In the file gatt.c, GAP service contains the Device Name
characteristic. If writable, authentication and authorization may
be defined by a higher layer specification.It means that GATT
clients can write to device name GAP characteristic without
bonding. So we add a configuration for writable name without
bonding.
Signed-off-by: Jun Huang <huangjun6@xiaomi.com>
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
Fix array overrun of client features bitset, where CF_BYTE_LAST was
incorrectly defined as 2 using module instead of divide.
Also fix additional bit-logic when number of bits would exceed a byte:
- Inner for loop iterates from 0 to number of bits on a single byte.
- Same bitmask used for all bytes.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
Fix endianness issue in reading CPF descriptor not converting from
native endianess to little-endian on the 'unit' and 'description'
fields.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
Use the definitions of UUID values instead of magic constants with
explanation in comment.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
The ATT request buffers are held until the ATT response has been
received. This means that the ATT request buffers are released by the
RX thread, instead of the from the RX priority context of
num_complete.
This can cause a deadlock in the RX thread when we allocate buffers
and all the available buffers are ATT requests, since the RX thread is
the only thread that can release buffers.
Release the ATT request buffers once they have been sent and instead
handle ATT request resending by reconstructing the buffer from the
GATT parameters.
Also re-order the order of resource allocation by allocating the
request context before the buffer. This ensures that we cannot
allocate more buffers for ATT requests than there are ATT requests.
Fixed a buf reference leak that could occur when the ATT request buffer
has been allocated, but GATT returns an error before handing the
responsebility of the buffer to ATT, for example when bt_att_req_alloc
fails.
This is fixed by moving the functionality of att_req_destroy to
bt_att_req_free.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
Remove the ATT request destroy callback which is never assigned
by any of the ATT requests.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
Fix indicate without func not working properly, when sent as a
non-req by GATT this has two propblems:
- The indicate would not be treated as a transaction, and back
to back indicate would be sent without waiting for the confirm
- The destroy callback would not be called on the indicate parameters
since the indicate_rsp callback would not be called.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
When using BT_GATT_AUTO_DISCOVER_CCC if the ccc_handle is not set
bt_gatt_subscribe would initiate a discovery to locate the CCC handle
but instead of awaiting it to complete the code does proceed to call
gatt_write_ccc even with ccc_handle being 0x0000 which is invalid.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Adds a `destroy` callback to the `struct bt_gatt_indicate_params` which
is used to signify to the application that the indication operation has
completed and the struct instance can be freed/destroyed.
This is required as the number of indication value callbacks that will
be triggered is not known by the caller when the `conn` parameter is
`NULL`.
Tracking when this callback should be run is mananged by a private
reference counter inside the struct.
Signed-off-by: Jordan Yates <jordan.yates@data61.csiro.au>
Update the signature of the `bt_gatt_indicate_func_t` callback type by
replacing the attr pointer with a pointer to the
`bt_gatt_indicate_params` struct that was used to start the indication.
This allows the callback to free the `bt_gatt_indicate_params` instance
if it was allocated from storage, while still allowing the
`bt_gatt_attr` value to be accessed through `params->attr`.
Allocating the `bt_gatt_indicate_params` instance from storage is
desirable as multiple indications can be queued, however each instance
must be valid until the callback is run.
Implements API update from #29357
Signed-off-by: Jordan Yates <jordan.yates@data61.csiro.au>
This prevents any work to be submitted until the stack is initialized
thus avoiding pointless hash generation, etc, while initializing the
system.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Be consistent in the permission handling of the discovered attribute
in the temporary object given in the discovery callback.
For characteristics the permission field was set to READ, while for
all other attributes it was set to 0.
Fixes: #29083
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
Update check in the bt_gatt_attr_value_handle API function to use the
UUID of the function, in case the attribute has been declared with a
different read handler, or the attribute is a temporary object
where the read attribute has not been set.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
Refactor use of 16-bit common GATT UUID types where a complete UUID
object is declared on the stack only to use the 16-bit value.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
Don't use the ATT structs that has contains only a flexible array
member. This is not supported by C99 standard, only through GNU C
extension with zero length array.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
Accourding to the spec the CCC descriptor may occur in any position
within the characteristic definition after the Characteristic Value.
Fixes#28324
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This introduces bt_gatt_attr_get_handle which can be used to resolve
handles of static attributes.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Make it actually give the original pointer to the attribute and its
resolved handle so static attributes don't need an extra lookup.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This optimizes the lookups to skip ahead when attribute pointer is not
located within service array.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Allow the application to add subscription without resubscribing.
This is needed for persistent bonds that can go to deep sleep and
turn of the RAM or power-cycle.
In this case the application as a GATT client must have a way to add
the subscription callbacks back to the stack before the GATT server
sends notifications.
This should preferable be able to be done before even connecting
since the notifications can arrive immediately after connecting to
the peer.
The stack cannot persist this on it's own since it must remember the
function pointers for the callback functions. Storing these in
persistent storage would not be compatible with a Device Firmware
Upgrade (DFU) solution.
Fixes: #21798
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
Refactor the gatt_sub_add function to be similar in structure to how
find_cf_cfg is implemented. This is so that a subscription can be added
without an active connection.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
When lazy loading of CCCs are enabled there is no settings set handler
register for the 'bt/ccc' key, this means that the settings set handler
for 'bt' key is called instead. This handler does not know what to do
for the 'ccc' subkey, and returns -ENOENT for the entry.
This results in an error message logged by the settings subsystem.
"E: set-value failure. key: bt/ccc/f8c39e2f98210 error(-2)"
Fix this by providing an empty handler for the 'bt/ccc' key when
Lazy Loading feature is enabled.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
Added a callback that lets an application get write error
(if any) when subscribing to a gatt characteristic.
Signed-off-by: Emil Gydesen <emil_gydesen@bose.com>
Mark the ram version of the ccc_cfg as free after ccc has been
stored when a bonded device disconnects.
If the device use lazy loading of settings then ccc_cfg was not
cleaned up properly when a bonded device disconnects. This
resulted in the ccc system ran out of ccc_cfg resources after
having disconnected CONFIG_BT_MAX_CONN times.
Signed-off-by: Kim Sekkelund <ksek@oticon.com>
Step1: Move bt_gatt_disconnected() to avoid forward declarations which
otherwise would be needed by a fix to lazy loading cleanup on
disconnect in step 2.
Signed-off-by: Kim Sekkelund <ksek@oticon.com>
-Wimplicit-fallthrough=2 requires a fallthrough comment or a compiler
to tells gcc that this happens intentionally.
Signed-off-by: Flavio Ceolin <flavio.ceolin@intel.com>
Fix issue with bt_gatt_service_unregister not clearing CCC information.
If the service is unregistered while an unbonded peer is connected and
subscribed then this CCC would be restored again when registering the
service even if the peer is now disconnected.
If the service is unregistered with bonded peers CCCs stored in settings
then this value would never be cleared. If the service is registered
again then the peer would receive a service changed for this service,
but it's CCC value would still be enabled.
Fixes: #26924
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
Extract enqueue of GATT CCC when CONFIG_BT_SETTINGS_CCC_STORE_ON_WRITE
is enabled to a helper function gatt_ccc_conn_enqueue so that it can be
reused.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
Move the clear_ccc_cfg function further up to be re-used without a
forward declaration in bt_gatt_service_unregister.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
When using CONFIG_BT_CONN_DISABLE_SECURITY bt_gatt_check_perm would
ignore not only the security sensitive permissions but also access
related ones causing crashes since the callback would be NULL.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This adds CONFIG_BT_CONN_DISABLE_SECURITY which can be used to disable
security checks for incoming requests enabling to test accessing GATT
attributes and L2CAP channels that would otherwise require
encryption/authentication in order to be accessed.
It depends on BT_TESTING to indicate to the users that this is a
testing feature which shall not be used in production.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Added a feature that allows an application to request
automatic discovery of the CCCD handle when subscriping
to a characteristic. In order to preserver RAM, the application
is expected to provide the discovery parameters, and it's up
to the application whether or not it wants to reuse the
discovery parameters or use one for each characteristic.
Signed-off-by: Emil Gydesen <emil_gydesen@bose.com>
Change fixes storing subscriptions in settings. CCC write can interrupt
the ccc_delayed_store. Without the change, new CCC was not stored in
non-volatile memory and the work that stored CCC was not resubmitted.
That resulted in lost subscription after reboot.
Fixes: #26862
Signed-off-by: Marek Pieta <Marek.Pieta@nordicsemi.no>
When CONFIG_BT_GATT_NOTIFY_MULTIPLE is selected and the remote has
enabled support for using its procedure data can sometimes not fit
into the buffer since the multiple variant has a bigger header, so
instead of failing immediatelly this attempts to send the data using
the legacy PDU instead so those using bt_gatt_get_mtu - 3 can still be
sent.
Fixes#26106
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commits fixes the loading of bt/cf settings into memory. Only data
was loaded and not the address.
Signed-off-by: François Delawarde <fnde@demant.com>
Fix Service Changed configuration stored in flash not deleted in flash
when calling bt_gatt_clear from bt_unpair.
When clearing the check for "is bonded" should not be made. If the
bond information is already removed this check will fail.
When clearing the check for "modified" should not be made, clearing
is in itself a modification, and should always be made.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
This adds support for ATT_MULTIPLE_HANDLE_VALUE_NTF,
ATT_READ_MULTIPLE_VARIABLE_REQ and ATT_READ_MULTIPLE_VARIABLE_RSP.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This adds support for EATT bearer which was introduced in 5.2, they work
as extra channels to have GATT traffic, at the moment it is completely
transparent to application when they are in use since the allocation
happens automatically.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Most places used an int so that should have handled most cases but
keys_set was using an unsigned int, which meant that checking len > 0
is an expression that is always false, and the error handling is not
working.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
Fixes#23485
When we create a GATT table dynamically, we also create a hash
identifying this table. This hash can be stored in persistent memory and
we can thus determine after recreating the GATT table whether the
services have changed or not from before the reboot.
When these hashes are identical, it implies that the table has not
changed, wherefore a service changed indication should not be sent to
any bonded clients. The method for achieving this was to remove the
gatt_sc.work entry from the work queue. This work queue entry was to
send an indication to the clients when the table had been allocated.
If the final entry then caused the hashes to match, the indication
would be cancelled.
On unit testing this behaviour in simulation and in practice, we found
that the indication was sent nonetheless, and the issue was located to
be tied to the SERVICE_RANGE_CHANGED flag which is set when the services
are changed and is cleared when the indications are being sent out.
It was the job of the work queue entry to clear this flag, and as the
entry was never serviced, the flag was never cleared, and when
sc_commit() is called at the end of the process, it believes that there
is a new service change pending and therefore starts the job over, thus
creating a redundant indication to the clients.
This commit fixes the issue by clearing the flag when the work entry
is removed due to a hash match. This has been unittested in a live
environment, in a simulation environment, and sanitycheck has been run
on it.
Signed-off-by: Dan Erichsen <daee@demant.com>
If the client is change-unware and disconnects the spec requires that
the stack still sends the error out of sync for the next request:
'The ATT_ERROR_RSP PDU is sent only once after the client becomes
change-unaware, unless the client _disconnects_ or the database changes
again before the client becomes change-aware in which case the
ATT_ERROR_RSP PDU shall be sent again'
Fixes#23110
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Fix issue where a new connection with the same peer would use the CCC
from from first connection, despite different local identity.
Since there is no CCC for the new connection yet this caused the
application to think that CCC was enabled but the remote device had not
yet subscribed.
Fix this issue by making the id as an input to the peer address check
function. This will force us to make the check every time. This commit
might also fix similar issues not yes discovered as the ID check was
missing in a few other places as well.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
Fix issue where an invalid (all zeroes) hash was written to settings
storage on reset. This caused the old value to written to zeroes, before
being written back to it's original value again immediately after.
This causes excessive flash wear.
This happens because the check if (k_delayed_work_remaining) returns the
amount of time until the work will execute. When that time has run out
the time is zero, but the work has not yet been executed.
We then write the invalid hash to flash, and then once the work-item
executes it will write the correct value.
Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
SC config data is no longer stored within the CCC config itself
therefore it must be cleared separately.
Fixes#22539
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
