1 /****************************************************************************** 2 * 3 * Copyright 2008-2012 Broadcom Corporation 4 * 5 * Licensed under the Apache License, Version 2.0 (the "License"); 6 * you may not use this file except in compliance with the License. 7 * You may obtain a copy of the License at: 8 * 9 * http://www.apache.org/licenses/LICENSE-2.0 10 * 11 * Unless required by applicable law or agreed to in writing, software 12 * distributed under the License is distributed on an "AS IS" BASIS, 13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 * See the License for the specific language governing permissions and 15 * limitations under the License. 16 * 17 ******************************************************************************/ 18 19 /****************************************************************************** 20 * 21 * this file contains the GATT server functions 22 * 23 ******************************************************************************/ 24 25 #include <log/log.h> 26 #include "bt_target.h" 27 #include "bt_utils.h" 28 #include "osi/include/osi.h" 29 30 #include <string.h> 31 #include "gatt_int.h" 32 #include "l2c_api.h" 33 #include "l2c_int.h" 34 #define GATT_MTU_REQ_MIN_LEN 2 35 36 using base::StringPrintf; 37 using bluetooth::Uuid; 38 39 /******************************************************************************* 40 * 41 * Function gatt_sr_enqueue_cmd 42 * 43 * Description This function enqueue the request from client which needs a 44 * application response, and update the transaction ID. 45 * 46 * Returns void 47 * 48 ******************************************************************************/ 49 uint32_t gatt_sr_enqueue_cmd(tGATT_TCB& tcb, uint8_t op_code, uint16_t handle) { 50 tGATT_SR_CMD* p_cmd = &tcb.sr_cmd; 51 uint32_t trans_id = 0; 52 53 if ((p_cmd->op_code == 0) || 54 (op_code == GATT_HANDLE_VALUE_CONF)) /* no pending request */ 55 { 56 if (op_code == GATT_CMD_WRITE || op_code == GATT_SIGN_CMD_WRITE || 57 op_code == GATT_REQ_MTU || op_code == GATT_HANDLE_VALUE_CONF) { 58 trans_id = ++tcb.trans_id; 59 } else { 60 p_cmd->trans_id = ++tcb.trans_id; 61 p_cmd->op_code = op_code; 62 p_cmd->handle = handle; 63 p_cmd->status = GATT_NOT_FOUND; 64 tcb.trans_id %= GATT_TRANS_ID_MAX; 65 trans_id = p_cmd->trans_id; 66 } 67 } 68 69 return trans_id; 70 } 71 72 /******************************************************************************* 73 * 74 * Function gatt_sr_cmd_empty 75 * 76 * Description This function checks if the server command queue is empty. 77 * 78 * Returns true if empty, false if there is pending command. 79 * 80 ******************************************************************************/ 81 bool gatt_sr_cmd_empty(tGATT_TCB& tcb) { return (tcb.sr_cmd.op_code == 0); } 82 83 /******************************************************************************* 84 * 85 * Function gatt_dequeue_sr_cmd 86 * 87 * Description This function dequeue the request from command queue. 88 * 89 * Returns void 90 * 91 ******************************************************************************/ 92 void gatt_dequeue_sr_cmd(tGATT_TCB& tcb) { 93 /* Double check in case any buffers are queued */ 94 VLOG(1) << "gatt_dequeue_sr_cmd"; 95 if (tcb.sr_cmd.p_rsp_msg) 96 LOG(ERROR) << "free tcb.sr_cmd.p_rsp_msg = " << tcb.sr_cmd.p_rsp_msg; 97 osi_free_and_reset((void**)&tcb.sr_cmd.p_rsp_msg); 98 99 while (!fixed_queue_is_empty(tcb.sr_cmd.multi_rsp_q)) 100 osi_free(fixed_queue_try_dequeue(tcb.sr_cmd.multi_rsp_q)); 101 fixed_queue_free(tcb.sr_cmd.multi_rsp_q, NULL); 102 memset(&tcb.sr_cmd, 0, sizeof(tGATT_SR_CMD)); 103 } 104 105 /******************************************************************************* 106 * 107 * Function process_read_multi_rsp 108 * 109 * Description This function check the read multiple response. 110 * 111 * Returns bool if all replies have been received 112 * 113 ******************************************************************************/ 114 static bool process_read_multi_rsp(tGATT_SR_CMD* p_cmd, tGATT_STATUS status, 115 tGATTS_RSP* p_msg, uint16_t mtu) { 116 uint16_t ii, total_len, len; 117 uint8_t* p; 118 bool is_overflow = false; 119 120 VLOG(1) << StringPrintf("%s status=%d mtu=%d", __func__, status, mtu); 121 122 if (p_cmd->multi_rsp_q == NULL) 123 p_cmd->multi_rsp_q = fixed_queue_new(SIZE_MAX); 124 125 /* Enqueue the response */ 126 BT_HDR* p_buf = (BT_HDR*)osi_malloc(sizeof(tGATTS_RSP)); 127 memcpy((void*)p_buf, (const void*)p_msg, sizeof(tGATTS_RSP)); 128 fixed_queue_enqueue(p_cmd->multi_rsp_q, p_buf); 129 130 p_cmd->status = status; 131 if (status == GATT_SUCCESS) { 132 VLOG(1) << "Multi read count=" << fixed_queue_length(p_cmd->multi_rsp_q) 133 << " num_hdls=" << p_cmd->multi_req.num_handles; 134 /* Wait till we get all the responses */ 135 if (fixed_queue_length(p_cmd->multi_rsp_q) == 136 p_cmd->multi_req.num_handles) { 137 len = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + mtu; 138 p_buf = (BT_HDR*)osi_calloc(len); 139 p_buf->offset = L2CAP_MIN_OFFSET; 140 p = (uint8_t*)(p_buf + 1) + p_buf->offset; 141 142 /* First byte in the response is the opcode */ 143 *p++ = GATT_RSP_READ_MULTI; 144 p_buf->len = 1; 145 146 /* Now walk through the buffers puting the data into the response in order 147 */ 148 list_t* list = NULL; 149 const list_node_t* node = NULL; 150 if (!fixed_queue_is_empty(p_cmd->multi_rsp_q)) 151 list = fixed_queue_get_list(p_cmd->multi_rsp_q); 152 for (ii = 0; ii < p_cmd->multi_req.num_handles; ii++) { 153 tGATTS_RSP* p_rsp = NULL; 154 155 if (list != NULL) { 156 if (ii == 0) 157 node = list_begin(list); 158 else 159 node = list_next(node); 160 if (node != list_end(list)) p_rsp = (tGATTS_RSP*)list_node(node); 161 } 162 163 if (p_rsp != NULL) { 164 total_len = (p_buf->len + p_rsp->attr_value.len); 165 166 if (total_len > mtu) { 167 /* just send the partial response for the overflow case */ 168 len = p_rsp->attr_value.len - (total_len - mtu); 169 is_overflow = true; 170 VLOG(1) << StringPrintf( 171 "multi read overflow available len=%d val_len=%d", len, 172 p_rsp->attr_value.len); 173 } else { 174 len = p_rsp->attr_value.len; 175 } 176 177 if (p_rsp->attr_value.handle == p_cmd->multi_req.handles[ii]) { 178 memcpy(p, p_rsp->attr_value.value, len); 179 if (!is_overflow) p += len; 180 p_buf->len += len; 181 } else { 182 p_cmd->status = GATT_NOT_FOUND; 183 break; 184 } 185 186 if (is_overflow) break; 187 188 } else { 189 p_cmd->status = GATT_NOT_FOUND; 190 break; 191 } 192 193 } /* loop through all handles*/ 194 195 /* Sanity check on the buffer length */ 196 if (p_buf->len == 0) { 197 LOG(ERROR) << __func__ << " nothing found!!"; 198 p_cmd->status = GATT_NOT_FOUND; 199 osi_free(p_buf); 200 VLOG(1) << __func__ << "osi_free(p_buf)"; 201 } else if (p_cmd->p_rsp_msg != NULL) { 202 osi_free(p_buf); 203 } else { 204 p_cmd->p_rsp_msg = p_buf; 205 } 206 207 return (true); 208 } 209 } else /* any handle read exception occurs, return error */ 210 { 211 return (true); 212 } 213 214 /* If here, still waiting */ 215 return (false); 216 } 217 218 /******************************************************************************* 219 * 220 * Function gatt_sr_process_app_rsp 221 * 222 * Description This function checks whether the response message from 223 * application matches any pending request. 224 * 225 * Returns void 226 * 227 ******************************************************************************/ 228 tGATT_STATUS gatt_sr_process_app_rsp(tGATT_TCB& tcb, tGATT_IF gatt_if, 229 UNUSED_ATTR uint32_t trans_id, 230 uint8_t op_code, tGATT_STATUS status, 231 tGATTS_RSP* p_msg) { 232 tGATT_STATUS ret_code = GATT_SUCCESS; 233 234 VLOG(1) << __func__ << " gatt_if=" << +gatt_if; 235 236 gatt_sr_update_cback_cnt(tcb, gatt_if, false, false); 237 238 if (op_code == GATT_REQ_READ_MULTI) { 239 /* If no error and still waiting, just return */ 240 if (!process_read_multi_rsp(&tcb.sr_cmd, status, p_msg, tcb.payload_size)) 241 return (GATT_SUCCESS); 242 } else { 243 if (op_code == GATT_REQ_PREPARE_WRITE && status == GATT_SUCCESS) 244 gatt_sr_update_prep_cnt(tcb, gatt_if, true, false); 245 246 if (op_code == GATT_REQ_EXEC_WRITE && status != GATT_SUCCESS) 247 gatt_sr_reset_cback_cnt(tcb); 248 249 tcb.sr_cmd.status = status; 250 251 if (gatt_sr_is_cback_cnt_zero(tcb) && status == GATT_SUCCESS) { 252 if (tcb.sr_cmd.p_rsp_msg == NULL) { 253 tcb.sr_cmd.p_rsp_msg = attp_build_sr_msg(tcb, (uint8_t)(op_code + 1), 254 (tGATT_SR_MSG*)p_msg); 255 } else { 256 LOG(ERROR) << "Exception!!! already has respond message"; 257 } 258 } 259 } 260 if (gatt_sr_is_cback_cnt_zero(tcb)) { 261 if ((tcb.sr_cmd.status == GATT_SUCCESS) && (tcb.sr_cmd.p_rsp_msg)) { 262 ret_code = attp_send_sr_msg(tcb, tcb.sr_cmd.p_rsp_msg); 263 tcb.sr_cmd.p_rsp_msg = NULL; 264 } else { 265 ret_code = 266 gatt_send_error_rsp(tcb, status, op_code, tcb.sr_cmd.handle, false); 267 } 268 269 gatt_dequeue_sr_cmd(tcb); 270 } 271 272 VLOG(1) << __func__ << " ret_code=" << +ret_code; 273 274 return ret_code; 275 } 276 277 /******************************************************************************* 278 * 279 * Function gatt_process_exec_write_req 280 * 281 * Description This function is called to process the execute write request 282 * from client. 283 * 284 * Returns void 285 * 286 ******************************************************************************/ 287 void gatt_process_exec_write_req(tGATT_TCB& tcb, uint8_t op_code, uint16_t len, 288 uint8_t* p_data) { 289 uint8_t *p = p_data, flag, i = 0; 290 uint32_t trans_id = 0; 291 tGATT_IF gatt_if; 292 uint16_t conn_id; 293 294 #if (GATT_CONFORMANCE_TESTING == TRUE) 295 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) { 296 VLOG(1) 297 << "Conformance tst: forced err rspv for Execute Write: error status=" 298 << +gatt_cb.err_status; 299 300 gatt_send_error_rsp(tcb, gatt_cb.err_status, gatt_cb.req_op_code, 301 gatt_cb.handle, false); 302 303 return; 304 } 305 #endif 306 307 if (len < sizeof(flag)) { 308 android_errorWriteLog(0x534e4554, "73172115"); 309 LOG(ERROR) << __func__ << "invalid length"; 310 gatt_send_error_rsp(tcb, GATT_INVALID_PDU, GATT_REQ_EXEC_WRITE, 0, false); 311 return; 312 } 313 314 STREAM_TO_UINT8(flag, p); 315 316 /* mask the flag */ 317 flag &= GATT_PREP_WRITE_EXEC; 318 319 /* no prep write is queued */ 320 if (!gatt_sr_is_prep_cnt_zero(tcb)) { 321 trans_id = gatt_sr_enqueue_cmd(tcb, op_code, 0); 322 gatt_sr_copy_prep_cnt_to_cback_cnt(tcb); 323 324 for (i = 0; i < GATT_MAX_APPS; i++) { 325 if (tcb.prep_cnt[i]) { 326 gatt_if = (tGATT_IF)(i + 1); 327 conn_id = GATT_CREATE_CONN_ID(tcb.tcb_idx, gatt_if); 328 tGATTS_DATA gatts_data; 329 gatts_data.exec_write = flag; 330 gatt_sr_send_req_callback(conn_id, trans_id, GATTS_REQ_TYPE_WRITE_EXEC, 331 &gatts_data); 332 tcb.prep_cnt[i] = 0; 333 } 334 } 335 } else /* nothing needs to be executed , send response now */ 336 { 337 LOG(ERROR) << "gatt_process_exec_write_req: no prepare write pending"; 338 gatt_send_error_rsp(tcb, GATT_INVALID_OFFSET, GATT_REQ_EXEC_WRITE, 0, false); 339 } 340 } 341 342 /******************************************************************************* 343 * 344 * Function gatt_process_read_multi_req 345 * 346 * Description This function is called to process the read multiple request 347 * from client. 348 * 349 * Returns void 350 * 351 ******************************************************************************/ 352 void gatt_process_read_multi_req(tGATT_TCB& tcb, uint8_t op_code, uint16_t len, 353 uint8_t* p_data) { 354 uint32_t trans_id; 355 uint16_t handle = 0, ll = len; 356 uint8_t* p = p_data; 357 tGATT_STATUS err = GATT_SUCCESS; 358 uint8_t sec_flag, key_size; 359 360 VLOG(1) << __func__; 361 tcb.sr_cmd.multi_req.num_handles = 0; 362 363 gatt_sr_get_sec_info(tcb.peer_bda, tcb.transport, &sec_flag, &key_size); 364 365 #if (GATT_CONFORMANCE_TESTING == TRUE) 366 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) { 367 VLOG(1) << "Conformance tst: forced err rspvofr ReadMultiple: error status=" 368 << +gatt_cb.err_status; 369 370 STREAM_TO_UINT16(handle, p); 371 372 gatt_send_error_rsp(tcb, gatt_cb.err_status, gatt_cb.req_op_code, handle, 373 false); 374 375 return; 376 } 377 #endif 378 379 while (ll >= 2 && 380 tcb.sr_cmd.multi_req.num_handles < GATT_MAX_READ_MULTI_HANDLES) { 381 STREAM_TO_UINT16(handle, p); 382 383 auto it = gatt_sr_find_i_rcb_by_handle(handle); 384 if (it != gatt_cb.srv_list_info->end()) { 385 tcb.sr_cmd.multi_req.handles[tcb.sr_cmd.multi_req.num_handles++] = handle; 386 387 /* check read permission */ 388 err = gatts_read_attr_perm_check(it->p_db, false, handle, sec_flag, 389 key_size); 390 if (err != GATT_SUCCESS) { 391 VLOG(1) << StringPrintf("read permission denied : 0x%02x", err); 392 break; 393 } 394 } else { 395 /* invalid handle */ 396 err = GATT_INVALID_HANDLE; 397 break; 398 } 399 ll -= 2; 400 } 401 402 if (ll != 0) { 403 LOG(ERROR) << "max attribute handle reached in ReadMultiple Request."; 404 } 405 406 if (tcb.sr_cmd.multi_req.num_handles == 0) err = GATT_INVALID_HANDLE; 407 408 if (err == GATT_SUCCESS) { 409 trans_id = 410 gatt_sr_enqueue_cmd(tcb, op_code, tcb.sr_cmd.multi_req.handles[0]); 411 if (trans_id != 0) { 412 gatt_sr_reset_cback_cnt(tcb); /* read multiple use multi_rsp_q's count*/ 413 414 for (ll = 0; ll < tcb.sr_cmd.multi_req.num_handles; ll++) { 415 tGATTS_RSP* p_msg = (tGATTS_RSP*)osi_calloc(sizeof(tGATTS_RSP)); 416 handle = tcb.sr_cmd.multi_req.handles[ll]; 417 auto it = gatt_sr_find_i_rcb_by_handle(handle); 418 419 p_msg->attr_value.handle = handle; 420 err = gatts_read_attr_value_by_handle( 421 tcb, it->p_db, op_code, handle, 0, p_msg->attr_value.value, 422 &p_msg->attr_value.len, GATT_MAX_ATTR_LEN, sec_flag, key_size, 423 trans_id); 424 425 if (err == GATT_SUCCESS) { 426 gatt_sr_process_app_rsp(tcb, it->gatt_if, trans_id, op_code, 427 GATT_SUCCESS, p_msg); 428 } 429 /* either not using or done using the buffer, release it now */ 430 osi_free(p_msg); 431 } 432 } else 433 err = GATT_NO_RESOURCES; 434 } 435 436 /* in theroy BUSY is not possible(should already been checked), protected 437 * check */ 438 if (err != GATT_SUCCESS && err != GATT_PENDING && err != GATT_BUSY) 439 gatt_send_error_rsp(tcb, err, op_code, handle, false); 440 } 441 442 /******************************************************************************* 443 * 444 * Function gatt_build_primary_service_rsp 445 * 446 * Description Primamry service request processed internally. Theretically 447 * only deal with ReadByTypeVAlue and ReadByGroupType. 448 * 449 * Returns void 450 * 451 ******************************************************************************/ 452 static tGATT_STATUS gatt_build_primary_service_rsp( 453 BT_HDR* p_msg, tGATT_TCB& tcb, uint8_t op_code, uint16_t s_hdl, 454 uint16_t e_hdl, UNUSED_ATTR uint8_t* p_data, const Uuid& value) { 455 tGATT_STATUS status = GATT_NOT_FOUND; 456 uint8_t handle_len = 4; 457 458 uint8_t* p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET; 459 460 for (tGATT_SRV_LIST_ELEM& el : *gatt_cb.srv_list_info) { 461 if (el.s_hdl < s_hdl || el.s_hdl > e_hdl || 462 el.type != GATT_UUID_PRI_SERVICE) { 463 continue; 464 } 465 466 Uuid* p_uuid = gatts_get_service_uuid(el.p_db); 467 if (!p_uuid) continue; 468 469 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) 470 handle_len = 4 + gatt_build_uuid_to_stream_len(*p_uuid); 471 472 /* get the length byte in the repsonse */ 473 if (p_msg->offset == 0) { 474 *p++ = op_code + 1; 475 p_msg->len++; 476 p_msg->offset = handle_len; 477 478 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) { 479 *p++ = (uint8_t)p_msg->offset; /* length byte */ 480 p_msg->len++; 481 } 482 } 483 484 if (p_msg->len + p_msg->offset > tcb.payload_size || 485 handle_len != p_msg->offset) { 486 break; 487 } 488 489 if (op_code == GATT_REQ_FIND_TYPE_VALUE && value != *p_uuid) continue; 490 491 UINT16_TO_STREAM(p, el.s_hdl); 492 493 if (gatt_cb.last_service_handle && 494 gatt_cb.last_service_handle == el.s_hdl) { 495 VLOG(1) << "Use 0xFFFF for the last primary attribute"; 496 /* see GATT ERRATA 4065, 4063, ATT ERRATA 4062 */ 497 UINT16_TO_STREAM(p, 0xFFFF); 498 } else { 499 UINT16_TO_STREAM(p, el.e_hdl); 500 } 501 502 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) 503 gatt_build_uuid_to_stream(&p, *p_uuid); 504 505 status = GATT_SUCCESS; 506 p_msg->len += p_msg->offset; 507 } 508 p_msg->offset = L2CAP_MIN_OFFSET; 509 510 return status; 511 } 512 513 /** 514 * fill the find information response information in the given buffer. 515 * 516 * Returns true: if data filled sucessfully. 517 * false: packet full, or format mismatch. 518 */ 519 static tGATT_STATUS gatt_build_find_info_rsp(tGATT_SRV_LIST_ELEM& el, 520 BT_HDR* p_msg, uint16_t& len, 521 uint16_t s_hdl, uint16_t e_hdl) { 522 uint8_t info_pair_len[2] = {4, 18}; 523 524 if (!el.p_db) return GATT_NOT_FOUND; 525 526 /* check the attribute database */ 527 528 uint8_t* p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET + p_msg->len; 529 530 for (auto& attr : el.p_db->attr_list) { 531 if (attr.handle > e_hdl) break; 532 533 if (attr.handle < s_hdl) continue; 534 535 uint8_t uuid_len = attr.uuid.GetShortestRepresentationSize(); 536 if (p_msg->offset == 0) 537 p_msg->offset = (uuid_len == Uuid::kNumBytes16) ? GATT_INFO_TYPE_PAIR_16 538 : GATT_INFO_TYPE_PAIR_128; 539 540 if (len < info_pair_len[p_msg->offset - 1]) return GATT_NO_RESOURCES; 541 542 if (p_msg->offset == GATT_INFO_TYPE_PAIR_16 && 543 uuid_len == Uuid::kNumBytes16) { 544 UINT16_TO_STREAM(p, attr.handle); 545 UINT16_TO_STREAM(p, attr.uuid.As16Bit()); 546 } else if (p_msg->offset == GATT_INFO_TYPE_PAIR_128 && 547 uuid_len == Uuid::kNumBytes128) { 548 UINT16_TO_STREAM(p, attr.handle); 549 ARRAY_TO_STREAM(p, attr.uuid.To128BitLE(), (int)Uuid::kNumBytes128); 550 } else if (p_msg->offset == GATT_INFO_TYPE_PAIR_128 && 551 uuid_len == Uuid::kNumBytes32) { 552 UINT16_TO_STREAM(p, attr.handle); 553 ARRAY_TO_STREAM(p, attr.uuid.To128BitLE(), (int)Uuid::kNumBytes128); 554 } else { 555 LOG(ERROR) << "format mismatch"; 556 return GATT_NO_RESOURCES; 557 /* format mismatch */ 558 } 559 p_msg->len += info_pair_len[p_msg->offset - 1]; 560 len -= info_pair_len[p_msg->offset - 1]; 561 return GATT_SUCCESS; 562 } 563 564 return GATT_NOT_FOUND; 565 } 566 567 static tGATT_STATUS read_handles(uint16_t& len, uint8_t*& p, uint16_t& s_hdl, 568 uint16_t& e_hdl) { 569 if (len < 4) return GATT_INVALID_PDU; 570 571 /* obtain starting handle, and ending handle */ 572 STREAM_TO_UINT16(s_hdl, p); 573 STREAM_TO_UINT16(e_hdl, p); 574 len -= 4; 575 576 if (s_hdl > e_hdl || !GATT_HANDLE_IS_VALID(s_hdl) || 577 !GATT_HANDLE_IS_VALID(e_hdl)) { 578 return GATT_INVALID_HANDLE; 579 } 580 581 return GATT_SUCCESS; 582 } 583 584 static tGATT_STATUS gatts_validate_packet_format(uint8_t op_code, uint16_t& len, 585 uint8_t*& p, Uuid* p_uuid, 586 uint16_t& s_hdl, 587 uint16_t& e_hdl) { 588 tGATT_STATUS ret = read_handles(len, p, s_hdl, e_hdl); 589 if (ret != GATT_SUCCESS) return ret; 590 591 if (len < 2) return GATT_INVALID_PDU; 592 593 /* parse uuid now */ 594 CHECK(p_uuid); 595 uint16_t uuid_len = (op_code == GATT_REQ_FIND_TYPE_VALUE) ? 2 : len; 596 if (!gatt_parse_uuid_from_cmd(p_uuid, uuid_len, &p)) { 597 VLOG(1) << "Bad UUID"; 598 return GATT_INVALID_PDU; 599 } 600 601 len -= uuid_len; 602 return GATT_SUCCESS; 603 } 604 605 /******************************************************************************* 606 * 607 * Function gatts_process_primary_service_req 608 * 609 * Description Process ReadByGroupType/ReadByTypeValue request, for 610 * discovering all primary services or discover primary service 611 * by UUID request. 612 * 613 * Returns void 614 * 615 ******************************************************************************/ 616 void gatts_process_primary_service_req(tGATT_TCB& tcb, uint8_t op_code, 617 uint16_t len, uint8_t* p_data) { 618 uint16_t s_hdl = 0, e_hdl = 0; 619 Uuid uuid = Uuid::kEmpty; 620 621 uint8_t reason = 622 gatts_validate_packet_format(op_code, len, p_data, &uuid, s_hdl, e_hdl); 623 if (reason != GATT_SUCCESS) { 624 gatt_send_error_rsp(tcb, reason, op_code, s_hdl, false); 625 return; 626 } 627 628 if (uuid != Uuid::From16Bit(GATT_UUID_PRI_SERVICE)) { 629 if (op_code == GATT_REQ_READ_BY_GRP_TYPE) { 630 gatt_send_error_rsp(tcb, GATT_UNSUPPORT_GRP_TYPE, op_code, s_hdl, false); 631 VLOG(1) << StringPrintf("unexpected ReadByGrpType Group: %s", 632 uuid.ToString().c_str()); 633 return; 634 } 635 636 // we do not support ReadByTypeValue with any non-primamry_service type 637 gatt_send_error_rsp(tcb, GATT_NOT_FOUND, op_code, s_hdl, false); 638 VLOG(1) << StringPrintf("unexpected ReadByTypeValue type: %s", 639 uuid.ToString().c_str()); 640 return; 641 } 642 643 // TODO: we assume theh value is UUID, there is no such requirement in spec 644 Uuid value = Uuid::kEmpty; 645 if (op_code == GATT_REQ_FIND_TYPE_VALUE) { 646 if (!gatt_parse_uuid_from_cmd(&value, len, &p_data)) { 647 gatt_send_error_rsp(tcb, GATT_INVALID_PDU, op_code, s_hdl, false); 648 } 649 } 650 651 uint16_t msg_len = 652 (uint16_t)(sizeof(BT_HDR) + tcb.payload_size + L2CAP_MIN_OFFSET); 653 BT_HDR* p_msg = (BT_HDR*)osi_calloc(msg_len); 654 reason = gatt_build_primary_service_rsp(p_msg, tcb, op_code, s_hdl, e_hdl, 655 p_data, value); 656 if (reason != GATT_SUCCESS) { 657 osi_free(p_msg); 658 gatt_send_error_rsp(tcb, reason, op_code, s_hdl, false); 659 return; 660 } 661 662 attp_send_sr_msg(tcb, p_msg); 663 } 664 665 /******************************************************************************* 666 * 667 * Function gatts_process_find_info 668 * 669 * Description process find information request, for discover character 670 * descriptors. 671 * 672 * Returns void 673 * 674 ******************************************************************************/ 675 static void gatts_process_find_info(tGATT_TCB& tcb, uint8_t op_code, 676 uint16_t len, uint8_t* p_data) { 677 uint16_t s_hdl = 0, e_hdl = 0; 678 uint8_t reason = read_handles(len, p_data, s_hdl, e_hdl); 679 if (reason != GATT_SUCCESS) { 680 gatt_send_error_rsp(tcb, reason, op_code, s_hdl, false); 681 return; 682 } 683 684 uint16_t buf_len = 685 (uint16_t)(sizeof(BT_HDR) + tcb.payload_size + L2CAP_MIN_OFFSET); 686 687 BT_HDR* p_msg = (BT_HDR*)osi_calloc(buf_len); 688 reason = GATT_NOT_FOUND; 689 690 uint8_t* p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET; 691 *p++ = op_code + 1; 692 p_msg->len = 2; 693 694 buf_len = tcb.payload_size - 2; 695 696 for (tGATT_SRV_LIST_ELEM& el : *gatt_cb.srv_list_info) { 697 if (el.s_hdl <= e_hdl && el.e_hdl >= s_hdl) { 698 reason = gatt_build_find_info_rsp(el, p_msg, buf_len, s_hdl, e_hdl); 699 if (reason == GATT_NO_RESOURCES) { 700 reason = GATT_SUCCESS; 701 break; 702 } 703 } 704 } 705 706 *p = (uint8_t)p_msg->offset; 707 708 p_msg->offset = L2CAP_MIN_OFFSET; 709 710 if (reason != GATT_SUCCESS) { 711 osi_free(p_msg); 712 gatt_send_error_rsp(tcb, reason, op_code, s_hdl, false); 713 } else 714 attp_send_sr_msg(tcb, p_msg); 715 } 716 717 /******************************************************************************* 718 * 719 * Function gatts_process_mtu_req 720 * 721 * Description This function is called to process excahnge MTU request. 722 * Only used on LE. 723 * 724 * Returns void 725 * 726 ******************************************************************************/ 727 static void gatts_process_mtu_req(tGATT_TCB& tcb, uint16_t len, 728 uint8_t* p_data) { 729 /* BR/EDR conenction, send error response */ 730 if (tcb.att_lcid != L2CAP_ATT_CID) { 731 gatt_send_error_rsp(tcb, GATT_REQ_NOT_SUPPORTED, GATT_REQ_MTU, 0, false); 732 return; 733 } 734 735 if (len < GATT_MTU_REQ_MIN_LEN) { 736 LOG(ERROR) << "invalid MTU request PDU received."; 737 gatt_send_error_rsp(tcb, GATT_INVALID_PDU, GATT_REQ_MTU, 0, false); 738 return; 739 } 740 741 uint16_t mtu = 0; 742 uint8_t* p = p_data; 743 STREAM_TO_UINT16(mtu, p); 744 /* mtu must be greater than default MTU which is 23/48 */ 745 if (mtu < GATT_DEF_BLE_MTU_SIZE) 746 tcb.payload_size = GATT_DEF_BLE_MTU_SIZE; 747 else if (mtu > GATT_MAX_MTU_SIZE) 748 tcb.payload_size = GATT_MAX_MTU_SIZE; 749 else 750 tcb.payload_size = mtu; 751 752 LOG(ERROR) << "MTU request PDU with MTU size " << +tcb.payload_size; 753 754 l2cble_set_fixed_channel_tx_data_length(tcb.peer_bda, L2CAP_ATT_CID, 755 tcb.payload_size); 756 757 tGATT_SR_MSG gatt_sr_msg; 758 gatt_sr_msg.mtu = tcb.payload_size; 759 BT_HDR* p_buf = attp_build_sr_msg(tcb, GATT_RSP_MTU, &gatt_sr_msg); 760 attp_send_sr_msg(tcb, p_buf); 761 762 tGATTS_DATA gatts_data; 763 gatts_data.mtu = tcb.payload_size; 764 /* Notify all registered applicaiton with new MTU size. Us a transaction ID */ 765 /* of 0, as no response is allowed from applcations */ 766 for (int i = 0; i < GATT_MAX_APPS; i++) { 767 if (gatt_cb.cl_rcb[i].in_use) { 768 uint16_t conn_id = 769 GATT_CREATE_CONN_ID(tcb.tcb_idx, gatt_cb.cl_rcb[i].gatt_if); 770 gatt_sr_send_req_callback(conn_id, 0, GATTS_REQ_TYPE_MTU, &gatts_data); 771 } 772 } 773 } 774 775 /******************************************************************************* 776 * 777 * Function gatts_process_read_by_type_req 778 * 779 * Description process Read By type request. 780 * This PDU can be used to perform: 781 * - read characteristic value 782 * - read characteristic descriptor value 783 * - discover characteristic 784 * - discover characteristic by UUID 785 * - relationship discovery 786 * 787 * Returns void 788 * 789 ******************************************************************************/ 790 void gatts_process_read_by_type_req(tGATT_TCB& tcb, uint8_t op_code, 791 uint16_t len, uint8_t* p_data) { 792 Uuid uuid = Uuid::kEmpty; 793 uint16_t s_hdl = 0, e_hdl = 0, err_hdl = 0; 794 tGATT_STATUS reason = 795 gatts_validate_packet_format(op_code, len, p_data, &uuid, s_hdl, e_hdl); 796 797 #if (GATT_CONFORMANCE_TESTING == TRUE) 798 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) { 799 VLOG(1) << "Conformance tst: forced err rsp for ReadByType: error status=" 800 << +gatt_cb.err_status; 801 802 gatt_send_error_rsp(tcb, gatt_cb.err_status, gatt_cb.req_op_code, s_hdl, 803 false); 804 805 return; 806 } 807 #endif 808 809 if (reason != GATT_SUCCESS) { 810 gatt_send_error_rsp(tcb, reason, op_code, s_hdl, false); 811 return; 812 } 813 814 size_t msg_len = sizeof(BT_HDR) + tcb.payload_size + L2CAP_MIN_OFFSET; 815 BT_HDR* p_msg = (BT_HDR*)osi_calloc(msg_len); 816 uint8_t* p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET; 817 818 *p++ = op_code + 1; 819 /* reserve length byte */ 820 p_msg->len = 2; 821 uint16_t buf_len = tcb.payload_size - 2; 822 823 reason = GATT_NOT_FOUND; 824 for (tGATT_SRV_LIST_ELEM& el : *gatt_cb.srv_list_info) { 825 if (el.s_hdl <= e_hdl && el.e_hdl >= s_hdl) { 826 uint8_t sec_flag, key_size; 827 gatt_sr_get_sec_info(tcb.peer_bda, tcb.transport, &sec_flag, &key_size); 828 829 tGATT_STATUS ret = gatts_db_read_attr_value_by_type( 830 tcb, el.p_db, op_code, p_msg, s_hdl, e_hdl, uuid, &buf_len, sec_flag, 831 key_size, 0, &err_hdl); 832 if (ret != GATT_NOT_FOUND) { 833 reason = ret; 834 if (ret == GATT_NO_RESOURCES) reason = GATT_SUCCESS; 835 } 836 837 if (ret != GATT_SUCCESS && ret != GATT_NOT_FOUND) { 838 s_hdl = err_hdl; 839 break; 840 } 841 } 842 } 843 *p = (uint8_t)p_msg->offset; 844 p_msg->offset = L2CAP_MIN_OFFSET; 845 846 if (reason != GATT_SUCCESS) { 847 osi_free(p_msg); 848 849 /* in theroy BUSY is not possible(should already been checked), protected 850 * check */ 851 if (reason != GATT_PENDING && reason != GATT_BUSY) 852 gatt_send_error_rsp(tcb, reason, op_code, s_hdl, false); 853 854 return; 855 } 856 857 attp_send_sr_msg(tcb, p_msg); 858 } 859 860 /** 861 * This function is called to process the write request from client. 862 */ 863 void gatts_process_write_req(tGATT_TCB& tcb, tGATT_SRV_LIST_ELEM& el, 864 uint16_t handle, uint8_t op_code, uint16_t len, 865 uint8_t* p_data, 866 bt_gatt_db_attribute_type_t gatt_type) { 867 tGATTS_DATA sr_data; 868 uint32_t trans_id; 869 tGATT_STATUS status; 870 uint8_t sec_flag, key_size, *p = p_data; 871 uint16_t conn_id; 872 873 memset(&sr_data, 0, sizeof(tGATTS_DATA)); 874 875 switch (op_code) { 876 case GATT_REQ_PREPARE_WRITE: 877 if (len < 2) { 878 LOG(ERROR) << __func__ 879 << ": Prepare write request was invalid - missing offset, " 880 "sending error response"; 881 gatt_send_error_rsp(tcb, GATT_INVALID_PDU, op_code, handle, false); 882 return; 883 } 884 sr_data.write_req.is_prep = true; 885 STREAM_TO_UINT16(sr_data.write_req.offset, p); 886 len -= 2; 887 /* fall through */ 888 case GATT_SIGN_CMD_WRITE: 889 if (op_code == GATT_SIGN_CMD_WRITE) { 890 VLOG(1) << "Write CMD with data sigining"; 891 len -= GATT_AUTH_SIGN_LEN; 892 } 893 /* fall through */ 894 case GATT_CMD_WRITE: 895 case GATT_REQ_WRITE: 896 if (op_code == GATT_REQ_WRITE || op_code == GATT_REQ_PREPARE_WRITE) 897 sr_data.write_req.need_rsp = true; 898 sr_data.write_req.handle = handle; 899 sr_data.write_req.len = len; 900 if (len != 0 && p != NULL) { 901 memcpy(sr_data.write_req.value, p, len); 902 } 903 break; 904 } 905 906 gatt_sr_get_sec_info(tcb.peer_bda, tcb.transport, &sec_flag, &key_size); 907 908 status = gatts_write_attr_perm_check(el.p_db, op_code, handle, 909 sr_data.write_req.offset, p, len, 910 sec_flag, key_size); 911 912 if (status == GATT_SUCCESS) { 913 trans_id = gatt_sr_enqueue_cmd(tcb, op_code, handle); 914 if (trans_id != 0) { 915 conn_id = GATT_CREATE_CONN_ID(tcb.tcb_idx, el.gatt_if); 916 917 uint8_t opcode = 0; 918 if (gatt_type == BTGATT_DB_DESCRIPTOR) { 919 opcode = GATTS_REQ_TYPE_WRITE_DESCRIPTOR; 920 } else if (gatt_type == BTGATT_DB_CHARACTERISTIC) { 921 opcode = GATTS_REQ_TYPE_WRITE_CHARACTERISTIC; 922 } else { 923 LOG(ERROR) << __func__ 924 << "%s: Attempt to write attribute that's not tied with" 925 " characteristic or descriptor value."; 926 status = GATT_ERROR; 927 } 928 929 if (opcode) { 930 gatt_sr_send_req_callback(conn_id, trans_id, opcode, &sr_data); 931 status = GATT_PENDING; 932 } 933 } else { 934 LOG(ERROR) << "max pending command, send error"; 935 status = GATT_BUSY; /* max pending command, application error */ 936 } 937 } 938 939 /* in theroy BUSY is not possible(should already been checked), protected 940 * check */ 941 if (status != GATT_PENDING && status != GATT_BUSY && 942 (op_code == GATT_REQ_PREPARE_WRITE || op_code == GATT_REQ_WRITE)) { 943 gatt_send_error_rsp(tcb, status, op_code, handle, false); 944 } 945 return; 946 } 947 948 /** 949 * This function is called to process the read request from client. 950 */ 951 static void gatts_process_read_req(tGATT_TCB& tcb, tGATT_SRV_LIST_ELEM& el, 952 uint8_t op_code, uint16_t handle, 953 uint16_t len, uint8_t* p_data) { 954 size_t buf_len = sizeof(BT_HDR) + tcb.payload_size + L2CAP_MIN_OFFSET; 955 uint16_t offset = 0; 956 957 if (op_code == GATT_REQ_READ_BLOB && len < sizeof(uint16_t)) { 958 /* Error: packet length is too short */ 959 LOG(ERROR) << __func__ << ": packet length=" << len 960 << " too short. min=" << sizeof(uint16_t); 961 android_errorWriteWithInfoLog(0x534e4554, "73172115", -1, NULL, 0); 962 gatt_send_error_rsp(tcb, GATT_INVALID_PDU, op_code, 0, false); 963 return; 964 } 965 966 BT_HDR* p_msg = (BT_HDR*)osi_calloc(buf_len); 967 968 if (op_code == GATT_REQ_READ_BLOB) STREAM_TO_UINT16(offset, p_data); 969 970 uint8_t* p = (uint8_t*)(p_msg + 1) + L2CAP_MIN_OFFSET; 971 *p++ = op_code + 1; 972 p_msg->len = 1; 973 buf_len = tcb.payload_size - 1; 974 975 uint8_t sec_flag, key_size; 976 gatt_sr_get_sec_info(tcb.peer_bda, tcb.transport, &sec_flag, &key_size); 977 978 uint16_t value_len = 0; 979 tGATT_STATUS reason = gatts_read_attr_value_by_handle( 980 tcb, el.p_db, op_code, handle, offset, p, &value_len, (uint16_t)buf_len, 981 sec_flag, key_size, 0); 982 p_msg->len += value_len; 983 984 if (reason != GATT_SUCCESS) { 985 osi_free(p_msg); 986 987 /* in theory BUSY is not possible(should already been checked), protected 988 * check */ 989 if (reason != GATT_PENDING && reason != GATT_BUSY) 990 gatt_send_error_rsp(tcb, reason, op_code, handle, false); 991 992 return; 993 } 994 995 attp_send_sr_msg(tcb, p_msg); 996 } 997 998 /******************************************************************************* 999 * 1000 * Function gatts_process_attribute_req 1001 * 1002 * Description This function is called to process the per attribute handle 1003 * request from client. 1004 * 1005 * Returns void 1006 * 1007 ******************************************************************************/ 1008 void gatts_process_attribute_req(tGATT_TCB& tcb, uint8_t op_code, uint16_t len, 1009 uint8_t* p_data) { 1010 uint16_t handle = 0; 1011 uint8_t* p = p_data; 1012 tGATT_STATUS status = GATT_INVALID_HANDLE; 1013 1014 if (len < 2) { 1015 LOG(ERROR) << "Illegal PDU length, discard request"; 1016 status = GATT_INVALID_PDU; 1017 } else { 1018 STREAM_TO_UINT16(handle, p); 1019 len -= 2; 1020 } 1021 1022 #if (GATT_CONFORMANCE_TESTING == TRUE) 1023 gatt_cb.handle = handle; 1024 if (gatt_cb.enable_err_rsp && gatt_cb.req_op_code == op_code) { 1025 VLOG(1) << "Conformance tst: forced err rsp: error status=" 1026 << +gatt_cb.err_status; 1027 1028 gatt_send_error_rsp(tcb, gatt_cb.err_status, gatt_cb.req_op_code, handle, 1029 false); 1030 1031 return; 1032 } 1033 #endif 1034 1035 if (GATT_HANDLE_IS_VALID(handle)) { 1036 for (auto& el : *gatt_cb.srv_list_info) { 1037 if (el.s_hdl <= handle && el.e_hdl >= handle) { 1038 for (const auto& attr : el.p_db->attr_list) { 1039 if (attr.handle == handle) { 1040 switch (op_code) { 1041 case GATT_REQ_READ: /* read char/char descriptor value */ 1042 case GATT_REQ_READ_BLOB: 1043 gatts_process_read_req(tcb, el, op_code, handle, len, p); 1044 break; 1045 1046 case GATT_REQ_WRITE: /* write char/char descriptor value */ 1047 case GATT_CMD_WRITE: 1048 case GATT_SIGN_CMD_WRITE: 1049 case GATT_REQ_PREPARE_WRITE: 1050 gatts_process_write_req(tcb, el, handle, op_code, len, p, 1051 attr.gatt_type); 1052 break; 1053 default: 1054 break; 1055 } 1056 status = GATT_SUCCESS; 1057 break; 1058 } 1059 } 1060 break; 1061 } 1062 } 1063 } 1064 1065 if (status != GATT_SUCCESS && op_code != GATT_CMD_WRITE && 1066 op_code != GATT_SIGN_CMD_WRITE) 1067 gatt_send_error_rsp(tcb, status, op_code, handle, false); 1068 } 1069 1070 /******************************************************************************* 1071 * 1072 * Function gatts_proc_srv_chg_ind_ack 1073 * 1074 * Description This function process the service changed indicaiton ACK 1075 * 1076 * Returns void 1077 * 1078 ******************************************************************************/ 1079 static void gatts_proc_srv_chg_ind_ack(tGATT_TCB tcb) { 1080 tGATTS_SRV_CHG_REQ req; 1081 tGATTS_SRV_CHG* p_buf = NULL; 1082 1083 VLOG(1) << __func__; 1084 1085 p_buf = gatt_is_bda_in_the_srv_chg_clt_list(tcb.peer_bda); 1086 if (p_buf != NULL) { 1087 VLOG(1) << "NV update set srv chg = false"; 1088 p_buf->srv_changed = false; 1089 memcpy(&req.srv_chg, p_buf, sizeof(tGATTS_SRV_CHG)); 1090 if (gatt_cb.cb_info.p_srv_chg_callback) 1091 (*gatt_cb.cb_info.p_srv_chg_callback)(GATTS_SRV_CHG_CMD_UPDATE_CLIENT, 1092 &req, NULL); 1093 } 1094 } 1095 1096 /******************************************************************************* 1097 * 1098 * Function gatts_chk_pending_ind 1099 * 1100 * Description This function check any pending indication needs to be sent 1101 * if there is a pending indication then sent the indication 1102 * 1103 * Returns void 1104 * 1105 ******************************************************************************/ 1106 static void gatts_chk_pending_ind(tGATT_TCB& tcb) { 1107 VLOG(1) << __func__; 1108 1109 tGATT_VALUE* p_buf = 1110 (tGATT_VALUE*)fixed_queue_try_peek_first(tcb.pending_ind_q); 1111 if (p_buf != NULL) { 1112 GATTS_HandleValueIndication(p_buf->conn_id, p_buf->handle, p_buf->len, 1113 p_buf->value); 1114 osi_free(fixed_queue_try_remove_from_queue(tcb.pending_ind_q, p_buf)); 1115 } 1116 } 1117 1118 /******************************************************************************* 1119 * 1120 * Function gatts_proc_ind_ack 1121 * 1122 * Description This function processes the Indication ack 1123 * 1124 * Returns true continue to process the indication ack by the 1125 * application if the ACK is not a Service Changed Indication 1126 * 1127 ******************************************************************************/ 1128 static bool gatts_proc_ind_ack(tGATT_TCB& tcb, uint16_t ack_handle) { 1129 bool continue_processing = true; 1130 1131 VLOG(1) << __func__ << " ack handle=%d" << ack_handle; 1132 1133 if (ack_handle == gatt_cb.handle_of_h_r) { 1134 gatts_proc_srv_chg_ind_ack(tcb); 1135 /* there is no need to inform the application since srv chg is handled 1136 * internally by GATT */ 1137 continue_processing = false; 1138 } 1139 1140 gatts_chk_pending_ind(tcb); 1141 return continue_processing; 1142 } 1143 1144 /******************************************************************************* 1145 * 1146 * Function gatts_process_value_conf 1147 * 1148 * Description This function is called to process the handle value 1149 * confirmation. 1150 * 1151 * Returns void 1152 * 1153 ******************************************************************************/ 1154 void gatts_process_value_conf(tGATT_TCB& tcb, uint8_t op_code) { 1155 uint16_t handle = tcb.indicate_handle; 1156 1157 alarm_cancel(tcb.conf_timer); 1158 if (!GATT_HANDLE_IS_VALID(handle)) { 1159 LOG(ERROR) << "unexpected handle value confirmation"; 1160 return; 1161 } 1162 1163 tcb.indicate_handle = 0; 1164 bool continue_processing = gatts_proc_ind_ack(tcb, handle); 1165 1166 if (continue_processing) { 1167 tGATTS_DATA gatts_data; 1168 gatts_data.handle = handle; 1169 for (auto& el : *gatt_cb.srv_list_info) { 1170 if (el.s_hdl <= handle && el.e_hdl >= handle) { 1171 uint32_t trans_id = gatt_sr_enqueue_cmd(tcb, op_code, handle); 1172 uint16_t conn_id = GATT_CREATE_CONN_ID(tcb.tcb_idx, el.gatt_if); 1173 gatt_sr_send_req_callback(conn_id, trans_id, GATTS_REQ_TYPE_CONF, 1174 &gatts_data); 1175 } 1176 } 1177 } 1178 } 1179 1180 /** This function is called to handle the client requests to server */ 1181 void gatt_server_handle_client_req(tGATT_TCB& tcb, uint8_t op_code, 1182 uint16_t len, uint8_t* p_data) { 1183 /* there is pending command, discard this one */ 1184 if (!gatt_sr_cmd_empty(tcb) && op_code != GATT_HANDLE_VALUE_CONF) return; 1185 1186 /* the size of the message may not be bigger than the local max PDU size*/ 1187 /* The message has to be smaller than the agreed MTU, len does not include op 1188 * code */ 1189 if (len >= tcb.payload_size) { 1190 LOG(ERROR) << StringPrintf("server receive invalid PDU size:%d pdu size:%d", 1191 len + 1, tcb.payload_size); 1192 /* for invalid request expecting response, send it now */ 1193 if (op_code != GATT_CMD_WRITE && op_code != GATT_SIGN_CMD_WRITE && 1194 op_code != GATT_HANDLE_VALUE_CONF) { 1195 gatt_send_error_rsp(tcb, GATT_INVALID_PDU, op_code, 0, false); 1196 } 1197 /* otherwise, ignore the pkt */ 1198 } else { 1199 switch (op_code) { 1200 case GATT_REQ_READ_BY_GRP_TYPE: /* discover primary services */ 1201 case GATT_REQ_FIND_TYPE_VALUE: /* discover service by UUID */ 1202 gatts_process_primary_service_req(tcb, op_code, len, p_data); 1203 break; 1204 1205 case GATT_REQ_FIND_INFO: /* discover char descrptor */ 1206 gatts_process_find_info(tcb, op_code, len, p_data); 1207 break; 1208 1209 case GATT_REQ_READ_BY_TYPE: /* read characteristic value, char descriptor 1210 value */ 1211 /* discover characteristic, discover char by UUID */ 1212 gatts_process_read_by_type_req(tcb, op_code, len, p_data); 1213 break; 1214 1215 case GATT_REQ_READ: /* read char/char descriptor value */ 1216 case GATT_REQ_READ_BLOB: 1217 case GATT_REQ_WRITE: /* write char/char descriptor value */ 1218 case GATT_CMD_WRITE: 1219 case GATT_SIGN_CMD_WRITE: 1220 case GATT_REQ_PREPARE_WRITE: 1221 gatts_process_attribute_req(tcb, op_code, len, p_data); 1222 break; 1223 1224 case GATT_HANDLE_VALUE_CONF: 1225 gatts_process_value_conf(tcb, op_code); 1226 break; 1227 1228 case GATT_REQ_MTU: 1229 gatts_process_mtu_req(tcb, len, p_data); 1230 break; 1231 1232 case GATT_REQ_EXEC_WRITE: 1233 gatt_process_exec_write_req(tcb, op_code, len, p_data); 1234 break; 1235 1236 case GATT_REQ_READ_MULTI: 1237 gatt_process_read_multi_req(tcb, op_code, len, p_data); 1238 break; 1239 1240 default: 1241 break; 1242 } 1243 } 1244 } 1245
