granicus.if.org Git - esp-idf/blob - components/bt/bluedroid/bta/gatt/bta_gattc_act.c

   1 /******************************************************************************
   2  *
   3  *  Copyright (C) 2003-2012 Broadcom Corporation
   4  *
   5  *  Licensed under the Apache License, Version 2.0 (the "License");
   6  *  you may not use this file except in compliance with the License.
   7  *  You may obtain a copy of the License at:
   8  *
   9  *  http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  *  Unless required by applicable law or agreed to in writing, software
  12  *  distributed under the License is distributed on an "AS IS" BASIS,
  13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  *  See the License for the specific language governing permissions and
  15  *  limitations under the License.
  16  *
  17  ******************************************************************************/
  18
  19 /******************************************************************************
  20  *
  21  *  This file contains the GATT client action functions for the state
  22  *  machine.
  23  *
  24  ******************************************************************************/
  25 #define LOG_TAG "bt_bta_gattc"
  26
  27 #include "bt_target.h"
  28
  29 #include "utl.h"
  30 #include "bta_sys.h"
  31
  32 #include "bta_gattc_int.h"
  33 #include "l2c_api.h"
  34 #include "l2c_int.h"
  35 #include "gatt_int.h"
  36 #include "allocator.h"
  37 #include "mutex.h"
  38
  39 #if (defined BTA_HH_LE_INCLUDED && BTA_HH_LE_INCLUDED == TRUE)
  40 #include "bta_hh_int.h"
  41 #endif
  42
  43 // #include "btif/include/btif_debug_conn.h"
  44
  45 #include <string.h>
  46
  47 // #include "osi/include/log.h"
  48
  49 #if GATTC_INCLUDED == TRUE && BLE_INCLUDED == TRUE
  50
  51 /*****************************************************************************
  52 **  Constants
  53 *****************************************************************************/
  54 static void bta_gattc_conn_cback(tGATT_IF gattc_if, BD_ADDR bda, UINT16 conn_id,
  55                                  BOOLEAN connected, tGATT_DISCONN_REASON reason,
  56                                  tBT_TRANSPORT transport);
  57
  58 static void  bta_gattc_cmpl_cback(UINT16 conn_id, tGATTC_OPTYPE op, tGATT_STATUS status,
  59                                   tGATT_CL_COMPLETE *p_data);
  60 static void bta_gattc_cmpl_sendmsg(UINT16 conn_id, tGATTC_OPTYPE op,
  61                                    tBTA_GATT_STATUS status,
  62                                    tGATT_CL_COMPLETE *p_data);
  63 static void bta_gattc_pop_command_to_send(tBTA_GATTC_CLCB *p_clcb);
  64
  65 static void bta_gattc_deregister_cmpl(tBTA_GATTC_RCB *p_clreg);
  66 static void bta_gattc_enc_cmpl_cback(tGATT_IF gattc_if, BD_ADDR bda);
  67 static void bta_gattc_cong_cback (UINT16 conn_id, BOOLEAN congested);
  68 static tBTA_GATTC_FIND_SERVICE_CB bta_gattc_register_service_change_notify(UINT16 conn_id, BD_ADDR remote_bda, BOOLEAN *need_timer);
  69 static void bta_gattc_wait4_service_change_ccc_cback (TIMER_LIST_ENT *p_tle);
  70 static void bta_gattc_start_service_change_ccc_timer(UINT16 conn_id, BD_ADDR bda,UINT32 timeout_ms,
  71                                               UINT8 timer_cnt, UINT8 last_status, TIMER_LIST_ENT *ccc_timer);
  72
  73 static tGATT_CBACK bta_gattc_cl_cback = {
  74     bta_gattc_conn_cback,
  75     bta_gattc_cmpl_cback,
  76     bta_gattc_disc_res_cback,
  77     bta_gattc_disc_cmpl_cback,
  78     NULL,
  79     bta_gattc_enc_cmpl_cback,
  80     bta_gattc_cong_cback
  81 };
  82
  83 /* opcode(tGATTC_OPTYPE) order has to be comply with internal event order */
  84 static UINT16 bta_gattc_opcode_to_int_evt[] = {
  85     BTA_GATTC_API_READ_EVT,
  86     BTA_GATTC_API_WRITE_EVT,
  87     BTA_GATTC_API_EXEC_EVT,
  88     BTA_GATTC_API_CFG_MTU_EVT,
  89     BTA_GATTC_API_READ_MULTI_EVT
  90 };
  91
  92 #if (BT_TRACE_VERBOSE == TRUE)
  93 static const char *bta_gattc_op_code_name[] = {
  94     "Unknown",
  95     "Discovery",
  96     "Read",
  97     "Write",
  98     "Exec",
  99     "Config",
 100     "Notification",
 101     "Indication"
 102 };
 103 #endif
 104 /*****************************************************************************
 105 **  Action Functions
 106 *****************************************************************************/
 107
 108
 109 void bta_gattc_reset_discover_st(tBTA_GATTC_SERV *p_srcb, tBTA_GATT_STATUS status);
 110
 111 /*******************************************************************************
 112 **
 113 ** Function         bta_gattc_enable
 114 **
 115 ** Description      Enables GATTC module
 116 **
 117 **
 118 ** Returns          void
 119 **
 120 *******************************************************************************/
 121 static void bta_gattc_enable(tBTA_GATTC_CB *p_cb)
 122 {
 123     APPL_TRACE_DEBUG("bta_gattc_enable");
 124
 125     if (p_cb->state == BTA_GATTC_STATE_DISABLED) {
 126         /* initialize control block */
 127         memset(&bta_gattc_cb, 0, sizeof(tBTA_GATTC_CB));
 128         p_cb->state = BTA_GATTC_STATE_ENABLED;
 129         // Create a write ccc mutex when the gatt client enable
 130         osi_mutex_new(&bta_gattc_cb.write_ccc_mutex);
 131     } else {
 132         APPL_TRACE_DEBUG("GATTC is already enabled");
 133     }
 134 }
 135
 136
 137 /*******************************************************************************
 138 **
 139 ** Function         bta_gattc_disable
 140 **
 141 ** Description      Disable GATTC module by cleaning up all active connections
 142 **                  and deregister all application.
 143 **
 144 ** Returns          void
 145 **
 146 *******************************************************************************/
 147 void bta_gattc_disable(tBTA_GATTC_CB *p_cb)
 148 {
 149     UINT8           i;
 150
 151     APPL_TRACE_DEBUG("bta_gattc_disable");
 152
 153     if (p_cb->state != BTA_GATTC_STATE_ENABLED) {
 154         APPL_TRACE_ERROR("not enabled or disable in pogress");
 155         return;
 156     }
 157     // Free the write ccc mutex when the gatt client disable
 158     osi_mutex_free(&bta_gattc_cb.write_ccc_mutex);
 159
 160     for (i = 0; i < BTA_GATTC_CL_MAX; i ++) {
 161         if (p_cb->cl_rcb[i].in_use) {
 162             p_cb->state = BTA_GATTC_STATE_DISABLING;
 163             /* don't deregister HH GATT IF */
 164             /* HH GATT IF will be deregistered by bta_hh_le_deregister when disable HH */
 165 #if (defined BTA_HH_LE_INCLUDED && BTA_HH_LE_INCLUDED == TRUE)
 166             if (!bta_hh_le_is_hh_gatt_if(p_cb->cl_rcb[i].client_if)) {
 167 #endif
 168                 bta_gattc_deregister(p_cb, &p_cb->cl_rcb[i]);
 169 #if (defined BTA_HH_LE_INCLUDED && BTA_HH_LE_INCLUDED == TRUE)
 170             }
 171 #endif
 172         }
 173     }
 174
 175     /* no registered apps, indicate disable completed */
 176     if (p_cb->state != BTA_GATTC_STATE_DISABLING) {
 177         p_cb->state = BTA_GATTC_STATE_DISABLED;
 178         memset(p_cb, 0, sizeof(tBTA_GATTC_CB));
 179     }
 180 }
 181
 182 /*******************************************************************************
 183 **
 184 ** Function         bta_gattc_register
 185 **
 186 ** Description      Register a GATT client application with BTA.
 187 **
 188 ** Returns          void
 189 **
 190 *******************************************************************************/
 191 void bta_gattc_register(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_data)
 192 {
 193     tBTA_GATTC               cb_data;
 194     UINT8                    i;
 195     tBT_UUID                 *p_app_uuid = &p_data->api_reg.app_uuid;
 196     tBTA_GATTC_INT_START_IF  *p_buf;
 197     tBTA_GATT_STATUS         status = BTA_GATT_NO_RESOURCES;
 198
 199
 200     APPL_TRACE_DEBUG("bta_gattc_register state %d\n", p_cb->state);
 201     memset(&cb_data, 0, sizeof(cb_data));
 202     cb_data.reg_oper.status = BTA_GATT_NO_RESOURCES;
 203
 204     /* check if  GATTC module is already enabled . Else enable */
 205     if (p_cb->state == BTA_GATTC_STATE_DISABLED) {
 206         bta_gattc_enable (p_cb);
 207     }
 208     /* todo need to check duplicate uuid */
 209     for (i = 0; i < BTA_GATTC_CL_MAX; i ++) {
 210         if (!p_cb->cl_rcb[i].in_use) {
 211             if ((p_app_uuid == NULL) || (p_cb->cl_rcb[i].client_if = GATT_Register(p_app_uuid, &bta_gattc_cl_cback)) == 0) {
 212                 APPL_TRACE_ERROR("Register with GATT stack failed.\n");
 213                 status = BTA_GATT_ERROR;
 214             } else {
 215                 p_cb->cl_rcb[i].in_use = TRUE;
 216                 p_cb->cl_rcb[i].p_cback = p_data->api_reg.p_cback;
 217                 memcpy(&p_cb->cl_rcb[i].app_uuid, p_app_uuid, sizeof(tBT_UUID));
 218
 219                 /* BTA use the same client interface as BTE GATT statck */
 220                 cb_data.reg_oper.client_if = p_cb->cl_rcb[i].client_if;
 221
 222                 if ((p_buf = (tBTA_GATTC_INT_START_IF *) osi_malloc(sizeof(tBTA_GATTC_INT_START_IF))) != NULL) {
 223                     p_buf->hdr.event    = BTA_GATTC_INT_START_IF_EVT;
 224                     p_buf->client_if    = p_cb->cl_rcb[i].client_if;
 225                     APPL_TRACE_DEBUG("GATTC getbuf sucess.\n");
 226                     bta_sys_sendmsg(p_buf);
 227                     status = BTA_GATT_OK;
 228                 } else {
 229                     GATT_Deregister(p_cb->cl_rcb[i].client_if);
 230
 231                     status = BTA_GATT_NO_RESOURCES;
 232                     memset( &p_cb->cl_rcb[i], 0 , sizeof(tBTA_GATTC_RCB));
 233                 }
 234                 break;
 235             }
 236         }
 237     }
 238
 239     /* callback with register event */
 240     if (p_data->api_reg.p_cback) {
 241         if (p_app_uuid != NULL) {
 242             memcpy(&(cb_data.reg_oper.app_uuid), p_app_uuid, sizeof(tBT_UUID));
 243         }
 244         cb_data.reg_oper.status = status;
 245         (*p_data->api_reg.p_cback)(BTA_GATTC_REG_EVT,  (tBTA_GATTC *)&cb_data);
 246     }
 247 }
 248 /*******************************************************************************
 249 **
 250 ** Function         bta_gattc_start_if
 251 **
 252 ** Description      start an application interface.
 253 **
 254 ** Returns          none.
 255 **
 256 *******************************************************************************/
 257 void bta_gattc_start_if(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg)
 258 {
 259     UNUSED(p_cb);
 260
 261     if (bta_gattc_cl_get_regcb(p_msg->int_start_if.client_if) != NULL ) {
 262         GATT_StartIf(p_msg->int_start_if.client_if);
 263     } else {
 264         APPL_TRACE_ERROR("Unable to start app.: Unknown interface =%d", p_msg->int_start_if.client_if );
 265     }
 266 }
 267
 268 /*******************************************************************************
 269 **
 270 ** Function         bta_gattc_deregister
 271 **
 272 ** Description      De-Register a GATT client application with BTA.
 273 **
 274 ** Returns          void
 275 **
 276 *******************************************************************************/
 277 void bta_gattc_deregister(tBTA_GATTC_CB *p_cb, tBTA_GATTC_RCB  *p_clreg)
 278 {
 279     UINT8               i;
 280     BT_HDR              buf;
 281
 282     if (p_clreg != NULL) {
 283         /* remove bg connection associated with this rcb */
 284         for (i = 0; i < BTA_GATTC_KNOWN_SR_MAX; i ++) {
 285             if (p_cb->bg_track[i].in_use) {
 286                 if (p_cb->bg_track[i].cif_mask & (1 << (p_clreg->client_if - 1))) {
 287                     bta_gattc_mark_bg_conn(p_clreg->client_if, p_cb->bg_track[i].remote_bda, FALSE, FALSE);
 288                     GATT_CancelConnect(p_clreg->client_if, p_cb->bg_track[i].remote_bda, FALSE);
 289                 }
 290                 if (p_cb->bg_track[i].cif_adv_mask & (1 << (p_clreg->client_if - 1))) {
 291                     bta_gattc_mark_bg_conn(p_clreg->client_if, p_cb->bg_track[i].remote_bda, FALSE, TRUE);
 292                 }
 293             }
 294         }
 295
 296         if (p_clreg->num_clcb > 0) {
 297             /* close all CLCB related to this app */
 298             for (i = 0; i < BTA_GATTC_CLCB_MAX; i ++) {
 299                 if (p_cb->clcb[i].in_use && (p_cb->clcb[i].p_rcb == p_clreg)) {
 300                     p_clreg->dereg_pending = TRUE;
 301
 302                     buf.event = BTA_GATTC_API_CLOSE_EVT;
 303                     buf.layer_specific = p_cb->clcb[i].bta_conn_id;
 304                     bta_gattc_close(&p_cb->clcb[i], (tBTA_GATTC_DATA *)&buf)  ;
 305                 }
 306             }
 307         } else {
 308             bta_gattc_deregister_cmpl(p_clreg);
 309         }
 310     } else {
 311         APPL_TRACE_ERROR("bta_gattc_deregister Deregister Failedm unknown client cif");
 312     }
 313 }
 314 /*******************************************************************************
 315 **
 316 ** Function         bta_gattc_process_api_open
 317 **
 318 ** Description      process connect API request.
 319 **
 320 ** Returns          void
 321 **
 322 *******************************************************************************/
 323 void bta_gattc_process_api_open (tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg)
 324 {
 325     UINT16 event = ((BT_HDR *)p_msg)->event;
 326     tBTA_GATTC_CLCB *p_clcb = NULL;
 327     tBTA_GATTC_RCB *p_clreg = bta_gattc_cl_get_regcb(p_msg->api_conn.client_if);
 328     UNUSED(p_cb);
 329
 330     if (p_clreg != NULL) {
 331         if (p_msg->api_conn.is_direct) {
 332             if ((p_clcb = bta_gattc_find_alloc_clcb(p_msg->api_conn.client_if,
 333                                                     p_msg->api_conn.remote_bda,
 334                                                     p_msg->api_conn.transport)) != NULL) {
 335                 bta_gattc_sm_execute(p_clcb, event, p_msg);
 336             } else {
 337                 APPL_TRACE_ERROR("No resources to open a new connection.");
 338
 339                 bta_gattc_send_open_cback(p_clreg,
 340                                           BTA_GATT_NO_RESOURCES,
 341                                           p_msg->api_conn.remote_bda,
 342                                           BTA_GATT_INVALID_CONN_ID,
 343                                           p_msg->api_conn.transport, 0);
 344             }
 345         } else {
 346             bta_gattc_init_bk_conn(&p_msg->api_conn, p_clreg);
 347         }
 348     } else {
 349         APPL_TRACE_ERROR("bta_gattc_process_api_open Failed, unknown client_if: %d",
 350                          p_msg->api_conn.client_if);
 351     }
 352 }
 353 /*******************************************************************************
 354 **
 355 ** Function         bta_gattc_process_api_open_cancel
 356 **
 357 ** Description      process connect API request.
 358 **
 359 ** Returns          void
 360 **
 361 *******************************************************************************/
 362 void bta_gattc_process_api_open_cancel (tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg)
 363 {
 364     UINT16 event = ((BT_HDR *)p_msg)->event;
 365     tBTA_GATTC_CLCB *p_clcb = NULL;
 366     tBTA_GATTC_RCB *p_clreg;
 367     tBTA_GATTC cb_data;
 368     UNUSED(p_cb);
 369
 370     if (p_msg->api_cancel_conn.is_direct) {
 371         if ((p_clcb = bta_gattc_find_clcb_by_cif(p_msg->api_cancel_conn.client_if,
 372                       p_msg->api_cancel_conn.remote_bda,
 373                       BTA_GATT_TRANSPORT_LE)) != NULL) {
 374             bta_gattc_sm_execute(p_clcb, event, p_msg);
 375         } else {
 376             APPL_TRACE_ERROR("No such connection need to be cancelled");
 377
 378             p_clreg = bta_gattc_cl_get_regcb(p_msg->api_cancel_conn.client_if);
 379
 380             if (p_clreg && p_clreg->p_cback) {
 381                 cb_data.status = BTA_GATT_ERROR;
 382                 (*p_clreg->p_cback)(BTA_GATTC_CANCEL_OPEN_EVT, &cb_data);
 383             }
 384         }
 385     } else {
 386         bta_gattc_cancel_bk_conn(&p_msg->api_cancel_conn);
 387
 388     }
 389 }
 390
 391 /*******************************************************************************
 392 **
 393 ** Function         bta_gattc_process_enc_cmpl
 394 **
 395 ** Description      process encryption complete message.
 396 **
 397 ** Returns          void
 398 **
 399 *******************************************************************************/
 400 void bta_gattc_process_enc_cmpl(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg)
 401 {
 402     tBTA_GATTC_RCB *p_clreg;
 403     tBTA_GATTC cb_data;
 404     UNUSED(p_cb);
 405
 406     p_clreg = bta_gattc_cl_get_regcb(p_msg->enc_cmpl.client_if);
 407
 408     if (p_clreg && p_clreg->p_cback) {
 409         memset(&cb_data, 0, sizeof(tBTA_GATTC));
 410
 411         cb_data.enc_cmpl.client_if = p_msg->enc_cmpl.client_if;
 412         bdcpy(cb_data.enc_cmpl.remote_bda, p_msg->enc_cmpl.remote_bda);
 413
 414         (*p_clreg->p_cback)(BTA_GATTC_ENC_CMPL_CB_EVT, &cb_data);
 415     }
 416 }
 417
 418 /*******************************************************************************
 419 **
 420 ** Function         bta_gattc_cancel_open_error
 421 **
 422 ** Description
 423 **
 424 ** Returns          void
 425 **
 426 *******************************************************************************/
 427 void bta_gattc_cancel_open_error(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 428 {
 429     tBTA_GATTC cb_data;
 430     UNUSED(p_data);
 431
 432     cb_data.status = BTA_GATT_ERROR;
 433
 434     if ( p_clcb && p_clcb->p_rcb && p_clcb->p_rcb->p_cback ) {
 435         (*p_clcb->p_rcb->p_cback)(BTA_GATTC_CANCEL_OPEN_EVT, &cb_data);
 436     }
 437 }
 438
 439 /*******************************************************************************
 440 **
 441 ** Function         bta_gattc_open_error
 442 **
 443 ** Description
 444 **
 445 ** Returns          void
 446 **
 447 *******************************************************************************/
 448 void bta_gattc_open_error(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 449 {
 450     UNUSED(p_data);
 451
 452     APPL_TRACE_ERROR("Connection already opened. wrong state");
 453
 454     bta_gattc_send_open_cback(p_clcb->p_rcb,
 455                               BTA_GATT_OK,
 456                               p_clcb->bda,
 457                               p_clcb->bta_conn_id,
 458                               p_clcb->transport,
 459                               0);
 460 }
 461 /*******************************************************************************
 462 **
 463 ** Function         bta_gattc_open_fail
 464 **
 465 ** Description
 466 **
 467 ** Returns          void
 468 **
 469 *******************************************************************************/
 470 void bta_gattc_open_fail(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 471 {
 472     UNUSED(p_data);
 473
 474     bta_gattc_send_open_cback(p_clcb->p_rcb,
 475                               BTA_GATT_ERROR,
 476                               p_clcb->bda,
 477                               p_clcb->bta_conn_id,
 478                               p_clcb->transport,
 479                               0);
 480     /* open failure, remove clcb */
 481     bta_gattc_clcb_dealloc(p_clcb);
 482 }
 483
 484 /*******************************************************************************
 485 **
 486 ** Function         bta_gattc_open
 487 **
 488 ** Description      Process API connection function.
 489 **
 490 ** Returns          void
 491 **
 492 *******************************************************************************/
 493 void bta_gattc_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 494 {
 495     tBTA_GATTC_DATA gattc_data;
 496
 497     /* open/hold a connection */
 498     if (!GATT_Connect(p_clcb->p_rcb->client_if, p_data->api_conn.remote_bda,
 499                       TRUE, p_data->api_conn.transport)) {
 500         APPL_TRACE_ERROR("Connection open failure");
 501
 502         bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_OPEN_FAIL_EVT, p_data);
 503     } else {
 504         /* a connected remote device */
 505         if (GATT_GetConnIdIfConnected(p_clcb->p_rcb->client_if,
 506                                       p_data->api_conn.remote_bda,
 507                                       &p_clcb->bta_conn_id,
 508                                       p_data->api_conn.transport)) {
 509             gattc_data.int_conn.hdr.layer_specific = p_clcb->bta_conn_id;
 510
 511             bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_CONN_EVT, &gattc_data);
 512         }
 513         /* else wait for the callback event */
 514     }
 515 }
 516 /*******************************************************************************
 517 **
 518 ** Function         bta_gattc_init_bk_conn
 519 **
 520 ** Description      Process API Open for a background connection
 521 **
 522 ** Returns          void
 523 **
 524 *******************************************************************************/
 525 void bta_gattc_init_bk_conn(tBTA_GATTC_API_OPEN *p_data, tBTA_GATTC_RCB *p_clreg)
 526 {
 527     tBTA_GATT_STATUS         status = BTA_GATT_NO_RESOURCES;
 528     UINT16                   conn_id;
 529     tBTA_GATTC_CLCB         *p_clcb;
 530     tBTA_GATTC_DATA         gattc_data;
 531
 532     if (bta_gattc_mark_bg_conn(p_data->client_if, p_data->remote_bda, TRUE, FALSE)) {
 533         /* always call open to hold a connection */
 534         if (!GATT_Connect(p_data->client_if, p_data->remote_bda, FALSE, p_data->transport)) {
 535             uint8_t *bda = (uint8_t *)p_data->remote_bda;
 536             status = BTA_GATT_ERROR;
 537             APPL_TRACE_ERROR("%s unable to connect to remote bd_addr:%02x:%02x:%02x:%02x:%02x:%02x",
 538                              __func__, bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
 539
 540         } else {
 541             status = BTA_GATT_OK;
 542
 543             /* if is a connected remote device */
 544             if (GATT_GetConnIdIfConnected(p_data->client_if,
 545                                           p_data->remote_bda,
 546                                           &conn_id,
 547                                           p_data->transport)) {
 548                 if ((p_clcb = bta_gattc_find_alloc_clcb(p_data->client_if, p_data->remote_bda,
 549                                                         BTA_GATT_TRANSPORT_LE)) != NULL) {
 550                     gattc_data.hdr.layer_specific = p_clcb->bta_conn_id = conn_id;
 551
 552                     /* open connection */
 553                     bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_CONN_EVT, &gattc_data);
 554                     status = BTA_GATT_OK;
 555                 }
 556             }
 557         }
 558     }
 559
 560     /* open failure, report OPEN_EVT */
 561     if (status != BTA_GATT_OK) {
 562         bta_gattc_send_open_cback(p_clreg, status, p_data->remote_bda,
 563                                   BTA_GATT_INVALID_CONN_ID, BTA_GATT_TRANSPORT_LE, 0);
 564     }
 565 }
 566 /*******************************************************************************
 567 **
 568 ** Function         bta_gattc_cancel_bk_conn
 569 **
 570 ** Description      Process API Cancel Open for a background connection
 571 **
 572 ** Returns          void
 573 **
 574 *******************************************************************************/
 575 void bta_gattc_cancel_bk_conn(tBTA_GATTC_API_CANCEL_OPEN *p_data)
 576 {
 577     tBTA_GATTC_RCB      *p_clreg;
 578     tBTA_GATTC          cb_data;
 579     cb_data.status = BTA_GATT_ERROR;
 580
 581     /* remove the device from the bg connection mask */
 582     if (bta_gattc_mark_bg_conn(p_data->client_if, p_data->remote_bda, FALSE, FALSE)) {
 583         if (GATT_CancelConnect(p_data->client_if, p_data->remote_bda, FALSE)) {
 584             cb_data.status = BTA_GATT_OK;
 585         } else {
 586             APPL_TRACE_ERROR("bta_gattc_cancel_bk_conn failed");
 587         }
 588     }
 589     p_clreg = bta_gattc_cl_get_regcb(p_data->client_if);
 590
 591     if (p_clreg && p_clreg->p_cback) {
 592         (*p_clreg->p_cback)(BTA_GATTC_CANCEL_OPEN_EVT, &cb_data);
 593     }
 594
 595 }
 596 /*******************************************************************************
 597 **
 598 ** Function         bta_gattc_int_cancel_open_ok
 599 **
 600 ** Description
 601 **
 602 ** Returns          void
 603 **
 604 *******************************************************************************/
 605 void bta_gattc_cancel_open_ok(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 606 {
 607     tBTA_GATTC          cb_data;
 608     UNUSED(p_data);
 609
 610     if ( p_clcb->p_rcb->p_cback ) {
 611         cb_data.status = BTA_GATT_OK;
 612         (*p_clcb->p_rcb->p_cback)(BTA_GATTC_CANCEL_OPEN_EVT, &cb_data);
 613     }
 614
 615     bta_gattc_clcb_dealloc(p_clcb);
 616 }
 617 /*******************************************************************************
 618 **
 619 ** Function         bta_gattc_cancel_open
 620 **
 621 ** Description
 622 **
 623 ** Returns          void
 624 **
 625 *******************************************************************************/
 626 void bta_gattc_cancel_open(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 627 {
 628     tBTA_GATTC          cb_data;
 629
 630     if (GATT_CancelConnect(p_clcb->p_rcb->client_if, p_data->api_cancel_conn.remote_bda, TRUE)) {
 631         bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_CANCEL_OPEN_OK_EVT, p_data);
 632     } else {
 633         if ( p_clcb->p_rcb->p_cback ) {
 634             cb_data.status = BTA_GATT_ERROR;
 635             (*p_clcb->p_rcb->p_cback)(BTA_GATTC_CANCEL_OPEN_EVT, &cb_data);
 636         }
 637     }
 638 }
 639 /*******************************************************************************
 640 **
 641 ** Function         bta_gattc_conn
 642 **
 643 ** Description      receive connection callback from stack
 644 **
 645 ** Returns          void
 646 **
 647 *******************************************************************************/
 648 void bta_gattc_conn(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 649 {
 650     tBTA_GATTC_IF   gatt_if;
 651     APPL_TRACE_DEBUG("bta_gattc_conn server cache state=%d", p_clcb->p_srcb->state);
 652
 653     if (p_data != NULL) {
 654         APPL_TRACE_DEBUG("bta_gattc_conn conn_id=%d", p_data->hdr.layer_specific);
 655         p_clcb->bta_conn_id  = p_data->int_conn.hdr.layer_specific;
 656
 657         GATT_GetConnectionInfor(p_data->hdr.layer_specific,
 658                                 &gatt_if, p_clcb->bda, &p_clcb->transport);
 659     }
 660
 661     p_clcb->p_srcb->connected = TRUE;
 662
 663     if (p_clcb->p_srcb->mtu == 0) {
 664         p_clcb->p_srcb->mtu = GATT_DEF_BLE_MTU_SIZE;
 665     }
 666
 667     /* start database cache if needed */
 668     if (p_clcb->p_srcb->p_srvc_cache == NULL ||
 669             p_clcb->p_srcb->state != BTA_GATTC_SERV_IDLE) {
 670         if (p_clcb->p_srcb->state == BTA_GATTC_SERV_IDLE) {
 671             p_clcb->p_srcb->state = BTA_GATTC_SERV_LOAD;
 672             if (bta_gattc_cache_load(p_clcb)) {
 673                 p_clcb->p_srcb->state = BTA_GATTC_SERV_IDLE;
 674                 bta_gattc_reset_discover_st(p_clcb->p_srcb, BTA_GATT_OK);
 675         } else { /* cache is building */
 676                 p_clcb->p_srcb->state = BTA_GATTC_SERV_DISC;
 677                 /* cache load failure, start discovery */
 678                 bta_gattc_start_discover(p_clcb, NULL);
 679         }
 680     } else { /* cache is building */
 681         p_clcb->state = BTA_GATTC_DISCOVER_ST;
 682     }
 683     } else {
 684         /* a pending service handle change indication */
 685         if (p_clcb->p_srcb->srvc_hdl_chg) {
 686             p_clcb->p_srcb->srvc_hdl_chg = FALSE;
 687             /* start discovery */
 688             bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_DISCOVER_EVT, NULL);
 689         }
 690     }
 691
 692     if (p_clcb->p_rcb) {
 693         /* there is no RM for GATT */
 694         if (p_clcb->transport == BTA_TRANSPORT_BR_EDR) {
 695             bta_sys_conn_open(BTA_ID_GATTC, BTA_ALL_APP_ID, p_clcb->bda);
 696         }
 697
 698         bta_gattc_send_open_cback(p_clcb->p_rcb,
 699                                   BTA_GATT_OK,
 700                                   p_clcb->bda,
 701                                   p_clcb->bta_conn_id,
 702                                   p_clcb->transport,
 703                                   p_clcb->p_srcb->mtu);
 704
 705     }
 706 }
 707 /*******************************************************************************
 708 **
 709 ** Function         bta_gattc_conncback
 710 **
 711 ** Description      receive connection callback from stack
 712 **
 713 ** Returns          void
 714 **
 715 *******************************************************************************/
 716 void bta_gattc_conncback(tBTA_GATTC_RCB *p_rcb, tBTA_GATTC_DATA *p_data)
 717 {
 718     if (p_rcb) {
 719         bta_gattc_send_connect_cback(p_rcb,
 720                                      p_data->int_conn.remote_bda,
 721                                      p_data->int_conn.hdr.layer_specific);
 722
 723     }
 724 }
 725 /*******************************************************************************
 726 **
 727 ** Function         bta_gattc_disconncback
 728 **
 729 ** Description      receive disconnection callback from stack
 730 **
 731 ** Returns          void
 732 **
 733 *******************************************************************************/
 734 void bta_gattc_disconncback(tBTA_GATTC_RCB *p_rcb, tBTA_GATTC_DATA *p_data)
 735 {
 736     if (p_rcb) {
 737         bta_gattc_send_disconnect_cback(p_rcb,
 738                                      p_data->int_conn.reason,
 739                                      p_data->int_conn.remote_bda,
 740                                      p_data->int_conn.hdr.layer_specific);
 741
 742     }
 743 }
 744 /*******************************************************************************
 745 **
 746 ** Function         bta_gattc_close_fail
 747 **
 748 ** Description      close a  connection.
 749 **
 750 ** Returns          void
 751 **
 752 *******************************************************************************/
 753 void bta_gattc_close_fail(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 754 {
 755     tBTA_GATTC           cb_data;
 756
 757     if ( p_clcb->p_rcb->p_cback ) {
 758         memset(&cb_data, 0, sizeof(tBTA_GATTC));
 759         cb_data.close.client_if = p_clcb->p_rcb->client_if;
 760         cb_data.close.conn_id   = p_data->hdr.layer_specific;
 761         bdcpy(cb_data.close.remote_bda, p_clcb->bda);
 762         cb_data.close.status    = BTA_GATT_ERROR;
 763         cb_data.close.reason    = BTA_GATT_CONN_NONE;
 764
 765
 766         (*p_clcb->p_rcb->p_cback)(BTA_GATTC_CLOSE_EVT, &cb_data);
 767     }
 768 }
 769 /*******************************************************************************
 770 **
 771 ** Function         bta_gattc_api_close
 772 **
 773 ** Description      close a GATTC connection.
 774 **
 775 ** Returns          void
 776 **
 777 *******************************************************************************/
 778 void bta_gattc_close(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 779 {
 780     tBTA_GATTC_CBACK    *p_cback = p_clcb->p_rcb->p_cback;
 781     tBTA_GATTC_RCB      *p_clreg = p_clcb->p_rcb;
 782     tBTA_GATTC           cb_data;
 783
 784     APPL_TRACE_DEBUG("bta_gattc_close conn_id=%d", p_clcb->bta_conn_id);
 785
 786     cb_data.close.client_if = p_clcb->p_rcb->client_if;
 787     cb_data.close.conn_id   = p_clcb->bta_conn_id;
 788     cb_data.close.reason    = p_clcb->reason;
 789     cb_data.close.status    = p_clcb->status;
 790     bdcpy(cb_data.close.remote_bda, p_clcb->bda);
 791
 792     if (p_clcb->transport == BTA_TRANSPORT_BR_EDR) {
 793         bta_sys_conn_close( BTA_ID_GATTC , BTA_ALL_APP_ID, p_clcb->bda);
 794     }
 795
 796     bta_gattc_clcb_dealloc(p_clcb);
 797
 798     if (p_data->hdr.event == BTA_GATTC_API_CLOSE_EVT) {
 799         cb_data.close.status = GATT_Disconnect(p_data->hdr.layer_specific);
 800     } else if (p_data->hdr.event == BTA_GATTC_INT_DISCONN_EVT) {
 801         cb_data.close.status = BTA_GATT_OK;
 802         cb_data.close.reason = p_data->int_conn.reason;
 803     }
 804
 805     if (p_cback) {
 806         (* p_cback)(BTA_GATTC_CLOSE_EVT,   (tBTA_GATTC *)&cb_data);
 807     }
 808
 809     if (p_clreg->num_clcb == 0 && p_clreg->dereg_pending) {
 810         bta_gattc_deregister_cmpl(p_clreg);
 811     }
 812 }
 813 /*******************************************************************************
 814 **
 815 ** Function         bta_gattc_reset_discover_st
 816 **
 817 ** Description      when a SRCB finished discovery, tell all related clcb.
 818 **
 819 ** Returns          None.
 820 **
 821 *******************************************************************************/
 822 void bta_gattc_reset_discover_st(tBTA_GATTC_SERV *p_srcb, tBTA_GATT_STATUS status)
 823 {
 824     tBTA_GATTC_CB   *p_cb = &bta_gattc_cb;
 825     UINT8 i;
 826
 827     for (i = 0; i < BTA_GATTC_CLCB_MAX; i ++) {
 828         if (p_cb->clcb[i].p_srcb == p_srcb) {
 829             p_cb->clcb[i].status = status;
 830             bta_gattc_sm_execute(&p_cb->clcb[i], BTA_GATTC_DISCOVER_CMPL_EVT, NULL);
 831         }
 832     }
 833 }
 834 /*******************************************************************************
 835 **
 836 ** Function         bta_gattc_disc_close
 837 **
 838 ** Description      close a GATTC connection while in discovery state.
 839 **
 840 ** Returns          void
 841 **
 842 *******************************************************************************/
 843 void bta_gattc_disc_close(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 844 {
 845     APPL_TRACE_DEBUG("%s: Discovery cancel conn_id=%d", __func__,
 846                      p_clcb->bta_conn_id);
 847
 848     if (p_clcb->disc_active) {
 849         bta_gattc_reset_discover_st(p_clcb->p_srcb, BTA_GATT_ERROR);
 850     } else {
 851         p_clcb->state = BTA_GATTC_CONN_ST;
 852     }
 853
 854     // This function only gets called as the result of a BTA_GATTC_API_CLOSE_EVT
 855     // while in the BTA_GATTC_DISCOVER_ST state. Once the state changes, the
 856     // connection itself still needs to be closed to resolve the original event.
 857     if (p_clcb->state == BTA_GATTC_CONN_ST) {
 858         APPL_TRACE_DEBUG("State is back to BTA_GATTC_CONN_ST. "
 859                          "Trigger connection close");
 860         bta_gattc_close(p_clcb, p_data);
 861     }
 862 }
 863 /*******************************************************************************
 864 **
 865 ** Function         bta_gattc_set_discover_st
 866 **
 867 ** Description      when a SRCB start discovery, tell all related clcb and set
 868 **                  the state.
 869 **
 870 ** Returns          None.
 871 **
 872 *******************************************************************************/
 873 void bta_gattc_set_discover_st(tBTA_GATTC_SERV *p_srcb)
 874 {
 875     tBTA_GATTC_CB   *p_cb = &bta_gattc_cb;
 876     UINT8   i;
 877
 878     for (i = 0; i < BTA_GATTC_CLCB_MAX; i ++) {
 879         if (p_cb->clcb[i].p_srcb == p_srcb) {
 880             p_cb->clcb[i].status = BTA_GATT_OK;
 881             p_cb->clcb[i].state = BTA_GATTC_DISCOVER_ST;
 882         }
 883     }
 884 }
 885 /*******************************************************************************
 886 **
 887 ** Function         bta_gattc_restart_discover
 888 **
 889 ** Description      process service change in discovery state, mark up the auto
 890 **                  update flag and set status to be discovery cancel for current
 891 **                  discovery.
 892 **
 893 ** Returns          None.
 894 **
 895 *******************************************************************************/
 896 void bta_gattc_restart_discover(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 897 {
 898     UNUSED(p_data);
 899
 900     p_clcb->status      = BTA_GATT_CANCEL;
 901     p_clcb->auto_update = BTA_GATTC_DISC_WAITING;
 902 }
 903
 904 /*******************************************************************************
 905 **
 906 ** Function         bta_gattc_cfg_mtu
 907 **
 908 ** Description      Configure MTU size on the GATT connection.
 909 **
 910 ** Returns          None.
 911 **
 912 *******************************************************************************/
 913 void bta_gattc_cfg_mtu(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 914 {
 915     tBTA_GATT_STATUS    status;
 916
 917     if (bta_gattc_enqueue(p_clcb, p_data)) {
 918         status = GATTC_ConfigureMTU (p_clcb->bta_conn_id);
 919
 920         /* if failed, return callback here */
 921         if (status != GATT_SUCCESS && status != GATT_CMD_STARTED) {
 922             /* Dequeue the data, if it was enqueued */
 923             if (p_clcb->p_q_cmd == p_data) {
 924                 p_clcb->p_q_cmd = NULL;
 925                 bta_gattc_pop_command_to_send(p_clcb);
 926             }
 927
 928             bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_CONFIG, status, NULL);
 929         }
 930     }
 931 }
 932 /*******************************************************************************
 933 **
 934 ** Function         bta_gattc_start_discover
 935 **
 936 ** Description      Start a discovery send to server.
 937 **
 938 ** Returns          None.
 939 **
 940 *******************************************************************************/
 941 void bta_gattc_start_discover(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
 942 {
 943     UNUSED(p_data);
 944
 945     APPL_TRACE_DEBUG("bta_gattc_start_discover conn_id=%d p_clcb->p_srcb->state = %d ",
 946                      p_clcb->bta_conn_id, p_clcb->p_srcb->state);
 947
 948     if (((p_clcb->p_q_cmd == NULL || p_clcb->auto_update == BTA_GATTC_REQ_WAITING) &&
 949             p_clcb->p_srcb->state == BTA_GATTC_SERV_IDLE) ||
 950             p_clcb->p_srcb->state == BTA_GATTC_SERV_DISC) {
 951         /* no pending operation, start discovery right away */
 952         p_clcb->auto_update = BTA_GATTC_NO_SCHEDULE;
 953
 954         if (p_clcb->p_srcb != NULL) {
 955             /* clear the service change mask */
 956             p_clcb->p_srcb->srvc_hdl_chg = FALSE;
 957             p_clcb->p_srcb->update_count = 0;
 958             p_clcb->p_srcb->state = BTA_GATTC_SERV_DISC_ACT;
 959
 960             if (p_clcb->transport == BTA_TRANSPORT_LE) {
 961                 L2CA_EnableUpdateBleConnParams(p_clcb->p_srcb->server_bda, FALSE);
 962             }
 963
 964             /* set all srcb related clcb into discovery ST */
 965             bta_gattc_set_discover_st(p_clcb->p_srcb);
 966
 967             if ((p_clcb->status = bta_gattc_init_cache(p_clcb->p_srcb)) == BTA_GATT_OK) {
 968                 p_clcb->status = bta_gattc_discover_pri_service(p_clcb->bta_conn_id,
 969                                  p_clcb->p_srcb, GATT_DISC_SRVC_ALL);
 970             }
 971             if (p_clcb->status != BTA_GATT_OK) {
 972                 APPL_TRACE_ERROR("discovery on server failed");
 973                 bta_gattc_reset_discover_st(p_clcb->p_srcb, p_clcb->status);
 974             } else {
 975                 p_clcb->disc_active = TRUE;
 976             }
 977         } else {
 978             APPL_TRACE_ERROR("unknown device, can not start discovery");
 979         }
 980     }
 981     /* pending operation, wait until it finishes */
 982     else {
 983         p_clcb->auto_update = BTA_GATTC_DISC_WAITING;
 984
 985         if (p_clcb->p_srcb->state == BTA_GATTC_SERV_IDLE) {
 986             p_clcb->state = BTA_GATTC_CONN_ST;    /* set clcb state */
 987         }
 988     }
 989
 990 }
 991 /*******************************************************************************
 992 **
 993 ** Function         bta_gattc_disc_cmpl
 994 **
 995 ** Description      discovery on server is finished
 996 **
 997 ** Returns          None.
 998 **
 999 *******************************************************************************/
1000 void bta_gattc_disc_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
1001 {
1002     tBTA_GATTC_DATA *p_q_cmd = p_clcb->p_q_cmd;
1003     UNUSED(p_data);
1004
1005     APPL_TRACE_DEBUG("bta_gattc_disc_cmpl conn_id=%d, status = %d", p_clcb->bta_conn_id, p_clcb->status);
1006
1007     p_clcb->p_srcb->state = BTA_GATTC_SERV_IDLE;
1008     p_clcb->disc_active = FALSE;
1009
1010     if (p_clcb->status != GATT_SUCCESS) {
1011         /* clean up cache */
1012         if (p_clcb->p_srcb && p_clcb->p_srcb->p_srvc_cache) {
1013             list_free(p_clcb->p_srcb->p_srvc_cache);
1014             p_clcb->p_srcb->p_srvc_cache = NULL;
1015         }
1016
1017         /* used to reset cache in application */
1018         bta_gattc_cache_reset(p_clcb->p_srcb->server_bda);
1019     }
1020     if (p_clcb->p_srcb && p_clcb->p_srcb->p_srvc_list) {
1021         /* release pending attribute list buffer */
1022         osi_free(p_clcb->p_srcb->p_srvc_list);
1023         p_clcb->p_srcb->p_srvc_list = NULL;
1024         //osi_free_and_reset((void **)&p_clcb->p_srcb->p_srvc_list);
1025     }
1026
1027     if (p_clcb->auto_update == BTA_GATTC_DISC_WAITING) {
1028         /* start discovery again */
1029         bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_DISCOVER_EVT, NULL);
1030     }
1031     /* get any queued command to proceed */
1032     else if (p_q_cmd != NULL) {
1033         p_clcb->p_q_cmd = NULL;
1034         /* execute pending operation of link block still present */
1035         if (l2cu_find_lcb_by_bd_addr(p_clcb->p_srcb->server_bda, BT_TRANSPORT_LE) != NULL) {
1036             bta_gattc_sm_execute(p_clcb, p_q_cmd->hdr.event, p_q_cmd);
1037         }
1038         /* if the command executed requeued the cmd, we don't
1039          * want to free the underlying buffer that's being
1040          * referenced by p_clcb->p_q_cmd
1041          */
1042         if (p_q_cmd != p_clcb->p_q_cmd) {
1043             osi_free(p_q_cmd);
1044             p_q_cmd = NULL;
1045         }
1046     }
1047 }
1048 /*******************************************************************************
1049 **
1050 ** Function         bta_gattc_read
1051 **
1052 ** Description      Read an attribute
1053 **
1054 ** Returns          None.
1055 **
1056 *******************************************************************************/
1057 void bta_gattc_read(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
1058 {
1059     if (!bta_gattc_enqueue(p_clcb, p_data))
1060         return;
1061
1062     tGATT_READ_PARAM    read_param;
1063     memset (&read_param, 0 ,sizeof(tGATT_READ_PARAM));
1064     read_param.by_handle.handle = p_data->api_read.handle;
1065     read_param.by_handle.auth_req = p_data->api_read.auth_req;
1066
1067     tBTA_GATT_STATUS status = GATTC_Read(p_clcb->bta_conn_id, GATT_READ_BY_HANDLE, &read_param);
1068
1069         /* read fail */
1070         if (status != BTA_GATT_OK) {
1071             /* Dequeue the data, if it was enqueued */
1072             if (p_clcb->p_q_cmd == p_data) {
1073                 p_clcb->p_q_cmd = NULL;
1074                 bta_gattc_pop_command_to_send(p_clcb);
1075             }
1076
1077             bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_READ, status, NULL);
1078         }
1079 }
1080 /*******************************************************************************
1081 **
1082 ** Function         bta_gattc_read_multi
1083 **
1084 ** Description      read multiple
1085 **
1086 ** Returns          None.
1087 *********************************************************************************/
1088 void bta_gattc_read_multi(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
1089 {
1090     tBTA_GATT_STATUS    status = BTA_GATT_OK;
1091     tGATT_READ_PARAM    read_param;
1092
1093     if (bta_gattc_enqueue(p_clcb, p_data)) {
1094         memset(&read_param, 0, sizeof(tGATT_READ_PARAM));
1095
1096         if (status == BTA_GATT_OK) {
1097             read_param.read_multiple.num_handles = p_data->api_read_multi.num_attr;
1098             read_param.read_multiple.auth_req = p_data->api_read_multi.auth_req;
1099             memcpy(&read_param.read_multiple.handles, p_data->api_read_multi.handles,
1100                                         sizeof(UINT16) * p_data->api_read_multi.num_attr);
1101
1102             status = GATTC_Read(p_clcb->bta_conn_id, GATT_READ_MULTIPLE, &read_param);
1103         }
1104
1105         /* read fail */
1106         if (status != BTA_GATT_OK) {
1107             /* Dequeue the data, if it was enqueued */
1108             if (p_clcb->p_q_cmd == p_data) {
1109                 p_clcb->p_q_cmd = NULL;
1110                 bta_gattc_pop_command_to_send(p_clcb);
1111             }
1112
1113             bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_READ, status, NULL);
1114         }
1115     }
1116 }
1117 /*******************************************************************************
1118 **
1119 ** Function         bta_gattc_write
1120 **
1121 ** Description      Write an attribute
1122 **
1123 ** Returns          None.
1124 **
1125 *******************************************************************************/
1126 void bta_gattc_write(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
1127 {
1128     if (!bta_gattc_enqueue(p_clcb, p_data))
1129         return;
1130
1131     tBTA_GATT_STATUS    status = BTA_GATT_OK;
1132     tGATT_VALUE attr;
1133
1134     attr.conn_id = p_clcb->bta_conn_id;
1135     attr.handle = p_data->api_write.handle;
1136     attr.offset = p_data->api_write.offset;
1137     attr.len    = p_data->api_write.len;
1138     attr.auth_req = p_data->api_write.auth_req;
1139
1140     if (p_data->api_write.p_value) {
1141         memcpy(attr.value, p_data->api_write.p_value, p_data->api_write.len);
1142     }
1143
1144     status = GATTC_Write(p_clcb->bta_conn_id, p_data->api_write.write_type, &attr);
1145
1146     /* write fail */
1147     if (status != BTA_GATT_OK) {
1148         /* Dequeue the data, if it was enqueued */
1149         if (p_clcb->p_q_cmd == p_data) {
1150             p_clcb->p_q_cmd = NULL;
1151             bta_gattc_pop_command_to_send(p_clcb);
1152         }
1153
1154         bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_WRITE, status, NULL);
1155     }
1156 }
1157 /*******************************************************************************
1158 **
1159 ** Function         bta_gattc_execute
1160 **
1161 ** Description      send execute write
1162 **
1163 ** Returns          None.
1164 *********************************************************************************/
1165 void bta_gattc_execute(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
1166 {
1167     tBTA_GATT_STATUS    status;
1168
1169     if (bta_gattc_enqueue(p_clcb, p_data)) {
1170         status = GATTC_ExecuteWrite(p_clcb->bta_conn_id, p_data->api_exec.is_execute);
1171
1172         if (status != BTA_GATT_OK) {
1173             /* Dequeue the data, if it was enqueued */
1174             if (p_clcb->p_q_cmd == p_data) {
1175                 p_clcb->p_q_cmd = NULL;
1176                 bta_gattc_pop_command_to_send(p_clcb);
1177             }
1178
1179             bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_EXE_WRITE, status, NULL);
1180         }
1181     }
1182 }
1183 /*******************************************************************************
1184 **
1185 ** Function         bta_gattc_confirm
1186 **
1187 ** Description      send handle value confirmation
1188 **
1189 ** Returns          None.
1190 **
1191 *******************************************************************************/
1192 void bta_gattc_confirm(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
1193 {
1194     UINT16 handle = p_data->api_confirm.handle;
1195
1196     if (GATTC_SendHandleValueConfirm(p_data->api_confirm.hdr.layer_specific, handle)
1197         != GATT_SUCCESS) {
1198             APPL_TRACE_ERROR("bta_gattc_confirm to handle [0x%04x] failed", handle);
1199     } else {
1200         /* if over BR_EDR, inform PM for mode change */
1201         if (p_clcb->transport == BTA_TRANSPORT_BR_EDR) {
1202             bta_sys_busy(BTA_ID_GATTC, BTA_ALL_APP_ID, p_clcb->bda);
1203             bta_sys_idle(BTA_ID_GATTC, BTA_ALL_APP_ID, p_clcb->bda);
1204         }
1205     }
1206 }
1207 /*******************************************************************************
1208 **
1209 ** Function         bta_gattc_read_cmpl
1210 **
1211 ** Description      read complete
1212 **
1213 ** Returns          None.
1214 **
1215 *******************************************************************************/
1216 void bta_gattc_read_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data)
1217 {
1218     UINT8               event;
1219     tBTA_GATTC          cb_data;
1220     tBTA_GATT_UNFMT     read_value;
1221
1222     memset(&cb_data, 0, sizeof(tBTA_GATTC));
1223     memset(&read_value, 0, sizeof(tBTA_GATT_UNFMT));
1224
1225     cb_data.read.status     = p_data->status;
1226
1227     if (p_data->p_cmpl != NULL && p_data->status == BTA_GATT_OK) {
1228         cb_data.read.handle = p_data->p_cmpl->att_value.handle;
1229
1230         read_value.len = p_data->p_cmpl->att_value.len;
1231         read_value.p_value = p_data->p_cmpl->att_value.value;
1232         cb_data.read.p_value = &read_value;
1233     } else {
1234         cb_data.read.handle = p_clcb->p_q_cmd->api_read.handle;
1235     }
1236
1237     if (p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_MULTI_EVT) {
1238         event = p_clcb->p_q_cmd->api_read.cmpl_evt;
1239     } else {
1240         event = p_clcb->p_q_cmd->api_read_multi.cmpl_evt;
1241     }
1242     cb_data.read.conn_id = p_clcb->bta_conn_id;
1243     //free the command data store in the queue.
1244     bta_gattc_free_command_data(p_clcb);
1245     bta_gattc_pop_command_to_send(p_clcb);
1246     /* read complete, callback */
1247     ( *p_clcb->p_rcb->p_cback)(event, (tBTA_GATTC *)&cb_data);
1248
1249 }
1250 /*******************************************************************************
1251 **
1252 ** Function         bta_gattc_write_cmpl
1253 **
1254 ** Description      write complete
1255 **
1256 ** Returns          None.
1257 **
1258 *******************************************************************************/
1259 void bta_gattc_write_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data)
1260 {
1261     tBTA_GATTC      cb_data = {0};
1262     UINT8          event;
1263
1264     memset(&cb_data, 0, sizeof(tBTA_GATTC));
1265
1266     cb_data.write.status     = p_data->status;
1267     cb_data.write.handle = p_data->p_cmpl->att_value.handle;
1268
1269     if (p_clcb->p_q_cmd->api_write.hdr.event == BTA_GATTC_API_WRITE_EVT &&
1270         p_clcb->p_q_cmd->api_write.write_type == BTA_GATTC_WRITE_PREPARE) {
1271
1272         event = BTA_GATTC_PREP_WRITE_EVT;
1273                 } else {
1274         event = p_clcb->p_q_cmd->api_write.cmpl_evt;
1275         }
1276     //free the command data store in the queue.
1277     bta_gattc_free_command_data(p_clcb);
1278     bta_gattc_pop_command_to_send(p_clcb);
1279     cb_data.write.conn_id = p_clcb->bta_conn_id;
1280     /* write complete, callback */
1281     ( *p_clcb->p_rcb->p_cback)(event, (tBTA_GATTC *)&cb_data);
1282
1283 }
1284 /*******************************************************************************
1285 **
1286 ** Function         bta_gattc_exec_cmpl
1287 **
1288 ** Description      execute write complete
1289 **
1290 ** Returns          None.
1291 **
1292 *******************************************************************************/
1293 void bta_gattc_exec_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data)
1294 {
1295     tBTA_GATTC          cb_data;
1296     //free the command data store in the queue.
1297     bta_gattc_free_command_data(p_clcb);
1298     bta_gattc_pop_command_to_send(p_clcb);
1299     p_clcb->status      = BTA_GATT_OK;
1300
1301     /* execute complete, callback */
1302     cb_data.exec_cmpl.conn_id = p_clcb->bta_conn_id;
1303     cb_data.exec_cmpl.status = p_data->status;
1304
1305     ( *p_clcb->p_rcb->p_cback)(BTA_GATTC_EXEC_EVT,  &cb_data);
1306
1307 }
1308
1309 /*******************************************************************************
1310 **
1311 ** Function         bta_gattc_cfg_mtu_cmpl
1312 **
1313 ** Description      configure MTU operation complete
1314 **
1315 ** Returns          None.
1316 **
1317 *******************************************************************************/
1318 void bta_gattc_cfg_mtu_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_OP_CMPL *p_data)
1319 {
1320     tBTA_GATTC          cb_data;
1321     //free the command data store in the queue.
1322     bta_gattc_free_command_data(p_clcb);
1323     bta_gattc_pop_command_to_send(p_clcb);
1324
1325     if (p_data->p_cmpl  &&  p_data->status == BTA_GATT_OK) {
1326         p_clcb->p_srcb->mtu  = p_data->p_cmpl->mtu;
1327     }
1328
1329     /* configure MTU complete, callback */
1330     p_clcb->status          = p_data->status;
1331     cb_data.cfg_mtu.conn_id = p_clcb->bta_conn_id;
1332     cb_data.cfg_mtu.status  = p_data->status;
1333     cb_data.cfg_mtu.mtu     = p_clcb->p_srcb->mtu;
1334
1335     (*p_clcb->p_rcb->p_cback) (BTA_GATTC_CFG_MTU_EVT,  &cb_data);
1336
1337 }
1338 /*******************************************************************************
1339 **
1340 ** Function         bta_gattc_op_cmpl
1341 **
1342 ** Description      operation completed.
1343 **
1344 ** Returns          None.
1345 **
1346 *******************************************************************************/
1347 void  bta_gattc_op_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
1348 {
1349     UINT8           op = (UINT8)p_data->op_cmpl.op_code;
1350     UINT8           mapped_op = 0;
1351
1352     APPL_TRACE_DEBUG("bta_gattc_op_cmpl op = %d", op);
1353
1354     if (op == GATTC_OPTYPE_INDICATION || op == GATTC_OPTYPE_NOTIFICATION) {
1355         APPL_TRACE_ERROR("unexpected operation, ignored");
1356     } else if (op >= GATTC_OPTYPE_READ) {
1357         if (p_clcb->p_q_cmd == NULL) {
1358             APPL_TRACE_ERROR("No pending command");
1359             return;
1360         }
1361         if (p_clcb->p_q_cmd->hdr.event != bta_gattc_opcode_to_int_evt[op - GATTC_OPTYPE_READ]) {
1362             if (p_clcb->p_q_cmd->hdr.event != BTA_GATTC_API_READ_MULTI_EVT) {
1363                 mapped_op = p_clcb->p_q_cmd->hdr.event - BTA_GATTC_API_READ_EVT + GATTC_OPTYPE_READ;
1364                 if ( mapped_op > GATTC_OPTYPE_INDICATION) {
1365                     mapped_op = 0;
1366                 }
1367
1368 #if (BT_TRACE_VERBOSE == TRUE)
1369                 APPL_TRACE_ERROR("expect op:(%s :0x%04x), receive unexpected operation (%s).",
1370                                  bta_gattc_op_code_name[mapped_op] , p_clcb->p_q_cmd->hdr.event,
1371                                  bta_gattc_op_code_name[op]);
1372 #else
1373                 APPL_TRACE_ERROR("expect op:(%u :0x%04x), receive unexpected operation (%u).",
1374                                  mapped_op , p_clcb->p_q_cmd->hdr.event, op);
1375 #endif
1376                 return;
1377             }
1378         }
1379
1380         /* discard responses if service change indication is received before operation completed */
1381         if (p_clcb->auto_update == BTA_GATTC_DISC_WAITING && p_clcb->p_srcb->srvc_hdl_chg) {
1382             APPL_TRACE_DEBUG("Discard all responses when service change indication is received.");
1383             p_data->op_cmpl.status = GATT_ERROR;
1384         }
1385
1386         /* service handle change void the response, discard it */
1387         if (op == GATTC_OPTYPE_READ) {
1388             bta_gattc_read_cmpl(p_clcb, &p_data->op_cmpl);
1389         }
1390
1391         else if (op == GATTC_OPTYPE_WRITE) {
1392             bta_gattc_write_cmpl(p_clcb, &p_data->op_cmpl);
1393         }
1394
1395         else if (op == GATTC_OPTYPE_EXE_WRITE) {
1396             bta_gattc_exec_cmpl(p_clcb, &p_data->op_cmpl);
1397         }
1398
1399         else if (op == GATTC_OPTYPE_CONFIG) {
1400             bta_gattc_cfg_mtu_cmpl(p_clcb, &p_data->op_cmpl);
1401         }
1402
1403         if (p_clcb->auto_update == BTA_GATTC_DISC_WAITING) {
1404             p_clcb->auto_update = BTA_GATTC_REQ_WAITING;
1405             bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_DISCOVER_EVT, NULL);
1406         }
1407     }
1408 }
1409 /*******************************************************************************
1410 **
1411 ** Function         bta_gattc_op_cmpl
1412 **
1413 ** Description      operation completed.
1414 **
1415 ** Returns          None.
1416 **
1417 *******************************************************************************/
1418 void  bta_gattc_ignore_op_cmpl(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
1419 {
1420     UNUSED(p_clcb);
1421
1422     /* receive op complete when discovery is started, ignore the response,
1423         and wait for discovery finish and resent */
1424     APPL_TRACE_DEBUG("bta_gattc_ignore_op_cmpl op = %d", p_data->hdr.layer_specific);
1425
1426 }
1427 /*******************************************************************************
1428 **
1429 ** Function         bta_gattc_search
1430 **
1431 ** Description      start a search in the local server cache
1432 **
1433 ** Returns          None.
1434 **
1435 *******************************************************************************/
1436 void bta_gattc_search(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
1437 {
1438     tBTA_GATT_STATUS    status = GATT_INTERNAL_ERROR;
1439     tBTA_GATTC cb_data;
1440     APPL_TRACE_DEBUG("bta_gattc_search conn_id=%d", p_clcb->bta_conn_id);
1441     if (p_clcb->p_srcb && p_clcb->p_srcb->p_srvc_cache) {
1442         status = BTA_GATT_OK;
1443         /* search the local cache of a server device */
1444         bta_gattc_search_service(p_clcb, p_data->api_search.p_srvc_uuid);
1445     }
1446     cb_data.search_cmpl.status  = status;
1447     cb_data.search_cmpl.conn_id = p_clcb->bta_conn_id;
1448
1449     /* end of search or no server cache available */
1450     ( *p_clcb->p_rcb->p_cback)(BTA_GATTC_SEARCH_CMPL_EVT,  &cb_data);
1451 }
1452 /*******************************************************************************
1453 **
1454 ** Function         bta_gattc_q_cmd
1455 **
1456 ** Description      enqueue a command into control block, usually because discovery
1457 **                  operation is busy.
1458 **
1459 ** Returns          None.
1460 **
1461 *******************************************************************************/
1462 void bta_gattc_q_cmd(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
1463 {
1464     bta_gattc_enqueue(p_clcb, p_data);
1465 }
1466 /*******************************************************************************
1467 **
1468 ** Function         bta_gattc_pop_command_to_send
1469 **
1470 ** Description      dequeue a command into control block.
1471 **                  Check if there has command pending in the command queue or not,
1472 **                  if there has command pending in the command queue, sent it to the state machine to decision
1473 **                  should be sent it to the remote device or not.
1474 **
1475 ** Returns          None.
1476 **
1477 *******************************************************************************/
1478 static void bta_gattc_pop_command_to_send(tBTA_GATTC_CLCB *p_clcb)
1479 {
1480     if (!list_is_empty(p_clcb->p_cmd_list)) {
1481         list_node_t *node = list_begin(p_clcb->p_cmd_list);
1482         tBTA_GATTC_DATA *p_data = (tBTA_GATTC_DATA *)list_node(node);
1483         if (p_data != NULL) {
1484             /* execute pending operation of link block still present */
1485             if (l2cu_find_lcb_by_bd_addr(p_clcb->p_srcb->server_bda, BT_TRANSPORT_LE) != NULL) {
1486                 // The data to be sent to the gattc state machine for processing
1487                 if(bta_gattc_sm_execute(p_clcb, p_data->hdr.event, p_data)) {
1488                     list_remove(p_clcb->p_cmd_list, (void *)p_data);
1489                 }
1490
1491                 if (p_clcb->is_full) {
1492                     tBTA_GATTC cb_data = {0};
1493                     p_clcb->is_full = FALSE;
1494                     cb_data.status = GATT_SUCCESS;
1495                     cb_data.queue_full.conn_id = p_clcb->bta_conn_id;
1496                     cb_data.queue_full.is_full = FALSE;
1497                     if (p_clcb->p_rcb->p_cback != NULL) {
1498                         ( *p_clcb->p_rcb->p_cback)(BTA_GATTC_QUEUE_FULL_EVT, (tBTA_GATTC *)&cb_data);
1499                     }
1500                 }
1501             }
1502         }
1503     }
1504 }
1505 /*******************************************************************************
1506 **
1507 ** Function         bta_gattc_free_command_data
1508 **
1509 ** Description      free the command data into control block.
1510 **
1511 ** Returns          None.
1512 **
1513 *******************************************************************************/
1514 void bta_gattc_free_command_data(tBTA_GATTC_CLCB *p_clcb)
1515 {
1516     assert(p_clcb->p_cmd_list);
1517     //Check the list is empty or not.
1518     if (!list_is_empty(p_clcb->p_cmd_list)) {
1519         /* Traversal the command queue, check the p_q_cmd is point to the queue data or not, if the p_q_cmd point to the
1520            command queue,should remove it from the list */
1521         for (list_node_t *node = list_begin(p_clcb->p_cmd_list); node != list_end(p_clcb->p_cmd_list);
1522              node = list_next(node)) {
1523             tBTA_GATTC_DATA *p_data = (tBTA_GATTC_DATA *)list_node(node);
1524             if (p_data == p_clcb->p_q_cmd) {
1525                 list_remove(p_clcb->p_cmd_list, (void *)p_data);
1526                 p_clcb->p_q_cmd = NULL;
1527                 return;
1528             }
1529         }
1530
1531         osi_free(p_clcb->p_q_cmd);
1532         p_clcb->p_q_cmd = NULL;
1533     } else {
1534         osi_free(p_clcb->p_q_cmd);
1535         p_clcb->p_q_cmd = NULL;
1536     }
1537 }
1538
1539 /*******************************************************************************
1540 **
1541 ** Function         bta_gattc_fail
1542 **
1543 ** Description      report API call failure back to apps
1544 **
1545 ** Returns          None.
1546 **
1547 *******************************************************************************/
1548 void bta_gattc_fail(tBTA_GATTC_CLCB *p_clcb, tBTA_GATTC_DATA *p_data)
1549 {
1550     UNUSED(p_data);
1551
1552     if (p_clcb->status == BTA_GATT_OK) {
1553         APPL_TRACE_ERROR("operation not supported at current state [%d]", p_clcb->state);
1554     }
1555 }
1556
1557 /*******************************************************************************
1558 **
1559 ** Function         bta_gattc_deregister_cmpl
1560 **
1561 ** Description      De-Register a GATT client application with BTA completed.
1562 **
1563 ** Returns          void
1564 **
1565 *******************************************************************************/
1566 static void bta_gattc_deregister_cmpl(tBTA_GATTC_RCB *p_clreg)
1567 {
1568     tBTA_GATTC_CB       *p_cb = &bta_gattc_cb;
1569     tBTA_GATTC_IF       client_if = p_clreg->client_if;
1570     tBTA_GATTC          cb_data;
1571     tBTA_GATTC_CBACK    *p_cback = p_clreg->p_cback;
1572
1573     memset(&cb_data, 0, sizeof(tBTA_GATTC));
1574
1575     GATT_Deregister(p_clreg->client_if);
1576     memset(p_clreg, 0, sizeof(tBTA_GATTC_RCB));
1577
1578     cb_data.reg_oper.client_if = client_if;
1579     cb_data.reg_oper.status    = BTA_GATT_OK;
1580
1581     if (p_cback)
1582         /* callback with de-register event */
1583     {
1584         (*p_cback)(BTA_GATTC_DEREG_EVT,  (tBTA_GATTC *)&cb_data);
1585     }
1586
1587     if (bta_gattc_num_reg_app() == 0 && p_cb->state == BTA_GATTC_STATE_DISABLING) {
1588         p_cb->state = BTA_GATTC_STATE_DISABLED;
1589     }
1590 }
1591
1592 /*******************************************************************************
1593 **
1594 ** Function         bta_gattc_conn_cback
1595 **
1596 ** Description      callback functions to GATT client stack.
1597 **
1598 ** Returns          void
1599 **
1600 *******************************************************************************/
1601 static void bta_gattc_conn_cback(tGATT_IF gattc_if, BD_ADDR bda, UINT16 conn_id,
1602                                  BOOLEAN connected, tGATT_DISCONN_REASON reason,
1603                                  tBT_TRANSPORT transport)
1604 {
1605     tBTA_GATTC_DATA *p_buf;
1606     BOOLEAN start_ccc_timer = FALSE;
1607     tBTA_GATTC_CONN *p_conn = NULL;
1608     tBTA_GATTC_FIND_SERVICE_CB    result;
1609
1610     if (reason != 0) {
1611         APPL_TRACE_WARNING("%s() - cif=%d connected=%d conn_id=%d reason=0x%04x",
1612                            __FUNCTION__, gattc_if, connected, conn_id, reason);
1613     }
1614
1615     if (connected == TRUE){
1616         p_conn = bta_gattc_conn_find_alloc(bda);
1617     }
1618     else if (connected == FALSE){
1619         p_conn = bta_gattc_conn_find(bda);
1620     }
1621
1622     if (p_conn == NULL){
1623         APPL_TRACE_ERROR("p_conn is NULL in %s\n", __func__);
1624     }
1625
1626     if ((transport == BT_TRANSPORT_LE) && (connected == TRUE) && (p_conn != NULL) \
1627          && (p_conn->service_change_ccc_written == FALSE) && (p_conn->ccc_timer_used == FALSE)) {
1628         result = bta_gattc_register_service_change_notify(conn_id, bda, &start_ccc_timer);
1629         if (start_ccc_timer == TRUE) {
1630             TIMER_LIST_ENT *ccc_timer = &(p_conn->service_change_ccc_timer);
1631             /* start a 1000ms timer to wait for service discovery finished */
1632             bta_gattc_start_service_change_ccc_timer(conn_id, bda, 1000, 0, result, ccc_timer);
1633             p_conn->ccc_timer_used = TRUE;
1634         }
1635         else {
1636             /* Has written service change ccc; or service change ccc doesn't exist in remote device's gatt database */
1637             p_conn->service_change_ccc_written = TRUE;
1638             p_conn->ccc_timer_used = FALSE;
1639         }
1640
1641     }
1642     else if ((transport == BT_TRANSPORT_LE) && (connected == FALSE) && (p_conn != NULL)){
1643             p_conn->service_change_ccc_written = FALSE;
1644             if (p_conn->ccc_timer_used == TRUE){
1645                 assert(bta_gattc_cb.write_ccc_mutex != NULL);
1646                 osi_mutex_lock(&bta_gattc_cb.write_ccc_mutex, OSI_MUTEX_MAX_TIMEOUT);
1647
1648                 if (p_conn->service_change_ccc_timer.param != 0) {
1649                     osi_free((void *)p_conn->service_change_ccc_timer.param);
1650                     p_conn->service_change_ccc_timer.param = (TIMER_PARAM_TYPE)0;
1651                 }
1652                 bta_sys_stop_timer(&(p_conn->service_change_ccc_timer));
1653                 p_conn->ccc_timer_used = FALSE;
1654                 osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
1655             }
1656     }
1657
1658     bt_bdaddr_t bdaddr;
1659     bdcpy(bdaddr.address, bda);
1660
1661     if ((p_buf = (tBTA_GATTC_DATA *) osi_malloc(sizeof(tBTA_GATTC_DATA))) != NULL) {
1662         memset(p_buf, 0, sizeof(tBTA_GATTC_DATA));
1663
1664         p_buf->int_conn.hdr.event            = connected ? BTA_GATTC_INT_CONN_EVT :
1665                                                BTA_GATTC_INT_DISCONN_EVT;
1666         p_buf->int_conn.hdr.layer_specific   = conn_id;
1667         p_buf->int_conn.client_if            = gattc_if;
1668         p_buf->int_conn.role                 = L2CA_GetBleConnRole(bda);
1669         p_buf->int_conn.reason               = reason;
1670         p_buf->int_conn.transport            = transport;
1671         bdcpy(p_buf->int_conn.remote_bda, bda);
1672
1673         bta_sys_sendmsg(p_buf);
1674     }
1675 }
1676
1677 /*******************************************************************************
1678 **
1679 ** Function         bta_gattc_enc_cmpl_cback
1680 **
1681 ** Description      encryption complete callback function to GATT client stack.
1682 **
1683 ** Returns          void
1684 **
1685 *******************************************************************************/
1686 static void bta_gattc_enc_cmpl_cback(tGATT_IF gattc_if, BD_ADDR bda)
1687 {
1688     tBTA_GATTC_DATA *p_buf;
1689     tBTA_GATTC_CLCB *p_clcb = NULL;
1690
1691     if ((p_clcb = bta_gattc_find_clcb_by_cif(gattc_if, bda, BTA_GATT_TRANSPORT_LE)) == NULL) {
1692         return;
1693     }
1694
1695 #if (defined BTA_HH_LE_INCLUDED && BTA_HH_LE_INCLUDED == TRUE)
1696     /* filter this event just for BTA HH LE GATT client,
1697        In the future, if we want to enable encryption complete event
1698        for all GATT clients, we can remove this code */
1699     if (!bta_hh_le_is_hh_gatt_if(gattc_if)) {
1700         return;
1701     }
1702 #endif
1703
1704     APPL_TRACE_DEBUG("bta_gattc_enc_cmpl_cback: cif = %d", gattc_if);
1705
1706     if ((p_buf = (tBTA_GATTC_DATA *) osi_calloc(sizeof(tBTA_GATTC_DATA))) != NULL) {
1707         memset(p_buf, 0, sizeof(tBTA_GATTC_DATA));
1708
1709         p_buf->enc_cmpl.hdr.event            = BTA_GATTC_ENC_CMPL_EVT;
1710         p_buf->enc_cmpl.hdr.layer_specific   = p_clcb->bta_conn_id;
1711         p_buf->enc_cmpl.client_if            = gattc_if;
1712         bdcpy(p_buf->enc_cmpl.remote_bda, bda);
1713
1714         bta_sys_sendmsg(p_buf);
1715     }
1716 }
1717
1718 /*******************************************************************************
1719 **
1720 ** Function         bta_gattc_process_api_refresh
1721 **
1722 ** Description      process refresh API to delete cache and start a new discovery
1723 **                  if currently connected.
1724 **
1725 ** Returns          None.
1726 **
1727 *******************************************************************************/
1728 void bta_gattc_process_api_refresh(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg)
1729 {
1730     tBTA_GATTC_SERV *p_srvc_cb = bta_gattc_find_srvr_cache(p_msg->api_conn.remote_bda);
1731     tBTA_GATTC_CLCB      *p_clcb = &bta_gattc_cb.clcb[0];
1732     BOOLEAN         found = FALSE;
1733     UINT8           i;
1734     UNUSED(p_cb);
1735
1736     if (p_srvc_cb != NULL) {
1737         /* try to find a CLCB */
1738         if (p_srvc_cb->connected && p_srvc_cb->num_clcb != 0) {
1739             for (i = 0; i < BTA_GATTC_CLCB_MAX; i ++, p_clcb ++) {
1740                 if (p_clcb->in_use && p_clcb->p_srcb == p_srvc_cb) {
1741                     found = TRUE;
1742                     break;
1743                 }
1744             }
1745             if (found) {
1746                 bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_DISCOVER_EVT, NULL);
1747                 return;
1748             }
1749         }
1750         /* in all other cases, mark it and delete the cache */
1751         if (p_srvc_cb->p_srvc_cache != NULL) {
1752             list_free(p_srvc_cb->p_srvc_cache);
1753             p_srvc_cb->p_srvc_cache = NULL;
1754         }
1755     }
1756     /* used to reset cache in application */
1757     bta_gattc_cache_reset(p_msg->api_conn.remote_bda);
1758
1759 }
1760 /*******************************************************************************
1761 **
1762 ** Function         bta_gattc_process_srvc_chg_ind
1763 **
1764 ** Description      process service change indication.
1765 **
1766 ** Returns          None.
1767 **
1768 *******************************************************************************/
1769 BOOLEAN bta_gattc_process_srvc_chg_ind(UINT16 conn_id,
1770                                        tBTA_GATTC_RCB      *p_clrcb,
1771                                        tBTA_GATTC_SERV     *p_srcb,
1772                                        tBTA_GATTC_CLCB      *p_clcb,
1773                                        tBTA_GATTC_NOTIFY    *p_notify,
1774                                        tGATT_VALUE *att_value)
1775 {
1776     tBT_UUID        gattp_uuid, srvc_chg_uuid;
1777     BOOLEAN         processed = FALSE;
1778     UINT8           i;
1779
1780     gattp_uuid.len = 2;
1781     gattp_uuid.uu.uuid16 = UUID_SERVCLASS_GATT_SERVER;
1782
1783     srvc_chg_uuid.len = 2;
1784     srvc_chg_uuid.uu.uuid16 = GATT_UUID_GATT_SRV_CHGD;
1785
1786     const tBTA_GATTC_CHARACTERISTIC *p_char = bta_gattc_get_characteristic_srcb(p_srcb, p_notify->handle);
1787     if (p_char && bta_gattc_uuid_compare(&p_char->service->uuid, &gattp_uuid, TRUE) &&
1788         bta_gattc_uuid_compare(&p_char->uuid, &srvc_chg_uuid, TRUE)) {
1789         if (att_value->len != BTA_GATTC_SERVICE_CHANGED_LEN) {
1790             APPL_TRACE_ERROR("%s: received malformed service changed indication, skipping", __func__);
1791             return FALSE;
1792         }
1793
1794         UINT8 *p = att_value->value;
1795         UINT16 s_handle = ((UINT16)(*(p    )) + (((UINT16)(*(p + 1))) << 8));
1796         UINT16 e_handle = ((UINT16)(*(p + 2)) + (((UINT16)(*(p + 3))) << 8));
1797
1798         APPL_TRACE_ERROR("%s: service changed s_handle:0x%04x e_handle:0x%04x",
1799                          __func__, s_handle, e_handle);
1800
1801         processed = TRUE;
1802         /* mark service handle change pending */
1803         p_srcb->srvc_hdl_chg = TRUE;
1804         /* clear up all notification/indication registration */
1805         bta_gattc_clear_notif_registration(p_srcb, conn_id, s_handle, e_handle);
1806         /* service change indication all received, do discovery update */
1807         if ( ++ p_srcb->update_count == bta_gattc_num_reg_app()) {
1808             /* not an opened connection; or connection busy */
1809             /* search for first available clcb and start discovery */
1810             if (p_clcb == NULL || (p_clcb && p_clcb->p_q_cmd != NULL)) {
1811                 for (i = 0 ; i < BTA_GATTC_CLCB_MAX; i ++) {
1812                     if (bta_gattc_cb.clcb[i].in_use &&
1813                             bta_gattc_cb.clcb[i].p_srcb == p_srcb &&
1814                             bta_gattc_cb.clcb[i].p_q_cmd == NULL) {
1815                         p_clcb = &bta_gattc_cb.clcb[i];
1816                         break;
1817                     }
1818                 }
1819             }
1820             /* send confirmation here if this is an indication, it should always be */
1821             GATTC_SendHandleValueConfirm(conn_id, att_value->handle);
1822
1823             /* if connection available, refresh cache by doing discovery now */
1824             if (p_clcb != NULL) {
1825                 bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_DISCOVER_EVT, NULL);
1826             }
1827         }
1828         /* notify applicationf or service change */
1829         if (p_clrcb->p_cback != NULL) {
1830             (* p_clrcb->p_cback)(BTA_GATTC_SRVC_CHG_EVT, (tBTA_GATTC *)p_srcb->server_bda);
1831         }
1832
1833     }
1834
1835     return processed;
1836
1837 }
1838 /*******************************************************************************
1839 **
1840 ** Function         bta_gattc_proc_other_indication
1841 **
1842 ** Description      process all non-service change indication/notification.
1843 **
1844 ** Returns          None.
1845 **
1846 *******************************************************************************/
1847 void bta_gattc_proc_other_indication(tBTA_GATTC_CLCB *p_clcb, UINT8 op,
1848                                      tGATT_CL_COMPLETE *p_data,
1849                                      tBTA_GATTC_NOTIFY *p_notify)
1850 {
1851     APPL_TRACE_DEBUG("bta_gattc_proc_other_indication check p_data->att_value.handle=%d p_data->handle=%d",
1852                        p_data->att_value.handle, p_data->handle);
1853     APPL_TRACE_DEBUG("is_notify %d", p_notify->is_notify);
1854
1855     p_notify->is_notify = (op == GATTC_OPTYPE_INDICATION) ? FALSE : TRUE;
1856     p_notify->len = p_data->att_value.len;
1857     bdcpy(p_notify->bda, p_clcb->bda);
1858     memcpy(p_notify->value, p_data->att_value.value, p_data->att_value.len);
1859     p_notify->conn_id = p_clcb->bta_conn_id;
1860
1861     if (p_clcb->p_rcb->p_cback) {
1862         (*p_clcb->p_rcb->p_cback)(BTA_GATTC_NOTIF_EVT,  (tBTA_GATTC *)p_notify);
1863     }
1864
1865 }
1866 /*******************************************************************************
1867 **
1868 ** Function         bta_gattc_process_indicate
1869 **
1870 ** Description      process indication/notification.
1871 **
1872 ** Returns          None.
1873 **
1874 *******************************************************************************/
1875 void bta_gattc_process_indicate(UINT16 conn_id, tGATTC_OPTYPE op, tGATT_CL_COMPLETE *p_data)
1876 {
1877     UINT16              handle = p_data->att_value.handle;
1878     tBTA_GATTC_CLCB     *p_clcb ;
1879     tBTA_GATTC_RCB      *p_clrcb = NULL;
1880     tBTA_GATTC_SERV     *p_srcb = NULL;
1881     tBTA_GATTC_NOTIFY   notify;
1882     BD_ADDR             remote_bda;
1883     tBTA_GATTC_IF       gatt_if;
1884     tBTA_TRANSPORT transport;
1885
1886     if (!GATT_GetConnectionInfor(conn_id, &gatt_if, remote_bda, &transport)) {
1887         APPL_TRACE_ERROR("%s indication/notif for unknown app", __func__);
1888         if (op == GATTC_OPTYPE_INDICATION) {
1889             GATTC_SendHandleValueConfirm(conn_id, handle);
1890         }
1891         return;
1892     }
1893
1894     if ((p_clrcb = bta_gattc_cl_get_regcb(gatt_if)) == NULL) {
1895         APPL_TRACE_ERROR("%s indication/notif for unregistered app", __func__);
1896         if (op == GATTC_OPTYPE_INDICATION) {
1897             GATTC_SendHandleValueConfirm(conn_id, handle);
1898         }
1899         return;
1900     }
1901
1902     if ((p_srcb = bta_gattc_find_srcb(remote_bda)) == NULL) {
1903         APPL_TRACE_ERROR("%s indication/notif for unknown device, ignore", __func__);
1904         if (op == GATTC_OPTYPE_INDICATION) {
1905             GATTC_SendHandleValueConfirm(conn_id, handle);
1906         }
1907         return;
1908     }
1909
1910     p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
1911
1912     notify.handle = handle;
1913     /* if non-service change indication/notification, forward to application */
1914     if (!bta_gattc_process_srvc_chg_ind(conn_id, p_clrcb, p_srcb, p_clcb, &notify, &p_data->att_value)) {
1915         /* if app registered for the notification */
1916         if (bta_gattc_check_notif_registry(p_clrcb, p_srcb, &notify)) {
1917             /* connection not open yet */
1918             if (p_clcb == NULL) {
1919                 p_clcb = bta_gattc_clcb_alloc(gatt_if, remote_bda, transport);
1920
1921                 if (p_clcb == NULL) {
1922                     APPL_TRACE_ERROR("No resources");
1923                     return;
1924                 }
1925
1926                 p_clcb->bta_conn_id = conn_id;
1927                 p_clcb->transport   = transport;
1928
1929                 bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_CONN_EVT, NULL);
1930             }
1931
1932             if (p_clcb != NULL) {
1933                 bta_gattc_proc_other_indication(p_clcb, op, p_data, &notify);
1934             }
1935         } else if (op == GATTC_OPTYPE_INDICATION) {
1936             /* no one intersted and need ack? */
1937             APPL_TRACE_DEBUG("%s no one interested, ack now", __func__);
1938             GATTC_SendHandleValueConfirm(conn_id, handle);
1939         }
1940     }
1941 }
1942 /*******************************************************************************
1943 **
1944 ** Function         bta_gattc_cmpl_cback
1945 **
1946 ** Description      client operation complete callback register with BTE GATT.
1947 **
1948 ** Returns          None.
1949 **
1950 *******************************************************************************/
1951 static void  bta_gattc_cmpl_cback(UINT16 conn_id, tGATTC_OPTYPE op, tGATT_STATUS status,
1952                                   tGATT_CL_COMPLETE *p_data)
1953 {
1954     tBTA_GATTC_CLCB     *p_clcb;
1955     APPL_TRACE_DEBUG("bta_gattc_cmpl_cback: conn_id = %d op = %d status = %d",
1956                      conn_id, op, status);
1957
1958     /* notification and indication processed right away */
1959     if (op == GATTC_OPTYPE_NOTIFICATION || op == GATTC_OPTYPE_INDICATION) {
1960         bta_gattc_process_indicate(conn_id, op, p_data);
1961         return;
1962     }
1963     /* for all other operation, not expected if w/o connection */
1964     else if ((p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id)) == NULL) {
1965         APPL_TRACE_ERROR("bta_gattc_cmpl_cback unknown conn_id =  %d, ignore data", conn_id);
1966         return;
1967     }
1968
1969     /* if over BR_EDR, inform PM for mode change */
1970     if (p_clcb->transport == BTA_TRANSPORT_BR_EDR) {
1971         bta_sys_busy(BTA_ID_GATTC, BTA_ALL_APP_ID, p_clcb->bda);
1972         bta_sys_idle(BTA_ID_GATTC, BTA_ALL_APP_ID, p_clcb->bda);
1973     }
1974
1975     bta_gattc_cmpl_sendmsg(conn_id, op, status, p_data);
1976 }
1977
1978 /*******************************************************************************
1979 **
1980 ** Function         bta_gattc_cmpl_sendmsg
1981 **
1982 ** Description      client operation complete send message
1983 **
1984 ** Returns          None.
1985 **
1986 *******************************************************************************/
1987 static void bta_gattc_cmpl_sendmsg(UINT16 conn_id, tGATTC_OPTYPE op,
1988                                    tBTA_GATT_STATUS status,
1989                                    tGATT_CL_COMPLETE *p_data)
1990 {
1991     const UINT16         len = sizeof(tBTA_GATTC_OP_CMPL) + sizeof(tGATT_CL_COMPLETE);
1992     tBTA_GATTC_OP_CMPL  *p_buf = (tBTA_GATTC_OP_CMPL *) osi_malloc(len);
1993
1994     if (p_buf != NULL) {
1995         memset(p_buf, 0, len);
1996         p_buf->hdr.event = BTA_GATTC_OP_CMPL_EVT;
1997         p_buf->hdr.layer_specific = conn_id;
1998         p_buf->status = status;
1999         p_buf->op_code = op;
2000
2001         if (p_data != NULL) {
2002             p_buf->p_cmpl = (tGATT_CL_COMPLETE *)(p_buf + 1);
2003             memcpy(p_buf->p_cmpl, p_data, sizeof(tGATT_CL_COMPLETE));
2004         }
2005
2006         bta_sys_sendmsg(p_buf);
2007     }
2008 }
2009
2010 /*******************************************************************************
2011 **
2012 ** Function         bta_gattc_cong_cback
2013 **
2014 ** Description      congestion callback for BTA GATT client.
2015 **
2016 ** Returns          void
2017 **
2018 ********************************************************************************/
2019 static void bta_gattc_cong_cback (UINT16 conn_id, BOOLEAN congested)
2020 {
2021     tBTA_GATTC_CLCB *p_clcb;
2022     tBTA_GATTC cb_data;
2023
2024     if ((p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id)) != NULL) {
2025         if (p_clcb->p_rcb->p_cback) {
2026             cb_data.congest.conn_id = conn_id;
2027             cb_data.congest.congested = congested;
2028
2029             (*p_clcb->p_rcb->p_cback)(BTA_GATTC_CONGEST_EVT, &cb_data);
2030         }
2031     }
2032 }
2033
2034 #if BLE_INCLUDED == TRUE
2035 /*******************************************************************************
2036 **
2037 ** Function         bta_gattc_init_clcb_conn
2038 **
2039 ** Description      Initaite a BTA CLCB connection
2040 **
2041 ** Returns          void
2042 **
2043 ********************************************************************************/
2044 void bta_gattc_init_clcb_conn(UINT8 cif, BD_ADDR remote_bda)
2045 {
2046     tBTA_GATTC_CLCB     *p_clcb = NULL;
2047     tBTA_GATTC_DATA     gattc_data;
2048     UINT16              conn_id;
2049
2050     /* should always get the connection ID */
2051     if (GATT_GetConnIdIfConnected(cif, remote_bda, &conn_id, BTA_GATT_TRANSPORT_LE) == FALSE) {
2052         APPL_TRACE_ERROR("bta_gattc_init_clcb_conn ERROR: not a connected device");
2053         return;
2054     }
2055
2056     /* initaite a new connection here */
2057     if ((p_clcb = bta_gattc_clcb_alloc(cif, remote_bda, BTA_GATT_TRANSPORT_LE)) != NULL) {
2058         gattc_data.hdr.layer_specific = p_clcb->bta_conn_id = conn_id;
2059
2060         gattc_data.api_conn.client_if = cif;
2061         memcpy(gattc_data.api_conn.remote_bda, remote_bda, BD_ADDR_LEN);
2062         gattc_data.api_conn.is_direct = TRUE;
2063
2064         bta_gattc_sm_execute(p_clcb, BTA_GATTC_API_OPEN_EVT, &gattc_data);
2065     } else {
2066         APPL_TRACE_ERROR("No resources");
2067     }
2068 }
2069 /*******************************************************************************
2070 **
2071 ** Function         bta_gattc_process_listen_all
2072 **
2073 ** Description      process listen all, send open callback to application for all
2074 **                  connected slave LE link.
2075 **
2076 ** Returns          void
2077 **
2078 ********************************************************************************/
2079 void bta_gattc_process_listen_all(UINT8 cif)
2080 {
2081     UINT8               i_conn = 0;
2082     tBTA_GATTC_CONN     *p_conn = &bta_gattc_cb.conn_track[0];
2083
2084     for (i_conn = 0; i_conn < BTA_GATTC_CONN_MAX; i_conn++, p_conn ++) {
2085         if (p_conn->in_use ) {
2086             if (bta_gattc_find_clcb_by_cif(cif, p_conn->remote_bda, BTA_GATT_TRANSPORT_LE) == NULL) {
2087                 bta_gattc_init_clcb_conn(cif, p_conn->remote_bda);
2088             }
2089             /* else already connected */
2090         }
2091     }
2092 }
2093 /*******************************************************************************
2094 **
2095 ** Function         bta_gattc_listen
2096 **
2097 ** Description      Start or stop a listen for connection
2098 **
2099 ** Returns          void
2100 **
2101 ********************************************************************************/
2102 void bta_gattc_listen(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg)
2103 {
2104     tBTA_GATTC_RCB      *p_clreg = bta_gattc_cl_get_regcb(p_msg->api_listen.client_if);
2105     tBTA_GATTC          cb_data;
2106     UNUSED(p_cb);
2107
2108     cb_data.reg_oper.status = BTA_GATT_ERROR;
2109     cb_data.reg_oper.client_if = p_msg->api_listen.client_if;
2110
2111     if (p_clreg == NULL) {
2112         APPL_TRACE_ERROR("bta_gattc_listen failed, unknown client_if: %d",
2113                          p_msg->api_listen.client_if);
2114         return;
2115     }
2116     /* mark bg conn record */
2117     if (bta_gattc_mark_bg_conn(p_msg->api_listen.client_if,
2118                                (BD_ADDR_PTR) p_msg->api_listen.remote_bda,
2119                                p_msg->api_listen.start,
2120                                TRUE)) {
2121         if (!GATT_Listen(p_msg->api_listen.client_if,
2122                          p_msg->api_listen.start,
2123                          p_msg->api_listen.remote_bda)) {
2124             APPL_TRACE_ERROR("Listen failure");
2125             (*p_clreg->p_cback)(BTA_GATTC_LISTEN_EVT, &cb_data);
2126         } else {
2127             cb_data.status = BTA_GATT_OK;
2128
2129             (*p_clreg->p_cback)(BTA_GATTC_LISTEN_EVT, &cb_data);
2130
2131             if (p_msg->api_listen.start) {
2132                 /* if listen to a specific target */
2133                 if (p_msg->api_listen.remote_bda != NULL) {
2134
2135                     /* if is a connected remote device */
2136                     if (L2CA_GetBleConnRole(p_msg->api_listen.remote_bda) == HCI_ROLE_SLAVE &&
2137                             bta_gattc_find_clcb_by_cif(p_msg->api_listen.client_if,
2138                                                        p_msg->api_listen.remote_bda,
2139                                                        BTA_GATT_TRANSPORT_LE) == NULL) {
2140
2141                         bta_gattc_init_clcb_conn(p_msg->api_listen.client_if,
2142                                                  p_msg->api_listen.remote_bda);
2143                     }
2144                 }
2145                 /* if listen to all */
2146                 else {
2147                     LOG_DEBUG("Listen For All now");
2148                     /* go through all connected device and send
2149                     callback for all connected slave connection */
2150                     bta_gattc_process_listen_all(p_msg->api_listen.client_if);
2151                 }
2152             }
2153         }
2154     }
2155 }
2156
2157 /*******************************************************************************
2158 **
2159 ** Function         bta_gattc_broadcast
2160 **
2161 ** Description      Start or stop broadcasting
2162 **
2163 ** Returns          void
2164 **
2165 ********************************************************************************/
2166 void bta_gattc_broadcast(tBTA_GATTC_CB *p_cb, tBTA_GATTC_DATA *p_msg)
2167 {
2168     tBTA_GATTC_RCB      *p_clreg = bta_gattc_cl_get_regcb(p_msg->api_listen.client_if);
2169     tBTA_GATTC          cb_data;
2170     UNUSED(p_cb);
2171
2172     cb_data.reg_oper.client_if = p_msg->api_listen.client_if;
2173     cb_data.reg_oper.status = BTM_BleBroadcast(p_msg->api_listen.start, NULL);
2174     //TODO need modify callback if used
2175     if (p_clreg && p_clreg->p_cback) {
2176         (*p_clreg->p_cback)(BTA_GATTC_LISTEN_EVT, &cb_data);
2177     }
2178 }
2179
2180 /*******************************************************************************
2181 **
2182 ** Function         bta_gattc_start_service_change_ccc_timer
2183 **
2184 ** Description      start a timer to wait for service change ccc discovered
2185 **
2186 ** Returns          void
2187 **
2188 *******************************************************************************/
2189 void bta_gattc_start_service_change_ccc_timer(UINT16 conn_id, BD_ADDR bda,UINT32 timeout_ms,
2190                                               UINT8 timer_cnt, UINT8 last_status, TIMER_LIST_ENT *ccc_timer)
2191 {
2192     tBTA_GATTC_WAIT_CCC_TIMER *p_timer_param = (tBTA_GATTC_WAIT_CCC_TIMER*) osi_malloc(sizeof(tBTA_GATTC_WAIT_CCC_TIMER));
2193     if (p_timer_param != NULL) {
2194         p_timer_param->conn_id = conn_id;
2195         memcpy(p_timer_param->remote_bda, bda, sizeof(BD_ADDR));
2196         p_timer_param->count = timer_cnt;
2197         p_timer_param->last_status = last_status;
2198         ccc_timer->param = (UINT32)p_timer_param;
2199         ccc_timer->p_cback = (TIMER_CBACK *)&bta_gattc_wait4_service_change_ccc_cback;
2200         bta_sys_start_timer(ccc_timer, 0, timeout_ms);
2201     }
2202     else {
2203         APPL_TRACE_ERROR("%s, allocate p_timer_param failed\n", __func__);
2204     }
2205 }
2206
2207 /*******************************************************************************
2208 **
2209 ** Function         bta_gattc_register_service_change_notify
2210 **
2211 ** Description      Find remote device's gatt service change characteristic ccc's handle and write 2 to this
2212 **                  this ccc. If not found, start a timer to wait for service discovery finished.
2213 **
2214 ** Returns          Return result of service change ccc service discovery result result and written operate result
2215 **
2216 *******************************************************************************/
2217 tBTA_GATTC_FIND_SERVICE_CB bta_gattc_register_service_change_notify(UINT16 conn_id, BD_ADDR remote_bda, BOOLEAN *need_timer)
2218 {
2219     tBTA_GATTC_SERV     *p_srcb = NULL;
2220     list_t              *p_cache = NULL;
2221     tBTA_GATTC_SERVICE *p_service = NULL;
2222     tBTA_GATTC_CHARACTERISTIC *p_char = NULL;
2223     tBTA_GATTC_DESCRIPTOR *p_desc = NULL;
2224     tGATT_STATUS        write_status;
2225     tGATT_VALUE         ccc_value;
2226     tBTA_GATTC_FIND_SERVICE_CB    result;
2227     BOOLEAN             gatt_cache_found = FALSE;
2228     BOOLEAN             gatt_service_found = FALSE;
2229     BOOLEAN             gatt_service_change_found = FALSE;
2230     BOOLEAN             gatt_ccc_found = FALSE;
2231     BOOLEAN             start_find_ccc_timer = FALSE;
2232
2233     tBT_UUID gatt_service_uuid = {LEN_UUID_16, {UUID_SERVCLASS_GATT_SERVER}};
2234     tBT_UUID gatt_service_change_uuid = {LEN_UUID_16, {GATT_UUID_GATT_SRV_CHGD}};
2235     tBT_UUID gatt_ccc_uuid = {LEN_UUID_16, {GATT_UUID_CHAR_CLIENT_CONFIG}};
2236
2237     p_srcb = bta_gattc_find_srcb(remote_bda);
2238     if ((p_srcb != NULL) && (p_srcb->p_srvc_cache != NULL)) {
2239         p_cache = p_srcb->p_srvc_cache;
2240         gatt_cache_found = TRUE;
2241     }
2242     else {
2243         start_find_ccc_timer = TRUE;
2244         result = SERVICE_CHANGE_CACHE_NOT_FOUND;
2245     }
2246     /* start to find gatt service */
2247     if (gatt_cache_found == TRUE) {
2248         for (list_node_t *sn = list_begin(p_cache);
2249              sn != list_end(p_cache); sn = list_next(sn)) {
2250             p_service = list_node(sn);
2251             if (bta_gattc_uuid_compare(&gatt_service_uuid, &p_service->uuid, TRUE)) {
2252                 gatt_service_found = TRUE;
2253                 break;
2254             }
2255         }
2256     }
2257     else {
2258         start_find_ccc_timer = TRUE;
2259         result = SERVICE_CHANGE_CACHE_NOT_FOUND;
2260     }
2261
2262     /* start to find gatt service change characteristic */
2263     if (gatt_service_found == TRUE) {
2264         if (p_service->characteristics) {
2265             for (list_node_t *cn = list_begin(p_service->characteristics);
2266                  cn != list_end(p_service->characteristics); cn = list_next(cn)) {
2267                 p_char = list_node(cn);
2268                 if (bta_gattc_uuid_compare(&gatt_service_change_uuid, &p_char->uuid, TRUE)) {
2269                     gatt_service_change_found = TRUE;
2270                     break;
2271                 }
2272             }
2273         }
2274     }
2275     else if (gatt_cache_found == TRUE) {
2276         /* Gatt service not found, start a timer to wait for service discovery */
2277         start_find_ccc_timer = TRUE;
2278         result = SERVICE_CHANGE_SERVICE_NOT_FOUND;
2279     }
2280     /* start to find gatt service change characteristic ccc */
2281     if (gatt_service_change_found == TRUE) {
2282         if (p_char->descriptors) {
2283             for (list_node_t *dn = list_begin(p_char->descriptors);
2284                  dn != list_end(p_char->descriptors); dn = list_next(dn)) {
2285                 p_desc = list_node(dn);
2286                 if (bta_gattc_uuid_compare(&gatt_ccc_uuid, &p_desc->uuid, TRUE)) {
2287                     gatt_ccc_found = TRUE;
2288                     break;
2289                 }
2290             }
2291         }
2292     }
2293     else if (gatt_service_found ==TRUE) {
2294         /* Gatt service found, but service change char not found,
2295          * Case1: remote device doesn't have service change char, we don't need to start a timer here to
2296          * wait for service discovery
2297          * Case2: remote device exist service change char, we have found gatt service, but have not found
2298          * service change char, we need to start a timer here*/
2299         start_find_ccc_timer = TRUE;
2300         result = SERVICE_CHANGE_CHAR_NOT_FOUND;
2301     }
2302
2303     if (gatt_ccc_found == TRUE){
2304         ccc_value.handle = p_desc->handle;
2305         ccc_value.len = 2;
2306         ccc_value.value[0] = GATT_CLT_CONFIG_INDICATION;
2307         ccc_value.auth_req = GATT_AUTH_REQ_NONE;
2308         if (gatt_is_clcb_allocated(conn_id)) {
2309             APPL_TRACE_DEBUG("%s, GATTC_Write GATT_BUSY conn_id = %d", __func__, conn_id);
2310             write_status = GATT_BUSY;
2311         } else {
2312             write_status = GATTC_Write (conn_id, GATT_WRITE, &ccc_value);
2313         }
2314         if (write_status != GATT_SUCCESS) {
2315             start_find_ccc_timer = TRUE;
2316             result = SERVICE_CHANGE_WRITE_CCC_FAILED;
2317         }
2318         else {
2319             start_find_ccc_timer = FALSE;
2320             result = SERVICE_CHANGE_CCC_WRITTEN_SUCCESS;
2321         }
2322     }
2323     else if (gatt_service_change_found == TRUE) {
2324         /* Gatt service char found, but service change char ccc not found,
2325          * Case1: remote device doesn't have service change char ccc, we don't need to start a timer here to
2326          * wait for service discovery
2327          * Case2: remote device exist service change char ccc, we have found gatt service change char, but have not found
2328          * service change char ccc, we need to start a timer here */
2329         start_find_ccc_timer = TRUE;
2330         result = SERVICE_CHANGE_CCC_NOT_FOUND;
2331     }
2332
2333     if (need_timer != NULL) {
2334         *need_timer = start_find_ccc_timer;
2335     }
2336
2337     return result;
2338 }
2339
2340 /*******************************************************************************
2341 **
2342 ** Function         bta_gattc_wait4_service_change_ccc_cback
2343 **
2344 ** Description      callback function of service_change_ccc_timer
2345 **
2346 ** Returns          None
2347 **
2348 *******************************************************************************/
2349 static void bta_gattc_wait4_service_change_ccc_cback (TIMER_LIST_ENT *p_tle)
2350 {
2351     tBTA_GATTC_FIND_SERVICE_CB result;
2352     BOOLEAN start_ccc_timer = FALSE;
2353     UINT32 new_timeout;
2354
2355     assert(bta_gattc_cb.write_ccc_mutex != NULL);
2356     osi_mutex_lock(&bta_gattc_cb.write_ccc_mutex, OSI_MUTEX_MAX_TIMEOUT);
2357
2358     tBTA_GATTC_WAIT_CCC_TIMER *p_timer_param = (tBTA_GATTC_WAIT_CCC_TIMER*) p_tle->param;
2359     p_tle->param = (TIMER_PARAM_TYPE)0;
2360     if (p_timer_param == NULL){
2361         APPL_TRACE_ERROR("p_timer_param is NULL in %s\n", __func__);
2362         osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
2363         return;
2364     }
2365
2366     tBTA_GATTC_CONN *p_conn = bta_gattc_conn_find(p_timer_param->remote_bda);
2367     if (p_conn == NULL){
2368         APPL_TRACE_ERROR("p_conn is NULL in %s\n", __func__);
2369         osi_free(p_timer_param);
2370         osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
2371         return;
2372     }
2373
2374     result = bta_gattc_register_service_change_notify(p_timer_param->conn_id, p_timer_param->remote_bda, &start_ccc_timer);
2375     /* If return SERVICE_CHANGE_CHAR_NOT_FOUND or SERVICE_CHANGE_CCC_NOT_FOUND twice, means remote device doesn't have
2376      * service change char or ccc, stop timer */
2377     if ((result == p_timer_param->last_status) \
2378             && ((result == SERVICE_CHANGE_CHAR_NOT_FOUND) || (result == SERVICE_CHANGE_CCC_NOT_FOUND))){
2379         start_ccc_timer = FALSE;
2380     }
2381
2382     if ((start_ccc_timer == TRUE) && (p_timer_param->count < 10)){
2383         TIMER_LIST_ENT *ccc_timer = &(p_conn->service_change_ccc_timer);
2384         if (result == SERVICE_CHANGE_WRITE_CCC_FAILED){
2385             /* retry to write service change ccc, needn't to add counter */
2386             new_timeout = 200;
2387         }
2388         else {
2389             /* retry to find service change ccc */
2390             new_timeout = 1000;
2391             p_timer_param->count ++;
2392         }
2393         bta_gattc_start_service_change_ccc_timer(p_timer_param->conn_id, p_timer_param->remote_bda, \
2394                                                  new_timeout, p_timer_param->count, result, ccc_timer);
2395     }
2396     else {
2397         p_conn->ccc_timer_used = FALSE;
2398         p_conn->service_change_ccc_written = TRUE;
2399     }
2400
2401     osi_free(p_timer_param);
2402     osi_mutex_unlock(&bta_gattc_cb.write_ccc_mutex);
2403 }
2404
2405 #endif
2406 #endif  ///GATTC_INCLUDED == TRUE && BLE_INCLUDED == TRUE