/* att.c - Attribute protocol handling */ /* * Copyright (c) 2015-2016 Intel Corporation * * SPDX-License-Identifier: Apache-2.0 */ #include #include #include #include #include #include #include #include #include #include #include #include #define BT_DBG_ENABLED IS_ENABLED(CONFIG_BT_DEBUG_ATT) #include "log.h" #include "hci_core.h" #include "conn_internal.h" #include "l2cap_internal.h" #include "smp.h" #include "att_internal.h" #include "gatt_internal.h" #define ATT_CHAN(_ch) CONTAINER_OF(_ch, struct bt_att, chan.chan) #define ATT_REQ(_node) CONTAINER_OF(_node, struct bt_att_req, node) #define ATT_CMD_MASK 0x40 #define ATT_TIMEOUT K_SECONDS(30) typedef enum __packed { ATT_COMMAND, ATT_REQUEST, ATT_RESPONSE, ATT_NOTIFICATION, ATT_CONFIRMATION, ATT_INDICATION, ATT_UNKNOWN, } att_type_t; static att_type_t att_op_get_type(u8_t op); #if CONFIG_BT_ATT_PREPARE_COUNT > 0 struct bt_attr_data { u16_t handle; u16_t offset; }; #if !defined(BFLB_DYNAMIC_ALLOC_MEM) /* Pool for incoming ATT packets */ NET_BUF_POOL_DEFINE(prep_pool, CONFIG_BT_ATT_PREPARE_COUNT, BT_ATT_MTU, sizeof(struct bt_attr_data), NULL); #else struct net_buf_pool prep_pool; #endif #endif /* CONFIG_BT_ATT_PREPARE_COUNT */ enum { ATT_PENDING_RSP, ATT_PENDING_CFM, ATT_DISCONNECTED, /* Total number of flags - must be at the end of the enum */ ATT_NUM_FLAGS, }; /* ATT channel specific context */ struct bt_att { /* The channel this context is associated with */ struct bt_l2cap_le_chan chan; ATOMIC_DEFINE(flags, ATT_NUM_FLAGS); struct bt_att_req *req; sys_slist_t reqs; struct k_delayed_work timeout_work; struct k_sem tx_sem; struct k_fifo tx_queue; #if CONFIG_BT_ATT_PREPARE_COUNT > 0 struct k_fifo prep_queue; #endif }; #if defined(CONFIG_BT_STACK_PTS) extern volatile u8_t event_flag; #endif static struct bt_att bt_req_pool[CONFIG_BT_MAX_CONN]; static struct bt_att_req cancel; #if defined(CONFIG_BLE_AT_CMD) static u16_t mtu_size = BT_ATT_MTU; void set_mtu_size(u16_t size) { mtu_size = size; } #endif static void att_req_destroy(struct bt_att_req *req) { BT_DBG("req %p", req); if (req->buf) { net_buf_unref(req->buf); } if (req->destroy) { req->destroy(req); } (void)memset(req, 0, sizeof(*req)); } static struct bt_att *att_get(struct bt_conn *conn) { struct bt_l2cap_chan *chan; chan = bt_l2cap_le_lookup_tx_cid(conn, BT_L2CAP_CID_ATT); __ASSERT(chan, "No ATT channel found"); return CONTAINER_OF(chan, struct bt_att, chan); } static bt_conn_tx_cb_t att_cb(struct net_buf *buf); static int att_send(struct bt_conn *conn, struct net_buf *buf, bt_conn_tx_cb_t cb, void *user_data) { struct bt_att_hdr *hdr; hdr = (void *)buf->data; BT_DBG("code 0x%02x", hdr->code); #if defined(CONFIG_BT_SMP) && defined(CONFIG_BT_SIGNING) if (hdr->code == BT_ATT_OP_SIGNED_WRITE_CMD) { int err; err = bt_smp_sign(conn, buf); if (err) { BT_ERR("Error signing data"); net_buf_unref(buf); return err; } } #endif return bt_l2cap_send_cb(conn, BT_L2CAP_CID_ATT, buf, cb ? cb : att_cb(buf), user_data); } void att_pdu_sent(struct bt_conn *conn, void *user_data) { struct bt_att *att = att_get(conn); struct net_buf *buf; BT_DBG("conn %p att %p", conn, att); while ((buf = net_buf_get(&att->tx_queue, K_NO_WAIT))) { /* Check if the queued buf is a request */ if (att->req && att->req->buf == buf) { /* Save request state so it can be resent */ net_buf_simple_save(&att->req->buf->b, &att->req->state); } if (!att_send(conn, buf, NULL, NULL)) { return; } } k_sem_give(&att->tx_sem); } void att_cfm_sent(struct bt_conn *conn, void *user_data) { struct bt_att *att = att_get(conn); BT_DBG("conn %p att %p", conn, att); if (IS_ENABLED(CONFIG_BT_ATT_ENFORCE_FLOW)) { atomic_clear_bit(att->flags, ATT_PENDING_CFM); } att_pdu_sent(conn, user_data); } void att_rsp_sent(struct bt_conn *conn, void *user_data) { struct bt_att *att = att_get(conn); BT_DBG("conn %p att %p", conn, att); if (IS_ENABLED(CONFIG_BT_ATT_ENFORCE_FLOW)) { atomic_clear_bit(att->flags, ATT_PENDING_RSP); } att_pdu_sent(conn, user_data); } void att_req_sent(struct bt_conn *conn, void *user_data) { struct bt_att *att = att_get(conn); BT_DBG("conn %p att %p att->req %p", conn, att, att->req); /* Start timeout work */ if (att->req) { k_delayed_work_submit(&att->timeout_work, ATT_TIMEOUT); } att_pdu_sent(conn, user_data); } static bt_conn_tx_cb_t att_cb(struct net_buf *buf) { switch (att_op_get_type(buf->data[0])) { case ATT_RESPONSE: return att_rsp_sent; case ATT_CONFIRMATION: return att_cfm_sent; case ATT_REQUEST: case ATT_INDICATION: return att_req_sent; default: return att_pdu_sent; } } static void send_err_rsp(struct bt_conn *conn, u8_t req, u16_t handle, u8_t err) { struct bt_att_error_rsp *rsp; struct net_buf *buf; /* Ignore opcode 0x00 */ if (!req) { return; } buf = bt_att_create_pdu(conn, BT_ATT_OP_ERROR_RSP, sizeof(*rsp)); if (!buf) { return; } rsp = net_buf_add(buf, sizeof(*rsp)); rsp->request = req; rsp->handle = sys_cpu_to_le16(handle); rsp->error = err; (void)bt_l2cap_send_cb(conn, BT_L2CAP_CID_ATT, buf, att_rsp_sent, NULL); } static u8_t att_mtu_req(struct bt_att *att, struct net_buf *buf) { struct bt_conn *conn = att->chan.chan.conn; struct bt_att_exchange_mtu_req *req; struct bt_att_exchange_mtu_rsp *rsp; struct net_buf *pdu; u16_t mtu_client, mtu_server; req = (void *)buf->data; mtu_client = sys_le16_to_cpu(req->mtu); BT_DBG("Client MTU %u", mtu_client); /* Check if MTU is valid */ if (mtu_client < BT_ATT_DEFAULT_LE_MTU) { return BT_ATT_ERR_INVALID_PDU; } pdu = bt_att_create_pdu(conn, BT_ATT_OP_MTU_RSP, sizeof(*rsp)); if (!pdu) { return BT_ATT_ERR_UNLIKELY; } mtu_server = BT_ATT_MTU; BT_DBG("Server MTU %u", mtu_server); rsp = net_buf_add(pdu, sizeof(*rsp)); rsp->mtu = sys_cpu_to_le16(mtu_server); (void)bt_l2cap_send_cb(conn, BT_L2CAP_CID_ATT, pdu, att_rsp_sent, NULL); /* BLUETOOTH SPECIFICATION Version 4.2 [Vol 3, Part F] page 484: * * A device's Exchange MTU Request shall contain the same MTU as the * device's Exchange MTU Response (i.e. the MTU shall be symmetric). */ att->chan.rx.mtu = MIN(mtu_client, mtu_server); att->chan.tx.mtu = att->chan.rx.mtu; BT_DBG("Negotiated MTU %u", att->chan.rx.mtu); #if defined(BFLB_BLE_MTU_CHANGE_CB) if (att->chan.chan.ops->mtu_changed) att->chan.chan.ops->mtu_changed(&(att->chan.chan), att->chan.rx.mtu); #endif return 0; } static inline bool att_is_connected(struct bt_att *att) { return (att->chan.chan.conn->state != BT_CONN_CONNECTED || !atomic_test_bit(att->flags, ATT_DISCONNECTED)); } static int att_send_req(struct bt_att *att, struct bt_att_req *req) { int err; __ASSERT_NO_MSG(req); __ASSERT_NO_MSG(req->func); __ASSERT_NO_MSG(!att->req); BT_DBG("req %p", req); att->req = req; if (k_sem_take(&att->tx_sem, K_NO_WAIT) < 0) { k_fifo_put(&att->tx_queue, req->buf); return 0; } /* Save request state so it can be resent */ net_buf_simple_save(&req->buf->b, &req->state); /* Keep a reference for resending in case of an error */ err = bt_l2cap_send_cb(att->chan.chan.conn, BT_L2CAP_CID_ATT, net_buf_ref(req->buf), att_cb(req->buf), NULL); if (err) { net_buf_unref(req->buf); req->buf = NULL; return err; } return 0; } static void att_process(struct bt_att *att) { sys_snode_t *node; BT_DBG(""); /* Pull next request from the list */ node = sys_slist_get(&att->reqs); if (!node) { return; } att_send_req(att, ATT_REQ(node)); } static u8_t att_handle_rsp(struct bt_att *att, void *pdu, u16_t len, u8_t err) { bt_att_func_t func; BT_DBG("err 0x%02x len %u: %s", err, len, bt_hex(pdu, len)); /* Cancel timeout if ongoing */ k_delayed_work_cancel(&att->timeout_work); if (!att->req) { BT_WARN("No pending ATT request"); goto process; } /* Check if request has been cancelled */ if (att->req == &cancel) { att->req = NULL; goto process; } /* Release original buffer */ if (att->req->buf) { net_buf_unref(att->req->buf); att->req->buf = NULL; } /* Reset func so it can be reused by the callback */ func = att->req->func; att->req->func = NULL; func(att->chan.chan.conn, err, pdu, len, att->req); /* Don't destroy if callback had reused the request */ if (!att->req->func) { att_req_destroy(att->req); } att->req = NULL; process: /* Process pending requests */ att_process(att); return 0; } #if defined(CONFIG_BT_GATT_CLIENT) static u8_t att_mtu_rsp(struct bt_att *att, struct net_buf *buf) { struct bt_att_exchange_mtu_rsp *rsp; u16_t mtu; if (!att) { return 0; } rsp = (void *)buf->data; mtu = sys_le16_to_cpu(rsp->mtu); BT_DBG("Server MTU %u", mtu); /* Check if MTU is valid */ if (mtu < BT_ATT_DEFAULT_LE_MTU) { return att_handle_rsp(att, NULL, 0, BT_ATT_ERR_INVALID_PDU); } att->chan.rx.mtu = MIN(mtu, BT_ATT_MTU); /* BLUETOOTH SPECIFICATION Version 4.2 [Vol 3, Part F] page 484: * * A device's Exchange MTU Request shall contain the same MTU as the * device's Exchange MTU Response (i.e. the MTU shall be symmetric). */ att->chan.tx.mtu = att->chan.rx.mtu; BT_DBG("Negotiated MTU %u", att->chan.rx.mtu); return att_handle_rsp(att, rsp, buf->len, 0); } #endif /* CONFIG_BT_GATT_CLIENT */ static bool range_is_valid(u16_t start, u16_t end, u16_t *err) { /* Handle 0 is invalid */ if (!start || !end) { if (err) { *err = 0U; } return false; } /* Check if range is valid */ if (start > end) { if (err) { *err = start; } return false; } return true; } struct find_info_data { struct bt_att *att; struct net_buf *buf; struct bt_att_find_info_rsp *rsp; union { struct bt_att_info_16 *info16; struct bt_att_info_128 *info128; }; }; static u8_t find_info_cb(const struct bt_gatt_attr *attr, void *user_data) { struct find_info_data *data = user_data; struct bt_att *att = data->att; BT_DBG("handle 0x%04x", attr->handle); /* Initialize rsp at first entry */ if (!data->rsp) { data->rsp = net_buf_add(data->buf, sizeof(*data->rsp)); data->rsp->format = (attr->uuid->type == BT_UUID_TYPE_16) ? BT_ATT_INFO_16 : BT_ATT_INFO_128; } switch (data->rsp->format) { case BT_ATT_INFO_16: if (attr->uuid->type != BT_UUID_TYPE_16) { return BT_GATT_ITER_STOP; } /* Fast forward to next item position */ data->info16 = net_buf_add(data->buf, sizeof(*data->info16)); data->info16->handle = sys_cpu_to_le16(attr->handle); data->info16->uuid = sys_cpu_to_le16(BT_UUID_16(attr->uuid)->val); if (att->chan.tx.mtu - data->buf->len > sizeof(*data->info16)) { return BT_GATT_ITER_CONTINUE; } break; case BT_ATT_INFO_128: if (attr->uuid->type != BT_UUID_TYPE_128) { return BT_GATT_ITER_STOP; } /* Fast forward to next item position */ data->info128 = net_buf_add(data->buf, sizeof(*data->info128)); data->info128->handle = sys_cpu_to_le16(attr->handle); memcpy(data->info128->uuid, BT_UUID_128(attr->uuid)->val, sizeof(data->info128->uuid)); if (att->chan.tx.mtu - data->buf->len > sizeof(*data->info128)) { return BT_GATT_ITER_CONTINUE; } } return BT_GATT_ITER_STOP; } static u8_t att_find_info_rsp(struct bt_att *att, u16_t start_handle, u16_t end_handle) { struct bt_conn *conn = att->chan.chan.conn; struct find_info_data data; (void)memset(&data, 0, sizeof(data)); data.buf = bt_att_create_pdu(conn, BT_ATT_OP_FIND_INFO_RSP, 0); if (!data.buf) { return BT_ATT_ERR_UNLIKELY; } data.att = att; bt_gatt_foreach_attr(start_handle, end_handle, find_info_cb, &data); if (!data.rsp) { net_buf_unref(data.buf); /* Respond since handle is set */ send_err_rsp(conn, BT_ATT_OP_FIND_INFO_REQ, start_handle, BT_ATT_ERR_ATTRIBUTE_NOT_FOUND); return 0; } (void)bt_l2cap_send_cb(conn, BT_L2CAP_CID_ATT, data.buf, att_rsp_sent, NULL); return 0; } static u8_t att_find_info_req(struct bt_att *att, struct net_buf *buf) { struct bt_conn *conn = att->chan.chan.conn; struct bt_att_find_info_req *req; u16_t start_handle, end_handle, err_handle; req = (void *)buf->data; start_handle = sys_le16_to_cpu(req->start_handle); end_handle = sys_le16_to_cpu(req->end_handle); BT_DBG("start_handle 0x%04x end_handle 0x%04x", start_handle, end_handle); if (!range_is_valid(start_handle, end_handle, &err_handle)) { send_err_rsp(conn, BT_ATT_OP_FIND_INFO_REQ, err_handle, BT_ATT_ERR_INVALID_HANDLE); return 0; } return att_find_info_rsp(att, start_handle, end_handle); } struct find_type_data { struct bt_att *att; struct net_buf *buf; struct bt_att_handle_group *group; const void *value; u8_t value_len; u8_t err; }; static u8_t find_type_cb(const struct bt_gatt_attr *attr, void *user_data) { struct find_type_data *data = user_data; struct bt_att *att = data->att; struct bt_conn *conn = att->chan.chan.conn; int read; u8_t uuid[16]; /* Skip secondary services */ if (!bt_uuid_cmp(attr->uuid, BT_UUID_GATT_SECONDARY)) { goto skip; } /* Update group end_handle if not a primary service */ if (bt_uuid_cmp(attr->uuid, BT_UUID_GATT_PRIMARY)) { if (data->group && attr->handle > sys_le16_to_cpu(data->group->end_handle)) { data->group->end_handle = sys_cpu_to_le16(attr->handle); } return BT_GATT_ITER_CONTINUE; } BT_DBG("handle 0x%04x", attr->handle); /* stop if there is no space left */ if (att->chan.tx.mtu - data->buf->len < sizeof(*data->group)) { return BT_GATT_ITER_STOP; } /* Read attribute value and store in the buffer */ read = attr->read(conn, attr, uuid, sizeof(uuid), 0); if (read < 0) { /* * Since we don't know if it is the service with requested UUID, * we cannot respond with an error to this request. */ goto skip; } /* Check if data matches */ if (read != data->value_len) { /* Use bt_uuid_cmp() to compare UUIDs of different form. */ struct bt_uuid_128 ref_uuid; struct bt_uuid_128 recvd_uuid; if (!bt_uuid_create(&recvd_uuid.uuid, data->value, data->value_len)) { BT_WARN("Unable to create UUID: size %u", data->value_len); goto skip; } if (!bt_uuid_create(&ref_uuid.uuid, uuid, read)) { BT_WARN("Unable to create UUID: size %d", read); goto skip; } if (bt_uuid_cmp(&recvd_uuid.uuid, &ref_uuid.uuid)) { goto skip; } } else if (memcmp(data->value, uuid, read)) { goto skip; } /* If service has been found, error should be cleared */ data->err = 0x00; /* Fast forward to next item position */ data->group = net_buf_add(data->buf, sizeof(*data->group)); data->group->start_handle = sys_cpu_to_le16(attr->handle); data->group->end_handle = sys_cpu_to_le16(attr->handle); /* continue to find the end_handle */ return BT_GATT_ITER_CONTINUE; skip: data->group = NULL; return BT_GATT_ITER_CONTINUE; } static u8_t att_find_type_rsp(struct bt_att *att, u16_t start_handle, u16_t end_handle, const void *value, u8_t value_len) { struct bt_conn *conn = att->chan.chan.conn; struct find_type_data data; (void)memset(&data, 0, sizeof(data)); data.buf = bt_att_create_pdu(conn, BT_ATT_OP_FIND_TYPE_RSP, 0); if (!data.buf) { return BT_ATT_ERR_UNLIKELY; } data.att = att; data.group = NULL; data.value = value; data.value_len = value_len; /* Pre-set error in case no service will be found */ data.err = BT_ATT_ERR_ATTRIBUTE_NOT_FOUND; bt_gatt_foreach_attr(start_handle, end_handle, find_type_cb, &data); /* If error has not been cleared, no service has been found */ if (data.err) { net_buf_unref(data.buf); /* Respond since handle is set */ send_err_rsp(conn, BT_ATT_OP_FIND_TYPE_REQ, start_handle, data.err); #if defined(CONFIG_BT_STACK_PTS) /*PTS sends a request to the iut discover all primary services it contains */ if (event_flag == att_find_by_type_value_ind) { BT_PTS("rsp err : [%d] start_handle = [0x%04x]\r\n", data.err, start_handle); } #endif return 0; } #if defined(CONFIG_BT_STACK_PTS) /*when PTS sends a request to the iut discover all primary services it contains, set event flag * to @att_find_by_type_value_ind make it easy for the user to check whether the messages is correct in the console. */ if (event_flag == att_find_by_type_value_ind) { u8_t i = 0; u8_t *req_val = (u8_t *)data.value; u8_t src[20]; (void)memcpy(src, req_val, data.value_len); BT_PTS("uuid = ["); for (i = 0; i < value_len; i++) { BT_PTS("%02x", src[value_len - 1 - i]); } BT_PTS("]\r\n"); BT_PTS("start_handle = [0x%04x] end_handle = [0x%04x]\r\n", data.buf->data[1] | data.buf->data[2] << 8, data.buf->data[3] | data.buf->data[4] << 8); } #endif (void)bt_l2cap_send_cb(conn, BT_L2CAP_CID_ATT, data.buf, att_rsp_sent, NULL); return 0; } static u8_t att_find_type_req(struct bt_att *att, struct net_buf *buf) { struct bt_conn *conn = att->chan.chan.conn; struct bt_att_find_type_req *req; u16_t start_handle, end_handle, err_handle, type; u8_t *value; req = net_buf_pull_mem(buf, sizeof(*req)); start_handle = sys_le16_to_cpu(req->start_handle); end_handle = sys_le16_to_cpu(req->end_handle); type = sys_le16_to_cpu(req->type); value = buf->data; BT_DBG("start_handle 0x%04x end_handle 0x%04x type %u", start_handle, end_handle, type); if (!range_is_valid(start_handle, end_handle, &err_handle)) { send_err_rsp(conn, BT_ATT_OP_FIND_TYPE_REQ, err_handle, BT_ATT_ERR_INVALID_HANDLE); return 0; } /* The Attribute Protocol Find By Type Value Request shall be used with * the Attribute Type parameter set to the UUID for "Primary Service" * and the Attribute Value set to the 16-bit Bluetooth UUID or 128-bit * UUID for the specific primary service. */ if (bt_uuid_cmp(BT_UUID_DECLARE_16(type), BT_UUID_GATT_PRIMARY)) { send_err_rsp(conn, BT_ATT_OP_FIND_TYPE_REQ, start_handle, BT_ATT_ERR_ATTRIBUTE_NOT_FOUND); return 0; } return att_find_type_rsp(att, start_handle, end_handle, value, buf->len); } static u8_t err_to_att(int err) { BT_DBG("%d", err); if (err < 0 && err >= -0xff) { return -err; } return BT_ATT_ERR_UNLIKELY; } struct read_type_data { struct bt_att *att; struct bt_uuid *uuid; struct net_buf *buf; struct bt_att_read_type_rsp *rsp; struct bt_att_data *item; u8_t err; }; static u8_t read_type_cb(const struct bt_gatt_attr *attr, void *user_data) { struct read_type_data *data = user_data; struct bt_att *att = data->att; struct bt_conn *conn = att->chan.chan.conn; int read; /* Skip if doesn't match */ if (bt_uuid_cmp(attr->uuid, data->uuid)) { return BT_GATT_ITER_CONTINUE; } BT_DBG("handle 0x%04x", attr->handle); /* * If an attribute in the set of requested attributes would cause an * Error Response then this attribute cannot be included in a * Read By Type Response and the attributes before this attribute * shall be returned * * If the first attribute in the set of requested attributes would * cause an Error Response then no other attributes in the requested * attributes can be considered. */ data->err = bt_gatt_check_perm(conn, attr, BT_GATT_PERM_READ_MASK); if (data->err) { if (data->rsp->len) { data->err = 0x00; } return BT_GATT_ITER_STOP; } /* * If any attribute is founded in handle range it means that error * should be changed from pre-set: attr not found error to no error. */ data->err = 0x00; /* Fast forward to next item position */ data->item = net_buf_add(data->buf, sizeof(*data->item)); data->item->handle = sys_cpu_to_le16(attr->handle); /* Read attribute value and store in the buffer */ read = attr->read(conn, attr, data->buf->data + data->buf->len, att->chan.tx.mtu - data->buf->len, 0); if (read < 0) { data->err = err_to_att(read); return BT_GATT_ITER_STOP; } if (!data->rsp->len) { /* Set len to be the first item found */ data->rsp->len = read + sizeof(*data->item); } else if (data->rsp->len != read + sizeof(*data->item)) { /* All items should have the same size */ data->buf->len -= sizeof(*data->item); return BT_GATT_ITER_STOP; } net_buf_add(data->buf, read); /* return true only if there are still space for more items */ return att->chan.tx.mtu - data->buf->len > data->rsp->len ? BT_GATT_ITER_CONTINUE : BT_GATT_ITER_STOP; } static u8_t att_read_type_rsp(struct bt_att *att, struct bt_uuid *uuid, u16_t start_handle, u16_t end_handle) { struct bt_conn *conn = att->chan.chan.conn; struct read_type_data data; (void)memset(&data, 0, sizeof(data)); data.buf = bt_att_create_pdu(conn, BT_ATT_OP_READ_TYPE_RSP, sizeof(*data.rsp)); if (!data.buf) { return BT_ATT_ERR_UNLIKELY; } data.att = att; data.uuid = uuid; data.rsp = net_buf_add(data.buf, sizeof(*data.rsp)); data.rsp->len = 0U; /* Pre-set error if no attr will be found in handle */ data.err = BT_ATT_ERR_ATTRIBUTE_NOT_FOUND; bt_gatt_foreach_attr(start_handle, end_handle, read_type_cb, &data); if (data.err) { net_buf_unref(data.buf); /* Response here since handle is set */ send_err_rsp(conn, BT_ATT_OP_READ_TYPE_REQ, start_handle, data.err); return 0; } #if defined(CONFIG_BT_STACK_PTS) if (event_flag == att_read_by_type_ind) BT_PTS("handle : [0x%04x]\r\n", data.rsp->data->handle); #endif (void)bt_l2cap_send_cb(conn, BT_L2CAP_CID_ATT, data.buf, att_rsp_sent, NULL); return 0; } static u8_t att_read_type_req(struct bt_att *att, struct net_buf *buf) { struct bt_conn *conn = att->chan.chan.conn; struct bt_att_read_type_req *req; u16_t start_handle, end_handle, err_handle; union { struct bt_uuid uuid; struct bt_uuid_16 u16; struct bt_uuid_128 u128; } u; u8_t uuid_len = buf->len - sizeof(*req); /* Type can only be UUID16 or UUID128 */ if (uuid_len != 2 && uuid_len != 16) { return BT_ATT_ERR_INVALID_PDU; } req = net_buf_pull_mem(buf, sizeof(*req)); start_handle = sys_le16_to_cpu(req->start_handle); end_handle = sys_le16_to_cpu(req->end_handle); if (!bt_uuid_create(&u.uuid, req->uuid, uuid_len)) { return BT_ATT_ERR_UNLIKELY; } BT_DBG("start_handle 0x%04x end_handle 0x%04x type %s", start_handle, end_handle, bt_uuid_str(&u.uuid)); if (!range_is_valid(start_handle, end_handle, &err_handle)) { send_err_rsp(conn, BT_ATT_OP_READ_TYPE_REQ, err_handle, BT_ATT_ERR_INVALID_HANDLE); return 0; } return att_read_type_rsp(att, &u.uuid, start_handle, end_handle); } struct read_data { struct bt_att *att; u16_t offset; struct net_buf *buf; struct bt_att_read_rsp *rsp; u8_t err; }; static u8_t read_cb(const struct bt_gatt_attr *attr, void *user_data) { struct read_data *data = user_data; struct bt_att *att = data->att; struct bt_conn *conn = att->chan.chan.conn; int read; BT_DBG("handle 0x%04x", attr->handle); data->rsp = net_buf_add(data->buf, sizeof(*data->rsp)); /* * If any attribute is founded in handle range it means that error * should be changed from pre-set: invalid handle error to no error. */ data->err = 0x00; /* Check attribute permissions */ data->err = bt_gatt_check_perm(conn, attr, BT_GATT_PERM_READ_MASK); if (data->err) { return BT_GATT_ITER_STOP; } /* Read attribute value and store in the buffer */ read = attr->read(conn, attr, data->buf->data + data->buf->len, att->chan.tx.mtu - data->buf->len, data->offset); if (read < 0) { data->err = err_to_att(read); return BT_GATT_ITER_STOP; } net_buf_add(data->buf, read); return BT_GATT_ITER_CONTINUE; } static u8_t att_read_rsp(struct bt_att *att, u8_t op, u8_t rsp, u16_t handle, u16_t offset) { struct bt_conn *conn = att->chan.chan.conn; struct read_data data; if (!bt_gatt_change_aware(conn, true)) { return BT_ATT_ERR_DB_OUT_OF_SYNC; } if (!handle) { return BT_ATT_ERR_INVALID_HANDLE; } (void)memset(&data, 0, sizeof(data)); data.buf = bt_att_create_pdu(conn, rsp, 0); if (!data.buf) { return BT_ATT_ERR_UNLIKELY; } data.att = att; data.offset = offset; /* Pre-set error if no attr will be found in handle */ data.err = BT_ATT_ERR_INVALID_HANDLE; bt_gatt_foreach_attr(handle, handle, read_cb, &data); /* In case of error discard data and respond with an error */ if (data.err) { net_buf_unref(data.buf); /* Respond here since handle is set */ send_err_rsp(conn, op, handle, data.err); return 0; } (void)bt_l2cap_send_cb(conn, BT_L2CAP_CID_ATT, data.buf, att_rsp_sent, NULL); return 0; } static u8_t att_read_req(struct bt_att *att, struct net_buf *buf) { struct bt_att_read_req *req; u16_t handle; req = (void *)buf->data; handle = sys_le16_to_cpu(req->handle); BT_DBG("handle 0x%04x", handle); return att_read_rsp(att, BT_ATT_OP_READ_REQ, BT_ATT_OP_READ_RSP, handle, 0); } static u8_t att_read_blob_req(struct bt_att *att, struct net_buf *buf) { struct bt_att_read_blob_req *req; u16_t handle, offset; req = (void *)buf->data; handle = sys_le16_to_cpu(req->handle); offset = sys_le16_to_cpu(req->offset); BT_DBG("handle 0x%04x offset %u", handle, offset); return att_read_rsp(att, BT_ATT_OP_READ_BLOB_REQ, BT_ATT_OP_READ_BLOB_RSP, handle, offset); } #if defined(CONFIG_BT_GATT_READ_MULTIPLE) static u8_t att_read_mult_req(struct bt_att *att, struct net_buf *buf) { struct bt_conn *conn = att->chan.chan.conn; struct read_data data; u16_t handle; (void)memset(&data, 0, sizeof(data)); data.buf = bt_att_create_pdu(conn, BT_ATT_OP_READ_MULT_RSP, 0); if (!data.buf) { return BT_ATT_ERR_UNLIKELY; } data.att = att; while (buf->len >= sizeof(u16_t)) { handle = net_buf_pull_le16(buf); BT_DBG("handle 0x%04x ", handle); /* An Error Response shall be sent by the server in response to * the Read Multiple Request [....] if a read operation is not * permitted on any of the Characteristic Values. * * If handle is not valid then return invalid handle error. * If handle is found error will be cleared by read_cb. */ data.err = BT_ATT_ERR_INVALID_HANDLE; bt_gatt_foreach_attr(handle, handle, read_cb, &data); /* Stop reading in case of error */ if (data.err) { net_buf_unref(data.buf); /* Respond here since handle is set */ send_err_rsp(conn, BT_ATT_OP_READ_MULT_REQ, handle, data.err); return 0; } } (void)bt_l2cap_send_cb(conn, BT_L2CAP_CID_ATT, data.buf, att_rsp_sent, NULL); return 0; } #endif /* CONFIG_BT_GATT_READ_MULTIPLE */ struct read_group_data { struct bt_att *att; struct bt_uuid *uuid; struct net_buf *buf; struct bt_att_read_group_rsp *rsp; struct bt_att_group_data *group; }; static u8_t read_group_cb(const struct bt_gatt_attr *attr, void *user_data) { struct read_group_data *data = user_data; struct bt_att *att = data->att; struct bt_conn *conn = att->chan.chan.conn; int read; /* Update group end_handle if attribute is not a service */ if (bt_uuid_cmp(attr->uuid, BT_UUID_GATT_PRIMARY) && bt_uuid_cmp(attr->uuid, BT_UUID_GATT_SECONDARY)) { if (data->group && attr->handle > sys_le16_to_cpu(data->group->end_handle)) { data->group->end_handle = sys_cpu_to_le16(attr->handle); } return BT_GATT_ITER_CONTINUE; } /* If Group Type don't match skip */ if (bt_uuid_cmp(attr->uuid, data->uuid)) { data->group = NULL; return BT_GATT_ITER_CONTINUE; } BT_DBG("handle 0x%04x", attr->handle); /* Stop if there is no space left */ if (data->rsp->len && att->chan.tx.mtu - data->buf->len < data->rsp->len) { return BT_GATT_ITER_STOP; } /* Fast forward to next group position */ data->group = net_buf_add(data->buf, sizeof(*data->group)); /* Initialize group handle range */ data->group->start_handle = sys_cpu_to_le16(attr->handle); data->group->end_handle = sys_cpu_to_le16(attr->handle); /* Read attribute value and store in the buffer */ read = attr->read(conn, attr, data->buf->data + data->buf->len, att->chan.tx.mtu - data->buf->len, 0); if (read < 0) { /* TODO: Handle read errors */ return BT_GATT_ITER_STOP; } if (!data->rsp->len) { /* Set len to be the first group found */ data->rsp->len = read + sizeof(*data->group); } else if (data->rsp->len != read + sizeof(*data->group)) { /* All groups entries should have the same size */ data->buf->len -= sizeof(*data->group); return false; } net_buf_add(data->buf, read); /* Continue to find the end handle */ return BT_GATT_ITER_CONTINUE; } static u8_t att_read_group_rsp(struct bt_att *att, struct bt_uuid *uuid, u16_t start_handle, u16_t end_handle) { struct bt_conn *conn = att->chan.chan.conn; struct read_group_data data; (void)memset(&data, 0, sizeof(data)); data.buf = bt_att_create_pdu(conn, BT_ATT_OP_READ_GROUP_RSP, sizeof(*data.rsp)); if (!data.buf) { return BT_ATT_ERR_UNLIKELY; } data.att = att; data.uuid = uuid; data.rsp = net_buf_add(data.buf, sizeof(*data.rsp)); data.rsp->len = 0U; data.group = NULL; bt_gatt_foreach_attr(start_handle, end_handle, read_group_cb, &data); if (!data.rsp->len) { net_buf_unref(data.buf); /* Respond here since handle is set */ send_err_rsp(conn, BT_ATT_OP_READ_GROUP_REQ, start_handle, BT_ATT_ERR_ATTRIBUTE_NOT_FOUND); return 0; } (void)bt_l2cap_send_cb(conn, BT_L2CAP_CID_ATT, data.buf, att_rsp_sent, NULL); return 0; } static u8_t att_read_group_req(struct bt_att *att, struct net_buf *buf) { struct bt_conn *conn = att->chan.chan.conn; struct bt_att_read_group_req *req; u16_t start_handle, end_handle, err_handle; union { struct bt_uuid uuid; struct bt_uuid_16 u16; struct bt_uuid_128 u128; } u; u8_t uuid_len = buf->len - sizeof(*req); /* Type can only be UUID16 or UUID128 */ if (uuid_len != 2 && uuid_len != 16) { return BT_ATT_ERR_INVALID_PDU; } req = net_buf_pull_mem(buf, sizeof(*req)); start_handle = sys_le16_to_cpu(req->start_handle); end_handle = sys_le16_to_cpu(req->end_handle); if (!bt_uuid_create(&u.uuid, req->uuid, uuid_len)) { return BT_ATT_ERR_UNLIKELY; } BT_DBG("start_handle 0x%04x end_handle 0x%04x type %s", start_handle, end_handle, bt_uuid_str(&u.uuid)); if (!range_is_valid(start_handle, end_handle, &err_handle)) { send_err_rsp(conn, BT_ATT_OP_READ_GROUP_REQ, err_handle, BT_ATT_ERR_INVALID_HANDLE); return 0; } /* Core v4.2, Vol 3, sec 2.5.3 Attribute Grouping: * Not all of the grouping attributes can be used in the ATT * Read By Group Type Request. The "Primary Service" and "Secondary * Service" grouping types may be used in the Read By Group Type * Request. The "Characteristic" grouping type shall not be used in * the ATT Read By Group Type Request. */ if (bt_uuid_cmp(&u.uuid, BT_UUID_GATT_PRIMARY) && bt_uuid_cmp(&u.uuid, BT_UUID_GATT_SECONDARY)) { send_err_rsp(conn, BT_ATT_OP_READ_GROUP_REQ, start_handle, BT_ATT_ERR_UNSUPPORTED_GROUP_TYPE); return 0; } return att_read_group_rsp(att, &u.uuid, start_handle, end_handle); } struct write_data { struct bt_conn *conn; struct net_buf *buf; u8_t req; const void *value; u16_t len; u16_t offset; u8_t err; }; static u8_t write_cb(const struct bt_gatt_attr *attr, void *user_data) { struct write_data *data = user_data; int write; u8_t flags = 0U; BT_DBG("handle 0x%04x offset %u", attr->handle, data->offset); /* Check attribute permissions */ data->err = bt_gatt_check_perm(data->conn, attr, BT_GATT_PERM_WRITE_MASK); if (data->err) { return BT_GATT_ITER_STOP; } /* Set command flag if not a request */ if (!data->req) { flags |= BT_GATT_WRITE_FLAG_CMD; } /* Write attribute value */ write = attr->write(data->conn, attr, data->value, data->len, data->offset, flags); if (write < 0 || write != data->len) { data->err = err_to_att(write); return BT_GATT_ITER_STOP; } data->err = 0U; return BT_GATT_ITER_CONTINUE; } static u8_t att_write_rsp(struct bt_conn *conn, u8_t req, u8_t rsp, u16_t handle, u16_t offset, const void *value, u16_t len) { struct write_data data; if (!bt_gatt_change_aware(conn, req ? true : false)) { return BT_ATT_ERR_DB_OUT_OF_SYNC; } if (!handle) { return BT_ATT_ERR_INVALID_HANDLE; } (void)memset(&data, 0, sizeof(data)); /* Only allocate buf if required to respond */ if (rsp) { data.buf = bt_att_create_pdu(conn, rsp, 0); if (!data.buf) { return BT_ATT_ERR_UNLIKELY; } } data.conn = conn; data.req = req; data.offset = offset; data.value = value; data.len = len; data.err = BT_ATT_ERR_INVALID_HANDLE; bt_gatt_foreach_attr(handle, handle, write_cb, &data); if (data.err) { /* In case of error discard data and respond with an error */ if (rsp) { net_buf_unref(data.buf); /* Respond here since handle is set */ send_err_rsp(conn, req, handle, data.err); } return req == BT_ATT_OP_EXEC_WRITE_REQ ? data.err : 0; } if (data.buf) { (void)bt_l2cap_send_cb(conn, BT_L2CAP_CID_ATT, data.buf, att_rsp_sent, NULL); } return 0; } static u8_t att_write_req(struct bt_att *att, struct net_buf *buf) { struct bt_conn *conn = att->chan.chan.conn; u16_t handle; handle = net_buf_pull_le16(buf); BT_DBG("handle 0x%04x", handle); return att_write_rsp(conn, BT_ATT_OP_WRITE_REQ, BT_ATT_OP_WRITE_RSP, handle, 0, buf->data, buf->len); } #if CONFIG_BT_ATT_PREPARE_COUNT > 0 struct prep_data { struct bt_conn *conn; struct net_buf *buf; const void *value; u16_t len; u16_t offset; u8_t err; }; static u8_t prep_write_cb(const struct bt_gatt_attr *attr, void *user_data) { struct prep_data *data = user_data; struct bt_attr_data *attr_data; int write; BT_DBG("handle 0x%04x offset %u", attr->handle, data->offset); /* Check attribute permissions */ data->err = bt_gatt_check_perm(data->conn, attr, BT_GATT_PERM_WRITE_MASK); if (data->err) { return BT_GATT_ITER_STOP; } /* Check if attribute requires handler to accept the data */ if (!(attr->perm & BT_GATT_PERM_PREPARE_WRITE)) { goto append; } /* Write attribute value to check if device is authorized */ write = attr->write(data->conn, attr, data->value, data->len, data->offset, BT_GATT_WRITE_FLAG_PREPARE); if (write != 0) { data->err = err_to_att(write); return BT_GATT_ITER_STOP; } append: /* Copy data into the outstanding queue */ data->buf = net_buf_alloc(&prep_pool, K_NO_WAIT); if (!data->buf) { data->err = BT_ATT_ERR_PREPARE_QUEUE_FULL; return BT_GATT_ITER_STOP; } attr_data = net_buf_user_data(data->buf); attr_data->handle = attr->handle; attr_data->offset = data->offset; net_buf_add_mem(data->buf, data->value, data->len); data->err = 0U; return BT_GATT_ITER_CONTINUE; } static u8_t att_prep_write_rsp(struct bt_att *att, u16_t handle, u16_t offset, const void *value, u16_t len) { struct bt_conn *conn = att->chan.chan.conn; struct prep_data data; struct bt_att_prepare_write_rsp *rsp; if (!bt_gatt_change_aware(conn, true)) { return BT_ATT_ERR_DB_OUT_OF_SYNC; } if (!handle) { return BT_ATT_ERR_INVALID_HANDLE; } (void)memset(&data, 0, sizeof(data)); data.conn = conn; data.offset = offset; data.value = value; data.len = len; data.err = BT_ATT_ERR_INVALID_HANDLE; bt_gatt_foreach_attr(handle, handle, prep_write_cb, &data); if (data.err) { /* Respond here since handle is set */ send_err_rsp(conn, BT_ATT_OP_PREPARE_WRITE_REQ, handle, data.err); return 0; } BT_DBG("buf %p handle 0x%04x offset %u", data.buf, handle, offset); /* Store buffer in the outstanding queue */ net_buf_put(&att->prep_queue, data.buf); /* Generate response */ data.buf = bt_att_create_pdu(conn, BT_ATT_OP_PREPARE_WRITE_RSP, 0); if (!data.buf) { return BT_ATT_ERR_UNLIKELY; } rsp = net_buf_add(data.buf, sizeof(*rsp)); rsp->handle = sys_cpu_to_le16(handle); rsp->offset = sys_cpu_to_le16(offset); net_buf_add(data.buf, len); memcpy(rsp->value, value, len); (void)bt_l2cap_send_cb(conn, BT_L2CAP_CID_ATT, data.buf, att_rsp_sent, NULL); return 0; } #endif /* CONFIG_BT_ATT_PREPARE_COUNT */ static u8_t att_prepare_write_req(struct bt_att *att, struct net_buf *buf) { #if CONFIG_BT_ATT_PREPARE_COUNT == 0 return BT_ATT_ERR_NOT_SUPPORTED; #else struct bt_att_prepare_write_req *req; u16_t handle, offset; req = net_buf_pull_mem(buf, sizeof(*req)); handle = sys_le16_to_cpu(req->handle); offset = sys_le16_to_cpu(req->offset); BT_DBG("handle 0x%04x offset %u", handle, offset); return att_prep_write_rsp(att, handle, offset, buf->data, buf->len); #endif /* CONFIG_BT_ATT_PREPARE_COUNT */ } #if CONFIG_BT_ATT_PREPARE_COUNT > 0 static u8_t att_exec_write_rsp(struct bt_att *att, u8_t flags) { struct bt_conn *conn = att->chan.chan.conn; struct net_buf *buf; u8_t err = 0U; while ((buf = net_buf_get(&att->prep_queue, K_NO_WAIT))) { struct bt_attr_data *data = net_buf_user_data(buf); BT_DBG("buf %p handle 0x%04x offset %u", buf, data->handle, data->offset); /* Just discard the data if an error was set */ if (!err && flags == BT_ATT_FLAG_EXEC) { err = att_write_rsp(conn, BT_ATT_OP_EXEC_WRITE_REQ, 0, data->handle, data->offset, buf->data, buf->len); if (err) { /* Respond here since handle is set */ send_err_rsp(conn, BT_ATT_OP_EXEC_WRITE_REQ, data->handle, err); } } net_buf_unref(buf); } if (err) { return 0; } /* Generate response */ buf = bt_att_create_pdu(conn, BT_ATT_OP_EXEC_WRITE_RSP, 0); if (!buf) { return BT_ATT_ERR_UNLIKELY; } (void)bt_l2cap_send_cb(conn, BT_L2CAP_CID_ATT, buf, att_rsp_sent, NULL); return 0; } #endif /* CONFIG_BT_ATT_PREPARE_COUNT */ static u8_t att_exec_write_req(struct bt_att *att, struct net_buf *buf) { #if CONFIG_BT_ATT_PREPARE_COUNT == 0 return BT_ATT_ERR_NOT_SUPPORTED; #else struct bt_att_exec_write_req *req; req = (void *)buf->data; BT_DBG("flags 0x%02x", req->flags); return att_exec_write_rsp(att, req->flags); #endif /* CONFIG_BT_ATT_PREPARE_COUNT */ } static u8_t att_write_cmd(struct bt_att *att, struct net_buf *buf) { struct bt_conn *conn = att->chan.chan.conn; u16_t handle; handle = net_buf_pull_le16(buf); BT_DBG("handle 0x%04x", handle); return att_write_rsp(conn, 0, 0, handle, 0, buf->data, buf->len); } #if defined(CONFIG_BT_SIGNING) static u8_t att_signed_write_cmd(struct bt_att *att, struct net_buf *buf) { struct bt_conn *conn = att->chan.chan.conn; struct bt_att_signed_write_cmd *req; u16_t handle; int err; req = (void *)buf->data; handle = sys_le16_to_cpu(req->handle); BT_DBG("handle 0x%04x", handle); /* Verifying data requires full buffer including attribute header */ net_buf_push(buf, sizeof(struct bt_att_hdr)); err = bt_smp_sign_verify(conn, buf); if (err) { BT_ERR("Error verifying data"); /* No response for this command */ return 0; } net_buf_pull(buf, sizeof(struct bt_att_hdr)); net_buf_pull(buf, sizeof(*req)); return att_write_rsp(conn, 0, 0, handle, 0, buf->data, buf->len - sizeof(struct bt_att_signature)); } #endif /* CONFIG_BT_SIGNING */ #if defined(CONFIG_BT_GATT_CLIENT) #if defined(CONFIG_BT_SMP) static int att_change_security(struct bt_conn *conn, u8_t err) { bt_security_t sec; switch (err) { case BT_ATT_ERR_INSUFFICIENT_ENCRYPTION: if (conn->sec_level >= BT_SECURITY_L2) return -EALREADY; sec = BT_SECURITY_L2; break; case BT_ATT_ERR_AUTHENTICATION: if (conn->sec_level < BT_SECURITY_L2) { /* BLUETOOTH SPECIFICATION Version 4.2 [Vol 3, Part C] * page 375: * * If an LTK is not available, the service request * shall be rejected with the error code 'Insufficient * Authentication'. * Note: When the link is not encrypted, the error code * "Insufficient Authentication" does not indicate that * MITM protection is required. */ sec = BT_SECURITY_L2; } else if (conn->sec_level < BT_SECURITY_L3) { /* BLUETOOTH SPECIFICATION Version 4.2 [Vol 3, Part C] * page 375: * * If an authenticated pairing is required but only an * unauthenticated pairing has occurred and the link is * currently encrypted, the service request shall be * rejected with the error code 'Insufficient * Authentication'. * Note: When unauthenticated pairing has occurred and * the link is currently encrypted, the error code * 'Insufficient Authentication' indicates that MITM * protection is required. */ sec = BT_SECURITY_L3; } else if (conn->sec_level < BT_SECURITY_L4) { /* BLUETOOTH SPECIFICATION Version 4.2 [Vol 3, Part C] * page 375: * * If LE Secure Connections authenticated pairing is * required but LE legacy pairing has occurred and the * link is currently encrypted, the service request * shall be rejected with the error code ''Insufficient * Authentication'. */ sec = BT_SECURITY_L4; } else { return -EALREADY; } break; default: return -EINVAL; } return bt_conn_set_security(conn, sec); } #endif /* CONFIG_BT_SMP */ static u8_t att_error_rsp(struct bt_att *att, struct net_buf *buf) { struct bt_att_error_rsp *rsp; u8_t err; rsp = (void *)buf->data; BT_DBG("request 0x%02x handle 0x%04x error 0x%02x", rsp->request, sys_le16_to_cpu(rsp->handle), rsp->error); /* Don't retry if there is no req pending or it has been cancelled */ if (!att->req || att->req == &cancel) { err = BT_ATT_ERR_UNLIKELY; goto done; } if (att->req->buf) { /* Restore state to be resent */ net_buf_simple_restore(&att->req->buf->b, &att->req->state); } err = rsp->error; #if defined(CONFIG_BT_SMP) if (att->req->retrying) { goto done; } /* Check if security needs to be changed */ if (!att_change_security(att->chan.chan.conn, err)) { att->req->retrying = true; /* Wait security_changed: TODO: Handle fail case */ return 0; } #endif /* CONFIG_BT_SMP */ done: return att_handle_rsp(att, NULL, 0, err); } static u8_t att_handle_find_info_rsp(struct bt_att *att, struct net_buf *buf) { BT_DBG(""); return att_handle_rsp(att, buf->data, buf->len, 0); } static u8_t att_handle_find_type_rsp(struct bt_att *att, struct net_buf *buf) { BT_DBG(""); return att_handle_rsp(att, buf->data, buf->len, 0); } static u8_t att_handle_read_type_rsp(struct bt_att *att, struct net_buf *buf) { BT_DBG(""); return att_handle_rsp(att, buf->data, buf->len, 0); } static u8_t att_handle_read_rsp(struct bt_att *att, struct net_buf *buf) { BT_DBG(""); return att_handle_rsp(att, buf->data, buf->len, 0); } static u8_t att_handle_read_blob_rsp(struct bt_att *att, struct net_buf *buf) { BT_DBG(""); return att_handle_rsp(att, buf->data, buf->len, 0); } #if defined(CONFIG_BT_GATT_READ_MULTIPLE) static u8_t att_handle_read_mult_rsp(struct bt_att *att, struct net_buf *buf) { BT_DBG(""); return att_handle_rsp(att, buf->data, buf->len, 0); } #endif /* CONFIG_BT_GATT_READ_MULTIPLE */ static u8_t att_handle_read_group_rsp(struct bt_att *att, struct net_buf *buf) { BT_DBG(""); return att_handle_rsp(att, buf->data, buf->len, 0); } static u8_t att_handle_write_rsp(struct bt_att *att, struct net_buf *buf) { BT_DBG(""); return att_handle_rsp(att, buf->data, buf->len, 0); } static u8_t att_handle_prepare_write_rsp(struct bt_att *att, struct net_buf *buf) { BT_DBG(""); return att_handle_rsp(att, buf->data, buf->len, 0); } static u8_t att_handle_exec_write_rsp(struct bt_att *att, struct net_buf *buf) { BT_DBG(""); return att_handle_rsp(att, buf->data, buf->len, 0); } static u8_t att_notify(struct bt_att *att, struct net_buf *buf) { struct bt_conn *conn = att->chan.chan.conn; u16_t handle; handle = net_buf_pull_le16(buf); BT_DBG("handle 0x%04x", handle); bt_gatt_notification(conn, handle, buf->data, buf->len); return 0; } static u8_t att_indicate(struct bt_att *att, struct net_buf *buf) { struct bt_conn *conn = att->chan.chan.conn; u16_t handle; handle = net_buf_pull_le16(buf); BT_DBG("handle 0x%04x", handle); bt_gatt_notification(conn, handle, buf->data, buf->len); buf = bt_att_create_pdu(conn, BT_ATT_OP_CONFIRM, 0); if (!buf) { return 0; } (void)bt_l2cap_send_cb(conn, BT_L2CAP_CID_ATT, buf, att_cfm_sent, NULL); return 0; } #endif /* CONFIG_BT_GATT_CLIENT */ static u8_t att_confirm(struct bt_att *att, struct net_buf *buf) { BT_DBG(""); return att_handle_rsp(att, buf->data, buf->len, 0); } static const struct att_handler { u8_t op; u8_t expect_len; att_type_t type; u8_t (*func)(struct bt_att *att, struct net_buf *buf); } handlers[] = { { BT_ATT_OP_MTU_REQ, sizeof(struct bt_att_exchange_mtu_req), ATT_REQUEST, att_mtu_req }, { BT_ATT_OP_FIND_INFO_REQ, sizeof(struct bt_att_find_info_req), ATT_REQUEST, att_find_info_req }, { BT_ATT_OP_FIND_TYPE_REQ, sizeof(struct bt_att_find_type_req), ATT_REQUEST, att_find_type_req }, { BT_ATT_OP_READ_TYPE_REQ, sizeof(struct bt_att_read_type_req), ATT_REQUEST, att_read_type_req }, { BT_ATT_OP_READ_REQ, sizeof(struct bt_att_read_req), ATT_REQUEST, att_read_req }, { BT_ATT_OP_READ_BLOB_REQ, sizeof(struct bt_att_read_blob_req), ATT_REQUEST, att_read_blob_req }, #if defined(CONFIG_BT_GATT_READ_MULTIPLE) { BT_ATT_OP_READ_MULT_REQ, BT_ATT_READ_MULT_MIN_LEN_REQ, ATT_REQUEST, att_read_mult_req }, #endif /* CONFIG_BT_GATT_READ_MULTIPLE */ { BT_ATT_OP_READ_GROUP_REQ, sizeof(struct bt_att_read_group_req), ATT_REQUEST, att_read_group_req }, { BT_ATT_OP_WRITE_REQ, sizeof(struct bt_att_write_req), ATT_REQUEST, att_write_req }, { BT_ATT_OP_PREPARE_WRITE_REQ, sizeof(struct bt_att_prepare_write_req), ATT_REQUEST, att_prepare_write_req }, { BT_ATT_OP_EXEC_WRITE_REQ, sizeof(struct bt_att_exec_write_req), ATT_REQUEST, att_exec_write_req }, { BT_ATT_OP_CONFIRM, 0, ATT_CONFIRMATION, att_confirm }, { BT_ATT_OP_WRITE_CMD, sizeof(struct bt_att_write_cmd), ATT_COMMAND, att_write_cmd }, #if defined(CONFIG_BT_SIGNING) { BT_ATT_OP_SIGNED_WRITE_CMD, (sizeof(struct bt_att_write_cmd) + sizeof(struct bt_att_signature)), ATT_COMMAND, att_signed_write_cmd }, #endif /* CONFIG_BT_SIGNING */ #if defined(CONFIG_BT_GATT_CLIENT) { BT_ATT_OP_ERROR_RSP, sizeof(struct bt_att_error_rsp), ATT_RESPONSE, att_error_rsp }, { BT_ATT_OP_MTU_RSP, sizeof(struct bt_att_exchange_mtu_rsp), ATT_RESPONSE, att_mtu_rsp }, { BT_ATT_OP_FIND_INFO_RSP, sizeof(struct bt_att_find_info_rsp), ATT_RESPONSE, att_handle_find_info_rsp }, { BT_ATT_OP_FIND_TYPE_RSP, sizeof(struct bt_att_find_type_rsp), ATT_RESPONSE, att_handle_find_type_rsp }, { BT_ATT_OP_READ_TYPE_RSP, sizeof(struct bt_att_read_type_rsp), ATT_RESPONSE, att_handle_read_type_rsp }, { BT_ATT_OP_READ_RSP, sizeof(struct bt_att_read_rsp), ATT_RESPONSE, att_handle_read_rsp }, { BT_ATT_OP_READ_BLOB_RSP, sizeof(struct bt_att_read_blob_rsp), ATT_RESPONSE, att_handle_read_blob_rsp }, #if defined(CONFIG_BT_GATT_READ_MULTIPLE) { BT_ATT_OP_READ_MULT_RSP, sizeof(struct bt_att_read_mult_rsp), ATT_RESPONSE, att_handle_read_mult_rsp }, #endif /* CONFIG_BT_GATT_READ_MULTIPLE */ { BT_ATT_OP_READ_GROUP_RSP, sizeof(struct bt_att_read_group_rsp), ATT_RESPONSE, att_handle_read_group_rsp }, { BT_ATT_OP_WRITE_RSP, 0, ATT_RESPONSE, att_handle_write_rsp }, { BT_ATT_OP_PREPARE_WRITE_RSP, sizeof(struct bt_att_prepare_write_rsp), ATT_RESPONSE, att_handle_prepare_write_rsp }, { BT_ATT_OP_EXEC_WRITE_RSP, 0, ATT_RESPONSE, att_handle_exec_write_rsp }, { BT_ATT_OP_NOTIFY, sizeof(struct bt_att_notify), ATT_NOTIFICATION, att_notify }, { BT_ATT_OP_INDICATE, sizeof(struct bt_att_indicate), ATT_INDICATION, att_indicate }, #endif /* CONFIG_BT_GATT_CLIENT */ }; static att_type_t att_op_get_type(u8_t op) { switch (op) { case BT_ATT_OP_MTU_REQ: case BT_ATT_OP_FIND_INFO_REQ: case BT_ATT_OP_FIND_TYPE_REQ: case BT_ATT_OP_READ_TYPE_REQ: case BT_ATT_OP_READ_REQ: case BT_ATT_OP_READ_BLOB_REQ: case BT_ATT_OP_READ_MULT_REQ: case BT_ATT_OP_READ_GROUP_REQ: case BT_ATT_OP_WRITE_REQ: case BT_ATT_OP_PREPARE_WRITE_REQ: case BT_ATT_OP_EXEC_WRITE_REQ: return ATT_REQUEST; case BT_ATT_OP_CONFIRM: return ATT_CONFIRMATION; case BT_ATT_OP_WRITE_CMD: case BT_ATT_OP_SIGNED_WRITE_CMD: return ATT_COMMAND; case BT_ATT_OP_ERROR_RSP: case BT_ATT_OP_MTU_RSP: case BT_ATT_OP_FIND_INFO_RSP: case BT_ATT_OP_FIND_TYPE_RSP: case BT_ATT_OP_READ_TYPE_RSP: case BT_ATT_OP_READ_RSP: case BT_ATT_OP_READ_BLOB_RSP: case BT_ATT_OP_READ_MULT_RSP: case BT_ATT_OP_READ_GROUP_RSP: case BT_ATT_OP_WRITE_RSP: case BT_ATT_OP_PREPARE_WRITE_RSP: case BT_ATT_OP_EXEC_WRITE_RSP: return ATT_RESPONSE; case BT_ATT_OP_NOTIFY: return ATT_NOTIFICATION; case BT_ATT_OP_INDICATE: return ATT_INDICATION; } if (op & ATT_CMD_MASK) { return ATT_COMMAND; } return ATT_UNKNOWN; } static int bt_att_recv(struct bt_l2cap_chan *chan, struct net_buf *buf) { struct bt_att *att = ATT_CHAN(chan); struct bt_att_hdr *hdr; const struct att_handler *handler; u8_t err; size_t i; if (buf->len < sizeof(*hdr)) { BT_ERR("Too small ATT PDU received"); return 0; } hdr = net_buf_pull_mem(buf, sizeof(*hdr)); BT_DBG("Received ATT code 0x%02x len %u", hdr->code, buf->len); for (i = 0, handler = NULL; i < ARRAY_SIZE(handlers); i++) { if (hdr->code == handlers[i].op) { handler = &handlers[i]; break; } } if (!handler) { BT_WARN("Unhandled ATT code 0x%02x", hdr->code); if (att_op_get_type(hdr->code) != ATT_COMMAND) { send_err_rsp(chan->conn, hdr->code, 0, BT_ATT_ERR_NOT_SUPPORTED); } return 0; } if (IS_ENABLED(CONFIG_BT_ATT_ENFORCE_FLOW)) { if (handler->type == ATT_REQUEST && atomic_test_and_set_bit(att->flags, ATT_PENDING_RSP)) { BT_WARN("Ignoring unexpected request"); return 0; } else if (handler->type == ATT_INDICATION && atomic_test_and_set_bit(att->flags, ATT_PENDING_CFM)) { BT_WARN("Ignoring unexpected indication"); return 0; } } if (buf->len < handler->expect_len) { BT_ERR("Invalid len %u for code 0x%02x", buf->len, hdr->code); err = BT_ATT_ERR_INVALID_PDU; } else { err = handler->func(att, buf); } if (handler->type == ATT_REQUEST && err) { BT_DBG("ATT error 0x%02x", err); send_err_rsp(chan->conn, hdr->code, 0, err); } return 0; } static struct bt_att *att_chan_get(struct bt_conn *conn) { struct bt_l2cap_chan *chan; struct bt_att *att; if (conn->state != BT_CONN_CONNECTED) { BT_WARN("Not connected"); return NULL; } chan = bt_l2cap_le_lookup_rx_cid(conn, BT_L2CAP_CID_ATT); if (!chan) { BT_ERR("Unable to find ATT channel"); return NULL; } att = ATT_CHAN(chan); if (atomic_test_bit(att->flags, ATT_DISCONNECTED)) { BT_WARN("ATT context flagged as disconnected"); return NULL; } return att; } struct net_buf *bt_att_create_pdu(struct bt_conn *conn, u8_t op, size_t len) { struct bt_att_hdr *hdr; struct net_buf *buf; struct bt_att *att; att = att_chan_get(conn); if (!att) { return NULL; } if (len + sizeof(op) > att->chan.tx.mtu) { BT_WARN("ATT MTU exceeded, max %u, wanted %zu", att->chan.tx.mtu, len + sizeof(op)); return NULL; } switch (att_op_get_type(op)) { case ATT_RESPONSE: case ATT_CONFIRMATION: /* Use a timeout only when responding/confirming */ buf = bt_l2cap_create_pdu_timeout(NULL, 0, ATT_TIMEOUT); break; default: buf = bt_l2cap_create_pdu(NULL, 0); } if (!buf) { BT_ERR("Unable to allocate buffer for op 0x%02x", op); return NULL; } hdr = net_buf_add(buf, sizeof(*hdr)); hdr->code = op; return buf; } static void att_reset(struct bt_att *att) { struct bt_att_req *req, *tmp; int i; struct net_buf *buf; #if CONFIG_BT_ATT_PREPARE_COUNT > 0 /* Discard queued buffers */ while ((buf = k_fifo_get(&att->prep_queue, K_NO_WAIT))) { net_buf_unref(buf); } #endif /* CONFIG_BT_ATT_PREPARE_COUNT > 0 */ while ((buf = k_fifo_get(&att->tx_queue, K_NO_WAIT))) { net_buf_unref(buf); } atomic_set_bit(att->flags, ATT_DISCONNECTED); /* Ensure that any waiters are woken up */ for (i = 0; i < CONFIG_BT_ATT_TX_MAX; i++) { k_sem_give(&att->tx_sem); } /* Notify pending requests */ SYS_SLIST_FOR_EACH_CONTAINER_SAFE(&att->reqs, req, tmp, node) { if (req->func) { req->func(NULL, BT_ATT_ERR_UNLIKELY, NULL, 0, req); } att_req_destroy(req); } /* Reset list */ sys_slist_init(&att->reqs); if (!att->req) { return; } /* Notify outstanding request */ att_handle_rsp(att, NULL, 0, BT_ATT_ERR_UNLIKELY); } static void att_timeout(struct k_work *work) { struct bt_att *att = CONTAINER_OF(work, struct bt_att, timeout_work); struct bt_l2cap_le_chan *ch = &att->chan; BT_ERR("ATT Timeout"); /* BLUETOOTH SPECIFICATION Version 4.2 [Vol 3, Part F] page 480: * * A transaction not completed within 30 seconds shall time out. Such a * transaction shall be considered to have failed and the local higher * layers shall be informed of this failure. No more attribute protocol * requests, commands, indications or notifications shall be sent to the * target device on this ATT Bearer. */ att_reset(att); /* Consider the channel disconnected */ bt_gatt_disconnected(ch->chan.conn); ch->chan.conn = NULL; } static void bt_att_connected(struct bt_l2cap_chan *chan) { struct bt_att *att = ATT_CHAN(chan); struct bt_l2cap_le_chan *ch = BT_L2CAP_LE_CHAN(chan); BT_DBG("chan %p cid 0x%04x", ch, ch->tx.cid); k_fifo_init(&att->tx_queue, 20); #if CONFIG_BT_ATT_PREPARE_COUNT > 0 k_fifo_init(&att->prep_queue, 20); #endif ch->tx.mtu = BT_ATT_DEFAULT_LE_MTU; ch->rx.mtu = BT_ATT_DEFAULT_LE_MTU; k_delayed_work_init(&att->timeout_work, att_timeout); sys_slist_init(&att->reqs); } static void bt_att_disconnected(struct bt_l2cap_chan *chan) { struct bt_att *att = ATT_CHAN(chan); struct bt_l2cap_le_chan *ch = BT_L2CAP_LE_CHAN(chan); BT_DBG("chan %p cid 0x%04x", ch, ch->tx.cid); att_reset(att); bt_gatt_disconnected(ch->chan.conn); #ifdef BFLB_BLE_PATCH_FREE_ALLOCATED_BUFFER_IN_OS if (att->timeout_work.timer.timer.hdl) k_delayed_work_del_timer(&att->timeout_work); if (att->tx_queue._queue.hdl) { k_queue_free(&att->tx_queue._queue); att->tx_queue._queue.hdl = NULL; } #if CONFIG_BT_ATT_PREPARE_COUNT > 0 if (att->prep_queue._queue.hdl) { k_queue_free(&att->prep_queue._queue); att->prep_queue._queue.hdl = NULL; } #endif if (att->tx_sem.sem.hdl) k_sem_delete(&att->tx_sem); #endif } #if defined(CONFIG_BT_SMP) static void bt_att_encrypt_change(struct bt_l2cap_chan *chan, u8_t hci_status) { struct bt_att *att = ATT_CHAN(chan); struct bt_l2cap_le_chan *ch = BT_L2CAP_LE_CHAN(chan); struct bt_conn *conn = ch->chan.conn; BT_DBG("chan %p conn %p handle %u sec_level 0x%02x status 0x%02x", ch, conn, conn->handle, conn->sec_level, hci_status); /* * If status (HCI status of security procedure) is non-zero, notify * outstanding request about security failure. */ if (hci_status) { att_handle_rsp(att, NULL, 0, BT_ATT_ERR_AUTHENTICATION); return; } bt_gatt_encrypt_change(conn); if (conn->sec_level == BT_SECURITY_L1) { return; } if (!att->req || !att->req->retrying) { return; } k_sem_take(&att->tx_sem, K_FOREVER); if (!att_is_connected(att)) { BT_WARN("Disconnected"); k_sem_give(&att->tx_sem); return; } BT_DBG("Retrying"); /* Resend buffer */ (void)bt_l2cap_send_cb(conn, BT_L2CAP_CID_ATT, att->req->buf, att_cb(att->req->buf), NULL); att->req->buf = NULL; } #endif /* CONFIG_BT_SMP */ #if defined(BFLB_BLE_MTU_CHANGE_CB) void bt_att_mtu_changed(struct bt_l2cap_chan *chan, u16_t mtu) { bt_gatt_mtu_changed(chan->conn, mtu); } #endif static int bt_att_accept(struct bt_conn *conn, struct bt_l2cap_chan **chan) { int i; static struct bt_l2cap_chan_ops ops = { .connected = bt_att_connected, .disconnected = bt_att_disconnected, .recv = bt_att_recv, #if defined(CONFIG_BT_SMP) .encrypt_change = bt_att_encrypt_change, #endif /* CONFIG_BT_SMP */ #if defined(BFLB_BLE_MTU_CHANGE_CB) .mtu_changed = bt_att_mtu_changed, #endif }; BT_DBG("conn %p handle %u", conn, conn->handle); for (i = 0; i < ARRAY_SIZE(bt_req_pool); i++) { struct bt_att *att = &bt_req_pool[i]; if (att->chan.chan.conn) { continue; } (void)memset(att, 0, sizeof(*att)); att->chan.chan.ops = &ops; k_sem_init(&att->tx_sem, CONFIG_BT_ATT_TX_MAX, CONFIG_BT_ATT_TX_MAX); *chan = &att->chan.chan; return 0; } BT_ERR("No available ATT context for conn %p", conn); return -ENOMEM; } BT_L2CAP_CHANNEL_DEFINE(att_fixed_chan, BT_L2CAP_CID_ATT, bt_att_accept); void bt_att_init(void) { #if defined(BFLB_BLE_DISABLE_STATIC_CHANNEL) static struct bt_l2cap_fixed_chan chan = { .cid = BT_L2CAP_CID_ATT, .accept = bt_att_accept, }; bt_l2cap_le_fixed_chan_register(&chan); #endif #if CONFIG_BT_ATT_PREPARE_COUNT > 0 #if defined(BFLB_DYNAMIC_ALLOC_MEM) net_buf_init(&prep_pool, CONFIG_BT_ATT_PREPARE_COUNT, BT_ATT_MTU, NULL); #endif #endif bt_gatt_init(); } u16_t bt_att_get_mtu(struct bt_conn *conn) { struct bt_att *att; att = att_chan_get(conn); if (!att) { return 0; } /* tx and rx MTU shall be symmetric */ return att->chan.tx.mtu; } int bt_att_send(struct bt_conn *conn, struct net_buf *buf, bt_conn_tx_cb_t cb, void *user_data) { struct bt_att *att; int err; __ASSERT_NO_MSG(conn); __ASSERT_NO_MSG(buf); att = att_chan_get(conn); if (!att) { net_buf_unref(buf); return -ENOTCONN; } /* Don't use tx_sem if caller has set it own callback */ if (!cb) { /* Queue buffer to be send later */ if (k_sem_take(&att->tx_sem, K_NO_WAIT) < 0) { k_fifo_put(&att->tx_queue, buf); return 0; } } err = att_send(conn, buf, cb, user_data); if (err) { if (!cb) { k_sem_give(&att->tx_sem); } return err; } return 0; } int bt_att_req_send(struct bt_conn *conn, struct bt_att_req *req) { struct bt_att *att; BT_DBG("conn %p req %p", conn, req); __ASSERT_NO_MSG(conn); __ASSERT_NO_MSG(req); att = att_chan_get(conn); if (!att) { net_buf_unref(req->buf); req->buf = NULL; return -ENOTCONN; } /* Check if there is a request outstanding */ if (att->req) { /* Queue the request to be send later */ sys_slist_append(&att->reqs, &req->node); return 0; } return att_send_req(att, req); } void bt_att_req_cancel(struct bt_conn *conn, struct bt_att_req *req) { struct bt_att *att; BT_DBG("req %p", req); if (!conn || !req) { return; } att = att_chan_get(conn); if (!att) { return; } /* Check if request is outstanding */ if (att->req == req) { att->req = &cancel; } else { /* Remove request from the list */ sys_slist_find_and_remove(&att->reqs, &req->node); } att_req_destroy(req); }