xref: /btstack/src/ble/gatt_client.c (revision 7d2c9f1338264c647180e0f28fb11a9a1909d3c4)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #include <stdint.h>
39 #include <stdio.h>
40 #include <stdlib.h>
41 #include <string.h>
42 
43 #include "btstack_config.h"
44 
45 #include "att_dispatch.h"
46 #include "ble/ad_parser.h"
47 #include "ble/att_db.h"
48 #include "ble/core.h"
49 #include "ble/gatt_client.h"
50 #include "ble/le_device_db.h"
51 #include "ble/sm.h"
52 #include "btstack_debug.h"
53 #include "btstack_event.h"
54 #include "btstack_memory.h"
55 #include "btstack_run_loop.h"
56 #include "btstack_util.h"
57 #include "classic/sdp_util.h"
58 #include "hci.h"
59 #include "hci_cmd.h"
60 #include "hci_dump.h"
61 #include "l2cap.h"
62 
63 static btstack_linked_list_t gatt_client_connections;
64 static btstack_linked_list_t gatt_client_value_listeners;
65 static btstack_packet_callback_registration_t hci_event_callback_registration;
66 static uint8_t  pts_suppress_mtu_exchange;
67 
68 static void gatt_client_att_packet_handler(uint8_t packet_type, uint16_t handle, uint8_t *packet, uint16_t size);
69 static void gatt_client_hci_event_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size);
70 static void gatt_client_report_error_if_pending(gatt_client_t *peripheral, uint8_t error_code);
71 static void att_signed_write_handle_cmac_result(uint8_t hash[8]);
72 
73 static uint16_t peripheral_mtu(gatt_client_t *peripheral){
74     if (peripheral->mtu > l2cap_max_le_mtu()){
75         log_error("Peripheral mtu is not initialized");
76         return l2cap_max_le_mtu();
77     }
78     return peripheral->mtu;
79 }
80 
81 void gatt_client_init(void){
82     gatt_client_connections = NULL;
83     pts_suppress_mtu_exchange = 0;
84 
85     // regsister for HCI Events
86     hci_event_callback_registration.callback = &gatt_client_hci_event_packet_handler;
87     hci_add_event_handler(&hci_event_callback_registration);
88 
89     // and ATT Client PDUs
90     att_dispatch_register_client(gatt_client_att_packet_handler);
91 }
92 
93 static gatt_client_t * gatt_client_for_timer(btstack_timer_source_t * ts){
94     btstack_linked_list_iterator_t it;
95     btstack_linked_list_iterator_init(&it, &gatt_client_connections);
96     while (btstack_linked_list_iterator_has_next(&it)){
97         gatt_client_t * peripheral = (gatt_client_t *) btstack_linked_list_iterator_next(&it);
98         if ( &peripheral->gc_timeout == ts) {
99             return peripheral;
100         }
101     }
102     return NULL;
103 }
104 
105 static void gatt_client_timeout_handler(btstack_timer_source_t * timer){
106     gatt_client_t * peripheral = gatt_client_for_timer(timer);
107     if (!peripheral) return;
108     log_info("GATT client timeout handle, handle 0x%02x", peripheral->con_handle);
109     gatt_client_report_error_if_pending(peripheral, ATT_ERROR_TIMEOUT);
110 }
111 
112 static void gatt_client_timeout_start(gatt_client_t * peripheral){
113     log_info("GATT client timeout start, handle 0x%02x", peripheral->con_handle);
114     btstack_run_loop_remove_timer(&peripheral->gc_timeout);
115     btstack_run_loop_set_timer_handler(&peripheral->gc_timeout, gatt_client_timeout_handler);
116     btstack_run_loop_set_timer(&peripheral->gc_timeout, 30000); // 30 seconds sm timeout
117     btstack_run_loop_add_timer(&peripheral->gc_timeout);
118 }
119 
120 static void gatt_client_timeout_stop(gatt_client_t * peripheral){
121     log_info("GATT client timeout stop, handle 0x%02x", peripheral->con_handle);
122     btstack_run_loop_remove_timer(&peripheral->gc_timeout);
123 }
124 
125 static gatt_client_t * get_gatt_client_context_for_handle(uint16_t handle){
126     btstack_linked_item_t *it;
127     for (it = (btstack_linked_item_t *) gatt_client_connections; it ; it = it->next){
128         gatt_client_t * peripheral = (gatt_client_t *) it;
129         if (peripheral->con_handle == handle){
130             return peripheral;
131         }
132     }
133     return NULL;
134 }
135 
136 
137 // @returns context
138 // returns existing one, or tries to setup new one
139 static gatt_client_t * provide_context_for_conn_handle(hci_con_handle_t con_handle){
140     gatt_client_t * context = get_gatt_client_context_for_handle(con_handle);
141     if (context) return  context;
142 
143     context = btstack_memory_gatt_client_get();
144     if (!context) return NULL;
145     // init state
146     memset(context, 0, sizeof(gatt_client_t));
147     context->con_handle = con_handle;
148     context->mtu = ATT_DEFAULT_MTU;
149     context->mtu_state = SEND_MTU_EXCHANGE;
150     context->gatt_client_state = P_READY;
151     btstack_linked_list_add(&gatt_client_connections, (btstack_linked_item_t*)context);
152 
153     // skip mtu exchange for testing sm with pts
154     if (pts_suppress_mtu_exchange){
155          context->mtu_state = MTU_EXCHANGED;
156     }
157     return context;
158 }
159 
160 static gatt_client_t * provide_context_for_conn_handle_and_start_timer(hci_con_handle_t con_handle){
161     gatt_client_t * context = provide_context_for_conn_handle(con_handle);
162     if (!context) return NULL;
163     gatt_client_timeout_start(context);
164     return context;
165 }
166 
167 static int is_ready(gatt_client_t * context){
168     return context->gatt_client_state == P_READY;
169 }
170 
171 int gatt_client_is_ready(hci_con_handle_t con_handle){
172     gatt_client_t * context = provide_context_for_conn_handle(con_handle);
173     if (!context) return 0;
174     return is_ready(context);
175 }
176 
177 uint8_t gatt_client_get_mtu(hci_con_handle_t con_handle, uint16_t * mtu){
178     gatt_client_t * context = provide_context_for_conn_handle(con_handle);
179     if (context && context->mtu_state == MTU_EXCHANGED){
180         *mtu = context->mtu;
181         return 0;
182     }
183     *mtu = ATT_DEFAULT_MTU;
184     return GATT_CLIENT_IN_WRONG_STATE;
185 }
186 
187 // precondition: can_send_packet_now == TRUE
188 static void att_confirmation(uint16_t peripheral_handle){
189     l2cap_reserve_packet_buffer();
190     uint8_t * request = l2cap_get_outgoing_buffer();
191     request[0] = ATT_HANDLE_VALUE_CONFIRMATION;
192     l2cap_send_prepared_connectionless(peripheral_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 1);
193 }
194 
195 // precondition: can_send_packet_now == TRUE
196 static void att_find_information_request(uint16_t request_type, uint16_t peripheral_handle, uint16_t start_handle, uint16_t end_handle){
197     l2cap_reserve_packet_buffer();
198     uint8_t * request = l2cap_get_outgoing_buffer();
199     request[0] = request_type;
200     little_endian_store_16(request, 1, start_handle);
201     little_endian_store_16(request, 3, end_handle);
202 
203     l2cap_send_prepared_connectionless(peripheral_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 5);
204 }
205 
206 // precondition: can_send_packet_now == TRUE
207 static void att_find_by_type_value_request(uint16_t request_type, uint16_t attribute_group_type, uint16_t peripheral_handle, uint16_t start_handle, uint16_t end_handle, uint8_t * value, uint16_t value_size){
208     l2cap_reserve_packet_buffer();
209     uint8_t * request = l2cap_get_outgoing_buffer();
210 
211     request[0] = request_type;
212     little_endian_store_16(request, 1, start_handle);
213     little_endian_store_16(request, 3, end_handle);
214     little_endian_store_16(request, 5, attribute_group_type);
215     memcpy(&request[7], value, value_size);
216 
217     l2cap_send_prepared_connectionless(peripheral_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 7+value_size);
218 }
219 
220 // precondition: can_send_packet_now == TRUE
221 static void att_read_by_type_or_group_request_for_uuid16(uint16_t request_type, uint16_t uuid16, uint16_t peripheral_handle, uint16_t start_handle, uint16_t end_handle){
222     l2cap_reserve_packet_buffer();
223     uint8_t * request = l2cap_get_outgoing_buffer();
224     request[0] = request_type;
225     little_endian_store_16(request, 1, start_handle);
226     little_endian_store_16(request, 3, end_handle);
227     little_endian_store_16(request, 5, uuid16);
228 
229     l2cap_send_prepared_connectionless(peripheral_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 7);
230 }
231 
232 // precondition: can_send_packet_now == TRUE
233 static void att_read_by_type_or_group_request_for_uuid128(uint16_t request_type, uint8_t * uuid128, uint16_t peripheral_handle, uint16_t start_handle, uint16_t end_handle){
234     l2cap_reserve_packet_buffer();
235     uint8_t * request = l2cap_get_outgoing_buffer();
236     request[0] = request_type;
237     little_endian_store_16(request, 1, start_handle);
238     little_endian_store_16(request, 3, end_handle);
239     reverse_128(uuid128, &request[5]);
240 
241     l2cap_send_prepared_connectionless(peripheral_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 21);
242 }
243 
244 // precondition: can_send_packet_now == TRUE
245 static void att_read_request(uint16_t request_type, uint16_t peripheral_handle, uint16_t attribute_handle){
246     l2cap_reserve_packet_buffer();
247     uint8_t * request = l2cap_get_outgoing_buffer();
248     request[0] = request_type;
249     little_endian_store_16(request, 1, attribute_handle);
250 
251     l2cap_send_prepared_connectionless(peripheral_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 3);
252 }
253 
254 // precondition: can_send_packet_now == TRUE
255 static void att_read_blob_request(uint16_t request_type, uint16_t peripheral_handle, uint16_t attribute_handle, uint16_t value_offset){
256     l2cap_reserve_packet_buffer();
257     uint8_t * request = l2cap_get_outgoing_buffer();
258     request[0] = request_type;
259     little_endian_store_16(request, 1, attribute_handle);
260     little_endian_store_16(request, 3, value_offset);
261 
262     l2cap_send_prepared_connectionless(peripheral_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 5);
263 }
264 
265 static void att_read_multiple_request(uint16_t peripheral_handle, uint16_t num_value_handles, uint16_t * value_handles){
266     l2cap_reserve_packet_buffer();
267     uint8_t * request = l2cap_get_outgoing_buffer();
268     request[0] = ATT_READ_MULTIPLE_REQUEST;
269     int i;
270     int offset = 1;
271     for (i=0;i<num_value_handles;i++){
272         little_endian_store_16(request, offset, value_handles[i]);
273         offset += 2;
274     }
275     l2cap_send_prepared_connectionless(peripheral_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, offset);
276 }
277 
278 // precondition: can_send_packet_now == TRUE
279 static void att_signed_write_request(uint16_t request_type, uint16_t peripheral_handle, uint16_t attribute_handle, uint16_t value_length, uint8_t * value, uint32_t sign_counter, uint8_t sgn[8]){
280     l2cap_reserve_packet_buffer();
281     uint8_t * request = l2cap_get_outgoing_buffer();
282     request[0] = request_type;
283     little_endian_store_16(request, 1, attribute_handle);
284     memcpy(&request[3], value, value_length);
285     little_endian_store_32(request, 3 + value_length, sign_counter);
286     reverse_64(sgn, &request[3 + value_length + 4]);
287     l2cap_send_prepared_connectionless(peripheral_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 3 + value_length + 12);
288 }
289 
290 // precondition: can_send_packet_now == TRUE
291 static void att_write_request(uint16_t request_type, uint16_t peripheral_handle, uint16_t attribute_handle, uint16_t value_length, uint8_t * value){
292     l2cap_reserve_packet_buffer();
293     uint8_t * request = l2cap_get_outgoing_buffer();
294     request[0] = request_type;
295     little_endian_store_16(request, 1, attribute_handle);
296     memcpy(&request[3], value, value_length);
297 
298     l2cap_send_prepared_connectionless(peripheral_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 3 + value_length);
299 }
300 
301 // precondition: can_send_packet_now == TRUE
302 static void att_execute_write_request(uint16_t request_type, uint16_t peripheral_handle, uint8_t execute_write){
303     l2cap_reserve_packet_buffer();
304     uint8_t * request = l2cap_get_outgoing_buffer();
305     request[0] = request_type;
306     request[1] = execute_write;
307     l2cap_send_prepared_connectionless(peripheral_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 2);
308 }
309 
310 // precondition: can_send_packet_now == TRUE
311 static void att_prepare_write_request(uint16_t request_type, uint16_t peripheral_handle,  uint16_t attribute_handle, uint16_t value_offset, uint16_t blob_length, uint8_t * value){
312     l2cap_reserve_packet_buffer();
313     uint8_t * request = l2cap_get_outgoing_buffer();
314     request[0] = request_type;
315     little_endian_store_16(request, 1, attribute_handle);
316     little_endian_store_16(request, 3, value_offset);
317     memcpy(&request[5], &value[value_offset], blob_length);
318 
319     l2cap_send_prepared_connectionless(peripheral_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 5+blob_length);
320 }
321 
322 static void att_exchange_mtu_request(uint16_t peripheral_handle){
323     uint16_t mtu = l2cap_max_le_mtu();
324     l2cap_reserve_packet_buffer();
325     uint8_t * request = l2cap_get_outgoing_buffer();
326     request[0] = ATT_EXCHANGE_MTU_REQUEST;
327     little_endian_store_16(request, 1, mtu);
328     l2cap_send_prepared_connectionless(peripheral_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 3);
329 }
330 
331 static uint16_t write_blob_length(gatt_client_t * peripheral){
332     uint16_t max_blob_length = peripheral_mtu(peripheral) - 5;
333     if (peripheral->attribute_offset >= peripheral->attribute_length) {
334         return 0;
335     }
336     uint16_t rest_length = peripheral->attribute_length - peripheral->attribute_offset;
337     if (max_blob_length > rest_length){
338         return rest_length;
339     }
340     return max_blob_length;
341 }
342 
343 static void send_gatt_services_request(gatt_client_t *peripheral){
344     att_read_by_type_or_group_request_for_uuid16(ATT_READ_BY_GROUP_TYPE_REQUEST, GATT_PRIMARY_SERVICE_UUID, peripheral->con_handle, peripheral->start_group_handle, peripheral->end_group_handle);
345 }
346 
347 static void send_gatt_by_uuid_request(gatt_client_t *peripheral, uint16_t attribute_group_type){
348     if (peripheral->uuid16){
349         uint8_t uuid16[2];
350         little_endian_store_16(uuid16, 0, peripheral->uuid16);
351         att_find_by_type_value_request(ATT_FIND_BY_TYPE_VALUE_REQUEST, attribute_group_type, peripheral->con_handle, peripheral->start_group_handle, peripheral->end_group_handle, uuid16, 2);
352         return;
353     }
354     uint8_t uuid128[16];
355     reverse_128(peripheral->uuid128, uuid128);
356     att_find_by_type_value_request(ATT_FIND_BY_TYPE_VALUE_REQUEST, attribute_group_type, peripheral->con_handle, peripheral->start_group_handle, peripheral->end_group_handle, uuid128, 16);
357 }
358 
359 static void send_gatt_services_by_uuid_request(gatt_client_t *peripheral){
360     send_gatt_by_uuid_request(peripheral, GATT_PRIMARY_SERVICE_UUID);
361 }
362 
363 static void send_gatt_included_service_uuid_request(gatt_client_t *peripheral){
364     att_read_request(ATT_READ_REQUEST, peripheral->con_handle, peripheral->query_start_handle);
365 }
366 
367 static void send_gatt_included_service_request(gatt_client_t *peripheral){
368     att_read_by_type_or_group_request_for_uuid16(ATT_READ_BY_TYPE_REQUEST, GATT_INCLUDE_SERVICE_UUID, peripheral->con_handle, peripheral->start_group_handle, peripheral->end_group_handle);
369 }
370 
371 static void send_gatt_characteristic_request(gatt_client_t *peripheral){
372     att_read_by_type_or_group_request_for_uuid16(ATT_READ_BY_TYPE_REQUEST, GATT_CHARACTERISTICS_UUID, peripheral->con_handle, peripheral->start_group_handle, peripheral->end_group_handle);
373 }
374 
375 static void send_gatt_characteristic_descriptor_request(gatt_client_t *peripheral){
376     att_find_information_request(ATT_FIND_INFORMATION_REQUEST, peripheral->con_handle, peripheral->start_group_handle, peripheral->end_group_handle);
377 }
378 
379 static void send_gatt_read_characteristic_value_request(gatt_client_t *peripheral){
380     att_read_request(ATT_READ_REQUEST, peripheral->con_handle, peripheral->attribute_handle);
381 }
382 
383 static void send_gatt_read_by_type_request(gatt_client_t * peripheral){
384     if (peripheral->uuid16){
385         att_read_by_type_or_group_request_for_uuid16(ATT_READ_BY_TYPE_REQUEST, peripheral->uuid16, peripheral->con_handle, peripheral->start_group_handle, peripheral->end_group_handle);
386     } else {
387         att_read_by_type_or_group_request_for_uuid128(ATT_READ_BY_TYPE_REQUEST, peripheral->uuid128, peripheral->con_handle, peripheral->start_group_handle, peripheral->end_group_handle);
388     }
389 }
390 
391 static void send_gatt_read_blob_request(gatt_client_t *peripheral){
392     att_read_blob_request(ATT_READ_BLOB_REQUEST, peripheral->con_handle, peripheral->attribute_handle, peripheral->attribute_offset);
393 }
394 
395 static void send_gatt_read_multiple_request(gatt_client_t * peripheral){
396     att_read_multiple_request(peripheral->con_handle, peripheral->read_multiple_handle_count, peripheral->read_multiple_handles);
397 }
398 
399 static void send_gatt_write_attribute_value_request(gatt_client_t * peripheral){
400     att_write_request(ATT_WRITE_REQUEST, peripheral->con_handle, peripheral->attribute_handle, peripheral->attribute_length, peripheral->attribute_value);
401 }
402 
403 static void send_gatt_write_client_characteristic_configuration_request(gatt_client_t * peripheral){
404     att_write_request(ATT_WRITE_REQUEST, peripheral->con_handle, peripheral->client_characteristic_configuration_handle, 2, peripheral->client_characteristic_configuration_value);
405 }
406 
407 static void send_gatt_prepare_write_request(gatt_client_t * peripheral){
408     att_prepare_write_request(ATT_PREPARE_WRITE_REQUEST, peripheral->con_handle, peripheral->attribute_handle, peripheral->attribute_offset, write_blob_length(peripheral), peripheral->attribute_value);
409 }
410 
411 static void send_gatt_execute_write_request(gatt_client_t * peripheral){
412     att_execute_write_request(ATT_EXECUTE_WRITE_REQUEST, peripheral->con_handle, 1);
413 }
414 
415 static void send_gatt_cancel_prepared_write_request(gatt_client_t * peripheral){
416     att_execute_write_request(ATT_EXECUTE_WRITE_REQUEST, peripheral->con_handle, 0);
417 }
418 
419 static void send_gatt_read_client_characteristic_configuration_request(gatt_client_t * peripheral){
420     att_read_by_type_or_group_request_for_uuid16(ATT_READ_BY_TYPE_REQUEST, GATT_CLIENT_CHARACTERISTICS_CONFIGURATION, peripheral->con_handle, peripheral->start_group_handle, peripheral->end_group_handle);
421 }
422 
423 static void send_gatt_read_characteristic_descriptor_request(gatt_client_t * peripheral){
424     att_read_request(ATT_READ_REQUEST, peripheral->con_handle, peripheral->attribute_handle);
425 }
426 
427 static void send_gatt_signed_write_request(gatt_client_t * peripheral, uint32_t sign_counter){
428     att_signed_write_request(ATT_SIGNED_WRITE_COMMAND, peripheral->con_handle, peripheral->attribute_handle, peripheral->attribute_length, peripheral->attribute_value, sign_counter, peripheral->cmac);
429 }
430 
431 static uint16_t get_last_result_handle_from_service_list(uint8_t * packet, uint16_t size){
432     uint8_t attr_length = packet[1];
433     return little_endian_read_16(packet, size - attr_length + 2);
434 }
435 
436 static uint16_t get_last_result_handle_from_characteristics_list(uint8_t * packet, uint16_t size){
437     uint8_t attr_length = packet[1];
438     return little_endian_read_16(packet, size - attr_length + 3);
439 }
440 
441 static uint16_t get_last_result_handle_from_included_services_list(uint8_t * packet, uint16_t size){
442     uint8_t attr_length = packet[1];
443     return little_endian_read_16(packet, size - attr_length);
444 }
445 
446 static void gatt_client_handle_transaction_complete(gatt_client_t * peripheral){
447     peripheral->gatt_client_state = P_READY;
448     gatt_client_timeout_stop(peripheral);
449 }
450 
451 static void emit_event_new(btstack_packet_handler_t callback, uint8_t * packet, uint16_t size){
452     if (!callback) return;
453     (*callback)(HCI_EVENT_PACKET, 0, packet, size);
454 }
455 
456 /**
457  * @brief Register for notifications and indications of a characteristic enabled by gatt_client_write_client_characteristic_configuration
458  * @param notification struct used to store registration
459  * @param con_handle
460  * @param characteristic
461  */
462 void gatt_client_listen_for_characteristic_value_updates(gatt_client_notification_t * notification, hci_con_handle_t con_handle, gatt_client_characteristic_t * characteristic){
463     notification->con_handle = con_handle;
464     notification->attribute_handle = characteristic->value_handle;
465     btstack_linked_list_add(&gatt_client_value_listeners, (btstack_linked_item_t*) notification);
466 }
467 
468 static void emit_event_to_registered_listeners(hci_con_handle_t con_handle, uint16_t attribute_handle, uint8_t * packet, uint16_t size){
469     btstack_linked_list_iterator_t it;
470     btstack_linked_list_iterator_init(&it, &gatt_client_value_listeners);
471     while (btstack_linked_list_iterator_has_next(&it)){
472         gatt_client_notification_t * registration = (gatt_client_notification_t*) btstack_linked_list_iterator_next(&it);
473         if (registration->con_handle != con_handle) continue;
474         if (registration->attribute_handle != attribute_handle) continue;
475         (*registration->callback)(HCI_EVENT_PACKET, 0, packet, size);
476     }
477 }
478 
479 static void emit_gatt_complete_event(gatt_client_t * peripheral, uint8_t status){
480     // @format H1
481     uint8_t packet[5];
482     packet[0] = GATT_EVENT_QUERY_COMPLETE;
483     packet[1] = 3;
484     little_endian_store_16(packet, 2, peripheral->con_handle);
485     packet[4] = status;
486     emit_event_new(peripheral->callback, packet, sizeof(packet));
487 }
488 
489 static void emit_gatt_service_query_result_event(gatt_client_t * peripheral, uint16_t start_group_handle, uint16_t end_group_handle, uint8_t * uuid128){
490     // @format HX
491     uint8_t packet[24];
492     packet[0] = GATT_EVENT_SERVICE_QUERY_RESULT;
493     packet[1] = sizeof(packet) - 2;
494     little_endian_store_16(packet, 2, peripheral->con_handle);
495     ///
496     little_endian_store_16(packet, 4, start_group_handle);
497     little_endian_store_16(packet, 6, end_group_handle);
498     reverse_128(uuid128, &packet[8]);
499     emit_event_new(peripheral->callback, packet, sizeof(packet));
500 }
501 
502 static void emit_gatt_included_service_query_result_event(gatt_client_t * peripheral, uint16_t include_handle, uint16_t start_group_handle, uint16_t end_group_handle, uint8_t * uuid128){
503     // @format HX
504     uint8_t packet[26];
505     packet[0] = GATT_EVENT_INCLUDED_SERVICE_QUERY_RESULT;
506     packet[1] = sizeof(packet) - 2;
507     little_endian_store_16(packet, 2, peripheral->con_handle);
508     ///
509     little_endian_store_16(packet, 4, include_handle);
510     //
511     little_endian_store_16(packet, 6, start_group_handle);
512     little_endian_store_16(packet, 8, end_group_handle);
513     reverse_128(uuid128, &packet[10]);
514     emit_event_new(peripheral->callback, packet, sizeof(packet));
515 }
516 
517 static void emit_gatt_characteristic_query_result_event(gatt_client_t * peripheral, uint16_t start_handle, uint16_t value_handle, uint16_t end_handle,
518         uint16_t properties, uint8_t * uuid128){
519     // @format HY
520     uint8_t packet[28];
521     packet[0] = GATT_EVENT_CHARACTERISTIC_QUERY_RESULT;
522     packet[1] = sizeof(packet) - 2;
523     little_endian_store_16(packet, 2, peripheral->con_handle);
524     ///
525     little_endian_store_16(packet, 4,  start_handle);
526     little_endian_store_16(packet, 6,  value_handle);
527     little_endian_store_16(packet, 8,  end_handle);
528     little_endian_store_16(packet, 10, properties);
529     reverse_128(uuid128, &packet[12]);
530     emit_event_new(peripheral->callback, packet, sizeof(packet));
531 }
532 
533 static void emit_gatt_all_characteristic_descriptors_result_event(
534     gatt_client_t * peripheral, uint16_t descriptor_handle, uint8_t * uuid128){
535     // @format HZ
536     uint8_t packet[22];
537     packet[0] = GATT_EVENT_ALL_CHARACTERISTIC_DESCRIPTORS_QUERY_RESULT;
538     packet[1] = sizeof(packet) - 2;
539     little_endian_store_16(packet, 2, peripheral->con_handle);
540     ///
541     little_endian_store_16(packet, 4,  descriptor_handle);
542     reverse_128(uuid128, &packet[6]);
543     emit_event_new(peripheral->callback, packet, sizeof(packet));
544 }
545 ///
546 
547 static void report_gatt_services(gatt_client_t * peripheral, uint8_t * packet,  uint16_t size){
548     uint8_t attr_length = packet[1];
549     uint8_t uuid_length = attr_length - 4;
550 
551     int i;
552     for (i = 2; i < size; i += attr_length){
553         uint16_t start_group_handle = little_endian_read_16(packet,i);
554         uint16_t end_group_handle   = little_endian_read_16(packet,i+2);
555         uint8_t  uuid128[16];
556         uint16_t uuid16 = 0;
557 
558         if (uuid_length == 2){
559             uuid16 = little_endian_read_16(packet, i+4);
560             uuid_add_bluetooth_prefix((uint8_t*) &uuid128, uuid16);
561         } else {
562             reverse_128(&packet[i+4], uuid128);
563         }
564         emit_gatt_service_query_result_event(peripheral, start_group_handle, end_group_handle, uuid128);
565     }
566     // log_info("report_gatt_services for %02X done", peripheral->con_handle);
567 }
568 
569 // helper
570 static void characteristic_start_found(gatt_client_t * peripheral, uint16_t start_handle, uint8_t properties, uint16_t value_handle, uint8_t * uuid, uint16_t uuid_length){
571     uint8_t uuid128[16];
572     uint16_t uuid16 = 0;
573     if (uuid_length == 2){
574         uuid16 = little_endian_read_16(uuid, 0);
575         uuid_add_bluetooth_prefix((uint8_t*) uuid128, uuid16);
576     } else {
577         reverse_128(uuid, uuid128);
578     }
579 
580     if (peripheral->filter_with_uuid && memcmp(peripheral->uuid128, uuid128, 16) != 0) return;
581 
582     peripheral->characteristic_properties = properties;
583     peripheral->characteristic_start_handle = start_handle;
584     peripheral->attribute_handle = value_handle;
585 
586     if (peripheral->filter_with_uuid) return;
587 
588     peripheral->uuid16 = uuid16;
589     memcpy(peripheral->uuid128, uuid128, 16);
590 }
591 
592 static void characteristic_end_found(gatt_client_t * peripheral, uint16_t end_handle){
593     // TODO: stop searching if filter and uuid found
594 
595     if (!peripheral->characteristic_start_handle) return;
596 
597     emit_gatt_characteristic_query_result_event(peripheral, peripheral->characteristic_start_handle, peripheral->attribute_handle,
598         end_handle, peripheral->characteristic_properties, peripheral->uuid128);
599 
600     peripheral->characteristic_start_handle = 0;
601 }
602 
603 static void report_gatt_characteristics(gatt_client_t * peripheral, uint8_t * packet,  uint16_t size){
604     uint8_t attr_length = packet[1];
605     uint8_t uuid_length = attr_length - 5;
606     int i;
607     for (i = 2; i < size; i += attr_length){
608         uint16_t start_handle = little_endian_read_16(packet, i);
609         uint8_t  properties = packet[i+2];
610         uint16_t value_handle = little_endian_read_16(packet, i+3);
611         characteristic_end_found(peripheral, start_handle-1);
612         characteristic_start_found(peripheral, start_handle, properties, value_handle, &packet[i+5], uuid_length);
613     }
614 }
615 
616 static void report_gatt_included_service_uuid16(gatt_client_t * peripheral, uint16_t include_handle, uint16_t uuid16){
617     uint8_t normalized_uuid128[16];
618     uuid_add_bluetooth_prefix(normalized_uuid128, uuid16);
619     emit_gatt_included_service_query_result_event(peripheral, include_handle, peripheral->query_start_handle,
620         peripheral->query_end_handle, normalized_uuid128);
621 }
622 
623 static void report_gatt_included_service_uuid128(gatt_client_t * peripheral, uint16_t include_handle, uint8_t *uuid128){
624     emit_gatt_included_service_query_result_event(peripheral, include_handle, peripheral->query_start_handle,
625         peripheral->query_end_handle, uuid128);
626 }
627 
628 // @returns packet pointer
629 // @note assume that value is part of an l2cap buffer - overwrite HCI + L2CAP packet headers
630 static const int characteristic_value_event_header_size = 8;
631 static uint8_t * setup_characteristic_value_packet(uint8_t type, hci_con_handle_t con_handle, uint16_t attribute_handle, uint8_t * value, uint16_t length){
632     // before the value inside the ATT PDU
633     uint8_t * packet = value - characteristic_value_event_header_size;
634     packet[0] = type;
635     packet[1] = characteristic_value_event_header_size - 2 + length;
636     little_endian_store_16(packet, 2, con_handle);
637     little_endian_store_16(packet, 4, attribute_handle);
638     little_endian_store_16(packet, 6, length);
639     return packet;
640 }
641 
642 // @returns packet pointer
643 // @note assume that value is part of an l2cap buffer - overwrite parts of the HCI/L2CAP/ATT packet (4/4/3) bytes
644 static const int long_characteristic_value_event_header_size = 10;
645 static uint8_t * setup_long_characteristic_value_packet(uint8_t type, hci_con_handle_t con_handle, uint16_t attribute_handle, uint16_t offset, uint8_t * value, uint16_t length){
646 #if defined(HCI_INCOMING_PRE_BUFFER_SIZE) && (HCI_INCOMING_PRE_BUFFER_SIZE >= 10 - 8) // L2CAP Header (4) - ACL Header (4)
647     // before the value inside the ATT PDU
648     uint8_t * packet = value - long_characteristic_value_event_header_size;
649     packet[0] = type;
650     packet[1] = long_characteristic_value_event_header_size - 2 + length;
651     little_endian_store_16(packet, 2, con_handle);
652     little_endian_store_16(packet, 4, attribute_handle);
653     little_endian_store_16(packet, 6, offset);
654     little_endian_store_16(packet, 8, length);
655     return packet;
656 #else
657     log_error("HCI_INCOMING_PRE_BUFFER_SIZE >= 2 required for long characteristic reads");
658     return NULL;
659 #endif
660 }
661 
662 
663 // @note assume that value is part of an l2cap buffer - overwrite parts of the HCI/L2CAP/ATT packet (4/4/3) bytes
664 static void report_gatt_notification(hci_con_handle_t con_handle, uint16_t value_handle, uint8_t * value, int length){
665     uint8_t * packet = setup_characteristic_value_packet(GATT_EVENT_NOTIFICATION, con_handle, value_handle, value, length);
666     emit_event_to_registered_listeners(con_handle, value_handle, packet, characteristic_value_event_header_size + length);
667 }
668 
669 // @note assume that value is part of an l2cap buffer - overwrite parts of the HCI/L2CAP/ATT packet (4/4/3) bytes
670 static void report_gatt_indication(hci_con_handle_t con_handle, uint16_t value_handle, uint8_t * value, int length){
671     uint8_t * packet = setup_characteristic_value_packet(GATT_EVENT_INDICATION, con_handle, value_handle, value, length);
672     emit_event_to_registered_listeners(con_handle, value_handle, packet, characteristic_value_event_header_size + length);
673 }
674 
675 // @note assume that value is part of an l2cap buffer - overwrite parts of the HCI/L2CAP/ATT packet (4/4/3) bytes
676 static void report_gatt_characteristic_value(gatt_client_t * peripheral, uint16_t attribute_handle, uint8_t * value, uint16_t length){
677     uint8_t * packet = setup_characteristic_value_packet(GATT_EVENT_CHARACTERISTIC_VALUE_QUERY_RESULT, peripheral->con_handle, attribute_handle, value, length);
678     emit_event_new(peripheral->callback, packet, characteristic_value_event_header_size + length);
679 }
680 
681 // @note assume that value is part of an l2cap buffer - overwrite parts of the HCI/L2CAP/ATT packet (4/4/3) bytes
682 static void report_gatt_long_characteristic_value_blob(gatt_client_t * peripheral, uint16_t attribute_handle, uint8_t * blob, uint16_t blob_length, int value_offset){
683     uint8_t * packet = setup_long_characteristic_value_packet(GATT_EVENT_LONG_CHARACTERISTIC_VALUE_QUERY_RESULT, peripheral->con_handle, attribute_handle, value_offset, blob, blob_length);
684     if (!packet) return;
685     emit_event_new(peripheral->callback, packet, blob_length + long_characteristic_value_event_header_size);
686 }
687 
688 static void report_gatt_characteristic_descriptor(gatt_client_t * peripheral, uint16_t descriptor_handle, uint8_t *value, uint16_t value_length, uint16_t value_offset){
689     uint8_t * packet = setup_characteristic_value_packet(GATT_EVENT_CHARACTERISTIC_DESCRIPTOR_QUERY_RESULT, peripheral->con_handle, descriptor_handle, value, value_length);
690     emit_event_new(peripheral->callback, packet, value_length + 8);
691 }
692 
693 static void report_gatt_long_characteristic_descriptor(gatt_client_t * peripheral, uint16_t descriptor_handle, uint8_t *blob, uint16_t blob_length, uint16_t value_offset){
694     uint8_t * packet = setup_long_characteristic_value_packet(GATT_EVENT_LONG_CHARACTERISTIC_DESCRIPTOR_QUERY_RESULT, peripheral->con_handle, descriptor_handle, value_offset, blob, blob_length);
695     if (!packet) return;
696     emit_event_new(peripheral->callback, packet, blob_length + long_characteristic_value_event_header_size);
697 }
698 
699 static void report_gatt_all_characteristic_descriptors(gatt_client_t * peripheral, uint8_t * packet, uint16_t size, uint16_t pair_size){
700     int i;
701     for (i = 0; i<size; i+=pair_size){
702         uint16_t descriptor_handle = little_endian_read_16(packet,i);
703         uint8_t uuid128[16];
704         uint16_t uuid16 = 0;
705         if (pair_size == 4){
706             uuid16 = little_endian_read_16(packet,i+2);
707             uuid_add_bluetooth_prefix(uuid128, uuid16);
708         } else {
709             reverse_128(&packet[i+2], uuid128);
710         }
711         emit_gatt_all_characteristic_descriptors_result_event(peripheral, descriptor_handle, uuid128);
712     }
713 
714 }
715 
716 static int is_query_done(gatt_client_t * peripheral, uint16_t last_result_handle){
717     return last_result_handle >= peripheral->end_group_handle;
718 }
719 
720 static void trigger_next_query(gatt_client_t * peripheral, uint16_t last_result_handle, gatt_client_state_t next_query_state){
721     if (is_query_done(peripheral, last_result_handle)){
722         gatt_client_handle_transaction_complete(peripheral);
723         emit_gatt_complete_event(peripheral, 0);
724         return;
725     }
726     // next
727     peripheral->start_group_handle = last_result_handle + 1;
728     peripheral->gatt_client_state = next_query_state;
729 }
730 
731 static inline void trigger_next_included_service_query(gatt_client_t * peripheral, uint16_t last_result_handle){
732     trigger_next_query(peripheral, last_result_handle, P_W2_SEND_INCLUDED_SERVICE_QUERY);
733 }
734 
735 static inline void trigger_next_service_query(gatt_client_t * peripheral, uint16_t last_result_handle){
736     trigger_next_query(peripheral, last_result_handle, P_W2_SEND_SERVICE_QUERY);
737 }
738 
739 static inline void trigger_next_service_by_uuid_query(gatt_client_t * peripheral, uint16_t last_result_handle){
740     trigger_next_query(peripheral, last_result_handle, P_W2_SEND_SERVICE_WITH_UUID_QUERY);
741 }
742 
743 static inline void trigger_next_characteristic_query(gatt_client_t * peripheral, uint16_t last_result_handle){
744     if (is_query_done(peripheral, last_result_handle)){
745         // report last characteristic
746         characteristic_end_found(peripheral, peripheral->end_group_handle);
747     }
748     trigger_next_query(peripheral, last_result_handle, P_W2_SEND_ALL_CHARACTERISTICS_OF_SERVICE_QUERY);
749 }
750 
751 static inline void trigger_next_characteristic_descriptor_query(gatt_client_t * peripheral, uint16_t last_result_handle){
752     trigger_next_query(peripheral, last_result_handle, P_W2_SEND_ALL_CHARACTERISTIC_DESCRIPTORS_QUERY);
753 }
754 
755 static inline void trigger_next_read_by_type_query(gatt_client_t * peripheral, uint16_t last_result_handle){
756     trigger_next_query(peripheral, last_result_handle, P_W2_SEND_READ_BY_TYPE_REQUEST);
757 }
758 
759 static inline void trigger_next_prepare_write_query(gatt_client_t * peripheral, gatt_client_state_t next_query_state, gatt_client_state_t done_state){
760     peripheral->attribute_offset += write_blob_length(peripheral);
761     uint16_t next_blob_length =  write_blob_length(peripheral);
762 
763     if (next_blob_length == 0){
764         peripheral->gatt_client_state = done_state;
765         return;
766     }
767     peripheral->gatt_client_state = next_query_state;
768 }
769 
770 static inline void trigger_next_blob_query(gatt_client_t * peripheral, gatt_client_state_t next_query_state, uint16_t received_blob_length){
771 
772     uint16_t max_blob_length = peripheral_mtu(peripheral) - 1;
773     if (received_blob_length < max_blob_length){
774         gatt_client_handle_transaction_complete(peripheral);
775         emit_gatt_complete_event(peripheral, 0);
776         return;
777     }
778 
779     peripheral->attribute_offset += received_blob_length;
780     peripheral->gatt_client_state = next_query_state;
781 }
782 
783 
784 static int is_value_valid(gatt_client_t *peripheral, uint8_t *packet, uint16_t size){
785     uint16_t attribute_handle = little_endian_read_16(packet, 1);
786     uint16_t value_offset = little_endian_read_16(packet, 3);
787 
788     if (peripheral->attribute_handle != attribute_handle) return 0;
789     if (peripheral->attribute_offset != value_offset) return 0;
790     return memcmp(&peripheral->attribute_value[peripheral->attribute_offset], &packet[5], size-5) == 0;
791 }
792 
793 
794 static void gatt_client_run(void){
795 
796     btstack_linked_item_t *it;
797     for (it = (btstack_linked_item_t *) gatt_client_connections; it ; it = it->next){
798 
799         gatt_client_t * peripheral = (gatt_client_t *) it;
800 
801         if (!att_dispatch_client_can_send_now(peripheral->con_handle)) {
802             att_dispatch_client_request_can_send_now_event(peripheral->con_handle);
803             return;
804         }
805 
806         // log_info("- handle_peripheral_list, mtu state %u, client state %u", peripheral->mtu_state, peripheral->gatt_client_state);
807 
808         switch (peripheral->mtu_state) {
809             case SEND_MTU_EXCHANGE:{
810                 peripheral->mtu_state = SENT_MTU_EXCHANGE;
811                 att_exchange_mtu_request(peripheral->con_handle);
812                 return;
813             }
814             case SENT_MTU_EXCHANGE:
815                 return;
816             default:
817                 break;
818         }
819 
820         if (peripheral->send_confirmation){
821             peripheral->send_confirmation = 0;
822             att_confirmation(peripheral->con_handle);
823             return;
824         }
825 
826         // check MTU for writes
827         switch (peripheral->gatt_client_state){
828             case P_W2_SEND_WRITE_CHARACTERISTIC_VALUE:
829             case P_W2_SEND_WRITE_CHARACTERISTIC_DESCRIPTOR:
830                 if (peripheral->attribute_length <= peripheral_mtu(peripheral) - 3) break;
831                 log_error("gatt_client_run: value len %u > MTU %u - 3\n", peripheral->attribute_length, peripheral_mtu(peripheral));
832                 gatt_client_handle_transaction_complete(peripheral);
833                 emit_gatt_complete_event(peripheral, ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LENGTH);
834                 return;
835             default:
836                 break;
837         }
838 
839         // log_info("gatt_client_state %u", peripheral->gatt_client_state);
840         switch (peripheral->gatt_client_state){
841             case P_W2_SEND_SERVICE_QUERY:
842                 peripheral->gatt_client_state = P_W4_SERVICE_QUERY_RESULT;
843                 send_gatt_services_request(peripheral);
844                 return;
845 
846             case P_W2_SEND_SERVICE_WITH_UUID_QUERY:
847                 peripheral->gatt_client_state = P_W4_SERVICE_WITH_UUID_RESULT;
848                 send_gatt_services_by_uuid_request(peripheral);
849                 return;
850 
851             case P_W2_SEND_ALL_CHARACTERISTICS_OF_SERVICE_QUERY:
852                 peripheral->gatt_client_state = P_W4_ALL_CHARACTERISTICS_OF_SERVICE_QUERY_RESULT;
853                 send_gatt_characteristic_request(peripheral);
854                 return;
855 
856             case P_W2_SEND_CHARACTERISTIC_WITH_UUID_QUERY:
857                 peripheral->gatt_client_state = P_W4_CHARACTERISTIC_WITH_UUID_QUERY_RESULT;
858                 send_gatt_characteristic_request(peripheral);
859                 return;
860 
861             case P_W2_SEND_ALL_CHARACTERISTIC_DESCRIPTORS_QUERY:
862                 peripheral->gatt_client_state = P_W4_CHARACTERISTIC_WITH_UUID_QUERY_RESULT;
863                 send_gatt_characteristic_descriptor_request(peripheral);
864                 return;
865 
866             case P_W2_SEND_INCLUDED_SERVICE_QUERY:
867                 peripheral->gatt_client_state = P_W4_INCLUDED_SERVICE_QUERY_RESULT;
868                 send_gatt_included_service_request(peripheral);
869                 return;
870 
871             case P_W2_SEND_INCLUDED_SERVICE_WITH_UUID_QUERY:
872                 peripheral->gatt_client_state = P_W4_INCLUDED_SERVICE_UUID_WITH_QUERY_RESULT;
873                 send_gatt_included_service_uuid_request(peripheral);
874                 return;
875 
876             case P_W2_SEND_READ_CHARACTERISTIC_VALUE_QUERY:
877                 peripheral->gatt_client_state = P_W4_READ_CHARACTERISTIC_VALUE_RESULT;
878                 send_gatt_read_characteristic_value_request(peripheral);
879                 return;
880 
881             case P_W2_SEND_READ_BLOB_QUERY:
882                 peripheral->gatt_client_state = P_W4_READ_BLOB_RESULT;
883                 send_gatt_read_blob_request(peripheral);
884                 return;
885 
886             case P_W2_SEND_READ_BY_TYPE_REQUEST:
887                 peripheral->gatt_client_state = P_W4_READ_BY_TYPE_RESPONSE;
888                 send_gatt_read_by_type_request(peripheral);
889                 break;
890 
891             case P_W2_SEND_READ_MULTIPLE_REQUEST:
892                 peripheral->gatt_client_state = P_W4_READ_MULTIPLE_RESPONSE;
893                 send_gatt_read_multiple_request(peripheral);
894                 break;
895 
896             case P_W2_SEND_WRITE_CHARACTERISTIC_VALUE:
897                 peripheral->gatt_client_state = P_W4_WRITE_CHARACTERISTIC_VALUE_RESULT;
898                 send_gatt_write_attribute_value_request(peripheral);
899                 return;
900 
901             case P_W2_PREPARE_WRITE:
902                 peripheral->gatt_client_state = P_W4_PREPARE_WRITE_RESULT;
903                 send_gatt_prepare_write_request(peripheral);
904                 return;
905 
906             case P_W2_PREPARE_WRITE_SINGLE:
907                 peripheral->gatt_client_state = P_W4_PREPARE_WRITE_SINGLE_RESULT;
908                 send_gatt_prepare_write_request(peripheral);
909                 return;
910 
911             case P_W2_PREPARE_RELIABLE_WRITE:
912                 peripheral->gatt_client_state = P_W4_PREPARE_RELIABLE_WRITE_RESULT;
913                 send_gatt_prepare_write_request(peripheral);
914                 return;
915 
916             case P_W2_EXECUTE_PREPARED_WRITE:
917                 peripheral->gatt_client_state = P_W4_EXECUTE_PREPARED_WRITE_RESULT;
918                 send_gatt_execute_write_request(peripheral);
919                 return;
920 
921             case P_W2_CANCEL_PREPARED_WRITE:
922                 peripheral->gatt_client_state = P_W4_CANCEL_PREPARED_WRITE_RESULT;
923                 send_gatt_cancel_prepared_write_request(peripheral);
924                 return;
925 
926             case P_W2_CANCEL_PREPARED_WRITE_DATA_MISMATCH:
927                 peripheral->gatt_client_state = P_W4_CANCEL_PREPARED_WRITE_DATA_MISMATCH_RESULT;
928                 send_gatt_cancel_prepared_write_request(peripheral);
929                 return;
930 
931             case P_W2_SEND_READ_CLIENT_CHARACTERISTIC_CONFIGURATION_QUERY:
932                 peripheral->gatt_client_state = P_W4_READ_CLIENT_CHARACTERISTIC_CONFIGURATION_QUERY_RESULT;
933                 send_gatt_read_client_characteristic_configuration_request(peripheral);
934                 return;
935 
936             case P_W2_SEND_READ_CHARACTERISTIC_DESCRIPTOR_QUERY:
937                 peripheral->gatt_client_state = P_W4_READ_CHARACTERISTIC_DESCRIPTOR_RESULT;
938                 send_gatt_read_characteristic_descriptor_request(peripheral);
939                 return;
940 
941             case P_W2_SEND_READ_BLOB_CHARACTERISTIC_DESCRIPTOR_QUERY:
942                 peripheral->gatt_client_state = P_W4_READ_BLOB_CHARACTERISTIC_DESCRIPTOR_RESULT;
943                 send_gatt_read_blob_request(peripheral);
944                 return;
945 
946             case P_W2_SEND_WRITE_CHARACTERISTIC_DESCRIPTOR:
947                 peripheral->gatt_client_state = P_W4_WRITE_CHARACTERISTIC_DESCRIPTOR_RESULT;
948                 send_gatt_write_attribute_value_request(peripheral);
949                 return;
950 
951             case P_W2_WRITE_CLIENT_CHARACTERISTIC_CONFIGURATION:
952                 peripheral->gatt_client_state = P_W4_CLIENT_CHARACTERISTIC_CONFIGURATION_RESULT;
953                 send_gatt_write_client_characteristic_configuration_request(peripheral);
954                 return;
955 
956             case P_W2_PREPARE_WRITE_CHARACTERISTIC_DESCRIPTOR:
957                 peripheral->gatt_client_state = P_W4_PREPARE_WRITE_CHARACTERISTIC_DESCRIPTOR_RESULT;
958                 send_gatt_prepare_write_request(peripheral);
959                 return;
960 
961             case P_W2_EXECUTE_PREPARED_WRITE_CHARACTERISTIC_DESCRIPTOR:
962                 peripheral->gatt_client_state = P_W4_EXECUTE_PREPARED_WRITE_CHARACTERISTIC_DESCRIPTOR_RESULT;
963                 send_gatt_execute_write_request(peripheral);
964                 return;
965 
966             case P_W4_CMAC_READY:
967                 if (sm_cmac_ready()){
968                     sm_key_t csrk;
969                     le_device_db_local_csrk_get(peripheral->le_device_index, csrk);
970                     uint32_t sign_counter = le_device_db_local_counter_get(peripheral->le_device_index);
971                     peripheral->gatt_client_state = P_W4_CMAC_RESULT;
972                     sm_cmac_start(csrk, ATT_SIGNED_WRITE_COMMAND, peripheral->attribute_handle, peripheral->attribute_length, peripheral->attribute_value, sign_counter, att_signed_write_handle_cmac_result);
973                 }
974                 return;
975 
976             case P_W2_SEND_SIGNED_WRITE: {
977                 peripheral->gatt_client_state = P_W4_SEND_SINGED_WRITE_DONE;
978                 // bump local signing counter
979                 uint32_t sign_counter = le_device_db_local_counter_get(peripheral->le_device_index);
980                 le_device_db_local_counter_set(peripheral->le_device_index, sign_counter + 1);
981 
982                 send_gatt_signed_write_request(peripheral, sign_counter);
983                 peripheral->gatt_client_state = P_READY;
984                 // finally, notifiy client that write is complete
985                 gatt_client_handle_transaction_complete(peripheral);
986                 return;
987             }
988 
989             default:
990                 break;
991         }
992     }
993 
994 }
995 
996 static void gatt_client_report_error_if_pending(gatt_client_t *peripheral, uint8_t error_code) {
997     if (is_ready(peripheral)) return;
998     gatt_client_handle_transaction_complete(peripheral);
999     emit_gatt_complete_event(peripheral, error_code);
1000 }
1001 
1002 static void gatt_client_hci_event_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1003     if (packet_type != HCI_EVENT_PACKET) return;
1004 
1005     switch (hci_event_packet_get_type(packet)) {
1006         case HCI_EVENT_DISCONNECTION_COMPLETE:
1007         {
1008             log_info("GATT Client: HCI_EVENT_DISCONNECTION_COMPLETE");
1009             hci_con_handle_t con_handle = little_endian_read_16(packet,3);
1010             gatt_client_t * peripheral = get_gatt_client_context_for_handle(con_handle);
1011             if (!peripheral) break;
1012             gatt_client_report_error_if_pending(peripheral, ATT_ERROR_HCI_DISCONNECT_RECEIVED);
1013 
1014             btstack_linked_list_remove(&gatt_client_connections, (btstack_linked_item_t *) peripheral);
1015             btstack_memory_gatt_client_free(peripheral);
1016             break;
1017         }
1018         default:
1019             break;
1020     }
1021 
1022     gatt_client_run();
1023 }
1024 
1025 static void gatt_client_att_packet_handler(uint8_t packet_type, uint16_t handle, uint8_t *packet, uint16_t size){
1026 
1027     if (packet_type == HCI_EVENT_PACKET && packet[0] == L2CAP_EVENT_CAN_SEND_NOW){
1028         gatt_client_run();
1029     }
1030 
1031     if (packet_type != ATT_DATA_PACKET) return;
1032 
1033     // special cases: notifications don't need a context while indications motivate creating one
1034     gatt_client_t * peripheral;
1035     switch (packet[0]){
1036         case ATT_HANDLE_VALUE_NOTIFICATION:
1037             report_gatt_notification(handle, little_endian_read_16(packet,1), &packet[3], size-3);
1038             return;
1039         case ATT_HANDLE_VALUE_INDICATION:
1040             peripheral = provide_context_for_conn_handle(handle);
1041             break;
1042         default:
1043             peripheral = get_gatt_client_context_for_handle(handle);
1044             break;
1045     }
1046 
1047     if (!peripheral) return;
1048 
1049     switch (packet[0]){
1050         case ATT_EXCHANGE_MTU_RESPONSE:
1051         {
1052             uint16_t remote_rx_mtu = little_endian_read_16(packet, 1);
1053             uint16_t local_rx_mtu = l2cap_max_le_mtu();
1054             peripheral->mtu = remote_rx_mtu < local_rx_mtu ? remote_rx_mtu : local_rx_mtu;
1055             peripheral->mtu_state = MTU_EXCHANGED;
1056 
1057             break;
1058         }
1059         case ATT_READ_BY_GROUP_TYPE_RESPONSE:
1060             switch(peripheral->gatt_client_state){
1061                 case P_W4_SERVICE_QUERY_RESULT:
1062                     report_gatt_services(peripheral, packet, size);
1063                     trigger_next_service_query(peripheral, get_last_result_handle_from_service_list(packet, size));
1064                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1065                     break;
1066                 default:
1067                     break;
1068             }
1069             break;
1070         case ATT_HANDLE_VALUE_INDICATION:
1071             report_gatt_indication(handle, little_endian_read_16(packet,1), &packet[3], size-3);
1072             peripheral->send_confirmation = 1;
1073             break;
1074 
1075         case ATT_READ_BY_TYPE_RESPONSE:
1076             switch (peripheral->gatt_client_state){
1077                 case P_W4_ALL_CHARACTERISTICS_OF_SERVICE_QUERY_RESULT:
1078                     report_gatt_characteristics(peripheral, packet, size);
1079                     trigger_next_characteristic_query(peripheral, get_last_result_handle_from_characteristics_list(packet, size));
1080                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done, or by ATT_ERROR
1081                     break;
1082                 case P_W4_CHARACTERISTIC_WITH_UUID_QUERY_RESULT:
1083                     report_gatt_characteristics(peripheral, packet, size);
1084                     trigger_next_characteristic_query(peripheral, get_last_result_handle_from_characteristics_list(packet, size));
1085                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done, or by ATT_ERROR
1086                     break;
1087                 case P_W4_INCLUDED_SERVICE_QUERY_RESULT:
1088                 {
1089                     uint16_t uuid16 = 0;
1090                     uint16_t pair_size = packet[1];
1091 
1092                     if (pair_size < 7){
1093                         // UUIDs not available, query first included service
1094                         peripheral->start_group_handle = little_endian_read_16(packet, 2); // ready for next query
1095                         peripheral->query_start_handle = little_endian_read_16(packet, 4);
1096                         peripheral->query_end_handle = little_endian_read_16(packet,6);
1097                         peripheral->gatt_client_state = P_W2_SEND_INCLUDED_SERVICE_WITH_UUID_QUERY;
1098                         break;
1099                     }
1100 
1101                     uint16_t offset;
1102                     for (offset = 2; offset < size; offset += pair_size){
1103                         uint16_t include_handle = little_endian_read_16(packet, offset);
1104                         peripheral->query_start_handle = little_endian_read_16(packet,offset+2);
1105                         peripheral->query_end_handle = little_endian_read_16(packet,offset+4);
1106                         uuid16 = little_endian_read_16(packet, offset+6);
1107                         report_gatt_included_service_uuid16(peripheral, include_handle, uuid16);
1108                     }
1109 
1110                     trigger_next_included_service_query(peripheral, get_last_result_handle_from_included_services_list(packet, size));
1111                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1112                     break;
1113                 }
1114                 case P_W4_READ_CLIENT_CHARACTERISTIC_CONFIGURATION_QUERY_RESULT:
1115                     peripheral->client_characteristic_configuration_handle = little_endian_read_16(packet, 2);
1116                     peripheral->gatt_client_state = P_W2_WRITE_CLIENT_CHARACTERISTIC_CONFIGURATION;
1117                     break;
1118                 case P_W4_READ_BY_TYPE_RESPONSE: {
1119                     uint16_t pair_size = packet[1];
1120                     uint16_t offset;
1121                     uint16_t last_result_handle = 0;
1122                     for (offset = 2; offset < size ; offset += pair_size){
1123                         uint16_t value_handle = little_endian_read_16(packet, offset);
1124                         report_gatt_characteristic_value(peripheral, value_handle, &packet[offset+2], pair_size-2);
1125                         last_result_handle = value_handle;
1126                     }
1127                     trigger_next_read_by_type_query(peripheral, last_result_handle);
1128                     break;
1129                 }
1130                 default:
1131                     break;
1132             }
1133             break;
1134         case ATT_READ_RESPONSE:
1135             switch (peripheral->gatt_client_state){
1136                 case P_W4_INCLUDED_SERVICE_UUID_WITH_QUERY_RESULT: {
1137                     uint8_t uuid128[16];
1138                     reverse_128(&packet[1], uuid128);
1139                     report_gatt_included_service_uuid128(peripheral, peripheral->start_group_handle, uuid128);
1140                     trigger_next_included_service_query(peripheral, peripheral->start_group_handle);
1141                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1142                     break;
1143                 }
1144                 case P_W4_READ_CHARACTERISTIC_VALUE_RESULT:
1145                     gatt_client_handle_transaction_complete(peripheral);
1146                     report_gatt_characteristic_value(peripheral, peripheral->attribute_handle, &packet[1], size-1);
1147                     emit_gatt_complete_event(peripheral, 0);
1148                     break;
1149 
1150                 case P_W4_READ_CHARACTERISTIC_DESCRIPTOR_RESULT:{
1151                     gatt_client_handle_transaction_complete(peripheral);
1152                     report_gatt_characteristic_descriptor(peripheral, peripheral->attribute_handle, &packet[1], size-1, 0);
1153                     emit_gatt_complete_event(peripheral, 0);
1154                     break;
1155                 }
1156                 default:
1157                     break;
1158             }
1159             break;
1160 
1161         case ATT_FIND_BY_TYPE_VALUE_RESPONSE:
1162         {
1163             uint8_t pair_size = 4;
1164             int i;
1165             uint16_t start_group_handle;
1166             uint16_t   end_group_handle= 0xffff; // asserts GATT_EVENT_QUERY_COMPLETE is emitted if no results
1167             for (i = 1; i<size; i+=pair_size){
1168                 start_group_handle = little_endian_read_16(packet,i);
1169                 end_group_handle = little_endian_read_16(packet,i+2);
1170                 emit_gatt_service_query_result_event(peripheral, start_group_handle, end_group_handle, peripheral->uuid128);
1171             }
1172             trigger_next_service_by_uuid_query(peripheral, end_group_handle);
1173             // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1174             break;
1175         }
1176         case ATT_FIND_INFORMATION_REPLY:
1177         {
1178             uint8_t pair_size = 4;
1179             if (packet[1] == 2){
1180                 pair_size = 18;
1181             }
1182             uint16_t last_descriptor_handle = little_endian_read_16(packet, size - pair_size);
1183 
1184             report_gatt_all_characteristic_descriptors(peripheral, &packet[2], size-2, pair_size);
1185             trigger_next_characteristic_descriptor_query(peripheral, last_descriptor_handle);
1186             // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1187             break;
1188         }
1189 
1190         case ATT_WRITE_RESPONSE:
1191             switch (peripheral->gatt_client_state){
1192                 case P_W4_WRITE_CHARACTERISTIC_VALUE_RESULT:
1193                     gatt_client_handle_transaction_complete(peripheral);
1194                     emit_gatt_complete_event(peripheral, 0);
1195                     break;
1196                 case P_W4_CLIENT_CHARACTERISTIC_CONFIGURATION_RESULT:
1197                     gatt_client_handle_transaction_complete(peripheral);
1198                     emit_gatt_complete_event(peripheral, 0);
1199                     break;
1200                 case P_W4_WRITE_CHARACTERISTIC_DESCRIPTOR_RESULT:
1201                     gatt_client_handle_transaction_complete(peripheral);
1202                     emit_gatt_complete_event(peripheral, 0);
1203                     break;
1204                 default:
1205                     break;
1206             }
1207             break;
1208 
1209         case ATT_READ_BLOB_RESPONSE:{
1210             uint16_t received_blob_length = size-1;
1211 
1212             switch(peripheral->gatt_client_state){
1213                 case P_W4_READ_BLOB_RESULT:
1214                     report_gatt_long_characteristic_value_blob(peripheral, peripheral->attribute_handle, &packet[1], received_blob_length, peripheral->attribute_offset);
1215                     trigger_next_blob_query(peripheral, P_W2_SEND_READ_BLOB_QUERY, received_blob_length);
1216                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1217                     break;
1218                 case P_W4_READ_BLOB_CHARACTERISTIC_DESCRIPTOR_RESULT:
1219                     report_gatt_long_characteristic_descriptor(peripheral, peripheral->attribute_handle,
1220                                                           &packet[1], received_blob_length,
1221                                                           peripheral->attribute_offset);
1222                     trigger_next_blob_query(peripheral, P_W2_SEND_READ_BLOB_CHARACTERISTIC_DESCRIPTOR_QUERY, received_blob_length);
1223                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1224                     break;
1225                 default:
1226                     break;
1227             }
1228             break;
1229         }
1230         case ATT_PREPARE_WRITE_RESPONSE:
1231             switch (peripheral->gatt_client_state){
1232                 case P_W4_PREPARE_WRITE_SINGLE_RESULT:
1233                     gatt_client_handle_transaction_complete(peripheral);
1234                     if (is_value_valid(peripheral, packet, size)){
1235                         emit_gatt_complete_event(peripheral, 0);
1236                     } else {
1237                         emit_gatt_complete_event(peripheral, ATT_ERROR_DATA_MISMATCH);
1238                     }
1239                     break;
1240 
1241                 case P_W4_PREPARE_WRITE_RESULT:{
1242                     peripheral->attribute_offset = little_endian_read_16(packet, 3);
1243                     trigger_next_prepare_write_query(peripheral, P_W2_PREPARE_WRITE, P_W2_EXECUTE_PREPARED_WRITE);
1244                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1245                     break;
1246                 }
1247                 case P_W4_PREPARE_WRITE_CHARACTERISTIC_DESCRIPTOR_RESULT:{
1248                     peripheral->attribute_offset = little_endian_read_16(packet, 3);
1249                     trigger_next_prepare_write_query(peripheral, P_W2_PREPARE_WRITE_CHARACTERISTIC_DESCRIPTOR, P_W2_EXECUTE_PREPARED_WRITE_CHARACTERISTIC_DESCRIPTOR);
1250                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1251                     break;
1252                 }
1253                 case P_W4_PREPARE_RELIABLE_WRITE_RESULT:{
1254                     if (is_value_valid(peripheral, packet, size)){
1255                         peripheral->attribute_offset = little_endian_read_16(packet, 3);
1256                         trigger_next_prepare_write_query(peripheral, P_W2_PREPARE_RELIABLE_WRITE, P_W2_EXECUTE_PREPARED_WRITE);
1257                         // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1258                         break;
1259                     }
1260                     peripheral->gatt_client_state = P_W2_CANCEL_PREPARED_WRITE_DATA_MISMATCH;
1261                     break;
1262                 }
1263                 default:
1264                     break;
1265             }
1266             break;
1267 
1268         case ATT_EXECUTE_WRITE_RESPONSE:
1269             switch (peripheral->gatt_client_state){
1270                 case P_W4_EXECUTE_PREPARED_WRITE_RESULT:
1271                     gatt_client_handle_transaction_complete(peripheral);
1272                     emit_gatt_complete_event(peripheral, 0);
1273                     break;
1274                 case P_W4_CANCEL_PREPARED_WRITE_RESULT:
1275                     gatt_client_handle_transaction_complete(peripheral);
1276                     emit_gatt_complete_event(peripheral, 0);
1277                     break;
1278                 case P_W4_CANCEL_PREPARED_WRITE_DATA_MISMATCH_RESULT:
1279                     gatt_client_handle_transaction_complete(peripheral);
1280                     emit_gatt_complete_event(peripheral, ATT_ERROR_DATA_MISMATCH);
1281                     break;
1282                 case P_W4_EXECUTE_PREPARED_WRITE_CHARACTERISTIC_DESCRIPTOR_RESULT:
1283                     gatt_client_handle_transaction_complete(peripheral);
1284                     emit_gatt_complete_event(peripheral, 0);
1285                     break;
1286                 default:
1287                     break;
1288 
1289             }
1290             break;
1291 
1292         case ATT_READ_MULTIPLE_RESPONSE:
1293             switch(peripheral->gatt_client_state){
1294                 case P_W4_READ_MULTIPLE_RESPONSE:
1295                     report_gatt_characteristic_value(peripheral, 0, &packet[1], size-1);
1296                     gatt_client_handle_transaction_complete(peripheral);
1297                     emit_gatt_complete_event(peripheral, 0);
1298                     break;
1299                 default:
1300                     break;
1301             }
1302             break;
1303 
1304         case ATT_ERROR_RESPONSE:
1305 
1306             switch (packet[4]){
1307                 case ATT_ERROR_ATTRIBUTE_NOT_FOUND: {
1308                     switch(peripheral->gatt_client_state){
1309                         case P_W4_SERVICE_QUERY_RESULT:
1310                         case P_W4_SERVICE_WITH_UUID_RESULT:
1311                         case P_W4_INCLUDED_SERVICE_QUERY_RESULT:
1312                         case P_W4_ALL_CHARACTERISTIC_DESCRIPTORS_QUERY_RESULT:
1313                             gatt_client_handle_transaction_complete(peripheral);
1314                             emit_gatt_complete_event(peripheral, 0);
1315                             break;
1316                         case P_W4_ALL_CHARACTERISTICS_OF_SERVICE_QUERY_RESULT:
1317                         case P_W4_CHARACTERISTIC_WITH_UUID_QUERY_RESULT:
1318                             characteristic_end_found(peripheral, peripheral->end_group_handle);
1319                             gatt_client_handle_transaction_complete(peripheral);
1320                             emit_gatt_complete_event(peripheral, 0);
1321                             break;
1322                         case P_W4_READ_BY_TYPE_RESPONSE:
1323                             gatt_client_handle_transaction_complete(peripheral);
1324                             if (peripheral->start_group_handle == peripheral->query_start_handle){
1325                                 emit_gatt_complete_event(peripheral, ATT_ERROR_ATTRIBUTE_NOT_FOUND);
1326                             } else {
1327                                 emit_gatt_complete_event(peripheral, 0);
1328                             }
1329                             break;
1330                         default:
1331                             gatt_client_report_error_if_pending(peripheral, packet[4]);
1332                             break;
1333                     }
1334                     break;
1335                 }
1336                 default:
1337                     gatt_client_report_error_if_pending(peripheral, packet[4]);
1338                     break;
1339             }
1340             break;
1341 
1342         default:
1343             log_info("ATT Handler, unhandled response type 0x%02x", packet[0]);
1344             break;
1345     }
1346     gatt_client_run();
1347 }
1348 
1349 static void att_signed_write_handle_cmac_result(uint8_t hash[8]){
1350     btstack_linked_list_iterator_t it;
1351     btstack_linked_list_iterator_init(&it, &gatt_client_connections);
1352     while (btstack_linked_list_iterator_has_next(&it)){
1353         gatt_client_t * peripheral = (gatt_client_t *) btstack_linked_list_iterator_next(&it);
1354         if (peripheral->gatt_client_state == P_W4_CMAC_RESULT){
1355             // store result
1356             memcpy(peripheral->cmac, hash, 8);
1357             // reverse_64(hash, peripheral->cmac);
1358             peripheral->gatt_client_state = P_W2_SEND_SIGNED_WRITE;
1359             gatt_client_run();
1360             return;
1361         }
1362     }
1363 }
1364 
1365 uint8_t gatt_client_signed_write_without_response(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t handle, uint16_t message_len, uint8_t * message){
1366     gatt_client_t * peripheral = provide_context_for_conn_handle(con_handle);
1367     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1368     peripheral->le_device_index = sm_le_device_index(con_handle);
1369     if (peripheral->le_device_index < 0) return GATT_CLIENT_IN_WRONG_STATE; // device lookup not done / no stored bonding information
1370 
1371     peripheral->callback = callback;
1372     peripheral->attribute_handle = handle;
1373     peripheral->attribute_length = message_len;
1374     peripheral->attribute_value = message;
1375     peripheral->gatt_client_state = P_W4_CMAC_READY;
1376 
1377     gatt_client_run();
1378     return 0;
1379 }
1380 
1381 uint8_t gatt_client_discover_primary_services(btstack_packet_handler_t callback, hci_con_handle_t con_handle){
1382     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1383     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1384     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1385 
1386     peripheral->callback = callback;
1387     peripheral->start_group_handle = 0x0001;
1388     peripheral->end_group_handle   = 0xffff;
1389     peripheral->gatt_client_state = P_W2_SEND_SERVICE_QUERY;
1390     peripheral->uuid16 = 0;
1391     gatt_client_run();
1392     return 0;
1393 }
1394 
1395 
1396 uint8_t gatt_client_discover_primary_services_by_uuid16(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t uuid16){
1397     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1398 
1399     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1400     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1401 
1402     peripheral->callback = callback;
1403     peripheral->start_group_handle = 0x0001;
1404     peripheral->end_group_handle   = 0xffff;
1405     peripheral->gatt_client_state = P_W2_SEND_SERVICE_WITH_UUID_QUERY;
1406     peripheral->uuid16 = uuid16;
1407     uuid_add_bluetooth_prefix((uint8_t*) &(peripheral->uuid128), peripheral->uuid16);
1408     gatt_client_run();
1409     return 0;
1410 }
1411 
1412 uint8_t gatt_client_discover_primary_services_by_uuid128(btstack_packet_handler_t callback, hci_con_handle_t con_handle, const uint8_t * uuid128){
1413     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1414 
1415     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1416     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1417 
1418     peripheral->callback = callback;
1419     peripheral->start_group_handle = 0x0001;
1420     peripheral->end_group_handle   = 0xffff;
1421     peripheral->uuid16 = 0;
1422     memcpy(peripheral->uuid128, uuid128, 16);
1423     peripheral->gatt_client_state = P_W2_SEND_SERVICE_WITH_UUID_QUERY;
1424     gatt_client_run();
1425     return 0;
1426 }
1427 
1428 uint8_t gatt_client_discover_characteristics_for_service(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_service_t *service){
1429     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1430 
1431     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1432     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1433 
1434     peripheral->callback = callback;
1435     peripheral->start_group_handle = service->start_group_handle;
1436     peripheral->end_group_handle   = service->end_group_handle;
1437     peripheral->filter_with_uuid = 0;
1438     peripheral->characteristic_start_handle = 0;
1439     peripheral->gatt_client_state = P_W2_SEND_ALL_CHARACTERISTICS_OF_SERVICE_QUERY;
1440     gatt_client_run();
1441     return 0;
1442 }
1443 
1444 uint8_t gatt_client_find_included_services_for_service(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_service_t *service){
1445     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1446 
1447     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1448     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1449 
1450     peripheral->callback = callback;
1451     peripheral->start_group_handle = service->start_group_handle;
1452     peripheral->end_group_handle   = service->end_group_handle;
1453     peripheral->gatt_client_state = P_W2_SEND_INCLUDED_SERVICE_QUERY;
1454 
1455     gatt_client_run();
1456     return 0;
1457 }
1458 
1459 uint8_t gatt_client_discover_characteristics_for_handle_range_by_uuid16(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t start_handle, uint16_t end_handle, uint16_t uuid16){
1460     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1461 
1462     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1463     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1464 
1465     peripheral->callback = callback;
1466     peripheral->start_group_handle = start_handle;
1467     peripheral->end_group_handle   = end_handle;
1468     peripheral->filter_with_uuid = 1;
1469     peripheral->uuid16 = uuid16;
1470     uuid_add_bluetooth_prefix((uint8_t*) &(peripheral->uuid128), uuid16);
1471     peripheral->characteristic_start_handle = 0;
1472     peripheral->gatt_client_state = P_W2_SEND_CHARACTERISTIC_WITH_UUID_QUERY;
1473 
1474     gatt_client_run();
1475     return 0;
1476 }
1477 
1478 uint8_t gatt_client_discover_characteristics_for_handle_range_by_uuid128(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t start_handle, uint16_t end_handle, uint8_t * uuid128){
1479     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1480 
1481     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1482     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1483 
1484     peripheral->callback = callback;
1485     peripheral->start_group_handle = start_handle;
1486     peripheral->end_group_handle   = end_handle;
1487     peripheral->filter_with_uuid = 1;
1488     peripheral->uuid16 = 0;
1489     memcpy(peripheral->uuid128, uuid128, 16);
1490     peripheral->characteristic_start_handle = 0;
1491     peripheral->gatt_client_state = P_W2_SEND_CHARACTERISTIC_WITH_UUID_QUERY;
1492 
1493     gatt_client_run();
1494     return 0;
1495 }
1496 
1497 
1498 uint8_t gatt_client_discover_characteristics_for_service_by_uuid16(btstack_packet_handler_t callback, uint16_t handle, gatt_client_service_t *service, uint16_t  uuid16){
1499     return gatt_client_discover_characteristics_for_handle_range_by_uuid16(callback, handle, service->start_group_handle, service->end_group_handle, uuid16);
1500 }
1501 
1502 uint8_t gatt_client_discover_characteristics_for_service_by_uuid128(btstack_packet_handler_t callback, uint16_t handle, gatt_client_service_t *service, uint8_t * uuid128){
1503     return gatt_client_discover_characteristics_for_handle_range_by_uuid128(callback, handle, service->start_group_handle, service->end_group_handle, uuid128);
1504 }
1505 
1506 uint8_t gatt_client_discover_characteristic_descriptors(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_characteristic_t *characteristic){
1507     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1508 
1509     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1510     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1511 
1512     if (characteristic->value_handle == characteristic->end_handle){
1513         emit_gatt_complete_event(peripheral, 0);
1514         return 0;
1515     }
1516     peripheral->callback = callback;
1517     peripheral->start_group_handle = characteristic->value_handle + 1;
1518     peripheral->end_group_handle   = characteristic->end_handle;
1519     peripheral->gatt_client_state = P_W2_SEND_ALL_CHARACTERISTIC_DESCRIPTORS_QUERY;
1520 
1521     gatt_client_run();
1522     return 0;
1523 }
1524 
1525 uint8_t gatt_client_read_value_of_characteristic_using_value_handle(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t value_handle){
1526     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1527 
1528     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1529     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1530 
1531     peripheral->callback = callback;
1532     peripheral->attribute_handle = value_handle;
1533     peripheral->attribute_offset = 0;
1534     peripheral->gatt_client_state = P_W2_SEND_READ_CHARACTERISTIC_VALUE_QUERY;
1535     gatt_client_run();
1536     return 0;
1537 }
1538 
1539 uint8_t gatt_client_read_value_of_characteristics_by_uuid16(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t start_handle, uint16_t end_handle, uint16_t uuid16){
1540     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1541 
1542     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1543     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1544 
1545     peripheral->callback = callback;
1546     peripheral->start_group_handle = start_handle;
1547     peripheral->end_group_handle = end_handle;
1548     peripheral->query_start_handle = start_handle;
1549     peripheral->query_end_handle = end_handle;
1550     peripheral->uuid16 = uuid16;
1551     uuid_add_bluetooth_prefix((uint8_t*) &(peripheral->uuid128), uuid16);
1552     peripheral->gatt_client_state = P_W2_SEND_READ_BY_TYPE_REQUEST;
1553     gatt_client_run();
1554     return 0;
1555 }
1556 
1557 uint8_t gatt_client_read_value_of_characteristics_by_uuid128(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t start_handle, uint16_t end_handle, uint8_t * uuid128){
1558     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1559 
1560     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1561     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1562 
1563     peripheral->callback = callback;
1564     peripheral->start_group_handle = start_handle;
1565     peripheral->end_group_handle = end_handle;
1566     peripheral->query_start_handle = start_handle;
1567     peripheral->query_end_handle = end_handle;
1568     peripheral->uuid16 = 0;
1569     memcpy(peripheral->uuid128, uuid128, 16);
1570     peripheral->gatt_client_state = P_W2_SEND_READ_BY_TYPE_REQUEST;
1571     gatt_client_run();
1572     return 0;
1573 }
1574 
1575 
1576 uint8_t gatt_client_read_value_of_characteristic(btstack_packet_handler_t callback, uint16_t handle, gatt_client_characteristic_t *characteristic){
1577     return gatt_client_read_value_of_characteristic_using_value_handle(callback, handle, characteristic->value_handle);
1578 }
1579 
1580 uint8_t gatt_client_read_long_value_of_characteristic_using_value_handle_with_offset(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t characteristic_value_handle, uint16_t offset){
1581     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1582 
1583     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1584     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1585 
1586     peripheral->callback = callback;
1587     peripheral->attribute_handle = characteristic_value_handle;
1588     peripheral->attribute_offset = offset;
1589     peripheral->gatt_client_state = P_W2_SEND_READ_BLOB_QUERY;
1590     gatt_client_run();
1591     return 0;
1592 }
1593 
1594 uint8_t gatt_client_read_long_value_of_characteristic_using_value_handle(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t characteristic_value_handle){
1595     return gatt_client_read_long_value_of_characteristic_using_value_handle_with_offset(callback, con_handle, characteristic_value_handle, 0);
1596 }
1597 
1598 uint8_t gatt_client_read_long_value_of_characteristic(btstack_packet_handler_t callback, uint16_t handle, gatt_client_characteristic_t *characteristic){
1599     return gatt_client_read_long_value_of_characteristic_using_value_handle(callback, handle, characteristic->value_handle);
1600 }
1601 
1602 uint8_t gatt_client_read_multiple_characteristic_values(btstack_packet_handler_t callback, hci_con_handle_t con_handle, int num_value_handles, uint16_t * value_handles){
1603     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1604 
1605     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1606     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1607 
1608     peripheral->callback = callback;
1609     peripheral->read_multiple_handle_count = num_value_handles;
1610     peripheral->read_multiple_handles = value_handles;
1611     peripheral->gatt_client_state = P_W2_SEND_READ_MULTIPLE_REQUEST;
1612     gatt_client_run();
1613     return 0;
1614 }
1615 
1616 uint8_t gatt_client_write_value_of_characteristic_without_response(hci_con_handle_t con_handle, uint16_t value_handle, uint16_t value_length, uint8_t * value){
1617     gatt_client_t * peripheral = provide_context_for_conn_handle(con_handle);
1618 
1619     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1620     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1621 
1622     if (value_length > peripheral_mtu(peripheral) - 3) return GATT_CLIENT_VALUE_TOO_LONG;
1623     if (!att_dispatch_client_can_send_now(peripheral->con_handle)) return GATT_CLIENT_BUSY;
1624 
1625     att_write_request(ATT_WRITE_COMMAND, peripheral->con_handle, value_handle, value_length, value);
1626     return 0;
1627 }
1628 
1629 uint8_t gatt_client_write_value_of_characteristic(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t value_handle, uint16_t value_length, uint8_t * data){
1630     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1631 
1632     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1633     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1634 
1635     peripheral->callback = callback;
1636     peripheral->attribute_handle = value_handle;
1637     peripheral->attribute_length = value_length;
1638     peripheral->attribute_value = data;
1639     peripheral->gatt_client_state = P_W2_SEND_WRITE_CHARACTERISTIC_VALUE;
1640     gatt_client_run();
1641     return 0;
1642 }
1643 
1644 uint8_t gatt_client_write_long_value_of_characteristic_with_offset(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t value_handle, uint16_t offset, uint16_t value_length, uint8_t  * data){
1645     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1646 
1647     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1648     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1649 
1650     peripheral->callback = callback;
1651     peripheral->attribute_handle = value_handle;
1652     peripheral->attribute_length = value_length;
1653     peripheral->attribute_offset = offset;
1654     peripheral->attribute_value = data;
1655     peripheral->gatt_client_state = P_W2_PREPARE_WRITE;
1656     gatt_client_run();
1657     return 0;
1658 }
1659 
1660 uint8_t gatt_client_write_long_value_of_characteristic(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t value_handle, uint16_t value_length, uint8_t * value){
1661     return gatt_client_write_long_value_of_characteristic_with_offset(callback, con_handle, value_handle, 0, value_length, value);
1662 }
1663 
1664 uint8_t gatt_client_reliable_write_long_value_of_characteristic(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t value_handle, uint16_t value_length, uint8_t * value){
1665     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1666 
1667     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1668     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1669 
1670     peripheral->callback = callback;
1671     peripheral->attribute_handle = value_handle;
1672     peripheral->attribute_length = value_length;
1673     peripheral->attribute_offset = 0;
1674     peripheral->attribute_value = value;
1675     peripheral->gatt_client_state = P_W2_PREPARE_RELIABLE_WRITE;
1676     gatt_client_run();
1677     return 0;
1678 }
1679 
1680 uint8_t gatt_client_write_client_characteristic_configuration(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_characteristic_t * characteristic, uint16_t configuration){
1681     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1682 
1683     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1684     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1685 
1686     if ( (configuration & GATT_CLIENT_CHARACTERISTICS_CONFIGURATION_NOTIFICATION) &&
1687         (characteristic->properties & ATT_PROPERTY_NOTIFY) == 0) {
1688         log_info("gatt_client_write_client_characteristic_configuration: GATT_CLIENT_CHARACTERISTIC_NOTIFICATION_NOT_SUPPORTED");
1689         return GATT_CLIENT_CHARACTERISTIC_NOTIFICATION_NOT_SUPPORTED;
1690     } else if ( (configuration & GATT_CLIENT_CHARACTERISTICS_CONFIGURATION_INDICATION) &&
1691                (characteristic->properties & ATT_PROPERTY_INDICATE) == 0){
1692         log_info("gatt_client_write_client_characteristic_configuration: GATT_CLIENT_CHARACTERISTIC_INDICATION_NOT_SUPPORTED");
1693         return GATT_CLIENT_CHARACTERISTIC_INDICATION_NOT_SUPPORTED;
1694     }
1695 
1696     peripheral->callback = callback;
1697     peripheral->start_group_handle = characteristic->value_handle;
1698     peripheral->end_group_handle = characteristic->end_handle;
1699     little_endian_store_16(peripheral->client_characteristic_configuration_value, 0, configuration);
1700 
1701     peripheral->gatt_client_state = P_W2_SEND_READ_CLIENT_CHARACTERISTIC_CONFIGURATION_QUERY;
1702     gatt_client_run();
1703     return 0;
1704 }
1705 
1706 uint8_t gatt_client_read_characteristic_descriptor_using_descriptor_handle(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t descriptor_handle){
1707     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1708 
1709     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1710     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1711 
1712     peripheral->callback = callback;
1713     peripheral->attribute_handle = descriptor_handle;
1714 
1715     peripheral->gatt_client_state = P_W2_SEND_READ_CHARACTERISTIC_DESCRIPTOR_QUERY;
1716     gatt_client_run();
1717     return 0;
1718 }
1719 
1720 uint8_t gatt_client_read_characteristic_descriptor(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_characteristic_descriptor_t * descriptor){
1721     return gatt_client_read_characteristic_descriptor_using_descriptor_handle(callback, con_handle, descriptor->handle);
1722 }
1723 
1724 uint8_t gatt_client_read_long_characteristic_descriptor_using_descriptor_handle_with_offset(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t descriptor_handle, uint16_t offset){
1725     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1726 
1727     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1728     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1729 
1730     peripheral->callback = callback;
1731     peripheral->attribute_handle = descriptor_handle;
1732     peripheral->attribute_offset = offset;
1733     peripheral->gatt_client_state = P_W2_SEND_READ_BLOB_CHARACTERISTIC_DESCRIPTOR_QUERY;
1734     gatt_client_run();
1735     return 0;
1736 }
1737 
1738 uint8_t gatt_client_read_long_characteristic_descriptor_using_descriptor_handle(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t descriptor_handle){
1739     return gatt_client_read_long_characteristic_descriptor_using_descriptor_handle_with_offset(callback, con_handle, descriptor_handle, 0);
1740 }
1741 
1742 uint8_t gatt_client_read_long_characteristic_descriptor(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_characteristic_descriptor_t * descriptor){
1743     return gatt_client_read_long_characteristic_descriptor_using_descriptor_handle(callback, con_handle, descriptor->handle);
1744 }
1745 
1746 uint8_t gatt_client_write_characteristic_descriptor_using_descriptor_handle(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t descriptor_handle, uint16_t length, uint8_t  * data){
1747     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1748 
1749     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1750     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1751 
1752     peripheral->callback = callback;
1753     peripheral->attribute_handle = descriptor_handle;
1754     peripheral->attribute_length = length;
1755     peripheral->attribute_offset = 0;
1756     peripheral->attribute_value = data;
1757     peripheral->gatt_client_state = P_W2_SEND_WRITE_CHARACTERISTIC_DESCRIPTOR;
1758     gatt_client_run();
1759     return 0;
1760 }
1761 
1762 uint8_t gatt_client_write_characteristic_descriptor(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_characteristic_descriptor_t * descriptor, uint16_t length, uint8_t * value){
1763     return gatt_client_write_characteristic_descriptor_using_descriptor_handle(callback, con_handle, descriptor->handle, length, value);
1764 }
1765 
1766 uint8_t gatt_client_write_long_characteristic_descriptor_using_descriptor_handle_with_offset(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t descriptor_handle, uint16_t offset, uint16_t length, uint8_t  * data){
1767     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1768 
1769     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1770     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1771 
1772     peripheral->callback = callback;
1773     peripheral->attribute_handle = descriptor_handle;
1774     peripheral->attribute_length = length;
1775     peripheral->attribute_offset = offset;
1776     peripheral->attribute_value = data;
1777     peripheral->gatt_client_state = P_W2_PREPARE_WRITE_CHARACTERISTIC_DESCRIPTOR;
1778     gatt_client_run();
1779     return 0;
1780 }
1781 
1782 uint8_t gatt_client_write_long_characteristic_descriptor_using_descriptor_handle(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t descriptor_handle, uint16_t length, uint8_t * data){
1783     return gatt_client_write_long_characteristic_descriptor_using_descriptor_handle_with_offset(callback, con_handle, descriptor_handle, 0, length, data );
1784 }
1785 
1786 uint8_t gatt_client_write_long_characteristic_descriptor(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_characteristic_descriptor_t * descriptor, uint16_t length, uint8_t * value){
1787     return gatt_client_write_long_characteristic_descriptor_using_descriptor_handle(callback, con_handle, descriptor->handle, length, value);
1788 }
1789 
1790 /**
1791  * @brief -> gatt complete event
1792  */
1793 uint8_t gatt_client_prepare_write(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t attribute_handle, uint16_t offset, uint16_t length, uint8_t * data){
1794     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1795 
1796     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1797     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1798 
1799     peripheral->callback = callback;
1800     peripheral->attribute_handle = attribute_handle;
1801     peripheral->attribute_length = length;
1802     peripheral->attribute_offset = offset;
1803     peripheral->attribute_value = data;
1804     peripheral->gatt_client_state = P_W2_PREPARE_WRITE_SINGLE;
1805     gatt_client_run();
1806     return 0;
1807 }
1808 
1809 /**
1810  * @brief -> gatt complete event
1811  */
1812 uint8_t gatt_client_execute_write(btstack_packet_handler_t callback, hci_con_handle_t con_handle){
1813     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1814 
1815     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1816     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1817 
1818     peripheral->callback = callback;
1819     peripheral->gatt_client_state = P_W2_EXECUTE_PREPARED_WRITE;
1820     gatt_client_run();
1821     return 0;
1822 }
1823 
1824 /**
1825  * @brief -> gatt complete event
1826  */
1827 uint8_t gatt_client_cancel_write(btstack_packet_handler_t callback, hci_con_handle_t con_handle){
1828     gatt_client_t * peripheral = provide_context_for_conn_handle_and_start_timer(con_handle);
1829 
1830     if (!peripheral) return BTSTACK_MEMORY_ALLOC_FAILED;
1831     if (!is_ready(peripheral)) return GATT_CLIENT_IN_WRONG_STATE;
1832 
1833     peripheral->callback = callback;
1834     peripheral->gatt_client_state = P_W2_CANCEL_PREPARED_WRITE;
1835     gatt_client_run();
1836     return 0;
1837 }
1838 
1839 void gatt_client_pts_suppress_mtu_exchange(void){
1840     pts_suppress_mtu_exchange = 1;
1841 }
1842 
1843 void gatt_client_deserialize_service(const uint8_t *packet, int offset, gatt_client_service_t *service){
1844     service->start_group_handle = little_endian_read_16(packet, offset);
1845     service->end_group_handle = little_endian_read_16(packet, offset + 2);
1846     reverse_128(&packet[offset + 4], service->uuid128);
1847     if (uuid_has_bluetooth_prefix(service->uuid128)){
1848         service->uuid16 = big_endian_read_32(service->uuid128, 0);
1849     }
1850 }
1851 
1852 void gatt_client_deserialize_characteristic(const uint8_t * packet, int offset, gatt_client_characteristic_t * characteristic){
1853     characteristic->start_handle = little_endian_read_16(packet, offset);
1854     characteristic->value_handle = little_endian_read_16(packet, offset + 2);
1855     characteristic->end_handle = little_endian_read_16(packet, offset + 4);
1856     characteristic->properties = little_endian_read_16(packet, offset + 6);
1857     characteristic->uuid16 = little_endian_read_16(packet, offset + 8);
1858     reverse_128(&packet[offset+10], characteristic->uuid128);
1859     if (uuid_has_bluetooth_prefix(characteristic->uuid128)){
1860         characteristic->uuid16 = big_endian_read_32(characteristic->uuid128, 0);
1861     }
1862 }
1863 
1864 void gatt_client_deserialize_characteristic_descriptor(const uint8_t * packet, int offset, gatt_client_characteristic_descriptor_t * descriptor){
1865     descriptor->handle = little_endian_read_16(packet, offset);
1866     reverse_128(&packet[offset+2], descriptor->uuid128);
1867 }
1868