1 /****************************************************************************** 2 * 3 * Copyright (C) 2008-2012 Broadcom Corporation 4 * 5 * Licensed under the Apache License, Version 2.0 (the "License"); 6 * you may not use this file except in compliance with the License. 7 * You may obtain a copy of the License at: 8 * 9 * http://www.apache.org/licenses/LICENSE-2.0 10 * 11 * Unless required by applicable law or agreed to in writing, software 12 * distributed under the License is distributed on an "AS IS" BASIS, 13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 * See the License for the specific language governing permissions and 15 * limitations under the License. 16 * 17 ******************************************************************************/ 18 19 /****************************************************************************** 20 * 21 * this file contains the GATT server functions 22 * 23 ******************************************************************************/ 24 25 #include "bt_target.h" 26 #include "bt_utils.h" 27 #include "osi/include/osi.h" 28 29 #include <string.h> 30 #include "gatt_int.h" 31 #include "l2c_api.h" 32 #include "l2c_int.h" 33 #define GATT_MTU_REQ_MIN_LEN 2 34 35 /******************************************************************************* 36 * 37 * Function gatt_sr_enqueue_cmd 38 * 39 * Description This function enqueue the request from client which needs a 40 * application response, and update the transaction ID. 41 * 42 * Returns void 43 * 44 ******************************************************************************/ 45 uint32_t gatt_sr_enqueue_cmd(tGATT_TCB* p_tcb, uint8_t op_code, 46 uint16_t handle) { 47 tGATT_SR_CMD* p_cmd = &p_tcb->sr_cmd; 48 uint32_t trans_id = 0; 49 50 if ((p_cmd->op_code == 0) || 51 (op_code == GATT_HANDLE_VALUE_CONF)) /* no pending request */ 52 { 53 if (op_code == GATT_CMD_WRITE || op_code == GATT_SIGN_CMD_WRITE || 54 op_code == GATT_REQ_MTU || op_code == GATT_HANDLE_VALUE_CONF) { 55 trans_id = ++p_tcb->trans_id; 56 } else { 57 p_cmd->trans_id = ++p_tcb->trans_id; 58 p_cmd->op_code = op_code; 59 p_cmd->handle = handle; 60 p_cmd->status = GATT_NOT_FOUND; 61 p_tcb->trans_id %= GATT_TRANS_ID_MAX; 62 trans_id = p_cmd->trans_id; 63 } 64 } 65 66 return trans_id; 67 } 68 69 /******************************************************************************* 70 * 71 * Function gatt_sr_cmd_empty 72 * 73 * Description This function checks if the server command queue is empty. 74 * 75 * Returns true if empty, false if there is pending command. 76 * 77 ******************************************************************************/ 78 bool gatt_sr_cmd_empty(tGATT_TCB* p_tcb) { 79 return (p_tcb->sr_cmd.op_code == 0); 80 } 81 82 /******************************************************************************* 83 * 84 * Function gatt_dequeue_sr_cmd 85 * 86 * Description This function dequeue the request from command queue. 87 * 88 * Returns void 89 * 90 ******************************************************************************/ 91 void gatt_dequeue_sr_cmd(tGATT_TCB* p_tcb) { 92 /* Double check in case any buffers are queued */ 93 GATT_TRACE_DEBUG("gatt_dequeue_sr_cmd"); 94 if (p_tcb->sr_cmd.p_rsp_msg) 95 GATT_TRACE_ERROR("free p_tcb->sr_cmd.p_rsp_msg = %d", 96 p_tcb->sr_cmd.p_rsp_msg); 97 osi_free_and_reset((void**)&p_tcb->sr_cmd.p_rsp_msg); 98 99 while (!fixed_queue_is_empty(p_tcb->sr_cmd.multi_rsp_q)) 100 osi_free(fixed_queue_try_dequeue(p_tcb->sr_cmd.multi_rsp_q)); 101 fixed_queue_free(p_tcb->sr_cmd.multi_rsp_q, NULL); 102 memset(&p_tcb->sr_cmd, 0, sizeof(tGATT_SR_CMD)); 103 } 104 105 /******************************************************************************* 106 * 107 * Function process_read_multi_rsp 108 * 109 * Description This function check the read multiple response. 110 * 111 * Returns bool if all replies have been received 112 * 113 ******************************************************************************/ 114 static bool process_read_multi_rsp(tGATT_SR_CMD* p_cmd, tGATT_STATUS status, 115 tGATTS_RSP* p_msg, uint16_t mtu) { 116 uint16_t ii, total_len, len; 117 uint8_t* p; 118 bool is_overflow = false; 119 120 GATT_TRACE_DEBUG("%s status=%d mtu=%d", __func__, status, mtu); 121 122 if (p_cmd->multi_rsp_q == NULL) 123 p_cmd->multi_rsp_q = fixed_queue_new(SIZE_MAX); 124 125 /* Enqueue the response */ 126 BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(tGATTS_RSP)); 127 memcpy((void*)p_buf, (const void*)p_msg, sizeof(tGATTS_RSP)); 128 fixed_queue_enqueue(p_cmd->multi_rsp_q, p_buf); 129 130 p_cmd->status = status; 131 if (status == GATT_SUCCESS) { 132 GATT_TRACE_DEBUG("Multi read count=%d num_hdls=%d", 133 fixed_queue_length(p_cmd->multi_rsp_q), 134 p_cmd->multi_req.num_handles); 135 /* Wait till we get all the responses */ 136 if (fixed_queue_length(p_cmd->multi_rsp_q) == 137 p_cmd->multi_req.num_handles) { 138 len = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + mtu; 139 p_buf = (BT_HDR*)osi_calloc(len); 140 p_buf->offset = L2CAP_MIN_OFFSET; 141 p = (uint8_t*)(p_buf + 1) + p_buf->offset; 142 143 /* First byte in the response is the opcode */ 144 *p++ = GATT_RSP_READ_MULTI; 145 p_buf->len = 1; 146 147 /* Now walk through the buffers puting the data into the response in order 148 */ 149 list_t* list = NULL; 150 const list_node_t* node = NULL; 151 if (!fixed_queue_is_empty(p_cmd->multi_rsp_q)) 152 list = fixed_queue_get_list(p_cmd->multi_rsp_q); 153 for (ii = 0; ii < p_cmd->multi_req.num_handles; ii++) { 154 tGATTS_RSP* p_rsp = NULL; 155 156 if (list != NULL) { 157 if (ii == 0) 158 node = list_begin(list); 159 else 160 node = list_next(node); 161 if (node != list_end(list)) p_rsp = (tGATTS_RSP*)list_node(node); 162 } 163 164 if (p_rsp != NULL) { 165 total_len = (p_buf->len + p_rsp->attr_value.len); 166 167 if (total_len > mtu) { 168 /* just send the partial response for the overflow case */ 169 len = p_rsp->attr_value.len - (total_len - mtu); 170 is_overflow = true; 171 GATT_TRACE_DEBUG("multi read overflow available len=%d val_len=%d", 172 len, p_rsp->attr_value.len); 173 } else { 174 len = p_rsp->attr_value.len; 175 } 176 177 if (p_rsp->attr_value.handle == p_cmd->multi_req.handles[ii]) { 178 memcpy(p, p_rsp->attr_value.value, len); 179 if (!is_overflow) p += len; 180 p_buf->len += len; 181 } else { 182 p_cmd->status = GATT_NOT_FOUND; 183 break; 184 } 185 186 if (is_overflow) break; 187 188 } else { 189 p_cmd->status = GATT_NOT_FOUND; 190 break; 191 } 192 193 } /* loop through all handles*/ 194 195 /* Sanity check on the buffer length */ 196 if (p_buf->len == 0) { 197 GATT_TRACE_ERROR("process_read_multi_rsp - nothing found!!"); 198 p_cmd->status = GATT_NOT_FOUND; 199 osi_free(p_buf); 200 GATT_TRACE_DEBUG("osi_free(p_buf)"); 201 } else if (p_cmd->p_rsp_msg != NULL) { 202 osi_free(p_buf); 203 } else { 204 p_cmd->p_rsp_msg = p_buf; 205 } 206 207 return (true); 208 } 209 } else /* any handle read exception occurs, return error */ 210 { 211 return (true); 212 } 213 214 /* If here, still waiting */ 215 return (false); 216 } 217 218 /******************************************************************************* 219 * 220 * Function gatt_sr_process_app_rsp 221 * 222 * Description This function checks whether the response message from 223 * application matches any pending request. 224 * 225 * Returns void 226 * 227 ******************************************************************************/ 228 tGATT_STATUS gatt_sr_process_app_rsp(tGATT_TCB* p_tcb, tGATT_IF gatt_if, 229 UNUSED_ATTR uint32_t trans_id, 230 uint8_t op_code, tGATT_STATUS status, 231 tGATTS_RSP* p_msg) { 232 tGATT_STATUS ret_code = GATT_SUCCESS; 233 234 GATT_TRACE_DEBUG("gatt_sr_process_app_rsp gatt_if=%d", gatt_if); 235 236 gatt_sr_update_cback_cnt(p_tcb, gatt_if, false, false); 237 238 if (op_code == GATT_REQ_READ_MULTI) { 239 /* If no error and still waiting, just return */ 240 if (!process_read_multi_rsp(&p_tcb->sr_cmd, status, p_msg, 241 p_tcb->payload_size)) 242 return (GATT_SUCCESS); 243 } else { 244 if (op_code == GATT_REQ_PREPARE_WRITE && status == GATT_SUCCESS) 245 gatt_sr_update_prep_cnt(p_tcb, gatt_if, true, false); 246 247 if (op_code == GATT_REQ_EXEC_WRITE && status != GATT_SUCCESS) 248 gatt_sr_reset_cback_cnt(p_tcb); 249 250 p_tcb->sr_cmd.status = status; 251 252 if (gatt_sr_is_cback_cnt_zero(p_tcb) && status == GATT_SUCCESS) { 253 if (p_tcb->sr_cmd.p_rsp_msg == NULL) { 254 p_tcb->sr_cmd.p_rsp_msg = attp_build_sr_msg( 255 p_tcb, (uint8_t)(op_code + 1), (tGATT_SR_MSG*)p_msg); 256 } else { 257 GATT_TRACE_ERROR("Exception!!! already has respond message"); 258 } 259 } 260 } 261 if (gatt_sr_is_cback_cnt_zero(p_tcb)) { 262 if ((p_tcb->sr_cmd.status == GATT_SUCCESS) && (p_tcb->sr_cmd.p_rsp_msg)) { 263 ret_code = attp_send_sr_msg(p_tcb, p_tcb->sr_cmd.p_rsp_msg); 264 p_tcb->sr_cmd.p_rsp_msg = NULL; 265 } else { 266 ret_code = gatt_send_error_rsp(p_tcb, status, op_code, 267 p_tcb->sr_cmd.handle, false); 268 } 269 270 gatt_dequeue_sr_cmd(p_tcb); 271 } 272 273 GATT_TRACE_DEBUG("gatt_sr_process_app_rsp ret_code=%d", ret_code); 274 275 return ret_code; 276 } 277 278 /******************************************************************************* 279 * 280 * Function gatt_process_exec_write_req 281 * 282 * Description This function is called to process the execute write request 283 * from client. 284 * 285 * Returns void 286 * 287 ******************************************************************************/ 288 void gatt_process_exec_write_req(tGATT_TCB* p_tcb, uint8_t op_code, 289 UNUSED_ATTR uint16_t len, uint8_t* p_data) { 290 uint8_t *p = p_data, flag, i = 0; 291 uint32_t trans_id = 0; 292 tGATT_IF gatt_if; 293 uint16_t conn_id; 294 295 #if (GATT_CONFORMANCE_TESTING == TRUE) 296 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) { 297 GATT_TRACE_DEBUG( 298 "Conformance tst: forced err rspv for Execute Write: error status=%d", 299 gatt_cb.err_status); 300 301 gatt_send_error_rsp(p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, 302 gatt_cb.handle, false); 303 304 return; 305 } 306 #endif 307 308 STREAM_TO_UINT8(flag, p); 309 310 /* mask the flag */ 311 flag &= GATT_PREP_WRITE_EXEC; 312 313 /* no prep write is queued */ 314 if (!gatt_sr_is_prep_cnt_zero(p_tcb)) { 315 trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, 0); 316 gatt_sr_copy_prep_cnt_to_cback_cnt(p_tcb); 317 318 for (i = 0; i < GATT_MAX_APPS; i++) { 319 if (p_tcb->prep_cnt[i]) { 320 gatt_if = (tGATT_IF)(i + 1); 321 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, gatt_if); 322 gatt_sr_send_req_callback(conn_id, trans_id, GATTS_REQ_TYPE_WRITE_EXEC, 323 (tGATTS_DATA*)&flag); 324 p_tcb->prep_cnt[i] = 0; 325 } 326 } 327 } else /* nothing needs to be executed , send response now */ 328 { 329 GATT_TRACE_ERROR("gatt_process_exec_write_req: no prepare write pending"); 330 gatt_send_error_rsp(p_tcb, GATT_ERROR, GATT_REQ_EXEC_WRITE, 0, false); 331 } 332 } 333 334 /******************************************************************************* 335 * 336 * Function gatt_process_read_multi_req 337 * 338 * Description This function is called to process the read multiple request 339 * from client. 340 * 341 * Returns void 342 * 343 ******************************************************************************/ 344 void gatt_process_read_multi_req(tGATT_TCB* p_tcb, uint8_t op_code, 345 uint16_t len, uint8_t* p_data) { 346 uint32_t trans_id; 347 uint16_t handle = 0, ll = len; 348 uint8_t* p = p_data; 349 tGATT_STATUS err = GATT_SUCCESS; 350 uint8_t sec_flag, key_size; 351 352 GATT_TRACE_DEBUG("gatt_process_read_multi_req"); 353 p_tcb->sr_cmd.multi_req.num_handles = 0; 354 355 gatt_sr_get_sec_info(p_tcb->peer_bda, p_tcb->transport, &sec_flag, &key_size); 356 357 #if (GATT_CONFORMANCE_TESTING == TRUE) 358 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) { 359 GATT_TRACE_DEBUG( 360 "Conformance tst: forced err rspvofr ReadMultiple: error status=%d", 361 gatt_cb.err_status); 362 363 STREAM_TO_UINT16(handle, p); 364 365 gatt_send_error_rsp(p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, handle, 366 false); 367 368 return; 369 } 370 #endif 371 372 while (ll >= 2 && 373 p_tcb->sr_cmd.multi_req.num_handles < GATT_MAX_READ_MULTI_HANDLES) { 374 STREAM_TO_UINT16(handle, p); 375 376 auto it = gatt_sr_find_i_rcb_by_handle(handle); 377 if (it != gatt_cb.srv_list_info->end()) { 378 p_tcb->sr_cmd.multi_req.handles[p_tcb->sr_cmd.multi_req.num_handles++] = 379 handle; 380 381 /* check read permission */ 382 err = gatts_read_attr_perm_check(it->p_db, false, handle, sec_flag, 383 key_size); 384 if (err != GATT_SUCCESS) { 385 GATT_TRACE_DEBUG("read permission denied : 0x%02x", err); 386 break; 387 } 388 } else { 389 /* invalid handle */ 390 err = GATT_INVALID_HANDLE; 391 break; 392 } 393 ll -= 2; 394 } 395 396 if (ll != 0) { 397 GATT_TRACE_ERROR("max attribute handle reached in ReadMultiple Request."); 398 } 399 400 if (p_tcb->sr_cmd.multi_req.num_handles == 0) err = GATT_INVALID_HANDLE; 401 402 if (err == GATT_SUCCESS) { 403 trans_id = 404 gatt_sr_enqueue_cmd(p_tcb, op_code, p_tcb->sr_cmd.multi_req.handles[0]); 405 if (trans_id != 0) { 406 gatt_sr_reset_cback_cnt(p_tcb); /* read multiple use multi_rsp_q's count*/ 407 408 for (ll = 0; ll < p_tcb->sr_cmd.multi_req.num_handles; ll++) { 409 tGATTS_RSP* p_msg = (tGATTS_RSP*)osi_calloc(sizeof(tGATTS_RSP)); 410 handle = p_tcb->sr_cmd.multi_req.handles[ll]; 411 auto it = gatt_sr_find_i_rcb_by_handle(handle); 412 413 p_msg->attr_value.handle = handle; 414 err = gatts_read_attr_value_by_handle( 415 p_tcb, it->p_db, op_code, handle, 0, p_msg->attr_value.value, 416 &p_msg->attr_value.len, GATT_MAX_ATTR_LEN, sec_flag, key_size, 417 trans_id); 418 419 if (err == GATT_SUCCESS) { 420 gatt_sr_process_app_rsp(p_tcb, it->gatt_if, trans_id, op_code, 421 GATT_SUCCESS, p_msg); 422 } 423 /* either not using or done using the buffer, release it now */ 424 osi_free(p_msg); 425 } 426 } else 427 err = GATT_NO_RESOURCES; 428 } 429 430 /* in theroy BUSY is not possible(should already been checked), protected 431 * check */ 432 if (err != GATT_SUCCESS && err != GATT_PENDING && err != GATT_BUSY) 433 gatt_send_error_rsp(p_tcb, err, op_code, handle, false); 434 } 435 436 /******************************************************************************* 437 * 438 * Function gatt_build_primary_service_rsp 439 * 440 * Description Primamry service request processed internally. Theretically 441 * only deal with ReadByTypeVAlue and ReadByGroupType. 442 * 443 * Returns void 444 * 445 ******************************************************************************/ 446 static tGATT_STATUS gatt_build_primary_service_rsp( 447 BT_HDR* p_msg, tGATT_TCB* p_tcb, uint8_t op_code, uint16_t s_hdl, 448 uint16_t e_hdl, UNUSED_ATTR uint8_t* p_data, tBT_UUID value) { 449 tGATT_STATUS status = GATT_NOT_FOUND; 450 uint8_t handle_len = 4, *p; 451 tBT_UUID* p_uuid; 452 453 p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET; 454 455 for (tGATT_SRV_LIST_ELEM& el : *gatt_cb.srv_list_info) { 456 if (el.s_hdl >= s_hdl && el.s_hdl <= e_hdl && 457 el.type == GATT_UUID_PRI_SERVICE) { 458 p_uuid = gatts_get_service_uuid(el.p_db); 459 if (p_uuid != NULL) { 460 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) handle_len = 4 + p_uuid->len; 461 462 /* get the length byte in the repsonse */ 463 if (p_msg->offset == 0) { 464 *p++ = op_code + 1; 465 p_msg->len++; 466 p_msg->offset = handle_len; 467 468 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) { 469 *p++ = (uint8_t)p_msg->offset; /* length byte */ 470 p_msg->len++; 471 } 472 } 473 474 if (p_msg->len + p_msg->offset <= p_tcb->payload_size && 475 handle_len == p_msg->offset) { 476 if (op_code != GATT_REQ_FIND_TYPE_VALUE || 477 gatt_uuid_compare(value, *p_uuid)) { 478 UINT16_TO_STREAM(p, el.s_hdl); 479 480 if (gatt_cb.last_primary_s_handle && 481 gatt_cb.last_primary_s_handle == el.s_hdl) { 482 GATT_TRACE_DEBUG("Use 0xFFFF for the last primary attribute"); 483 /* see GATT ERRATA 4065, 4063, ATT ERRATA 4062 */ 484 UINT16_TO_STREAM(p, 0xFFFF); 485 } else { 486 UINT16_TO_STREAM(p, el.e_hdl); 487 } 488 489 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) 490 gatt_build_uuid_to_stream(&p, *p_uuid); 491 492 status = GATT_SUCCESS; 493 p_msg->len += p_msg->offset; 494 } 495 } else 496 break; 497 } 498 } 499 } 500 p_msg->offset = L2CAP_MIN_OFFSET; 501 502 return status; 503 } 504 505 /** 506 * fill the find information response information in the given buffer. 507 * 508 * Returns true: if data filled sucessfully. 509 * false: packet full, or format mismatch. 510 */ 511 static tGATT_STATUS gatt_build_find_info_rsp(tGATT_SRV_LIST_ELEM& el, 512 BT_HDR* p_msg, uint16_t* p_len, 513 uint16_t s_hdl, uint16_t e_hdl) { 514 tGATT_STATUS status = GATT_NOT_FOUND; 515 uint8_t* p; 516 uint16_t len = *p_len; 517 uint8_t info_pair_len[2] = {4, 18}; 518 519 if (!el.p_db) return status; 520 521 /* check the attribute database */ 522 523 p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET + p_msg->len; 524 525 for (auto& attr : el.p_db->attr_list) { 526 if (attr.handle > e_hdl) { 527 break; 528 } 529 530 if (attr.handle >= s_hdl) { 531 if (p_msg->offset == 0) 532 p_msg->offset = (attr.uuid.len == LEN_UUID_16) 533 ? GATT_INFO_TYPE_PAIR_16 534 : GATT_INFO_TYPE_PAIR_128; 535 536 if (len >= info_pair_len[p_msg->offset - 1]) { 537 if (p_msg->offset == GATT_INFO_TYPE_PAIR_16 && 538 attr.uuid.len == LEN_UUID_16) { 539 UINT16_TO_STREAM(p, attr.handle); 540 UINT16_TO_STREAM(p, attr.uuid.uu.uuid16); 541 } else if (p_msg->offset == GATT_INFO_TYPE_PAIR_128 && 542 attr.uuid.len == LEN_UUID_128) { 543 UINT16_TO_STREAM(p, attr.handle); 544 ARRAY_TO_STREAM(p, attr.uuid.uu.uuid128, LEN_UUID_128); 545 } else if (p_msg->offset == GATT_INFO_TYPE_PAIR_128 && 546 attr.uuid.len == LEN_UUID_32) { 547 UINT16_TO_STREAM(p, attr.handle); 548 gatt_convert_uuid32_to_uuid128(p, attr.uuid.uu.uuid32); 549 p += LEN_UUID_128; 550 } else { 551 GATT_TRACE_ERROR("format mismatch"); 552 status = GATT_NO_RESOURCES; 553 break; 554 /* format mismatch */ 555 } 556 p_msg->len += info_pair_len[p_msg->offset - 1]; 557 len -= info_pair_len[p_msg->offset - 1]; 558 status = GATT_SUCCESS; 559 560 } else { 561 status = GATT_NO_RESOURCES; 562 break; 563 } 564 } 565 } 566 567 *p_len = len; 568 return status; 569 } 570 571 /******************************************************************************* 572 * 573 * Function gatts_internal_read_by_type_req 574 * 575 * Description Check to see if the ReadByType request can be handled 576 * internally. 577 * 578 * Returns void 579 * 580 ******************************************************************************/ 581 static tGATT_STATUS gatts_validate_packet_format( 582 uint8_t op_code, uint16_t* p_len, uint8_t** p_data, tBT_UUID* p_uuid_filter, 583 uint16_t* p_s_hdl, uint16_t* p_e_hdl) { 584 tGATT_STATUS reason = GATT_SUCCESS; 585 uint16_t uuid_len, s_hdl = 0, e_hdl = 0; 586 uint16_t len = *p_len; 587 uint8_t* p = *p_data; 588 589 if (len >= 4) { 590 /* obtain starting handle, and ending handle */ 591 STREAM_TO_UINT16(s_hdl, p); 592 STREAM_TO_UINT16(e_hdl, p); 593 len -= 4; 594 595 if (s_hdl > e_hdl || !GATT_HANDLE_IS_VALID(s_hdl) || 596 !GATT_HANDLE_IS_VALID(e_hdl)) { 597 reason = GATT_INVALID_HANDLE; 598 } 599 /* for these PDUs, uuid filter must present */ 600 else if (op_code == GATT_REQ_READ_BY_GRP_TYPE || 601 op_code == GATT_REQ_FIND_TYPE_VALUE || 602 op_code == GATT_REQ_READ_BY_TYPE) { 603 if (len >= 2 && p_uuid_filter != NULL) { 604 uuid_len = (op_code == GATT_REQ_FIND_TYPE_VALUE) ? 2 : len; 605 606 /* parse uuid now */ 607 if (gatt_parse_uuid_from_cmd(p_uuid_filter, uuid_len, &p) == false || 608 p_uuid_filter->len == 0) { 609 GATT_TRACE_DEBUG("UUID filter does not exsit"); 610 reason = GATT_INVALID_PDU; 611 } else 612 len -= p_uuid_filter->len; 613 } else 614 reason = GATT_INVALID_PDU; 615 } 616 } else 617 reason = GATT_INVALID_PDU; 618 619 *p_data = p; 620 *p_len = len; 621 *p_s_hdl = s_hdl; 622 *p_e_hdl = e_hdl; 623 624 return reason; 625 } 626 627 /******************************************************************************* 628 * 629 * Function gatts_process_primary_service_req 630 * 631 * Description Process ReadByGroupType/ReadByTypeValue request, for 632 * discovering all primary services or discover primary service 633 * by UUID request. 634 * 635 * Returns void 636 * 637 ******************************************************************************/ 638 void gatts_process_primary_service_req(tGATT_TCB* p_tcb, uint8_t op_code, 639 uint16_t len, uint8_t* p_data) { 640 uint8_t reason = GATT_INVALID_PDU; 641 uint16_t s_hdl = 0, e_hdl = 0; 642 tBT_UUID uuid, value, 643 primary_service = {LEN_UUID_16, {GATT_UUID_PRI_SERVICE}}; 644 BT_HDR* p_msg = NULL; 645 uint16_t msg_len = 646 (uint16_t)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET); 647 648 memset(&value, 0, sizeof(tBT_UUID)); 649 reason = gatts_validate_packet_format(op_code, &len, &p_data, &uuid, &s_hdl, 650 &e_hdl); 651 652 if (reason == GATT_SUCCESS) { 653 if (gatt_uuid_compare(uuid, primary_service)) { 654 if (op_code == GATT_REQ_FIND_TYPE_VALUE) { 655 if (gatt_parse_uuid_from_cmd(&value, len, &p_data) == false) 656 reason = GATT_INVALID_PDU; 657 } 658 659 if (reason == GATT_SUCCESS) { 660 p_msg = (BT_HDR*)osi_calloc(msg_len); 661 reason = gatt_build_primary_service_rsp(p_msg, p_tcb, op_code, s_hdl, 662 e_hdl, p_data, value); 663 } 664 } else { 665 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) { 666 reason = GATT_UNSUPPORT_GRP_TYPE; 667 GATT_TRACE_DEBUG("unexpected ReadByGrpType Group: 0x%04x", 668 uuid.uu.uuid16); 669 } else { 670 /* we do not support ReadByTypeValue with any non-primamry_service type 671 */ 672 reason = GATT_NOT_FOUND; 673 GATT_TRACE_DEBUG("unexpected ReadByTypeValue type: 0x%04x", 674 uuid.uu.uuid16); 675 } 676 } 677 } 678 679 if (reason != GATT_SUCCESS) { 680 osi_free(p_msg); 681 gatt_send_error_rsp(p_tcb, reason, op_code, s_hdl, false); 682 } else 683 attp_send_sr_msg(p_tcb, p_msg); 684 } 685 686 /******************************************************************************* 687 * 688 * Function gatts_process_find_info 689 * 690 * Description process find information request, for discover character 691 * descriptors. 692 * 693 * Returns void 694 * 695 ******************************************************************************/ 696 static void gatts_process_find_info(tGATT_TCB* p_tcb, uint8_t op_code, 697 uint16_t len, uint8_t* p_data) { 698 uint8_t reason = GATT_INVALID_PDU, *p; 699 uint16_t s_hdl = 0, e_hdl = 0, buf_len; 700 BT_HDR* p_msg = NULL; 701 702 reason = gatts_validate_packet_format(op_code, &len, &p_data, NULL, &s_hdl, 703 &e_hdl); 704 705 if (reason == GATT_SUCCESS) { 706 buf_len = 707 (uint16_t)(sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET); 708 709 p_msg = (BT_HDR*)osi_calloc(buf_len); 710 reason = GATT_NOT_FOUND; 711 712 p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET; 713 *p++ = op_code + 1; 714 p_msg->len = 2; 715 716 buf_len = p_tcb->payload_size - 2; 717 718 for (tGATT_SRV_LIST_ELEM& el : *gatt_cb.srv_list_info) { 719 if (el.s_hdl <= e_hdl && el.e_hdl >= s_hdl) { 720 reason = gatt_build_find_info_rsp(el, p_msg, &buf_len, s_hdl, e_hdl); 721 if (reason == GATT_NO_RESOURCES) { 722 reason = GATT_SUCCESS; 723 break; 724 } 725 } 726 } 727 728 *p = (uint8_t)p_msg->offset; 729 730 p_msg->offset = L2CAP_MIN_OFFSET; 731 } 732 733 if (reason != GATT_SUCCESS) { 734 osi_free(p_msg); 735 gatt_send_error_rsp(p_tcb, reason, op_code, s_hdl, false); 736 } else 737 attp_send_sr_msg(p_tcb, p_msg); 738 } 739 740 /******************************************************************************* 741 * 742 * Function gatts_process_mtu_req 743 * 744 * Description This function is called to process excahnge MTU request. 745 * Only used on LE. 746 * 747 * Returns void 748 * 749 ******************************************************************************/ 750 static void gatts_process_mtu_req(tGATT_TCB* p_tcb, uint16_t len, 751 uint8_t* p_data) { 752 uint16_t mtu = 0; 753 uint8_t *p = p_data, i; 754 BT_HDR* p_buf; 755 uint16_t conn_id; 756 757 /* BR/EDR conenction, send error response */ 758 if (p_tcb->att_lcid != L2CAP_ATT_CID) { 759 gatt_send_error_rsp(p_tcb, GATT_REQ_NOT_SUPPORTED, GATT_REQ_MTU, 0, false); 760 } else if (len < GATT_MTU_REQ_MIN_LEN) { 761 GATT_TRACE_ERROR("invalid MTU request PDU received."); 762 gatt_send_error_rsp(p_tcb, GATT_INVALID_PDU, GATT_REQ_MTU, 0, false); 763 } else { 764 STREAM_TO_UINT16(mtu, p); 765 /* mtu must be greater than default MTU which is 23/48 */ 766 if (mtu < GATT_DEF_BLE_MTU_SIZE) 767 p_tcb->payload_size = GATT_DEF_BLE_MTU_SIZE; 768 else if (mtu > GATT_MAX_MTU_SIZE) 769 p_tcb->payload_size = GATT_MAX_MTU_SIZE; 770 else 771 p_tcb->payload_size = mtu; 772 773 GATT_TRACE_ERROR("MTU request PDU with MTU size %d", p_tcb->payload_size); 774 775 l2cble_set_fixed_channel_tx_data_length(p_tcb->peer_bda, L2CAP_ATT_CID, 776 p_tcb->payload_size); 777 778 p_buf = attp_build_sr_msg(p_tcb, GATT_RSP_MTU, 779 (tGATT_SR_MSG*)&p_tcb->payload_size); 780 if (p_buf != NULL) { 781 attp_send_sr_msg(p_tcb, p_buf); 782 783 /* Notify all registered applicaiton with new MTU size. Us a transaction 784 * ID */ 785 /* of 0, as no response is allowed from applcations */ 786 787 for (i = 0; i < GATT_MAX_APPS; i++) { 788 if (gatt_cb.cl_rcb[i].in_use) { 789 conn_id = 790 GATT_CREATE_CONN_ID(p_tcb->tcb_idx, gatt_cb.cl_rcb[i].gatt_if); 791 gatt_sr_send_req_callback(conn_id, 0, GATTS_REQ_TYPE_MTU, 792 (tGATTS_DATA*)&p_tcb->payload_size); 793 } 794 } 795 } 796 } 797 } 798 799 /******************************************************************************* 800 * 801 * Function gatts_process_read_by_type_req 802 * 803 * Description process Read By type request. 804 * This PDU can be used to perform: 805 * - read characteristic value 806 * - read characteristic descriptor value 807 * - discover characteristic 808 * - discover characteristic by UUID 809 * - relationship discovery 810 * 811 * Returns void 812 * 813 ******************************************************************************/ 814 void gatts_process_read_by_type_req(tGATT_TCB* p_tcb, uint8_t op_code, 815 uint16_t len, uint8_t* p_data) { 816 tBT_UUID uuid; 817 size_t msg_len = sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET; 818 uint16_t buf_len, s_hdl, e_hdl, err_hdl = 0; 819 BT_HDR* p_msg = NULL; 820 tGATT_STATUS reason, ret; 821 uint8_t* p; 822 uint8_t sec_flag, key_size; 823 824 reason = gatts_validate_packet_format(op_code, &len, &p_data, &uuid, &s_hdl, 825 &e_hdl); 826 827 #if (GATT_CONFORMANCE_TESTING == TRUE) 828 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) { 829 GATT_TRACE_DEBUG( 830 "Conformance tst: forced err rsp for ReadByType: error status=%d", 831 gatt_cb.err_status); 832 833 gatt_send_error_rsp(p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, s_hdl, 834 false); 835 836 return; 837 } 838 #endif 839 840 if (reason == GATT_SUCCESS) { 841 p_msg = (BT_HDR*)osi_calloc(msg_len); 842 p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET; 843 844 *p++ = op_code + 1; 845 /* reserve length byte */ 846 p_msg->len = 2; 847 buf_len = p_tcb->payload_size - 2; 848 849 reason = GATT_NOT_FOUND; 850 851 for (tGATT_SRV_LIST_ELEM& el : *gatt_cb.srv_list_info) { 852 if (el.s_hdl <= e_hdl && el.e_hdl >= s_hdl) { 853 gatt_sr_get_sec_info(p_tcb->peer_bda, p_tcb->transport, &sec_flag, 854 &key_size); 855 856 ret = gatts_db_read_attr_value_by_type(p_tcb, el.p_db, op_code, p_msg, 857 s_hdl, e_hdl, uuid, &buf_len, 858 sec_flag, key_size, 0, &err_hdl); 859 if (ret != GATT_NOT_FOUND) { 860 reason = ret; 861 862 if (ret == GATT_NO_RESOURCES) reason = GATT_SUCCESS; 863 } 864 if (ret != GATT_SUCCESS && ret != GATT_NOT_FOUND) { 865 s_hdl = err_hdl; 866 break; 867 } 868 } 869 } 870 *p = (uint8_t)p_msg->offset; 871 p_msg->offset = L2CAP_MIN_OFFSET; 872 } 873 if (reason != GATT_SUCCESS) { 874 osi_free(p_msg); 875 876 /* in theroy BUSY is not possible(should already been checked), protected 877 * check */ 878 if (reason != GATT_PENDING && reason != GATT_BUSY) 879 gatt_send_error_rsp(p_tcb, reason, op_code, s_hdl, false); 880 } else 881 attp_send_sr_msg(p_tcb, p_msg); 882 } 883 884 /** 885 * This function is called to process the write request from client. 886 */ 887 void gatts_process_write_req(tGATT_TCB* p_tcb, tGATT_SRV_LIST_ELEM& el, 888 uint16_t handle, uint8_t op_code, uint16_t len, 889 uint8_t* p_data, 890 bt_gatt_db_attribute_type_t gatt_type) { 891 tGATTS_DATA sr_data; 892 uint32_t trans_id; 893 tGATT_STATUS status; 894 uint8_t sec_flag, key_size, *p = p_data; 895 uint16_t conn_id; 896 897 memset(&sr_data, 0, sizeof(tGATTS_DATA)); 898 899 switch (op_code) { 900 case GATT_REQ_PREPARE_WRITE: 901 if (len < 2) { 902 GATT_TRACE_ERROR( 903 "%s: Prepare write request was invalid - missing offset, sending " 904 "error response", 905 __func__); 906 gatt_send_error_rsp(p_tcb, GATT_INVALID_PDU, op_code, handle, false); 907 return; 908 } 909 sr_data.write_req.is_prep = true; 910 STREAM_TO_UINT16(sr_data.write_req.offset, p); 911 len -= 2; 912 /* fall through */ 913 case GATT_SIGN_CMD_WRITE: 914 if (op_code == GATT_SIGN_CMD_WRITE) { 915 GATT_TRACE_DEBUG("Write CMD with data sigining"); 916 len -= GATT_AUTH_SIGN_LEN; 917 } 918 /* fall through */ 919 case GATT_CMD_WRITE: 920 case GATT_REQ_WRITE: 921 if (op_code == GATT_REQ_WRITE || op_code == GATT_REQ_PREPARE_WRITE) 922 sr_data.write_req.need_rsp = true; 923 sr_data.write_req.handle = handle; 924 sr_data.write_req.len = len; 925 if (len != 0 && p != NULL) { 926 memcpy(sr_data.write_req.value, p, len); 927 } 928 break; 929 } 930 931 gatt_sr_get_sec_info(p_tcb->peer_bda, p_tcb->transport, &sec_flag, &key_size); 932 933 status = gatts_write_attr_perm_check(el.p_db, op_code, handle, 934 sr_data.write_req.offset, p, len, 935 sec_flag, key_size); 936 937 if (status == GATT_SUCCESS) { 938 trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, handle); 939 if (trans_id != 0) { 940 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, el.gatt_if); 941 942 uint8_t opcode = 0; 943 if (gatt_type == BTGATT_DB_DESCRIPTOR) { 944 opcode = GATTS_REQ_TYPE_WRITE_DESCRIPTOR; 945 } else if (gatt_type == BTGATT_DB_CHARACTERISTIC) { 946 opcode = GATTS_REQ_TYPE_WRITE_CHARACTERISTIC; 947 } else { 948 GATT_TRACE_ERROR( 949 "%s: Attempt to write attribute that's not tied with" 950 " characteristic or descriptor value.", 951 __func__); 952 status = GATT_ERROR; 953 } 954 955 if (opcode) { 956 gatt_sr_send_req_callback(conn_id, trans_id, opcode, &sr_data); 957 status = GATT_PENDING; 958 } 959 } else { 960 GATT_TRACE_ERROR("max pending command, send error"); 961 status = GATT_BUSY; /* max pending command, application error */ 962 } 963 } 964 965 /* in theroy BUSY is not possible(should already been checked), protected 966 * check */ 967 if (status != GATT_PENDING && status != GATT_BUSY && 968 (op_code == GATT_REQ_PREPARE_WRITE || op_code == GATT_REQ_WRITE)) { 969 gatt_send_error_rsp(p_tcb, status, op_code, handle, false); 970 } 971 return; 972 } 973 974 /** 975 * This function is called to process the read request from client. 976 */ 977 static void gatts_process_read_req(tGATT_TCB* p_tcb, tGATT_SRV_LIST_ELEM& el, 978 uint8_t op_code, uint16_t handle, 979 UNUSED_ATTR uint16_t len, uint8_t* p_data) { 980 size_t buf_len = sizeof(BT_HDR) + p_tcb->payload_size + L2CAP_MIN_OFFSET; 981 tGATT_STATUS reason; 982 uint8_t sec_flag, key_size, *p; 983 uint16_t offset = 0, value_len = 0; 984 BT_HDR* p_msg = (BT_HDR*)osi_calloc(buf_len); 985 986 if (op_code == GATT_REQ_READ_BLOB) STREAM_TO_UINT16(offset, p_data); 987 988 p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET; 989 *p++ = op_code + 1; 990 p_msg->len = 1; 991 buf_len = p_tcb->payload_size - 1; 992 993 gatt_sr_get_sec_info(p_tcb->peer_bda, p_tcb->transport, &sec_flag, &key_size); 994 995 reason = gatts_read_attr_value_by_handle( 996 p_tcb, el.p_db, op_code, handle, offset, p, &value_len, (uint16_t)buf_len, 997 sec_flag, key_size, 0); 998 999 p_msg->len += value_len; 1000 1001 if (reason != GATT_SUCCESS) { 1002 osi_free(p_msg); 1003 1004 /* in theroy BUSY is not possible(should already been checked), protected 1005 * check */ 1006 if (reason != GATT_PENDING && reason != GATT_BUSY) 1007 gatt_send_error_rsp(p_tcb, reason, op_code, handle, false); 1008 } else 1009 attp_send_sr_msg(p_tcb, p_msg); 1010 } 1011 1012 /******************************************************************************* 1013 * 1014 * Function gatts_process_attribute_req 1015 * 1016 * Description This function is called to process the per attribute handle 1017 * request from client. 1018 * 1019 * Returns void 1020 * 1021 ******************************************************************************/ 1022 void gatts_process_attribute_req(tGATT_TCB* p_tcb, uint8_t op_code, 1023 uint16_t len, uint8_t* p_data) { 1024 uint16_t handle = 0; 1025 uint8_t* p = p_data; 1026 tGATT_STATUS status = GATT_INVALID_HANDLE; 1027 1028 if (len < 2) { 1029 GATT_TRACE_ERROR("Illegal PDU length, discard request"); 1030 status = GATT_INVALID_PDU; 1031 } else { 1032 STREAM_TO_UINT16(handle, p); 1033 len -= 2; 1034 } 1035 1036 #if (GATT_CONFORMANCE_TESTING == TRUE) 1037 gatt_cb.handle = handle; 1038 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) { 1039 GATT_TRACE_DEBUG("Conformance tst: forced err rsp: error status=%d", 1040 gatt_cb.err_status); 1041 1042 gatt_send_error_rsp(p_tcb, gatt_cb.err_status, gatt_cb.req_op_code, handle, 1043 false); 1044 1045 return; 1046 } 1047 #endif 1048 1049 if (GATT_HANDLE_IS_VALID(handle)) { 1050 for (auto& el : *gatt_cb.srv_list_info) { 1051 if (el.s_hdl <= handle && el.e_hdl >= handle) { 1052 for (const auto& attr : el.p_db->attr_list) { 1053 if (attr.handle == handle) { 1054 switch (op_code) { 1055 case GATT_REQ_READ: /* read char/char descriptor value */ 1056 case GATT_REQ_READ_BLOB: 1057 gatts_process_read_req(p_tcb, el, op_code, handle, len, p); 1058 break; 1059 1060 case GATT_REQ_WRITE: /* write char/char descriptor value */ 1061 case GATT_CMD_WRITE: 1062 case GATT_SIGN_CMD_WRITE: 1063 case GATT_REQ_PREPARE_WRITE: 1064 gatts_process_write_req(p_tcb, el, handle, op_code, len, p, 1065 attr.gatt_type); 1066 break; 1067 default: 1068 break; 1069 } 1070 status = GATT_SUCCESS; 1071 break; 1072 } 1073 } 1074 break; 1075 } 1076 } 1077 } 1078 1079 if (status != GATT_SUCCESS && op_code != GATT_CMD_WRITE && 1080 op_code != GATT_SIGN_CMD_WRITE) 1081 gatt_send_error_rsp(p_tcb, status, op_code, handle, false); 1082 } 1083 1084 /******************************************************************************* 1085 * 1086 * Function gatts_proc_srv_chg_ind_ack 1087 * 1088 * Description This function process the service changed indicaiton ACK 1089 * 1090 * Returns void 1091 * 1092 ******************************************************************************/ 1093 static void gatts_proc_srv_chg_ind_ack(tGATT_TCB* p_tcb) { 1094 tGATTS_SRV_CHG_REQ req; 1095 tGATTS_SRV_CHG* p_buf = NULL; 1096 1097 GATT_TRACE_DEBUG("gatts_proc_srv_chg_ind_ack"); 1098 1099 p_buf = gatt_is_bda_in_the_srv_chg_clt_list(p_tcb->peer_bda); 1100 if (p_buf != NULL) { 1101 GATT_TRACE_DEBUG("NV update set srv chg = false"); 1102 p_buf->srv_changed = false; 1103 memcpy(&req.srv_chg, p_buf, sizeof(tGATTS_SRV_CHG)); 1104 if (gatt_cb.cb_info.p_srv_chg_callback) 1105 (*gatt_cb.cb_info.p_srv_chg_callback)(GATTS_SRV_CHG_CMD_UPDATE_CLIENT, 1106 &req, NULL); 1107 } 1108 } 1109 1110 /******************************************************************************* 1111 * 1112 * Function gatts_chk_pending_ind 1113 * 1114 * Description This function check any pending indication needs to be sent 1115 * if there is a pending indication then sent the indication 1116 * 1117 * Returns void 1118 * 1119 ******************************************************************************/ 1120 static void gatts_chk_pending_ind(tGATT_TCB* p_tcb) { 1121 GATT_TRACE_DEBUG("%s", __func__); 1122 1123 tGATT_VALUE* p_buf = 1124 (tGATT_VALUE*)fixed_queue_try_peek_first(p_tcb->pending_ind_q); 1125 if (p_buf != NULL) { 1126 GATTS_HandleValueIndication(p_buf->conn_id, p_buf->handle, p_buf->len, 1127 p_buf->value); 1128 osi_free(fixed_queue_try_remove_from_queue(p_tcb->pending_ind_q, p_buf)); 1129 } 1130 } 1131 1132 /******************************************************************************* 1133 * 1134 * Function gatts_proc_ind_ack 1135 * 1136 * Description This function processes the Indication ack 1137 * 1138 * Returns true continue to process the indication ack by the 1139 * application if the ACK is not a Service Changed Indication 1140 * 1141 ******************************************************************************/ 1142 static bool gatts_proc_ind_ack(tGATT_TCB* p_tcb, uint16_t ack_handle) { 1143 bool continue_processing = true; 1144 1145 GATT_TRACE_DEBUG("gatts_proc_ind_ack ack handle=%d", ack_handle); 1146 1147 if (ack_handle == gatt_cb.handle_of_h_r) { 1148 gatts_proc_srv_chg_ind_ack(p_tcb); 1149 /* there is no need to inform the application since srv chg is handled 1150 * internally by GATT */ 1151 continue_processing = false; 1152 } 1153 1154 gatts_chk_pending_ind(p_tcb); 1155 return continue_processing; 1156 } 1157 1158 /******************************************************************************* 1159 * 1160 * Function gatts_process_value_conf 1161 * 1162 * Description This function is called to process the handle value 1163 * confirmation. 1164 * 1165 * Returns void 1166 * 1167 ******************************************************************************/ 1168 void gatts_process_value_conf(tGATT_TCB* p_tcb, uint8_t op_code) { 1169 uint16_t handle = p_tcb->indicate_handle; 1170 uint32_t trans_id; 1171 bool continue_processing; 1172 uint16_t conn_id; 1173 1174 alarm_cancel(p_tcb->conf_timer); 1175 if (GATT_HANDLE_IS_VALID(handle)) { 1176 p_tcb->indicate_handle = 0; 1177 continue_processing = gatts_proc_ind_ack(p_tcb, handle); 1178 1179 if (continue_processing) { 1180 for (auto& el : *gatt_cb.srv_list_info) { 1181 if (el.s_hdl <= handle && el.e_hdl >= handle) { 1182 trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, handle); 1183 conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, el.gatt_if); 1184 gatt_sr_send_req_callback(conn_id, trans_id, GATTS_REQ_TYPE_CONF, 1185 (tGATTS_DATA*)&handle); 1186 } 1187 } 1188 } 1189 } else { 1190 GATT_TRACE_ERROR("unexpected handle value confirmation"); 1191 } 1192 } 1193 1194 /******************************************************************************* 1195 * 1196 * Function gatt_server_handle_client_req 1197 * 1198 * Description This function is called to handle the client requests to 1199 * server. 1200 * 1201 * 1202 * Returns void 1203 * 1204 ******************************************************************************/ 1205 void gatt_server_handle_client_req(tGATT_TCB* p_tcb, uint8_t op_code, 1206 uint16_t len, uint8_t* p_data) { 1207 /* there is pending command, discard this one */ 1208 if (!gatt_sr_cmd_empty(p_tcb) && op_code != GATT_HANDLE_VALUE_CONF) return; 1209 1210 /* the size of the message may not be bigger than the local max PDU size*/ 1211 /* The message has to be smaller than the agreed MTU, len does not include op 1212 * code */ 1213 if (len >= p_tcb->payload_size) { 1214 GATT_TRACE_ERROR("server receive invalid PDU size:%d pdu size:%d", len + 1, 1215 p_tcb->payload_size); 1216 /* for invalid request expecting response, send it now */ 1217 if (op_code != GATT_CMD_WRITE && op_code != GATT_SIGN_CMD_WRITE && 1218 op_code != GATT_HANDLE_VALUE_CONF) { 1219 gatt_send_error_rsp(p_tcb, GATT_INVALID_PDU, op_code, 0, false); 1220 } 1221 /* otherwise, ignore the pkt */ 1222 } else { 1223 switch (op_code) { 1224 case GATT_REQ_READ_BY_GRP_TYPE: /* discover primary services */ 1225 case GATT_REQ_FIND_TYPE_VALUE: /* discover service by UUID */ 1226 gatts_process_primary_service_req(p_tcb, op_code, len, p_data); 1227 break; 1228 1229 case GATT_REQ_FIND_INFO: /* discover char descrptor */ 1230 gatts_process_find_info(p_tcb, op_code, len, p_data); 1231 break; 1232 1233 case GATT_REQ_READ_BY_TYPE: /* read characteristic value, char descriptor 1234 value */ 1235 /* discover characteristic, discover char by UUID */ 1236 gatts_process_read_by_type_req(p_tcb, op_code, len, p_data); 1237 break; 1238 1239 case GATT_REQ_READ: /* read char/char descriptor value */ 1240 case GATT_REQ_READ_BLOB: 1241 case GATT_REQ_WRITE: /* write char/char descriptor value */ 1242 case GATT_CMD_WRITE: 1243 case GATT_SIGN_CMD_WRITE: 1244 case GATT_REQ_PREPARE_WRITE: 1245 gatts_process_attribute_req(p_tcb, op_code, len, p_data); 1246 break; 1247 1248 case GATT_HANDLE_VALUE_CONF: 1249 gatts_process_value_conf(p_tcb, op_code); 1250 break; 1251 1252 case GATT_REQ_MTU: 1253 gatts_process_mtu_req(p_tcb, len, p_data); 1254 break; 1255 1256 case GATT_REQ_EXEC_WRITE: 1257 gatt_process_exec_write_req(p_tcb, op_code, len, p_data); 1258 break; 1259 1260 case GATT_REQ_READ_MULTI: 1261 gatt_process_read_multi_req(p_tcb, op_code, len, p_data); 1262 break; 1263 1264 default: 1265 break; 1266 } 1267 } 1268 } 1269
