_cnt_zero(p_tcb) 281 && status == GATT_SUCCESS) 282 { 283 if (p_tcb->sr_cmd.p_rsp_msg == NULL) 284 { 285 p_tcb->sr_cmd.p_rsp_msg = attp_build_sr_msg (p_tcb, (UINT8)(op_code + 1), (tGATT_SR_MSG *)p_msg); 286 } 287 else 288 { 289 GATT_TRACE_ERROR("Exception!!! already has respond message"); 290 } 291 } 292 } 293 if (gatt_sr_is_cback_cnt_zero(p_tcb)) 294 { 295 if ( (p_tcb->sr_cmd.status == GATT_SUCCESS) && (p_tcb->sr_cmd.p_rsp_msg) ) 296 { 297 ret_code = attp_send_sr_msg (p_tcb, p_tcb->sr_cmd.p_rsp_msg); 298 p_tcb->sr_cmd.p_rsp_msg = NULL; 299 } 300 else 301 { 302 ret_code = gatt_send_error_rsp (p_tcb, status, op_code, p_tcb->sr_cmd.handle, FALSE); 303 } 304 305 gatt_dequeue_sr_cmd(p_tcb); 306 } 307 308 GATT_TRACE_DEBUG("gatt_sr_process_app_rsp ret_code=%d", ret_code); 309 310 return ret_code; 311 } 312 313 /******************************************************************************* 314 ** 315 ** Function gatt_process_exec_write_req 316 ** 317 ** Description This function is called to process the execute write request 318 ** from client. 319 ** 320 ** Returns void 321 ** 322 *******************************************************************************/ 323 void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data) 324 { 325 UINT8 *p = p_data, flag, i = 0; 326 UINT32 trans_id = 0; 327 tGATT_IF gatt_if; 328 UINT16 conn_id; 329 330 UNUSED(len); 331 332 #if GATT_CONFORMANCE_TESTING == TRUE 333 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) 334 { 335 GATT_TRACE_DEBUG("Conformance tst: forced err rspv for Execute Write: error status=%d", 336 gatt_cb.err_status); 337 338 gatt_send_error_rsp (p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, gatt_cb.handle, FALSE); 339 340 return; 341 } 342 #endif 343 344 STREAM_TO_UINT8(flag, p); 345 346 /* mask the flag */ 347 flag &= GATT_PREP_WRITE_EXEC; 348 349 350 /* no prep write is queued */ 351 if (!gatt_sr_is_prep_cnt_zero(p_tcb)) 352 { 353 trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, 0); 354 gatt_sr_copy_prep_cnt_to_cback_cnt(p_tcb); 355 356 for (i=0; i<GATT_MAX_APPS; i++) 357 { 358 if (p_tcb->prep_cnt[i]) 359 { 360 gatt_if = (tGATT_IF) (i+1); 361 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, gatt_if); 362 gatt_sr_send_req_callback(conn_id, 363 trans_id, 364 GATTS_REQ_TYPE_WRITE_EXEC, 365 (tGATTS_DATA *)&flag); 366 p_tcb->prep_cnt[i]= 0; 367 } 368 } 369 } 370 else /* nothing needs to be executed , send response now */ 371 { 372 GATT_TRACE_ERROR("gatt_process_exec_write_req: no prepare write pending"); 373 gatt_send_error_rsp(p_tcb, GATT_ERROR, GATT_REQ_EXEC_WRITE, 0, FALSE); 374 } 375 } 376 377 /******************************************************************************* 378 ** 379 ** Function gatt_process_read_multi_req 380 ** 381 ** Description This function is called to process the read multiple request 382 ** from client. 383 ** 384 ** Returns void 385 ** 386 *******************************************************************************/ 387 void gatt_process_read_multi_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data) 388 { 389 UINT32 trans_id; 390 UINT16 handle = 0, ll = len; 391 UINT8 *p = p_data, i_rcb; 392 tGATT_STATUS err = GATT_SUCCESS; 393 UINT8 sec_flag, key_size; 394 395 GATT_TRACE_DEBUG("gatt_process_read_multi_req" ); 396 p_tcb->sr_cmd.multi_req.num_handles = 0; 397 398 gatt_sr_get_sec_info(p_tcb->peer_bda, 399 p_tcb->transport, 400 &sec_flag, 401 &key_size); 402 403 #if GATT_CONFORMANCE_TESTING == TRUE 404 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) 405 { 406 GATT_TRACE_DEBUG("Conformance tst: forced err rspvofr ReadMultiple: error status=%d", gatt_cb.err_status); 407 408 STREAM_TO_UINT16(handle, p); 409 410 gatt_send_error_rsp (p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, handle, FALSE); 411 412 return; 413 } 414 #endif 415 416 while (ll >= 2 && p_tcb->sr_cmd.multi_req.num_handles < GATT_MAX_READ_MULTI_HANDLES) 417 { 418 STREAM_TO_UINT16(handle, p); 419 420 if ((i_rcb = gatt_sr_find_i_rcb_by_handle(handle)) < GATT_MAX_SR_PROFILES) 421 { 422 p_tcb->sr_cmd.multi_req.handles[p_tcb->sr_cmd.multi_req.num_handles++] = handle; 423 424 /* check read permission */ 425 if ((err = gatts_read_attr_perm_check( gatt_cb.sr_reg[i_rcb].p_db, 426 FALSE, 427 handle, 428 sec_flag, 429 key_size)) 430 != GATT_SUCCESS) 431 { 432 GATT_TRACE_DEBUG("read permission denied : 0x%02x", err); 433 break; 434 } 435 } 436 else 437 { 438 /* invalid handle */ 439 err = GATT_INVALID_HANDLE; 440 break; 441 } 442 ll -= 2; 443 } 444 445 if (ll != 0) 446 { 447 GATT_TRACE_ERROR("max attribute handle reached in ReadMultiple Request."); 448 } 449 450 if (p_tcb->sr_cmd.multi_req.num_handles == 0) 451 err = GATT_INVALID_HANDLE; 452 453 if (err == GATT_SUCCESS) 454 { 455 if ((trans_id = gatt_sr_enqueue_cmd (p_tcb, op_code, p_tcb->sr_cmd.multi_req.handles[0])) != 0) 456 { 457 gatt_sr_reset_cback_cnt(p_tcb); /* read multiple use multi_rsp_q's count*/ 458 459 for (ll = 0; ll < p_tcb->sr_cmd.multi_req.num_handles; ll ++) { 460 tGATTS_RSP *p_msg = (tGATTS_RSP *)osi_calloc(sizeof(tGATTS_RSP)); 461 handle = p_tcb->sr_cmd.multi_req.handles[ll]; 462 i_rcb = gatt_sr_find_i_rcb_by_handle(handle); 463 464 p_msg->attr_value.handle = handle; 465 err = gatts_read_attr_value_by_handle(p_tcb, 466 gatt_cb.sr_reg[i_rcb].p_db, 467 op_code, 468 handle, 469 0, 470 p_msg->attr_value.value, 471 &p_msg->attr_value.len, 472 GATT_MAX_ATTR_LEN, 473 sec_flag, 474 key_size, 475 trans_id); 476 477 if (err == GATT_SUCCESS) { 478 gatt_sr_process_app_rsp(p_tcb, gatt_cb.sr_reg[i_rcb].gatt_if ,trans_id, op_code, GATT_SUCCESS, p_msg); 479 } 480 /* either not using or done using the buffer, release it now */ 481 osi_free(p_msg); 482 } 483 } 484 else 485 err = GATT_NO_RESOURCES; 486 } 487 488 /* in theroy BUSY is not possible(should already been checked), protected check */ 489 if (err != GATT_SUCCESS && err != GATT_PENDING && err != GATT_BUSY) 490 gatt_send_error_rsp(p_tcb, err, op_code, handle, FALSE); 491 } 492 493 /******************************************************************************* 494 ** 495 ** Function gatt_build_primary_service_rsp 496 ** 497 ** Description Primamry service request processed internally. Theretically 498 ** only deal with ReadByTypeVAlue and ReadByGroupType. 499 ** 500 ** Returns void 501 ** 502 *******************************************************************************/ 503 static tGATT_STATUS gatt_build_primary_service_rsp (BT_HDR *p_msg, tGATT_TCB *p_tcb, 504 UINT8 op_code, UINT16 s_hdl, 505 UINT16 e_hdl, UINT8 *p_data, tBT_UUID value) 506 { 507 tGATT_STATUS status = GATT_NOT_FOUND; 508 UINT8 handle_len =4, *p ; 509 tGATT_SR_REG *p_rcb; 510 tGATT_SRV_LIST_INFO *p_list= &gatt_cb.srv_list_info; 511 tGATT_SRV_LIST_ELEM *p_srv=NULL; 512 tBT_UUID *p_uuid; 513 514 UNUSED(p_data); 515 516 p = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET; 517 518 p_srv = p_list->p_first; 519 520 while (p_srv) 521 { 522 p_rcb = GATT_GET_SR_REG_PTR(p_srv->i_sreg); 523 524 if (p_rcb->in_use && 525 p_rcb->s_hdl >= s_hdl && 526 p_rcb->s_hdl <= e_hdl && 527 p_rcb->type == GATT_UUID_PRI_SERVICE) 528 { 529 if ((p_uuid = gatts_get_service_uuid (p_rcb->p_db)) != NULL) 530 { 531 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) 532 handle_len = 4 + p_uuid->len; 533 534 /* get the length byte in the repsonse */ 535 if (p_msg->offset ==0) 536 { 537 *p ++ = op_code + 1; 538 p_msg->len ++; 539 p_msg->offset = handle_len; 540 541 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) 542 { 543 *p ++ = (UINT8)p_msg->offset; /* length byte */ 544 p_msg->len ++; 545 } 546 } 547 548 if (p_msg->len + p_msg->offset <= p_tcb->payload_size && 549 handle_len == p_msg->offset) 550 { 551 if (op_code != GATT_REQ_FIND_TYPE_VALUE || 552 gatt_uuid_compare(value, *p_uuid)) 553 { 554 UINT16_TO_STREAM(p, p_rcb->s_hdl); 555 556 if (p_list->p_last_primary == p_srv && 557 p_list->p_last_primary == p_list->p_last) 558 { 559 GATT_TRACE_DEBUG("Use 0xFFFF for the last primary attribute"); 560 UINT16_TO_STREAM(p, 0xFFFF); /* see GATT ERRATA 4065, 4063, ATT ERRATA 4062 */ 561 } 562 else 563 { 564 UINT16_TO_STREAM(p, p_rcb->e_hdl); 565 } 566 567 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) 568 gatt_build_uuid_to_stream(&p, *p_uuid); 569 570 status = GATT_SUCCESS; 571 p_msg->len += p_msg->offset; 572 } 573 } 574 else 575 break; 576 } 577 } 578 p_srv = p_srv->p_next; 579 } 580 p_msg->offset = L2CAP_MIN_OFFSET; 581 582 return status; 583 } 584 585 /******************************************************************************* 586 ** 587 ** Function gatt_build_find_info_rsp 588 ** 589 ** Description fill the find information response information in the given 590 ** buffer. 591 ** 592 ** Returns TRUE: if data filled sucessfully. 593 ** FALSE: packet full, or format mismatch. 594 ** 595 *******************************************************************************/ 596 static tGATT_STATUS gatt_build_find_info_rsp(tGATT_SR_REG *p_rcb, BT_HDR *p_msg, UINT16 *p_len, 597 UINT16 s_hdl, UINT16 e_hdl) 598 { 599 tGATT_STATUS status = GATT_NOT_FOUND; 600 UINT8 *p; 601 UINT16 len = *p_len; 602 tGATT_ATTR16 *p_attr = NULL; 603 UINT8 info_pair_len[2] = {4, 18}; 604 605 if (!p_rcb->p_db || !p_rcb->p_db->p_attr_list) 606 return status; 607 608 /* check the attribute database */ 609 p_attr = (tGATT_ATTR16 *) p_rcb->p_db->p_attr_list; 610 611 p = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET + p_msg->len; 612 613 while (p_attr) 614 { 615 if (p_attr->handle > e_hdl) 616 { 617 break; 618 } 619 620 if (p_attr->handle >= s_hdl) 621 { 622 if (p_msg->offset == 0) 623 p_msg->offset = (p_attr->uuid_type == GATT_ATTR_UUID_TYPE_16) ? GATT_INFO_TYPE_PAIR_16 : GATT_INFO_TYPE_PAIR_128; 624 625 if (len >= info_pair_len[p_msg->offset - 1]) 626 { 627 if (p_msg->offset == GATT_INFO_TYPE_PAIR_16 && p_attr->uuid_type == GATT_ATTR_UUID_TYPE_16) 628 { 629 UINT16_TO_STREAM(p, p_attr->handle); 630 UINT16_TO_STREAM(p, p_attr->uuid); 631 } 632 else if (p_msg->offset == GATT_INFO_TYPE_PAIR_128 && p_attr->uuid_type == GATT_ATTR_UUID_TYPE_128 ) 633 { 634 UINT16_TO_STREAM(p, p_attr->handle); 635 ARRAY_TO_STREAM (p, ((tGATT_ATTR128 *) p_attr)->uuid, LEN_UUID_128); 636 } 637 else if (p_msg->offset == GATT_INFO_TYPE_PAIR_128 && p_attr->uuid_type == GATT_ATTR_UUID_TYPE_32) 638 { 639 UINT16_TO_STREAM(p, p_attr->handle); 640 gatt_convert_uuid32_to_uuid128(p, ((tGATT_ATTR32 *) p_attr)->uuid); 641 p += LEN_UUID_128; 642 } 643 else 644 { 645 GATT_TRACE_ERROR("format mismatch"); 646 status = GATT_NO_RESOURCES; 647 break; 648 /* format mismatch */ 649 } 650 p_msg->len += info_pair_len[p_msg->offset - 1]; 651 len -= info_pair_len[p_msg->offset - 1]; 652 status = GATT_SUCCESS; 653 654 } 655 else 656 { 657 status = GATT_NO_RESOURCES; 658 break; 659 } 660 } 661 p_attr = (tGATT_ATTR16 *)p_attr->p_next; 662 } 663 664 *p_len = len; 665 return status; 666 } 667 668 /******************************************************************************* 669 ** 670 ** Function gatts_internal_read_by_type_req 671 ** 672 ** Description check to see if the ReadByType request can be handled internally. 673 ** 674 ** Returns void 675 ** 676 *******************************************************************************/ 677 static tGATT_STATUS gatts_validate_packet_format(UINT8 op_code, UINT16 *p_len, 678 UINT8 **p_data, tBT_UUID *p_uuid_filter, 679 UINT16 *p_s_hdl, UINT16 *p_e_hdl) 680 { 681 tGATT_STATUS reason = GATT_SUCCESS; 682 UINT16 uuid_len, s_hdl = 0, e_hdl = 0; 683 UINT16 len = *p_len; 684 UINT8 *p = *p_data; 685 686 if (len >= 4) 687 { 688 /* obtain starting handle, and ending handle */ 689 STREAM_TO_UINT16(s_hdl, p); 690 STREAM_TO_UINT16(e_hdl, p); 691 len -= 4; 692 693 if (s_hdl > e_hdl || !GATT_HANDLE_IS_VALID(s_hdl) || !GATT_HANDLE_IS_VALID(e_hdl)) 694 { 695 reason = GATT_INVALID_HANDLE; 696 } 697 /* for these PDUs, uuid filter must present */ 698 else if (op_code == GATT_REQ_READ_BY_GRP_TYPE || 699 op_code == GATT_REQ_FIND_TYPE_VALUE || 700 op_code == GATT_REQ_READ_BY_TYPE) 701 { 702 if (len >= 2 && p_uuid_filter != NULL) 703 { 704 uuid_len = (op_code == GATT_REQ_FIND_TYPE_VALUE) ? 2 : len; 705 706 /* parse uuid now */ 707 if (gatt_parse_uuid_from_cmd (p_uuid_filter, uuid_len, &p) == FALSE || 708 p_uuid_filter->len == 0) 709 { 710 GATT_TRACE_DEBUG("UUID filter does not exsit"); 711 reason = GATT_INVALID_PDU; 712 } 713 else 714 len -= p_uuid_filter->len; 715 } 716 else 717 reason = GATT_INVALID_PDU; 718 } 719 } 720 else 721 reason = GATT_INVALID_PDU; 722 723 *p_data = p; 724 *p_len = len; 725 *p_s_hdl = s_hdl; 726 *p_e_hdl = e_hdl; 727 728 return reason; 729 } 730 731 /******************************************************************************* 732 ** 733 ** Function gatts_process_primary_service_req 734 ** 735 ** Description process ReadByGroupType/ReadByTypeValue request, for discover 736 ** all primary services or discover primary service by UUID request. 737 ** 738 ** Returns void 739 ** 740 *******************************************************************************/ 741 void gatts_process_primary_service_req(tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data) 742 { 743 UINT8 reason = GATT_INVALID_PDU; 744 UINT16 s_hdl = 0, e_hdl = 0; 745 tBT_UUID uuid, value, primary_service = {LEN_UUID_16, {GATT_UUID_PRI_SERVICE}}; 746 BT_HDR *p_msg = NULL; 747 UINT16 msg_len = (UINT16)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET); 748 749 memset (&value, 0, sizeof(tBT_UUID)); 750 reason = gatts_validate_packet_format(op_code, &len, &p_data, &uuid, &s_hdl, &e_hdl); 751 752 if (reason == GATT_SUCCESS) 753 { 754 if (gatt_uuid_compare(uuid, primary_service)) 755 { 756 if (op_code == GATT_REQ_FIND_TYPE_VALUE) 757 { 758 if (gatt_parse_uuid_from_cmd(&value, len, &p_data) == FALSE) 759 reason = GATT_INVALID_PDU; 760 } 761 762 if (reason == GATT_SUCCESS) { 763 p_msg = (BT_HDR *)osi_calloc(msg_len); 764 reason = gatt_build_primary_service_rsp (p_msg, p_tcb, op_code, 765 s_hdl, e_hdl, p_data, 766 value); 767 } 768 } 769 else 770 { 771 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) 772 { 773 reason = GATT_UNSUPPORT_GRP_TYPE; 774 GATT_TRACE_DEBUG("unexpected ReadByGrpType Group: 0x%04x", uuid.uu.uuid16); 775 } 776 else 777 { 778 /* we do not support ReadByTypeValue with any non-primamry_service type */ 779 reason = GATT_NOT_FOUND; 780 GATT_TRACE_DEBUG("unexpected ReadByTypeValue type: 0x%04x", uuid.uu.uuid16); 781 } 782 } 783 } 784 785 if (reason != GATT_SUCCESS) 786 { 787 osi_free(p_msg); 788 gatt_send_error_rsp (p_tcb, reason, op_code, s_hdl, FALSE); 789 } 790 else 791 attp_send_sr_msg(p_tcb, p_msg); 792 793 } 794 795 /******************************************************************************* 796 ** 797 ** Function gatts_process_find_info 798 ** 799 ** Description process find information request, for discover character 800 ** descriptors. 801 ** 802 ** Returns void 803 ** 804 *******************************************************************************/ 805 static void gatts_process_find_info(tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data) 806 { 807 UINT8 reason = GATT_INVALID_PDU, *p; 808 UINT16 s_hdl = 0, e_hdl = 0, buf_len; 809 BT_HDR *p_msg = NULL; 810 tGATT_SR_REG *p_rcb; 811 tGATT_SRV_LIST_INFO *p_list= &gatt_cb.srv_list_info; 812 tGATT_SRV_LIST_ELEM *p_srv=NULL; 813 814 reason = gatts_validate_packet_format(op_code, &len, &p_data, NULL, &s_hdl, &e_hdl); 815 816 if (reason == GATT_SUCCESS) 817 { 818 buf_len = (UINT16)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET); 819 820 p_msg = (BT_HDR *)osi_calloc(buf_len); 821 reason = GATT_NOT_FOUND; 822 823 p = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET; 824 *p ++ = op_code + 1; 825 p_msg->len = 2; 826 827 buf_len = p_tcb->payload_size - 2; 828 829 p_srv = p_list->p_first; 830 831 while (p_srv) { 832 p_rcb = GATT_GET_SR_REG_PTR(p_srv->i_sreg); 833 834 if (p_rcb->in_use && !(p_rcb->s_hdl > e_hdl || 835 p_rcb->e_hdl < s_hdl)) { 836 reason = gatt_build_find_info_rsp(p_rcb, p_msg, &buf_len, 837 s_hdl, e_hdl); 838 if (reason == GATT_NO_RESOURCES) { 839 reason = GATT_SUCCESS; 840 break; 841 } 842 } 843 p_srv = p_srv->p_next; 844 } 845 *p = (UINT8)p_msg->offset; 846 847 p_msg->offset = L2CAP_MIN_OFFSET; 848 } 849 850 if (reason != GATT_SUCCESS) 851 { 852 osi_free(p_msg); 853 gatt_send_error_rsp (p_tcb, reason, op_code, s_hdl, FALSE); 854 } 855 else 856 attp_send_sr_msg(p_tcb, p_msg); 857 858 } 859 860 /******************************************************************************* 861 ** 862 ** Function gatts_process_mtu_req 863 ** 864 ** Description This function is called to process excahnge MTU request. 865 ** Only used on LE. 866 ** 867 ** Returns void 868 ** 869 *******************************************************************************/ 870 static void gatts_process_mtu_req (tGATT_TCB *p_tcb, UINT16 len, UINT8 *p_data) 871 { 872 UINT16 mtu = 0; 873 UINT8 *p = p_data, i; 874 BT_HDR *p_buf; 875 UINT16 conn_id; 876 877 /* BR/EDR conenction, send error response */ 878 if (p_tcb->att_lcid != L2CAP_ATT_CID) 879 { 880 gatt_send_error_rsp (p_tcb, GATT_REQ_NOT_SUPPORTED, GATT_REQ_MTU, 0, FALSE); 881 } 882 else if (len < GATT_MTU_REQ_MIN_LEN) 883 { 884 GATT_TRACE_ERROR("invalid MTU request PDU received."); 885 gatt_send_error_rsp (p_tcb, GATT_INVALID_PDU, GATT_REQ_MTU, 0, FALSE); 886 } 887 else 888 { 889 STREAM_TO_UINT16 (mtu, p); 890 /* mtu must be greater than default MTU which is 23/48 */ 891 if (mtu < GATT_DEF_BLE_MTU_SIZE) 892 p_tcb->payload_size = GATT_DEF_BLE_MTU_SIZE; 893 else if (mtu > GATT_MAX_MTU_SIZE) 894 p_tcb->payload_size = GATT_MAX_MTU_SIZE; 895 else 896 p_tcb->payload_size = mtu; 897 898 GATT_TRACE_ERROR("MTU request PDU with MTU size %d", p_tcb->payload_size); 899 900 l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, p_tcb->payload_size); 901 902 if ((p_buf = attp_build_sr_msg(p_tcb, GATT_RSP_MTU, (tGATT_SR_MSG *) &p_tcb->payload_size)) != NULL) 903 { 904 attp_send_sr_msg (p_tcb, p_buf); 905 906 /* Notify all registered applicaiton with new MTU size. Us a transaction ID */ 907 /* of 0, as no response is allowed from applcations */ 908 909 for (i = 0; i < GATT_MAX_APPS; i ++) 910 { 911 if (gatt_cb.cl_rcb[i].in_use ) 912 { 913 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, gatt_cb.cl_rcb[i].gatt_if); 914 gatt_sr_send_req_callback(conn_id, 0, GATTS_REQ_TYPE_MTU, 915 (tGATTS_DATA *)&p_tcb->payload_size); 916 } 917 } 918 919 } 920 } 921 } 922 923 /******************************************************************************* 924 ** 925 ** Function gatts_process_read_by_type_req 926 ** 927 ** Description process Read By type request. 928 ** This PDU can be used to perform: 929 ** - read characteristic value 930 ** - read characteristic descriptor value 931 ** - discover characteristic 932 ** - discover characteristic by UUID 933 ** - relationship discovery 934 ** 935 ** Returns void 936 ** 937 *******************************************************************************/ 938 void gatts_process_read_by_type_req(tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data) 939 { 940 tBT_UUID uuid; 941 tGATT_SR_REG *p_rcb; 942 size_t msg_len = sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET; 943 UINT16 buf_len, s_hdl, e_hdl, err_hdl = 0; 944 BT_HDR *p_msg = NULL; 945 tGATT_STATUS reason, ret; 946 UINT8 *p; 947 UINT8 sec_flag, key_size; 948 tGATT_SRV_LIST_INFO *p_list= &gatt_cb.srv_list_info; 949 tGATT_SRV_LIST_ELEM *p_srv=NULL; 950 951 reason = gatts_validate_packet_format(op_code, &len, &p_data, &uuid, &s_hdl, &e_hdl); 952 953 #if GATT_CONFORMANCE_TESTING == TRUE 954 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) 955 { 956 GATT_TRACE_DEBUG("Conformance tst: forced err rsp for ReadByType: error status=%d", gatt_cb.err_status); 957 958 gatt_send_error_rsp (p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, s_hdl, FALSE); 959 960 return; 961 } 962 #endif 963 964 if (reason == GATT_SUCCESS) 965 { 966 p_msg = (BT_HDR *)osi_calloc(msg_len); 967 p = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET; 968 969 *p ++ = op_code + 1; 970 /* reserve length byte */ 971 p_msg->len = 2; 972 buf_len = p_tcb->payload_size - 2; 973 974 reason = GATT_NOT_FOUND; 975 976 p_srv = p_list->p_first; 977 978 while (p_srv) { 979 p_rcb = GATT_GET_SR_REG_PTR(p_srv->i_sreg); 980 981 if (p_rcb->in_use && !(p_rcb->s_hdl > e_hdl || 982 p_rcb->e_hdl < s_hdl)) { 983 gatt_sr_get_sec_info(p_tcb->peer_bda, p_tcb->transport, 984 &sec_flag, &key_size); 985 986 ret = gatts_db_read_attr_value_by_type(p_tcb, 987 p_rcb->p_db, 988 op_code, 989 p_msg, 990 s_hdl, 991 e_hdl, 992 uuid, 993 &buf_len, 994 sec_flag, 995 key_size, 996 0, 997 &err_hdl); 998 if (ret != GATT_NOT_FOUND) { 999 reason = ret; 1000 1001 if (ret == GATT_NO_RESOURCES) 1002 reason = GATT_SUCCESS; 1003 } 1004 if (ret != GATT_SUCCESS && ret != GATT_NOT_FOUND) { 1005 s_hdl = err_hdl; 1006 break; 1007 } 1008 } 1009 p_srv = p_srv->p_next; 1010 } 1011 *p = (UINT8)p_msg->offset; 1012 p_msg->offset = L2CAP_MIN_OFFSET; 1013 } 1014 if (reason != GATT_SUCCESS) 1015 { 1016 osi_free(p_msg); 1017 1018 /* in theroy BUSY is not possible(should already been checked), protected check */ 1019 if (reason != GATT_PENDING && reason != GATT_BUSY) 1020 gatt_send_error_rsp (p_tcb, reason, op_code, s_hdl, FALSE); 1021 } 1022 else 1023 attp_send_sr_msg(p_tcb, p_msg); 1024 1025 } 1026 1027 /******************************************************************************* 1028 ** 1029 ** Function gatts_process_write_req 1030 ** 1031 ** Description This function is called to process the write request 1032 ** from client. 1033 ** 1034 ** Returns void 1035 ** 1036 *******************************************************************************/ 1037 void gatts_process_write_req (tGATT_TCB *p_tcb, UINT8 i_rcb, UINT16 handle, 1038 UINT8 op_code, UINT16 len, UINT8 *p_data) 1039 { 1040 tGATTS_DATA sr_data; 1041 UINT32 trans_id; 1042 tGATT_STATUS status; 1043 UINT8 sec_flag, key_size, *p = p_data; 1044 tGATT_SR_REG *p_sreg; 1045 UINT16 conn_id; 1046 1047 memset(&sr_data, 0, sizeof(tGATTS_DATA)); 1048 1049 switch (op_code) 1050 { 1051 case GATT_REQ_PREPARE_WRITE: 1052 if (len < 2) { 1053 GATT_TRACE_ERROR("%s: Prepare write request was invalid - missing offset, sending error response", __func__); 1054 gatt_send_error_rsp(p_tcb, GATT_INVALID_PDU, op_code, handle, FALSE); 1055 return; 1056 } 1057 sr_data.write_req.is_prep = TRUE; 1058 STREAM_TO_UINT16(sr_data.write_req.offset, p); 1059 len -= 2; 1060 /* fall through */ 1061 case GATT_SIGN_CMD_WRITE: 1062 if (op_code == GATT_SIGN_CMD_WRITE) 1063 { 1064 GATT_TRACE_DEBUG("Write CMD with data sigining" ); 1065 len -= GATT_AUTH_SIGN_LEN; 1066 } 1067 /* fall through */ 1068 case GATT_CMD_WRITE: 1069 case GATT_REQ_WRITE: 1070 if (op_code == GATT_REQ_WRITE || op_code == GATT_REQ_PREPARE_WRITE) 1071 sr_data.write_req.need_rsp = TRUE; 1072 sr_data.write_req.handle = handle; 1073 sr_data.write_req.len = len; 1074 if (len != 0 && p != NULL) 1075 { 1076 memcpy (sr_data.write_req.value, p, len); 1077 } 1078 break; 1079 } 1080 1081 gatt_sr_get_sec_info(p_tcb->peer_bda, 1082 p_tcb->transport, 1083 &sec_flag, 1084 &key_size); 1085 1086 status = gatts_write_attr_perm_check (gatt_cb.sr_reg[i_rcb].p_db, 1087 op_code, 1088 handle, 1089 sr_data.write_req.offset, 1090 p, 1091 len, 1092 sec_flag, 1093 key_size); 1094 1095 if (status == GATT_SUCCESS) 1096 { 1097 if ((trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, handle)) != 0) 1098 { 1099 p_sreg = &gatt_cb.sr_reg[i_rcb]; 1100 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_sreg->gatt_if); 1101 gatt_sr_send_req_callback(conn_id, 1102 trans_id, 1103 GATTS_REQ_TYPE_WRITE, 1104 &sr_data); 1105 1106 status = GATT_PENDING; 1107 } 1108 else 1109 { 1110 GATT_TRACE_ERROR("max pending command, send error"); 1111 status = GATT_BUSY; /* max pending command, application error */ 1112 } 1113 } 1114 1115 /* in theroy BUSY is not possible(should already been checked), protected check */ 1116 if (status != GATT_PENDING && status != GATT_BUSY && 1117 (op_code == GATT_REQ_PREPARE_WRITE || op_code == GATT_REQ_WRITE)) 1118 { 1119 gatt_send_error_rsp (p_tcb, status, op_code, handle, FALSE); 1120 } 1121 return; 1122 } 1123 1124 /******************************************************************************* 1125 ** 1126 ** Function gatts_process_read_req 1127 ** 1128 ** Description This function is called to process the read request 1129 ** from client. 1130 ** 1131 ** Returns void 1132 ** 1133 *******************************************************************************/ 1134 static void gatts_process_read_req(tGATT_TCB *p_tcb, tGATT_SR_REG *p_rcb, UINT8 op_code, 1135 UINT16 handle, UINT16 len, UINT8 *p_data) 1136 { 1137 size_t buf_len = sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET; 1138 tGATT_STATUS reason; 1139 UINT8 sec_flag, key_size, *p; 1140 UINT16 offset = 0, value_len = 0; 1141 BT_HDR *p_msg = (BT_HDR *)osi_calloc(buf_len); 1142 1143 UNUSED(len); 1144 1145 if (op_code == GATT_REQ_READ_BLOB) 1146 STREAM_TO_UINT16(offset, p_data); 1147 1148 p = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET; 1149 *p ++ = op_code + 1; 1150 p_msg->len = 1; 1151 buf_len = p_tcb->payload_size - 1; 1152 1153 gatt_sr_get_sec_info(p_tcb->peer_bda, p_tcb->transport, &sec_flag, 1154 &key_size); 1155 1156 reason = gatts_read_attr_value_by_handle(p_tcb, 1157 p_rcb->p_db, 1158 op_code, 1159 handle, 1160 offset, 1161 p, 1162 &value_len, 1163 (uint16_t)buf_len, 1164 sec_flag, 1165 key_size, 1166 0); 1167 1168 p_msg->len += value_len; 1169 1170 if (reason != GATT_SUCCESS) 1171 { 1172 osi_free(p_msg); 1173 1174 /* in theroy BUSY is not possible(should already been checked), protected check */ 1175 if (reason != GATT_PENDING && reason != GATT_BUSY) 1176 gatt_send_error_rsp (p_tcb, reason, op_code, handle, FALSE); 1177 } 1178 else 1179 attp_send_sr_msg(p_tcb, p_msg); 1180 1181 } 1182 1183 /******************************************************************************* 1184 ** 1185 ** Function gatts_process_attribute_req 1186 ** 1187 ** Description This function is called to process the per attribute handle request 1188 ** from client. 1189 ** 1190 ** Returns void 1191 ** 1192 *******************************************************************************/ 1193 void gatts_process_attribute_req (tGATT_TCB *p_tcb, UINT8 op_code, 1194 UINT16 len, UINT8 *p_data) 1195 { 1196 UINT16 handle = 0; 1197 UINT8 *p = p_data, i; 1198 tGATT_SR_REG *p_rcb = gatt_cb.sr_reg; 1199 tGATT_STATUS status = GATT_INVALID_HANDLE; 1200 tGATT_ATTR16 *p_attr; 1201 1202 if (len < 2) 1203 { 1204 GATT_TRACE_ERROR("Illegal PDU length, discard request"); 1205 status = GATT_INVALID_PDU; 1206 } 1207 else 1208 { 1209 STREAM_TO_UINT16(handle, p); 1210 len -= 2; 1211 } 1212 1213 #if GATT_CONFORMANCE_TESTING == TRUE 1214 gatt_cb.handle = handle; 1215 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) 1216 { 1217 GATT_TRACE_DEBUG("Conformance tst: forced err rsp: error status=%d", gatt_cb.err_status); 1218 1219 gatt_send_error_rsp (p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, handle, FALSE); 1220 1221 return; 1222 } 1223 #endif 1224 1225 if (GATT_HANDLE_IS_VALID(handle)) 1226 { 1227 for (i = 0; i < GATT_MAX_SR_PROFILES; i ++, p_rcb ++) 1228 { 1229 if (p_rcb->in_use && p_rcb->s_hdl <= handle && p_rcb->e_hdl >= handle) 1230 { 1231 p_attr = (tGATT_ATTR16 *)p_rcb->p_db->p_attr_list; 1232 1233 while (p_attr) 1234 { 1235 if (p_attr->handle == handle) 1236 { 1237 switch (op_code) 1238 { 1239 case GATT_REQ_READ: /* read char/char descriptor value */ 1240 case GATT_REQ_READ_BLOB: 1241 gatts_process_read_req(p_tcb, p_rcb, op_code, handle, len, p); 1242 break; 1243 1244 case GATT_REQ_WRITE: /* write char/char descriptor value */ 1245 case GATT_CMD_WRITE: 1246 case GATT_SIGN_CMD_WRITE: 1247 case GATT_REQ_PREPARE_WRITE: 1248 gatts_process_write_req(p_tcb, i, handle, op_code, len, p); 1249 break; 1250 default: 1251 break; 1252 } 1253 status = GATT_SUCCESS; 1254 break; 1255 } 1256 p_attr = (tGATT_ATTR16 *)p_attr->p_next; 1257 } 1258 break; 1259 } 1260 } 1261 } 1262 1263 if (status != GATT_SUCCESS && op_code != GATT_CMD_WRITE && op_code != GATT_SIGN_CMD_WRITE) 1264 gatt_send_error_rsp (p_tcb, status, op_code, handle, FALSE); 1265 } 1266 1267 /******************************************************************************* 1268 ** 1269 ** Function gatts_proc_srv_chg_ind_ack 1270 ** 1271 ** Description This function process the service changed indicaiton ACK 1272 ** 1273 ** Returns void 1274 ** 1275 *******************************************************************************/ 1276 static void gatts_proc_srv_chg_ind_ack(tGATT_TCB *p_tcb ) 1277 { 1278 tGATTS_SRV_CHG_REQ req; 1279 tGATTS_SRV_CHG *p_buf = NULL; 1280 1281 GATT_TRACE_DEBUG("gatts_proc_srv_chg_ind_ack"); 1282 1283 if ((p_buf = gatt_is_bda_in_the_srv_chg_clt_list(p_tcb->peer_bda)) != NULL) 1284 { 1285 GATT_TRACE_DEBUG("NV update set srv chg = FALSE"); 1286 p_buf->srv_changed = FALSE; 1287 memcpy(&req.srv_chg, p_buf, sizeof(tGATTS_SRV_CHG)); 1288 if (gatt_cb.cb_info.p_srv_chg_callback) 1289 (*gatt_cb.cb_info.p_srv_chg_callback)(GATTS_SRV_CHG_CMD_UPDATE_CLIENT,&req, NULL); 1290 } 1291 } 1292 1293 /******************************************************************************* 1294 ** 1295 ** Function gatts_chk_pending_ind 1296 ** 1297 ** Description This function check any pending indication needs to be sent if 1298 ** there is a pending indication then sent the indication 1299 ** 1300 ** Returns void 1301 ** 1302 *******************************************************************************/ 1303 static void gatts_chk_pending_ind(tGATT_TCB *p_tcb ) 1304 { 1305 GATT_TRACE_DEBUG("%s", __func__); 1306 1307 tGATT_VALUE *p_buf = (tGATT_VALUE *)fixed_queue_try_peek_first(p_tcb->pending_ind_q); 1308 if (p_buf != NULL) 1309 { 1310 GATTS_HandleValueIndication(p_buf->conn_id, 1311 p_buf->handle, 1312 p_buf->len, 1313 p_buf->value); 1314 osi_free(fixed_queue_try_remove_from_queue(p_tcb->pending_ind_q, 1315 p_buf)); 1316 } 1317 } 1318 1319 /******************************************************************************* 1320 ** 1321 ** Function gatts_proc_ind_ack 1322 ** 1323 ** Description This function process the Indication ack 1324 ** 1325 ** Returns TRUE continue to process the indication ack by the aaplication 1326 ** if the ACk is not a Service Changed Indication Ack 1327 ** 1328 *******************************************************************************/ 1329 static BOOLEAN gatts_proc_ind_ack(tGATT_TCB *p_tcb, UINT16 ack_handle) 1330 { 1331 BOOLEAN continue_processing = TRUE; 1332 1333 GATT_TRACE_DEBUG ("gatts_proc_ind_ack ack handle=%d", ack_handle); 1334 1335 if (ack_handle == gatt_cb.handle_of_h_r) 1336 { 1337 gatts_proc_srv_chg_ind_ack(p_tcb); 1338 /* there is no need to inform the application since srv chg is handled internally by GATT */ 1339 continue_processing = FALSE; 1340 } 1341 1342 gatts_chk_pending_ind(p_tcb); 1343 return continue_processing; 1344 } 1345 1346 /******************************************************************************* 1347 ** 1348 ** Function gatts_process_value_conf 1349 ** 1350 ** Description This function is called to process the handle value confirmation. 1351 ** 1352 ** Returns void 1353 ** 1354 *******************************************************************************/ 1355 void gatts_process_value_conf(tGATT_TCB *p_tcb, UINT8 op_code) 1356 { 1357 UINT16 handle = p_tcb->indicate_handle; 1358 UINT32 trans_id; 1359 UINT8 i; 1360 tGATT_SR_REG *p_rcb = gatt_cb.sr_reg; 1361 BOOLEAN continue_processing; 1362 UINT16 conn_id; 1363 1364 alarm_cancel(p_tcb->conf_timer); 1365 if (GATT_HANDLE_IS_VALID(handle)) 1366 { 1367 p_tcb->indicate_handle = 0; 1368 continue_processing = gatts_proc_ind_ack(p_tcb, handle); 1369 1370 if (continue_processing) 1371 { 1372 for (i = 0; i < GATT_MAX_SR_PROFILES; i ++, p_rcb ++) 1373 { 1374 if (p_rcb->in_use && p_rcb->s_hdl <= handle && p_rcb->e_hdl >= handle) 1375 { 1376 trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, handle); 1377 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_rcb->gatt_if); 1378 gatt_sr_send_req_callback(conn_id, 1379 trans_id, GATTS_REQ_TYPE_CONF, (tGATTS_DATA *)&handle); 1380 } 1381 } 1382 } 1383 } 1384 else 1385 { 1386 GATT_TRACE_ERROR("unexpected handle value confirmation"); 1387 } 1388 } 1389 1390 /******************************************************************************* 1391 ** 1392 ** Function gatt_server_handle_client_req 1393 ** 1394 ** Description This function is called to handle the client requests to 1395 ** server. 1396 ** 1397 ** 1398 ** Returns void 1399 ** 1400 *******************************************************************************/ 1401 void gatt_server_handle_client_req (tGATT_TCB *p_tcb, UINT8 op_code, 1402 UINT16 len, UINT8 *p_data) 1403 { 1404 /* there is pending command, discard this one */ 1405 if (!gatt_sr_cmd_empty(p_tcb) && op_code != GATT_HANDLE_VALUE_CONF) 1406 return; 1407 1408 /* the size of the message may not be bigger than the local max PDU size*/ 1409 /* The message has to be smaller than the agreed MTU, len does not include op code */ 1410 if (len >= p_tcb->payload_size) 1411 { 1412 GATT_TRACE_ERROR("server receive invalid PDU size:%d pdu size:%d", len + 1, p_tcb->payload_size ); 1413 /* for invalid request expecting response, send it now */ 1414 if (op_code != GATT_CMD_WRITE && 1415 op_code != GATT_SIGN_CMD_WRITE && 1416 op_code != GATT_HANDLE_VALUE_CONF) 1417 { 1418 gatt_send_error_rsp (p_tcb, GATT_INVALID_PDU, op_code, 0, FALSE); 1419 } 1420 /* otherwise, ignore the pkt */ 1421 } 1422 else 1423 { 1424 switch (op_code) 1425 { 1426 case GATT_REQ_READ_BY_GRP_TYPE: /* discover primary services */ 1427 case GATT_REQ_FIND_TYPE_VALUE: /* discover service by UUID */ 1428 gatts_process_primary_service_req (p_tcb, op_code, len, p_data); 1429 break; 1430 1431 case GATT_REQ_FIND_INFO:/* discover char descrptor */ 1432 gatts_process_find_info(p_tcb, op_code, len, p_data); 1433 break; 1434 1435 case GATT_REQ_READ_BY_TYPE: /* read characteristic value, char descriptor value */ 1436 /* discover characteristic, discover char by UUID */ 1437 gatts_process_read_by_type_req(p_tcb, op_code, len, p_data); 1438 break; 1439 1440 1441 case GATT_REQ_READ: /* read char/char descriptor value */ 1442 case GATT_REQ_READ_BLOB: 1443 case GATT_REQ_WRITE: /* write char/char descriptor value */ 1444 case GATT_CMD_WRITE: 1445 case GATT_SIGN_CMD_WRITE: 1446 case GATT_REQ_PREPARE_WRITE: 1447 gatts_process_attribute_req (p_tcb, op_code, len, p_data); 1448 break; 1449 1450 case GATT_HANDLE_VALUE_CONF: 1451 gatts_process_value_conf (p_tcb, op_code); 1452 break; 1453 1454 case GATT_REQ_MTU: 1455 gatts_process_mtu_req (p_tcb, len, p_data); 1456 break; 1457 1458 case GATT_REQ_EXEC_WRITE: 1459 gatt_process_exec_write_req (p_tcb, op_code, len, p_data); 1460 break; 1461 1462 case GATT_REQ_READ_MULTI: 1463 gatt_process_read_multi_req (p_tcb, op_code, len, p_data); 1464 break; 1465 1466 default: 1467 break; 1468 } 1469 } 1470 } 1471 1472 #endif /* BLE_INCLUDED */ 1473
