xref: /btstack/src/ble/gatt_client.c (revision f4ab45812f54c9a2c59f22c9ccc1aaaa4576eb3f)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "gatt_client.c"
39 
40 #include <stdint.h>
41 #include <string.h>
42 #include <stddef.h>
43 
44 #include "btstack_config.h"
45 
46 #include "att_dispatch.h"
47 #include "ad_parser.h"
48 #include "ble/att_db.h"
49 #include "ble/core.h"
50 #include "ble/gatt_client.h"
51 #include "ble/le_device_db.h"
52 #include "ble/sm.h"
53 #include "btstack_debug.h"
54 #include "btstack_event.h"
55 #include "btstack_memory.h"
56 #include "btstack_run_loop.h"
57 #include "btstack_util.h"
58 #include "classic/sdp_util.h"
59 #include "hci.h"
60 #include "hci_cmd.h"
61 #include "hci_dump.h"
62 #include "l2cap.h"
63 
64 static btstack_linked_list_t gatt_client_connections;
65 static btstack_linked_list_t gatt_client_value_listeners;
66 static btstack_packet_callback_registration_t hci_event_callback_registration;
67 static btstack_packet_callback_registration_t sm_event_callback_registration;
68 
69 // GATT Client Configuration
70 static bool                 gatt_client_mtu_exchange_enabled;
71 static gap_security_level_t gatt_client_required_security_level;
72 
73 static void gatt_client_att_packet_handler(uint8_t packet_type, uint16_t handle, uint8_t *packet, uint16_t size);
74 static void gatt_client_event_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size);
75 static void gatt_client_report_error_if_pending(gatt_client_t *gatt_client, uint8_t att_error_code);
76 
77 #ifdef ENABLE_LE_SIGNED_WRITE
78 static void att_signed_write_handle_cmac_result(uint8_t hash[8]);
79 #endif
80 
81 void gatt_client_init(void){
82     gatt_client_connections = NULL;
83 
84     // default configuration
85     gatt_client_mtu_exchange_enabled    = true;
86     gatt_client_required_security_level = LEVEL_0;
87 
88     // register for HCI Events
89     hci_event_callback_registration.callback = &gatt_client_event_packet_handler;
90     hci_add_event_handler(&hci_event_callback_registration);
91 
92     // register for SM Events
93     sm_event_callback_registration.callback = &gatt_client_event_packet_handler;
94     sm_add_event_handler(&sm_event_callback_registration);
95 
96     // and ATT Client PDUs
97     att_dispatch_register_client(gatt_client_att_packet_handler);
98 }
99 
100 void gatt_client_set_required_security_level(gap_security_level_t level){
101     gatt_client_required_security_level = level;
102 }
103 
104 static gatt_client_t * gatt_client_for_timer(btstack_timer_source_t * ts){
105     btstack_linked_list_iterator_t it;
106     btstack_linked_list_iterator_init(&it, &gatt_client_connections);
107     while (btstack_linked_list_iterator_has_next(&it)){
108         gatt_client_t * gatt_client = (gatt_client_t *) btstack_linked_list_iterator_next(&it);
109         if (&gatt_client->gc_timeout == ts) {
110             return gatt_client;
111         }
112     }
113     return NULL;
114 }
115 
116 static void gatt_client_timeout_handler(btstack_timer_source_t * timer){
117     gatt_client_t * gatt_client = gatt_client_for_timer(timer);
118     if (gatt_client == NULL) return;
119     log_info("GATT client timeout handle, handle 0x%02x", gatt_client->con_handle);
120     gatt_client_report_error_if_pending(gatt_client, ATT_ERROR_TIMEOUT);
121 }
122 
123 static void gatt_client_timeout_start(gatt_client_t * gatt_client){
124     log_info("GATT client timeout start, handle 0x%02x", gatt_client->con_handle);
125     btstack_run_loop_remove_timer(&gatt_client->gc_timeout);
126     btstack_run_loop_set_timer_handler(&gatt_client->gc_timeout, gatt_client_timeout_handler);
127     btstack_run_loop_set_timer(&gatt_client->gc_timeout, 30000); // 30 seconds sm timeout
128     btstack_run_loop_add_timer(&gatt_client->gc_timeout);
129 }
130 
131 static void gatt_client_timeout_stop(gatt_client_t * gatt_client){
132     log_info("GATT client timeout stop, handle 0x%02x", gatt_client->con_handle);
133     btstack_run_loop_remove_timer(&gatt_client->gc_timeout);
134 }
135 
136 static gap_security_level_t gatt_client_le_security_level_for_connection(hci_con_handle_t con_handle){
137     uint8_t encryption_key_size = gap_encryption_key_size(con_handle);
138     if (encryption_key_size == 0) return LEVEL_0;
139 
140     uint8_t authenticated = gap_authenticated(con_handle);
141     if (!authenticated) return LEVEL_2;
142 
143     return encryption_key_size == 16 ? LEVEL_4 : LEVEL_3;
144 }
145 
146 static gatt_client_t * gatt_client_get_context_for_handle(uint16_t handle){
147     btstack_linked_item_t *it;
148     for (it = (btstack_linked_item_t *) gatt_client_connections; it != NULL; it = it->next){
149         gatt_client_t * gatt_client = (gatt_client_t *) it;
150         if (gatt_client->con_handle == handle){
151             return gatt_client;
152         }
153     }
154     return NULL;
155 }
156 
157 
158 // @returns gatt_client context
159 // returns existing one, or tries to setup new one
160 static gatt_client_t * gatt_client_provide_context_for_handle(hci_con_handle_t con_handle){
161     gatt_client_t * gatt_client = gatt_client_get_context_for_handle(con_handle);
162     if (gatt_client != NULL) return gatt_client;
163 
164     // bail if no such hci connection
165     hci_connection_t * hci_connection = hci_connection_for_handle(con_handle);
166     if (hci_connection == NULL){
167         log_error("No connection for handle 0x%04x", con_handle);
168         return NULL;
169     }
170     gatt_client = btstack_memory_gatt_client_get();
171     if (!gatt_client) return NULL;
172     // init state
173     gatt_client->con_handle = con_handle;
174     gatt_client->mtu = ATT_DEFAULT_MTU;
175     gatt_client->security_level = gatt_client_le_security_level_for_connection(con_handle);
176     if (gatt_client_mtu_exchange_enabled){
177         gatt_client->mtu_state = SEND_MTU_EXCHANGE;
178     } else {
179         gatt_client->mtu_state = MTU_AUTO_EXCHANGE_DISABLED;
180     }
181     gatt_client->gatt_client_state = P_READY;
182     btstack_linked_list_add(&gatt_client_connections, (btstack_linked_item_t*)gatt_client);
183 
184     // get unenhanced att bearer state
185     if (hci_connection->att_connection.mtu_exchanged){
186         gatt_client->mtu = hci_connection->att_connection.mtu;
187         gatt_client->mtu_state = MTU_EXCHANGED;
188     }
189 
190     return gatt_client;
191 }
192 
193 static gatt_client_t * gatt_client_provide_context_for_handle_and_start_timer(hci_con_handle_t con_handle){
194     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle(con_handle);
195     if (gatt_client == NULL) return NULL;
196     gatt_client_timeout_start(gatt_client);
197     return gatt_client;
198 }
199 
200 static int is_ready(gatt_client_t * gatt_client){
201     return gatt_client->gatt_client_state == P_READY;
202 }
203 
204 int gatt_client_is_ready(hci_con_handle_t con_handle){
205     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle(con_handle);
206     if (gatt_client == NULL) return 0;
207     return is_ready(gatt_client);
208 }
209 
210 void gatt_client_mtu_enable_auto_negotiation(uint8_t enabled){
211     gatt_client_mtu_exchange_enabled = enabled != 0;
212 }
213 
214 uint8_t gatt_client_get_mtu(hci_con_handle_t con_handle, uint16_t * mtu){
215     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle(con_handle);
216     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
217 
218     if ((gatt_client->mtu_state == MTU_EXCHANGED) || (gatt_client->mtu_state == MTU_AUTO_EXCHANGE_DISABLED)){
219         *mtu = gatt_client->mtu;
220         return ERROR_CODE_SUCCESS;
221     }
222     *mtu = ATT_DEFAULT_MTU;
223     return GATT_CLIENT_IN_WRONG_STATE;
224 }
225 
226 // precondition: can_send_packet_now == TRUE
227 static uint8_t att_confirmation(uint16_t con_handle){
228     l2cap_reserve_packet_buffer();
229     uint8_t * request = l2cap_get_outgoing_buffer();
230     request[0] = ATT_HANDLE_VALUE_CONFIRMATION;
231 
232     return l2cap_send_prepared_connectionless(con_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 1);
233 }
234 
235 // precondition: can_send_packet_now == TRUE
236 static uint8_t att_find_information_request(uint16_t request_type, uint16_t con_handle, uint16_t start_handle, uint16_t end_handle){
237     l2cap_reserve_packet_buffer();
238     uint8_t * request = l2cap_get_outgoing_buffer();
239     request[0] = request_type;
240     little_endian_store_16(request, 1, start_handle);
241     little_endian_store_16(request, 3, end_handle);
242 
243     return l2cap_send_prepared_connectionless(con_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 5);
244 }
245 
246 // precondition: can_send_packet_now == TRUE
247 static uint8_t att_find_by_type_value_request(uint16_t request_type, uint16_t attribute_group_type, uint16_t con_handle, uint16_t start_handle, uint16_t end_handle, uint8_t * value, uint16_t value_size){
248     l2cap_reserve_packet_buffer();
249     uint8_t * request = l2cap_get_outgoing_buffer();
250 
251     request[0] = request_type;
252     little_endian_store_16(request, 1, start_handle);
253     little_endian_store_16(request, 3, end_handle);
254     little_endian_store_16(request, 5, attribute_group_type);
255     (void)memcpy(&request[7], value, value_size);
256 
257     return l2cap_send_prepared_connectionless(con_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 7u + value_size);
258 }
259 
260 // precondition: can_send_packet_now == TRUE
261 static uint8_t att_read_by_type_or_group_request_for_uuid16(uint16_t request_type, uint16_t uuid16, uint16_t con_handle, uint16_t start_handle, uint16_t end_handle){
262     l2cap_reserve_packet_buffer();
263     uint8_t * request = l2cap_get_outgoing_buffer();
264     request[0] = request_type;
265     little_endian_store_16(request, 1, start_handle);
266     little_endian_store_16(request, 3, end_handle);
267     little_endian_store_16(request, 5, uuid16);
268 
269     return l2cap_send_prepared_connectionless(con_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 7);
270 }
271 
272 // precondition: can_send_packet_now == TRUE
273 static uint8_t att_read_by_type_or_group_request_for_uuid128(uint16_t request_type, uint8_t * uuid128, uint16_t con_handle, uint16_t start_handle, uint16_t end_handle){
274     l2cap_reserve_packet_buffer();
275     uint8_t * request = l2cap_get_outgoing_buffer();
276     request[0] = request_type;
277     little_endian_store_16(request, 1, start_handle);
278     little_endian_store_16(request, 3, end_handle);
279     reverse_128(uuid128, &request[5]);
280 
281     return l2cap_send_prepared_connectionless(con_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 21);
282 }
283 
284 // precondition: can_send_packet_now == TRUE
285 static uint8_t att_read_request(uint16_t request_type, uint16_t con_handle, uint16_t attribute_handle){
286     l2cap_reserve_packet_buffer();
287     uint8_t * request = l2cap_get_outgoing_buffer();
288     request[0] = request_type;
289     little_endian_store_16(request, 1, attribute_handle);
290 
291     return l2cap_send_prepared_connectionless(con_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 3);
292 }
293 
294 // precondition: can_send_packet_now == TRUE
295 static uint8_t att_read_blob_request(uint16_t request_type, uint16_t con_handle, uint16_t attribute_handle, uint16_t value_offset){
296     l2cap_reserve_packet_buffer();
297     uint8_t * request = l2cap_get_outgoing_buffer();
298     request[0] = request_type;
299     little_endian_store_16(request, 1, attribute_handle);
300     little_endian_store_16(request, 3, value_offset);
301 
302     return l2cap_send_prepared_connectionless(con_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 5);
303 }
304 
305 static uint8_t att_read_multiple_request(uint16_t con_handle, uint16_t num_value_handles, uint16_t * value_handles){
306     l2cap_reserve_packet_buffer();
307     uint8_t * request = l2cap_get_outgoing_buffer();
308     request[0] = ATT_READ_MULTIPLE_REQUEST;
309     int i;
310     int offset = 1;
311     for (i=0;i<num_value_handles;i++){
312         little_endian_store_16(request, offset, value_handles[i]);
313         offset += 2;
314     }
315 
316     return l2cap_send_prepared_connectionless(con_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, offset);
317 }
318 
319 #ifdef ENABLE_LE_SIGNED_WRITE
320 // precondition: can_send_packet_now == TRUE
321 static uint8_t att_signed_write_request(uint16_t request_type, uint16_t con_handle, uint16_t attribute_handle, uint16_t value_length, uint8_t * value, uint32_t sign_counter, uint8_t sgn[8]){
322     l2cap_reserve_packet_buffer();
323     uint8_t * request = l2cap_get_outgoing_buffer();
324     request[0] = request_type;
325     little_endian_store_16(request, 1, attribute_handle);
326     (void)memcpy(&request[3], value, value_length);
327     little_endian_store_32(request, 3 + value_length, sign_counter);
328     reverse_64(sgn, &request[3 + value_length + 4]);
329 
330     return l2cap_send_prepared_connectionless(con_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 3 + value_length + 12);
331 }
332 #endif
333 
334 // precondition: can_send_packet_now == TRUE
335 static uint8_t att_write_request(uint16_t request_type, uint16_t con_handle, uint16_t attribute_handle, uint16_t value_length, uint8_t * value){
336     l2cap_reserve_packet_buffer();
337     uint8_t * request = l2cap_get_outgoing_buffer();
338     request[0] = request_type;
339     little_endian_store_16(request, 1, attribute_handle);
340     (void)memcpy(&request[3], value, value_length);
341 
342     return l2cap_send_prepared_connectionless(con_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 3u + value_length);
343 }
344 
345 // precondition: can_send_packet_now == TRUE
346 static uint8_t att_execute_write_request(uint16_t request_type, uint16_t con_handle, uint8_t execute_write){
347     l2cap_reserve_packet_buffer();
348     uint8_t * request = l2cap_get_outgoing_buffer();
349     request[0] = request_type;
350     request[1] = execute_write;
351 
352     return l2cap_send_prepared_connectionless(con_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 2);
353 }
354 
355 // precondition: can_send_packet_now == TRUE
356 static uint8_t att_prepare_write_request(uint16_t request_type, uint16_t con_handle, uint16_t attribute_handle, uint16_t value_offset, uint16_t blob_length, uint8_t * value){
357     l2cap_reserve_packet_buffer();
358     uint8_t * request = l2cap_get_outgoing_buffer();
359     request[0] = request_type;
360     little_endian_store_16(request, 1, attribute_handle);
361     little_endian_store_16(request, 3, value_offset);
362     (void)memcpy(&request[5], &value[value_offset], blob_length);
363 
364     return l2cap_send_prepared_connectionless(con_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 5u + blob_length);
365 }
366 
367 static uint8_t att_exchange_mtu_request(uint16_t con_handle){
368     uint16_t mtu = l2cap_max_le_mtu();
369     l2cap_reserve_packet_buffer();
370     uint8_t * request = l2cap_get_outgoing_buffer();
371     request[0] = ATT_EXCHANGE_MTU_REQUEST;
372     little_endian_store_16(request, 1, mtu);
373 
374     return l2cap_send_prepared_connectionless(con_handle, L2CAP_CID_ATTRIBUTE_PROTOCOL, 3);
375 }
376 
377 static uint16_t write_blob_length(gatt_client_t * gatt_client){
378     uint16_t max_blob_length = gatt_client->mtu - 5u;
379     if (gatt_client->attribute_offset >= gatt_client->attribute_length) {
380         return 0;
381     }
382     uint16_t rest_length = gatt_client->attribute_length - gatt_client->attribute_offset;
383     if (max_blob_length > rest_length){
384         return rest_length;
385     }
386     return max_blob_length;
387 }
388 
389 static void send_gatt_services_request(gatt_client_t *gatt_client){
390     att_read_by_type_or_group_request_for_uuid16(ATT_READ_BY_GROUP_TYPE_REQUEST, GATT_PRIMARY_SERVICE_UUID, gatt_client->con_handle, gatt_client->start_group_handle, gatt_client->end_group_handle);
391 }
392 
393 static void send_gatt_by_uuid_request(gatt_client_t *gatt_client, uint16_t attribute_group_type){
394     if (gatt_client->uuid16){
395         uint8_t uuid16[2];
396         little_endian_store_16(uuid16, 0, gatt_client->uuid16);
397         att_find_by_type_value_request(ATT_FIND_BY_TYPE_VALUE_REQUEST, attribute_group_type, gatt_client->con_handle, gatt_client->start_group_handle, gatt_client->end_group_handle, uuid16, 2);
398         return;
399     }
400     uint8_t uuid128[16];
401     reverse_128(gatt_client->uuid128, uuid128);
402     att_find_by_type_value_request(ATT_FIND_BY_TYPE_VALUE_REQUEST, attribute_group_type, gatt_client->con_handle, gatt_client->start_group_handle, gatt_client->end_group_handle, uuid128, 16);
403 }
404 
405 static void send_gatt_services_by_uuid_request(gatt_client_t *gatt_client){
406     send_gatt_by_uuid_request(gatt_client, GATT_PRIMARY_SERVICE_UUID);
407 }
408 
409 static void send_gatt_included_service_uuid_request(gatt_client_t *gatt_client){
410     att_read_request(ATT_READ_REQUEST, gatt_client->con_handle, gatt_client->query_start_handle);
411 }
412 
413 static void send_gatt_included_service_request(gatt_client_t *gatt_client){
414     att_read_by_type_or_group_request_for_uuid16(ATT_READ_BY_TYPE_REQUEST, GATT_INCLUDE_SERVICE_UUID, gatt_client->con_handle, gatt_client->start_group_handle, gatt_client->end_group_handle);
415 }
416 
417 static void send_gatt_characteristic_request(gatt_client_t *gatt_client){
418     att_read_by_type_or_group_request_for_uuid16(ATT_READ_BY_TYPE_REQUEST, GATT_CHARACTERISTICS_UUID, gatt_client->con_handle, gatt_client->start_group_handle, gatt_client->end_group_handle);
419 }
420 
421 static void send_gatt_characteristic_descriptor_request(gatt_client_t *gatt_client){
422     att_find_information_request(ATT_FIND_INFORMATION_REQUEST, gatt_client->con_handle, gatt_client->start_group_handle, gatt_client->end_group_handle);
423 }
424 
425 static void send_gatt_read_characteristic_value_request(gatt_client_t *gatt_client){
426     att_read_request(ATT_READ_REQUEST, gatt_client->con_handle, gatt_client->attribute_handle);
427 }
428 
429 static void send_gatt_read_by_type_request(gatt_client_t * gatt_client){
430     if (gatt_client->uuid16){
431         att_read_by_type_or_group_request_for_uuid16(ATT_READ_BY_TYPE_REQUEST, gatt_client->uuid16, gatt_client->con_handle, gatt_client->start_group_handle, gatt_client->end_group_handle);
432     } else {
433         att_read_by_type_or_group_request_for_uuid128(ATT_READ_BY_TYPE_REQUEST, gatt_client->uuid128, gatt_client->con_handle, gatt_client->start_group_handle, gatt_client->end_group_handle);
434     }
435 }
436 
437 static void send_gatt_read_blob_request(gatt_client_t *gatt_client){
438     att_read_blob_request(ATT_READ_BLOB_REQUEST, gatt_client->con_handle, gatt_client->attribute_handle, gatt_client->attribute_offset);
439 }
440 
441 static void send_gatt_read_multiple_request(gatt_client_t * gatt_client){
442     att_read_multiple_request(gatt_client->con_handle, gatt_client->read_multiple_handle_count, gatt_client->read_multiple_handles);
443 }
444 
445 static void send_gatt_write_attribute_value_request(gatt_client_t * gatt_client){
446     att_write_request(ATT_WRITE_REQUEST, gatt_client->con_handle, gatt_client->attribute_handle, gatt_client->attribute_length, gatt_client->attribute_value);
447 }
448 
449 static void send_gatt_write_client_characteristic_configuration_request(gatt_client_t * gatt_client){
450     att_write_request(ATT_WRITE_REQUEST, gatt_client->con_handle, gatt_client->client_characteristic_configuration_handle, 2, gatt_client->client_characteristic_configuration_value);
451 }
452 
453 static void send_gatt_prepare_write_request(gatt_client_t * gatt_client){
454     att_prepare_write_request(ATT_PREPARE_WRITE_REQUEST, gatt_client->con_handle, gatt_client->attribute_handle, gatt_client->attribute_offset, write_blob_length(gatt_client), gatt_client->attribute_value);
455 }
456 
457 static void send_gatt_execute_write_request(gatt_client_t * gatt_client){
458     att_execute_write_request(ATT_EXECUTE_WRITE_REQUEST, gatt_client->con_handle, 1);
459 }
460 
461 static void send_gatt_cancel_prepared_write_request(gatt_client_t * gatt_client){
462     att_execute_write_request(ATT_EXECUTE_WRITE_REQUEST, gatt_client->con_handle, 0);
463 }
464 
465 #ifndef ENABLE_GATT_FIND_INFORMATION_FOR_CCC_DISCOVERY
466 static void send_gatt_read_client_characteristic_configuration_request(gatt_client_t * gatt_client){
467     att_read_by_type_or_group_request_for_uuid16(ATT_READ_BY_TYPE_REQUEST, GATT_CLIENT_CHARACTERISTICS_CONFIGURATION, gatt_client->con_handle, gatt_client->start_group_handle, gatt_client->end_group_handle);
468 }
469 #endif
470 
471 static void send_gatt_read_characteristic_descriptor_request(gatt_client_t * gatt_client){
472     att_read_request(ATT_READ_REQUEST, gatt_client->con_handle, gatt_client->attribute_handle);
473 }
474 
475 #ifdef ENABLE_LE_SIGNED_WRITE
476 static void send_gatt_signed_write_request(gatt_client_t * gatt_client, uint32_t sign_counter){
477     att_signed_write_request(ATT_SIGNED_WRITE_COMMAND, gatt_client->con_handle, gatt_client->attribute_handle, gatt_client->attribute_length, gatt_client->attribute_value, sign_counter, gatt_client->cmac);
478 }
479 #endif
480 
481 static uint16_t get_last_result_handle_from_service_list(uint8_t * packet, uint16_t size){
482     uint8_t attr_length = packet[1];
483     return little_endian_read_16(packet, size - attr_length + 2u);
484 }
485 
486 static uint16_t get_last_result_handle_from_characteristics_list(uint8_t * packet, uint16_t size){
487     uint8_t attr_length = packet[1];
488     return little_endian_read_16(packet, size - attr_length + 3u);
489 }
490 
491 static uint16_t get_last_result_handle_from_included_services_list(uint8_t * packet, uint16_t size){
492     uint8_t attr_length = packet[1];
493     return little_endian_read_16(packet, size - attr_length);
494 }
495 
496 static void gatt_client_handle_transaction_complete(gatt_client_t * gatt_client){
497     gatt_client->gatt_client_state = P_READY;
498     gatt_client_timeout_stop(gatt_client);
499 }
500 
501 static void emit_event_new(btstack_packet_handler_t callback, uint8_t * packet, uint16_t size){
502     if (!callback) return;
503     hci_dump_packet(HCI_EVENT_PACKET, 0, packet, size);
504     (*callback)(HCI_EVENT_PACKET, 0, packet, size);
505 }
506 
507 void gatt_client_listen_for_characteristic_value_updates(gatt_client_notification_t * notification, btstack_packet_handler_t packet_handler, hci_con_handle_t con_handle, gatt_client_characteristic_t * characteristic){
508     notification->callback = packet_handler;
509     notification->con_handle = con_handle;
510     if (characteristic == NULL){
511         notification->attribute_handle = GATT_CLIENT_ANY_VALUE_HANDLE;
512     } else {
513         notification->attribute_handle = characteristic->value_handle;
514     }
515     btstack_linked_list_add(&gatt_client_value_listeners, (btstack_linked_item_t*) notification);
516 }
517 
518 void gatt_client_stop_listening_for_characteristic_value_updates(gatt_client_notification_t * notification){
519     btstack_linked_list_remove(&gatt_client_value_listeners, (btstack_linked_item_t*) notification);
520 }
521 
522 static void emit_event_to_registered_listeners(hci_con_handle_t con_handle, uint16_t attribute_handle, uint8_t * packet, uint16_t size){
523     btstack_linked_list_iterator_t it;
524     btstack_linked_list_iterator_init(&it, &gatt_client_value_listeners);
525     while (btstack_linked_list_iterator_has_next(&it)){
526         gatt_client_notification_t * notification = (gatt_client_notification_t*) btstack_linked_list_iterator_next(&it);
527         if ((notification->con_handle       != GATT_CLIENT_ANY_CONNECTION)   && (notification->con_handle       != con_handle)) continue;
528         if ((notification->attribute_handle != GATT_CLIENT_ANY_VALUE_HANDLE) && (notification->attribute_handle != attribute_handle)) continue;
529         (*notification->callback)(HCI_EVENT_PACKET, 0, packet, size);
530     }
531 }
532 
533 static void emit_gatt_complete_event(gatt_client_t * gatt_client, uint8_t att_status){
534     // @format H1
535     uint8_t packet[5];
536     packet[0] = GATT_EVENT_QUERY_COMPLETE;
537     packet[1] = 3;
538     little_endian_store_16(packet, 2, gatt_client->con_handle);
539     packet[4] = att_status;
540     emit_event_new(gatt_client->callback, packet, sizeof(packet));
541 }
542 
543 static void emit_gatt_service_query_result_event(gatt_client_t * gatt_client, uint16_t start_group_handle, uint16_t end_group_handle, uint8_t * uuid128){
544     // @format HX
545     uint8_t packet[24];
546     packet[0] = GATT_EVENT_SERVICE_QUERY_RESULT;
547     packet[1] = sizeof(packet) - 2u;
548     little_endian_store_16(packet, 2, gatt_client->con_handle);
549     ///
550     little_endian_store_16(packet, 4, start_group_handle);
551     little_endian_store_16(packet, 6, end_group_handle);
552     reverse_128(uuid128, &packet[8]);
553     emit_event_new(gatt_client->callback, packet, sizeof(packet));
554 }
555 
556 static void emit_gatt_included_service_query_result_event(gatt_client_t * gatt_client, uint16_t include_handle, uint16_t start_group_handle, uint16_t end_group_handle, uint8_t * uuid128){
557     // @format HX
558     uint8_t packet[26];
559     packet[0] = GATT_EVENT_INCLUDED_SERVICE_QUERY_RESULT;
560     packet[1] = sizeof(packet) - 2u;
561     little_endian_store_16(packet, 2, gatt_client->con_handle);
562     ///
563     little_endian_store_16(packet, 4, include_handle);
564     //
565     little_endian_store_16(packet, 6, start_group_handle);
566     little_endian_store_16(packet, 8, end_group_handle);
567     reverse_128(uuid128, &packet[10]);
568     emit_event_new(gatt_client->callback, packet, sizeof(packet));
569 }
570 
571 static void emit_gatt_characteristic_query_result_event(gatt_client_t * gatt_client, uint16_t start_handle, uint16_t value_handle, uint16_t end_handle,
572                                                         uint16_t properties, uint8_t * uuid128){
573     // @format HY
574     uint8_t packet[28];
575     packet[0] = GATT_EVENT_CHARACTERISTIC_QUERY_RESULT;
576     packet[1] = sizeof(packet) - 2u;
577     little_endian_store_16(packet, 2, gatt_client->con_handle);
578     ///
579     little_endian_store_16(packet, 4,  start_handle);
580     little_endian_store_16(packet, 6,  value_handle);
581     little_endian_store_16(packet, 8,  end_handle);
582     little_endian_store_16(packet, 10, properties);
583     reverse_128(uuid128, &packet[12]);
584     emit_event_new(gatt_client->callback, packet, sizeof(packet));
585 }
586 
587 static void emit_gatt_all_characteristic_descriptors_result_event(
588         gatt_client_t * gatt_client, uint16_t descriptor_handle, uint8_t * uuid128){
589     // @format HZ
590     uint8_t packet[22];
591     packet[0] = GATT_EVENT_ALL_CHARACTERISTIC_DESCRIPTORS_QUERY_RESULT;
592     packet[1] = sizeof(packet) - 2u;
593     little_endian_store_16(packet, 2, gatt_client->con_handle);
594     ///
595     little_endian_store_16(packet, 4,  descriptor_handle);
596     reverse_128(uuid128, &packet[6]);
597     emit_event_new(gatt_client->callback, packet, sizeof(packet));
598 }
599 
600 static void emit_gatt_mtu_exchanged_result_event(gatt_client_t * gatt_client, uint16_t new_mtu){
601     // @format H2
602     uint8_t packet[6];
603     packet[0] = GATT_EVENT_MTU;
604     packet[1] = sizeof(packet) - 2u;
605     little_endian_store_16(packet, 2, gatt_client->con_handle);
606     little_endian_store_16(packet, 4, new_mtu);
607     att_dispatch_client_mtu_exchanged(gatt_client->con_handle, new_mtu);
608     emit_event_new(gatt_client->callback, packet, sizeof(packet));
609 }
610 ///
611 static void report_gatt_services(gatt_client_t * gatt_client, uint8_t * packet, uint16_t size){
612     uint8_t attr_length = packet[1];
613     uint8_t uuid_length = attr_length - 4u;
614 
615     int i;
616     for (i = 2; i < size; i += attr_length){
617         uint16_t start_group_handle = little_endian_read_16(packet,i);
618         uint16_t end_group_handle   = little_endian_read_16(packet,i+2);
619         uint8_t  uuid128[16];
620         uint16_t uuid16 = 0;
621 
622         if (uuid_length == 2u){
623             uuid16 = little_endian_read_16(packet, i+4);
624             uuid_add_bluetooth_prefix((uint8_t*) &uuid128, uuid16);
625         } else {
626             reverse_128(&packet[i+4], uuid128);
627         }
628         emit_gatt_service_query_result_event(gatt_client, start_group_handle, end_group_handle, uuid128);
629     }
630 }
631 
632 // helper
633 static void characteristic_start_found(gatt_client_t * gatt_client, uint16_t start_handle, uint8_t properties, uint16_t value_handle, uint8_t * uuid, uint16_t uuid_length){
634     uint8_t uuid128[16];
635     uint16_t uuid16 = 0;
636     if (uuid_length == 2u){
637         uuid16 = little_endian_read_16(uuid, 0);
638         uuid_add_bluetooth_prefix((uint8_t*) uuid128, uuid16);
639     } else if (uuid_length == 16u){
640         reverse_128(uuid, uuid128);
641     } else {
642         return;
643     }
644 
645     if (gatt_client->filter_with_uuid && (memcmp(gatt_client->uuid128, uuid128, 16) != 0)) return;
646 
647     gatt_client->characteristic_properties = properties;
648     gatt_client->characteristic_start_handle = start_handle;
649     gatt_client->attribute_handle = value_handle;
650 
651     if (gatt_client->filter_with_uuid) return;
652 
653     gatt_client->uuid16 = uuid16;
654     (void)memcpy(gatt_client->uuid128, uuid128, 16);
655 }
656 
657 static void characteristic_end_found(gatt_client_t * gatt_client, uint16_t end_handle){
658     // TODO: stop searching if filter and uuid found
659 
660     if (!gatt_client->characteristic_start_handle) return;
661 
662     emit_gatt_characteristic_query_result_event(gatt_client, gatt_client->characteristic_start_handle, gatt_client->attribute_handle,
663                                                 end_handle, gatt_client->characteristic_properties, gatt_client->uuid128);
664 
665     gatt_client->characteristic_start_handle = 0;
666 }
667 
668 static void report_gatt_characteristics(gatt_client_t * gatt_client, uint8_t * packet, uint16_t size){
669     if (size < 2u) return;
670     uint8_t attr_length = packet[1];
671     if ((attr_length != 7u) && (attr_length != 21u)) return;
672     uint8_t uuid_length = attr_length - 5u;
673     int i;
674     for (i = 2u; (i + attr_length) <= size; i += attr_length){
675         uint16_t start_handle = little_endian_read_16(packet, i);
676         uint8_t  properties = packet[i+2];
677         uint16_t value_handle = little_endian_read_16(packet, i+3);
678         characteristic_end_found(gatt_client, start_handle - 1u);
679         characteristic_start_found(gatt_client, start_handle, properties, value_handle, &packet[i + 5], uuid_length);
680     }
681 }
682 
683 static void report_gatt_included_service_uuid16(gatt_client_t * gatt_client, uint16_t include_handle, uint16_t uuid16){
684     uint8_t normalized_uuid128[16];
685     uuid_add_bluetooth_prefix(normalized_uuid128, uuid16);
686     emit_gatt_included_service_query_result_event(gatt_client, include_handle, gatt_client->query_start_handle,
687                                                   gatt_client->query_end_handle, normalized_uuid128);
688 }
689 
690 static void report_gatt_included_service_uuid128(gatt_client_t * gatt_client, uint16_t include_handle, uint8_t *uuid128){
691     emit_gatt_included_service_query_result_event(gatt_client, include_handle, gatt_client->query_start_handle,
692                                                   gatt_client->query_end_handle, uuid128);
693 }
694 
695 // @returns packet pointer
696 // @note assume that value is part of an l2cap buffer - overwrite HCI + L2CAP packet headers
697 static const int characteristic_value_event_header_size = 8;
698 static uint8_t * setup_characteristic_value_packet(uint8_t type, hci_con_handle_t con_handle, uint16_t attribute_handle, uint8_t * value, uint16_t length){
699 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
700     // avoid using pre ATT headers.
701     return NULL;
702 #endif
703     // before the value inside the ATT PDU
704     uint8_t * packet = value - characteristic_value_event_header_size;
705     packet[0] = type;
706     packet[1] = characteristic_value_event_header_size - 2 + length;
707     little_endian_store_16(packet, 2, con_handle);
708     little_endian_store_16(packet, 4, attribute_handle);
709     little_endian_store_16(packet, 6, length);
710     return packet;
711 }
712 
713 // @returns packet pointer
714 // @note assume that value is part of an l2cap buffer - overwrite parts of the HCI/L2CAP/ATT packet (4/4/3) bytes
715 static const int long_characteristic_value_event_header_size = 10;
716 static uint8_t * setup_long_characteristic_value_packet(uint8_t type, hci_con_handle_t con_handle, uint16_t attribute_handle, uint16_t offset, uint8_t * value, uint16_t length){
717 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
718     // avoid using pre ATT headers.
719     return NULL;
720 #endif
721 #if defined(HCI_INCOMING_PRE_BUFFER_SIZE) && (HCI_INCOMING_PRE_BUFFER_SIZE >= 10 - 8) // L2CAP Header (4) - ACL Header (4)
722     // before the value inside the ATT PDU
723     uint8_t * packet = value - long_characteristic_value_event_header_size;
724     packet[0] = type;
725     packet[1] = long_characteristic_value_event_header_size - 2 + length;
726     little_endian_store_16(packet, 2, con_handle);
727     little_endian_store_16(packet, 4, attribute_handle);
728     little_endian_store_16(packet, 6, offset);
729     little_endian_store_16(packet, 8, length);
730     return packet;
731 #else
732     log_error("HCI_INCOMING_PRE_BUFFER_SIZE >= 2 required for long characteristic reads");
733     return NULL;
734 #endif
735 }
736 
737 // test if notification/indication should be delivered to application (BLESA)
738 static bool gatt_client_accept_server_message(hci_con_handle_t con_handle){
739 #ifdef ENABLE_LE_PROACTIVE_AUTHENTICATION
740 	// ignore messages until re-encryption is complete
741     if (gap_reconnect_security_setup_active(con_handle)) return false;
742 
743 	// after that ignore if bonded but not encrypted
744 	return !gap_bonded(con_handle) || (gap_encryption_key_size(con_handle) > 0);
745 #else
746     UNUSED(con_handle);
747 	return true;
748 #endif
749 }
750 
751 
752 // @note assume that value is part of an l2cap buffer - overwrite parts of the HCI/L2CAP/ATT packet (4/4/3) bytes
753 static void report_gatt_notification(hci_con_handle_t con_handle, uint16_t value_handle, uint8_t * value, int length){
754 	if (!gatt_client_accept_server_message(con_handle)) return;
755     uint8_t * packet = setup_characteristic_value_packet(GATT_EVENT_NOTIFICATION, con_handle, value_handle, value, length);
756     emit_event_to_registered_listeners(con_handle, value_handle, packet, characteristic_value_event_header_size + length);
757 }
758 
759 // @note assume that value is part of an l2cap buffer - overwrite parts of the HCI/L2CAP/ATT packet (4/4/3) bytes
760 static void report_gatt_indication(hci_con_handle_t con_handle, uint16_t value_handle, uint8_t * value, int length){
761 	if (!gatt_client_accept_server_message(con_handle)) return;
762     uint8_t * packet = setup_characteristic_value_packet(GATT_EVENT_INDICATION, con_handle, value_handle, value, length);
763     emit_event_to_registered_listeners(con_handle, value_handle, packet, characteristic_value_event_header_size + length);
764 }
765 
766 // @note assume that value is part of an l2cap buffer - overwrite parts of the HCI/L2CAP/ATT packet (4/4/3) bytes
767 static void report_gatt_characteristic_value(gatt_client_t * gatt_client, uint16_t attribute_handle, uint8_t * value, uint16_t length){
768     uint8_t * packet = setup_characteristic_value_packet(GATT_EVENT_CHARACTERISTIC_VALUE_QUERY_RESULT, gatt_client->con_handle, attribute_handle, value, length);
769     emit_event_new(gatt_client->callback, packet, characteristic_value_event_header_size + length);
770 }
771 
772 // @note assume that value is part of an l2cap buffer - overwrite parts of the HCI/L2CAP/ATT packet (4/4/3) bytes
773 static void report_gatt_long_characteristic_value_blob(gatt_client_t * gatt_client, uint16_t attribute_handle, uint8_t * blob, uint16_t blob_length, int value_offset){
774     uint8_t * packet = setup_long_characteristic_value_packet(GATT_EVENT_LONG_CHARACTERISTIC_VALUE_QUERY_RESULT, gatt_client->con_handle, attribute_handle, value_offset, blob, blob_length);
775     if (!packet) return;
776     emit_event_new(gatt_client->callback, packet, blob_length + long_characteristic_value_event_header_size);
777 }
778 
779 static void report_gatt_characteristic_descriptor(gatt_client_t * gatt_client, uint16_t descriptor_handle, uint8_t *value, uint16_t value_length, uint16_t value_offset){
780     UNUSED(value_offset);
781     uint8_t * packet = setup_characteristic_value_packet(GATT_EVENT_CHARACTERISTIC_DESCRIPTOR_QUERY_RESULT, gatt_client->con_handle, descriptor_handle, value, value_length);
782     emit_event_new(gatt_client->callback, packet, value_length + 8u);
783 }
784 
785 static void report_gatt_long_characteristic_descriptor(gatt_client_t * gatt_client, uint16_t descriptor_handle, uint8_t *blob, uint16_t blob_length, uint16_t value_offset){
786     uint8_t * packet = setup_long_characteristic_value_packet(GATT_EVENT_LONG_CHARACTERISTIC_DESCRIPTOR_QUERY_RESULT, gatt_client->con_handle, descriptor_handle, value_offset, blob, blob_length);
787     if (!packet) return;
788     emit_event_new(gatt_client->callback, packet, blob_length + long_characteristic_value_event_header_size);
789 }
790 
791 static void report_gatt_all_characteristic_descriptors(gatt_client_t * gatt_client, uint8_t * packet, uint16_t size, uint16_t pair_size){
792     int i;
793     for (i = 0u; (i + pair_size) <= size; i += pair_size){
794         uint16_t descriptor_handle = little_endian_read_16(packet,i);
795         uint8_t uuid128[16];
796         uint16_t uuid16 = 0;
797         if (pair_size == 4u){
798             uuid16 = little_endian_read_16(packet,i+2);
799             uuid_add_bluetooth_prefix(uuid128, uuid16);
800         } else {
801             reverse_128(&packet[i+2], uuid128);
802         }
803         emit_gatt_all_characteristic_descriptors_result_event(gatt_client, descriptor_handle, uuid128);
804     }
805 
806 }
807 
808 static int is_query_done(gatt_client_t * gatt_client, uint16_t last_result_handle){
809     return last_result_handle >= gatt_client->end_group_handle;
810 }
811 
812 static void trigger_next_query(gatt_client_t * gatt_client, uint16_t last_result_handle, gatt_client_state_t next_query_state){
813     if (is_query_done(gatt_client, last_result_handle)){
814         gatt_client_handle_transaction_complete(gatt_client);
815         emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
816         return;
817     }
818     // next
819     gatt_client->start_group_handle = last_result_handle + 1u;
820     gatt_client->gatt_client_state = next_query_state;
821 }
822 
823 static void trigger_next_included_service_query(gatt_client_t * gatt_client, uint16_t last_result_handle){
824     trigger_next_query(gatt_client, last_result_handle, P_W2_SEND_INCLUDED_SERVICE_QUERY);
825 }
826 
827 static void trigger_next_service_query(gatt_client_t * gatt_client, uint16_t last_result_handle){
828     trigger_next_query(gatt_client, last_result_handle, P_W2_SEND_SERVICE_QUERY);
829 }
830 
831 static void trigger_next_service_by_uuid_query(gatt_client_t * gatt_client, uint16_t last_result_handle){
832     trigger_next_query(gatt_client, last_result_handle, P_W2_SEND_SERVICE_WITH_UUID_QUERY);
833 }
834 
835 static void trigger_next_characteristic_query(gatt_client_t * gatt_client, uint16_t last_result_handle){
836     if (is_query_done(gatt_client, last_result_handle)){
837         // report last characteristic
838         characteristic_end_found(gatt_client, gatt_client->end_group_handle);
839     }
840     trigger_next_query(gatt_client, last_result_handle, P_W2_SEND_ALL_CHARACTERISTICS_OF_SERVICE_QUERY);
841 }
842 
843 static void trigger_next_characteristic_descriptor_query(gatt_client_t * gatt_client, uint16_t last_result_handle){
844     trigger_next_query(gatt_client, last_result_handle, P_W2_SEND_ALL_CHARACTERISTIC_DESCRIPTORS_QUERY);
845 }
846 
847 static void trigger_next_read_by_type_query(gatt_client_t * gatt_client, uint16_t last_result_handle){
848     trigger_next_query(gatt_client, last_result_handle, P_W2_SEND_READ_BY_TYPE_REQUEST);
849 }
850 
851 static void trigger_next_prepare_write_query(gatt_client_t * gatt_client, gatt_client_state_t next_query_state, gatt_client_state_t done_state){
852     gatt_client->attribute_offset += write_blob_length(gatt_client);
853     uint16_t next_blob_length =  write_blob_length(gatt_client);
854 
855     if (next_blob_length == 0u){
856         gatt_client->gatt_client_state = done_state;
857         return;
858     }
859     gatt_client->gatt_client_state = next_query_state;
860 }
861 
862 static void trigger_next_blob_query(gatt_client_t * gatt_client, gatt_client_state_t next_query_state, uint16_t received_blob_length){
863 
864     uint16_t max_blob_length = gatt_client->mtu - 1u;
865     if (received_blob_length < max_blob_length){
866         gatt_client_handle_transaction_complete(gatt_client);
867         emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
868         return;
869     }
870 
871     gatt_client->attribute_offset += received_blob_length;
872     gatt_client->gatt_client_state = next_query_state;
873 }
874 
875 
876 static int is_value_valid(gatt_client_t *gatt_client, uint8_t *packet, uint16_t size){
877     uint16_t attribute_handle = little_endian_read_16(packet, 1);
878     uint16_t value_offset = little_endian_read_16(packet, 3);
879 
880     if (gatt_client->attribute_handle != attribute_handle) return 0;
881     if (gatt_client->attribute_offset != value_offset) return 0;
882     return memcmp(&gatt_client->attribute_value[gatt_client->attribute_offset], &packet[5], size - 5u) == 0u;
883 }
884 
885 // returns 1 if packet was sent
886 static bool gatt_client_run_for_gatt_client(gatt_client_t * gatt_client){
887 
888     // wait until re-encryption is complete
889     if (gap_reconnect_security_setup_active(gatt_client->con_handle)) return false;
890 
891     // wait until re-encryption is complete
892     if (gatt_client->reencryption_active) return false;
893 
894     // wait until pairing complete (either reactive authentication or due to required security level)
895     if (gatt_client->wait_for_authentication_complete) return false;
896 
897     bool client_request_pending = gatt_client->gatt_client_state != P_READY;
898 
899     // verify security level for Mandatory Authentication
900     if (client_request_pending && (gatt_client_required_security_level > gatt_client->security_level)){
901         log_info("Trigger pairing, current security level %u, required %u\n", gatt_client->security_level, gatt_client_required_security_level);
902         gatt_client->wait_for_authentication_complete = 1;
903         // set att error code for pairing failure based on required level
904         switch (gatt_client_required_security_level){
905             case LEVEL_4:
906             case LEVEL_3:
907                 gatt_client->pending_error_code = ATT_ERROR_INSUFFICIENT_AUTHENTICATION;
908                 break;
909             default:
910                 gatt_client->pending_error_code = ATT_ERROR_INSUFFICIENT_ENCRYPTION;
911                 break;
912         }
913         sm_request_pairing(gatt_client->con_handle);
914         // sm probably just sent a pdu
915         return true;
916     }
917 
918     switch (gatt_client->mtu_state) {
919         case SEND_MTU_EXCHANGE:
920             gatt_client->mtu_state = SENT_MTU_EXCHANGE;
921             att_exchange_mtu_request(gatt_client->con_handle);
922             return true;
923         case SENT_MTU_EXCHANGE:
924             return false;
925         default:
926             break;
927     }
928 
929     if (gatt_client->send_confirmation){
930         gatt_client->send_confirmation = 0;
931         att_confirmation(gatt_client->con_handle);
932         return true;
933     }
934 
935     // check MTU for writes
936     switch (gatt_client->gatt_client_state){
937         case P_W2_SEND_WRITE_CHARACTERISTIC_VALUE:
938         case P_W2_SEND_WRITE_CHARACTERISTIC_DESCRIPTOR:
939             if (gatt_client->attribute_length <= (gatt_client->mtu - 3u)) break;
940             log_error("gatt_client_run: value len %u > MTU %u - 3\n", gatt_client->attribute_length,gatt_client->mtu);
941             gatt_client_handle_transaction_complete(gatt_client);
942             emit_gatt_complete_event(gatt_client, ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LENGTH);
943             return false;
944         default:
945             break;
946     }
947 
948     switch (gatt_client->gatt_client_state){
949         case P_W2_SEND_SERVICE_QUERY:
950             gatt_client->gatt_client_state = P_W4_SERVICE_QUERY_RESULT;
951             send_gatt_services_request(gatt_client);
952             return true;
953 
954         case P_W2_SEND_SERVICE_WITH_UUID_QUERY:
955             gatt_client->gatt_client_state = P_W4_SERVICE_WITH_UUID_RESULT;
956             send_gatt_services_by_uuid_request(gatt_client);
957             return true;
958 
959         case P_W2_SEND_ALL_CHARACTERISTICS_OF_SERVICE_QUERY:
960             gatt_client->gatt_client_state = P_W4_ALL_CHARACTERISTICS_OF_SERVICE_QUERY_RESULT;
961             send_gatt_characteristic_request(gatt_client);
962             return true;
963 
964         case P_W2_SEND_CHARACTERISTIC_WITH_UUID_QUERY:
965             gatt_client->gatt_client_state = P_W4_CHARACTERISTIC_WITH_UUID_QUERY_RESULT;
966             send_gatt_characteristic_request(gatt_client);
967             return true;
968 
969         case P_W2_SEND_ALL_CHARACTERISTIC_DESCRIPTORS_QUERY:
970             gatt_client->gatt_client_state = P_W4_CHARACTERISTIC_WITH_UUID_QUERY_RESULT;
971             send_gatt_characteristic_descriptor_request(gatt_client);
972             return true;
973 
974         case P_W2_SEND_INCLUDED_SERVICE_QUERY:
975             gatt_client->gatt_client_state = P_W4_INCLUDED_SERVICE_QUERY_RESULT;
976             send_gatt_included_service_request(gatt_client);
977             return true;
978 
979         case P_W2_SEND_INCLUDED_SERVICE_WITH_UUID_QUERY:
980             gatt_client->gatt_client_state = P_W4_INCLUDED_SERVICE_UUID_WITH_QUERY_RESULT;
981             send_gatt_included_service_uuid_request(gatt_client);
982             return true;
983 
984         case P_W2_SEND_READ_CHARACTERISTIC_VALUE_QUERY:
985             gatt_client->gatt_client_state = P_W4_READ_CHARACTERISTIC_VALUE_RESULT;
986             send_gatt_read_characteristic_value_request(gatt_client);
987             return true;
988 
989         case P_W2_SEND_READ_BLOB_QUERY:
990             gatt_client->gatt_client_state = P_W4_READ_BLOB_RESULT;
991             send_gatt_read_blob_request(gatt_client);
992             return true;
993 
994         case P_W2_SEND_READ_BY_TYPE_REQUEST:
995             gatt_client->gatt_client_state = P_W4_READ_BY_TYPE_RESPONSE;
996             send_gatt_read_by_type_request(gatt_client);
997             return true;
998 
999         case P_W2_SEND_READ_MULTIPLE_REQUEST:
1000             gatt_client->gatt_client_state = P_W4_READ_MULTIPLE_RESPONSE;
1001             send_gatt_read_multiple_request(gatt_client);
1002             return true;
1003 
1004         case P_W2_SEND_WRITE_CHARACTERISTIC_VALUE:
1005             gatt_client->gatt_client_state = P_W4_WRITE_CHARACTERISTIC_VALUE_RESULT;
1006             send_gatt_write_attribute_value_request(gatt_client);
1007             return true;
1008 
1009         case P_W2_PREPARE_WRITE:
1010             gatt_client->gatt_client_state = P_W4_PREPARE_WRITE_RESULT;
1011             send_gatt_prepare_write_request(gatt_client);
1012             return true;
1013 
1014         case P_W2_PREPARE_WRITE_SINGLE:
1015             gatt_client->gatt_client_state = P_W4_PREPARE_WRITE_SINGLE_RESULT;
1016             send_gatt_prepare_write_request(gatt_client);
1017             return true;
1018 
1019         case P_W2_PREPARE_RELIABLE_WRITE:
1020             gatt_client->gatt_client_state = P_W4_PREPARE_RELIABLE_WRITE_RESULT;
1021             send_gatt_prepare_write_request(gatt_client);
1022             return true;
1023 
1024         case P_W2_EXECUTE_PREPARED_WRITE:
1025             gatt_client->gatt_client_state = P_W4_EXECUTE_PREPARED_WRITE_RESULT;
1026             send_gatt_execute_write_request(gatt_client);
1027             return true;
1028 
1029         case P_W2_CANCEL_PREPARED_WRITE:
1030             gatt_client->gatt_client_state = P_W4_CANCEL_PREPARED_WRITE_RESULT;
1031             send_gatt_cancel_prepared_write_request(gatt_client);
1032             return true;
1033 
1034         case P_W2_CANCEL_PREPARED_WRITE_DATA_MISMATCH:
1035             gatt_client->gatt_client_state = P_W4_CANCEL_PREPARED_WRITE_DATA_MISMATCH_RESULT;
1036             send_gatt_cancel_prepared_write_request(gatt_client);
1037             return true;
1038 
1039 #ifdef ENABLE_GATT_FIND_INFORMATION_FOR_CCC_DISCOVERY
1040         case P_W2_SEND_FIND_CLIENT_CHARACTERISTIC_CONFIGURATION_QUERY:
1041             // use Find Information
1042             gatt_client->gatt_client_state = P_W4_FIND_CLIENT_CHARACTERISTIC_CONFIGURATION_QUERY_RESULT;
1043             send_gatt_characteristic_descriptor_request(gatt_client);
1044 #else
1045         case P_W2_SEND_READ_CLIENT_CHARACTERISTIC_CONFIGURATION_QUERY:
1046             // Use Read By Type
1047             gatt_client->gatt_client_state = P_W4_READ_CLIENT_CHARACTERISTIC_CONFIGURATION_QUERY_RESULT;
1048             send_gatt_read_client_characteristic_configuration_request(gatt_client);
1049 #endif
1050             return true;
1051 
1052         case P_W2_SEND_READ_CHARACTERISTIC_DESCRIPTOR_QUERY:
1053             gatt_client->gatt_client_state = P_W4_READ_CHARACTERISTIC_DESCRIPTOR_RESULT;
1054             send_gatt_read_characteristic_descriptor_request(gatt_client);
1055             return true;
1056 
1057         case P_W2_SEND_READ_BLOB_CHARACTERISTIC_DESCRIPTOR_QUERY:
1058             gatt_client->gatt_client_state = P_W4_READ_BLOB_CHARACTERISTIC_DESCRIPTOR_RESULT;
1059             send_gatt_read_blob_request(gatt_client);
1060             return true;
1061 
1062         case P_W2_SEND_WRITE_CHARACTERISTIC_DESCRIPTOR:
1063             gatt_client->gatt_client_state = P_W4_WRITE_CHARACTERISTIC_DESCRIPTOR_RESULT;
1064             send_gatt_write_attribute_value_request(gatt_client);
1065             return true;
1066 
1067         case P_W2_WRITE_CLIENT_CHARACTERISTIC_CONFIGURATION:
1068             gatt_client->gatt_client_state = P_W4_CLIENT_CHARACTERISTIC_CONFIGURATION_RESULT;
1069             send_gatt_write_client_characteristic_configuration_request(gatt_client);
1070             return true;
1071 
1072         case P_W2_PREPARE_WRITE_CHARACTERISTIC_DESCRIPTOR:
1073             gatt_client->gatt_client_state = P_W4_PREPARE_WRITE_CHARACTERISTIC_DESCRIPTOR_RESULT;
1074             send_gatt_prepare_write_request(gatt_client);
1075             return true;
1076 
1077         case P_W2_EXECUTE_PREPARED_WRITE_CHARACTERISTIC_DESCRIPTOR:
1078             gatt_client->gatt_client_state = P_W4_EXECUTE_PREPARED_WRITE_CHARACTERISTIC_DESCRIPTOR_RESULT;
1079             send_gatt_execute_write_request(gatt_client);
1080             return true;
1081 
1082 #ifdef ENABLE_LE_SIGNED_WRITE
1083         case P_W4_IDENTITY_RESOLVING:
1084             log_info("P_W4_IDENTITY_RESOLVING - state %x", sm_identity_resolving_state(gatt_client->con_handle));
1085             switch (sm_identity_resolving_state(gatt_client->con_handle)){
1086                 case IRK_LOOKUP_SUCCEEDED:
1087                     gatt_client->le_device_index = sm_le_device_index(gatt_client->con_handle);
1088                     gatt_client->gatt_client_state = P_W4_CMAC_READY;
1089                     break;
1090                 case IRK_LOOKUP_FAILED:
1091                     gatt_client_handle_transaction_complete(gatt_client);
1092                     emit_gatt_complete_event(gatt_client, ATT_ERROR_BONDING_INFORMATION_MISSING);
1093                     return false;
1094                 default:
1095                     return false;
1096             }
1097 
1098             /* Fall through */
1099 
1100         case P_W4_CMAC_READY:
1101             if (sm_cmac_ready()){
1102                 sm_key_t csrk;
1103                 le_device_db_local_csrk_get(gatt_client->le_device_index, csrk);
1104                 uint32_t sign_counter = le_device_db_local_counter_get(gatt_client->le_device_index);
1105                 gatt_client->gatt_client_state = P_W4_CMAC_RESULT;
1106                 sm_cmac_signed_write_start(csrk, ATT_SIGNED_WRITE_COMMAND, gatt_client->attribute_handle, gatt_client->attribute_length, gatt_client->attribute_value, sign_counter, att_signed_write_handle_cmac_result);
1107             }
1108             return false;
1109 
1110         case P_W2_SEND_SIGNED_WRITE: {
1111             gatt_client->gatt_client_state = P_W4_SEND_SINGED_WRITE_DONE;
1112             // bump local signing counter
1113             uint32_t sign_counter = le_device_db_local_counter_get(gatt_client->le_device_index);
1114             le_device_db_local_counter_set(gatt_client->le_device_index, sign_counter + 1);
1115             // send signed write command
1116             send_gatt_signed_write_request(gatt_client, sign_counter);
1117             // finally, notifiy client that write is complete
1118             gatt_client_handle_transaction_complete(gatt_client);
1119             emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
1120             return true;
1121         }
1122 #endif
1123         default:
1124             break;
1125     }
1126 
1127     // requested can send snow?
1128     if (gatt_client->write_without_response_callback){
1129         btstack_packet_handler_t packet_handler = gatt_client->write_without_response_callback;
1130         gatt_client->write_without_response_callback = NULL;
1131         uint8_t event[4];
1132         event[0] = GATT_EVENT_CAN_WRITE_WITHOUT_RESPONSE;
1133         event[1] = sizeof(event) - 2u;
1134         little_endian_store_16(event, 2, gatt_client->con_handle);
1135         packet_handler(HCI_EVENT_PACKET, gatt_client->con_handle, event, sizeof(event));
1136         return true; // to trigger requeueing (even if higher layer didn't sent)
1137     }
1138 
1139     return false;
1140 }
1141 
1142 static void gatt_client_run(void){
1143     btstack_linked_item_t *it;
1144     for (it = (btstack_linked_item_t *) gatt_client_connections; it != NULL; it = it->next){
1145         gatt_client_t * gatt_client = (gatt_client_t *) it;
1146         if (!att_dispatch_client_can_send_now(gatt_client->con_handle)) {
1147             att_dispatch_client_request_can_send_now_event(gatt_client->con_handle);
1148             return;
1149         }
1150         bool packet_sent = gatt_client_run_for_gatt_client(gatt_client);
1151         if (packet_sent){
1152             // request new permission
1153             att_dispatch_client_request_can_send_now_event(gatt_client->con_handle);
1154             // requeue client for fairness and exit
1155             // note: iterator has become invalid
1156             btstack_linked_list_remove(&gatt_client_connections, (btstack_linked_item_t *) gatt_client);
1157             btstack_linked_list_add_tail(&gatt_client_connections, (btstack_linked_item_t *) gatt_client);
1158             return;
1159         }
1160     }
1161 }
1162 
1163 static void gatt_client_report_error_if_pending(gatt_client_t *gatt_client, uint8_t att_error_code) {
1164     if (is_ready(gatt_client) == 1) return;
1165     gatt_client_handle_transaction_complete(gatt_client);
1166     emit_gatt_complete_event(gatt_client, att_error_code);
1167 }
1168 
1169 static void gatt_client_event_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1170     UNUSED(channel);    // ok: handling own l2cap events
1171     UNUSED(size);       // ok: there is no channel
1172 
1173     if (packet_type != HCI_EVENT_PACKET) return;
1174 
1175     hci_con_handle_t con_handle;
1176     gatt_client_t * gatt_client;
1177     switch (hci_event_packet_get_type(packet)) {
1178         case HCI_EVENT_DISCONNECTION_COMPLETE:
1179             log_info("GATT Client: HCI_EVENT_DISCONNECTION_COMPLETE");
1180             con_handle = little_endian_read_16(packet,3);
1181             gatt_client = gatt_client_get_context_for_handle(con_handle);
1182             if (gatt_client == NULL) break;
1183 
1184             gatt_client_report_error_if_pending(gatt_client, ATT_ERROR_HCI_DISCONNECT_RECEIVED);
1185             gatt_client_timeout_stop(gatt_client);
1186             btstack_linked_list_remove(&gatt_client_connections, (btstack_linked_item_t *) gatt_client);
1187             btstack_memory_gatt_client_free(gatt_client);
1188             break;
1189 
1190         // Pairing complete (with/without bonding=storing of pairing information)
1191         case SM_EVENT_PAIRING_COMPLETE:
1192             con_handle = sm_event_pairing_complete_get_handle(packet);
1193             gatt_client = gatt_client_get_context_for_handle(con_handle);
1194             if (gatt_client == NULL) break;
1195 
1196             // update security level
1197             gatt_client->security_level = gatt_client_le_security_level_for_connection(con_handle);
1198 
1199             if (gatt_client->wait_for_authentication_complete){
1200                 gatt_client->wait_for_authentication_complete = 0;
1201                 if (sm_event_pairing_complete_get_status(packet)){
1202                     log_info("pairing failed, report previous error 0x%x", gatt_client->pending_error_code);
1203                     gatt_client_report_error_if_pending(gatt_client, gatt_client->pending_error_code);
1204                 } else {
1205                     log_info("pairing success, retry operation");
1206                 }
1207             }
1208             break;
1209 
1210 #ifdef ENABLE_LE_SIGNED_WRITE
1211         // Identity Resolving completed (no code, gatt_client_run will continue)
1212         case SM_EVENT_IDENTITY_RESOLVING_SUCCEEDED:
1213         case SM_EVENT_IDENTITY_RESOLVING_FAILED:
1214             break;
1215 #endif
1216 
1217         // re-encryption started
1218         case SM_EVENT_REENCRYPTION_STARTED:
1219             con_handle = sm_event_reencryption_complete_get_handle(packet);
1220             gatt_client = gatt_client_get_context_for_handle(con_handle);
1221             if (gatt_client == NULL) break;
1222 
1223             gatt_client->reencryption_active = true;
1224             gatt_client->reencryption_result = ERROR_CODE_SUCCESS;
1225             break;
1226 
1227         // re-encryption complete
1228         case SM_EVENT_REENCRYPTION_COMPLETE:
1229             con_handle = sm_event_reencryption_complete_get_handle(packet);
1230             gatt_client = gatt_client_get_context_for_handle(con_handle);
1231             if (gatt_client == NULL) break;
1232 
1233             // update security level
1234             gatt_client->security_level = gatt_client_le_security_level_for_connection(con_handle);
1235 
1236             gatt_client->reencryption_result = sm_event_reencryption_complete_get_status(packet);
1237             gatt_client->reencryption_active = false;
1238             gatt_client->wait_for_authentication_complete = 0;
1239 
1240             if (gatt_client->gatt_client_state == P_READY) break;
1241 
1242             switch (sm_event_reencryption_complete_get_status(packet)){
1243                 case ERROR_CODE_SUCCESS:
1244                     log_info("re-encryption success, retry operation");
1245                     break;
1246                 case ERROR_CODE_AUTHENTICATION_FAILURE:
1247                 case ERROR_CODE_PIN_OR_KEY_MISSING:
1248 #if defined(ENABLE_GATT_CLIENT_PAIRING) && !defined(ENABLE_LE_PROACTIVE_AUTHENTICATION)
1249                     if (gatt_client_required_security_level == LEVEL_0) {
1250                         // re-encryption failed for reactive authentication with pairing and we have a pending client request
1251                         // => try to resolve it by deleting bonding information if we started pairing before
1252                         // delete bonding information
1253                         int le_device_db_index = sm_le_device_index(gatt_client->con_handle);
1254                         btstack_assert(le_device_db_index >= 0);
1255                         log_info("reactive auth with pairing: delete bonding and start pairing");
1256 #ifdef ENABLE_LE_PRIVACY_ADDRESS_RESOLUTION
1257                         hci_remove_le_device_db_entry_from_resolving_list((uint16_t) le_device_db_index);
1258 #endif
1259                         le_device_db_remove(le_device_db_index);
1260                         // trigger pairing again
1261                         sm_request_pairing(gatt_client->con_handle);
1262                         break;
1263                     }
1264 #endif
1265                     // report bonding information missing
1266                     gatt_client_handle_transaction_complete(gatt_client);
1267                     emit_gatt_complete_event(gatt_client, ATT_ERROR_BONDING_INFORMATION_MISSING);
1268                     break;
1269                 default:
1270                     // report bonding information missing
1271                     gatt_client_handle_transaction_complete(gatt_client);
1272                     emit_gatt_complete_event(gatt_client, gatt_client->pending_error_code);
1273                     break;
1274             }
1275             break;
1276         default:
1277             break;
1278     }
1279 
1280     gatt_client_run();
1281 }
1282 
1283 static void gatt_client_att_packet_handler(uint8_t packet_type, uint16_t handle, uint8_t *packet, uint16_t size){
1284     gatt_client_t * gatt_client;
1285     if (size < 1u) return;
1286 
1287     if (packet_type == HCI_EVENT_PACKET) {
1288         switch (packet[0]){
1289             case L2CAP_EVENT_CAN_SEND_NOW:
1290                 gatt_client_run();
1291                 break;
1292             // att_server has negotiated the mtu for this connection, cache if context exists
1293             case ATT_EVENT_MTU_EXCHANGE_COMPLETE:
1294                 if (size < 6u) break;
1295                 gatt_client = gatt_client_get_context_for_handle(handle);
1296                 if (gatt_client == NULL) break;
1297                 gatt_client->mtu = little_endian_read_16(packet, 4);
1298                 break;
1299             default:
1300                 break;
1301         }
1302         return;
1303     }
1304 
1305     if (packet_type != ATT_DATA_PACKET) return;
1306 
1307     // special cases: notifications don't need a context while indications motivate creating one
1308     switch (packet[0]){
1309         case ATT_HANDLE_VALUE_NOTIFICATION:
1310             if (size < 3u) return;
1311             report_gatt_notification(handle, little_endian_read_16(packet,1u), &packet[3], size-3u);
1312             return;
1313         case ATT_HANDLE_VALUE_INDICATION:
1314             gatt_client = gatt_client_provide_context_for_handle(handle);
1315             break;
1316         default:
1317             gatt_client = gatt_client_get_context_for_handle(handle);
1318             break;
1319     }
1320 
1321     if (gatt_client == NULL) return;
1322 
1323     uint8_t error_code;
1324     switch (packet[0]){
1325         case ATT_EXCHANGE_MTU_RESPONSE:
1326         {
1327             if (size < 3u) break;
1328             uint16_t remote_rx_mtu = little_endian_read_16(packet, 1);
1329             uint16_t local_rx_mtu = l2cap_max_le_mtu();
1330             uint16_t mtu = (remote_rx_mtu < local_rx_mtu) ? remote_rx_mtu : local_rx_mtu;
1331 
1332             // set gatt client mtu
1333             gatt_client->mtu = mtu;
1334             gatt_client->mtu_state = MTU_EXCHANGED;
1335 
1336             // set per connection mtu state
1337             hci_connection_t * hci_connection = hci_connection_for_handle(handle);
1338             hci_connection->att_connection.mtu = gatt_client->mtu;
1339             hci_connection->att_connection.mtu_exchanged = true;
1340 
1341             emit_gatt_mtu_exchanged_result_event(gatt_client, gatt_client->mtu);
1342             break;
1343         }
1344         case ATT_READ_BY_GROUP_TYPE_RESPONSE:
1345             switch(gatt_client->gatt_client_state){
1346                 case P_W4_SERVICE_QUERY_RESULT:
1347                     report_gatt_services(gatt_client, packet, size);
1348                     trigger_next_service_query(gatt_client, get_last_result_handle_from_service_list(packet, size));
1349                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1350                     break;
1351                 default:
1352                     break;
1353             }
1354             break;
1355         case ATT_HANDLE_VALUE_INDICATION:
1356             if (size < 3u) break;
1357             report_gatt_indication(handle, little_endian_read_16(packet,1u), &packet[3], size-3u);
1358             gatt_client->send_confirmation = 1;
1359             break;
1360 
1361         case ATT_READ_BY_TYPE_RESPONSE:
1362             switch (gatt_client->gatt_client_state){
1363                 case P_W4_ALL_CHARACTERISTICS_OF_SERVICE_QUERY_RESULT:
1364                     report_gatt_characteristics(gatt_client, packet, size);
1365                     trigger_next_characteristic_query(gatt_client, get_last_result_handle_from_characteristics_list(packet, size));
1366                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done, or by ATT_ERROR
1367                     break;
1368                 case P_W4_CHARACTERISTIC_WITH_UUID_QUERY_RESULT:
1369                     report_gatt_characteristics(gatt_client, packet, size);
1370                     trigger_next_characteristic_query(gatt_client, get_last_result_handle_from_characteristics_list(packet, size));
1371                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done, or by ATT_ERROR
1372                     break;
1373                 case P_W4_INCLUDED_SERVICE_QUERY_RESULT:
1374                 {
1375                     if (size < 2u) break;
1376                     uint16_t uuid16 = 0;
1377                     uint16_t pair_size = packet[1];
1378 
1379                     if (pair_size == 6u){
1380                         if (size < 8u) break;
1381                         // UUIDs not available, query first included service
1382                         gatt_client->start_group_handle = little_endian_read_16(packet, 2); // ready for next query
1383                         gatt_client->query_start_handle = little_endian_read_16(packet, 4);
1384                         gatt_client->query_end_handle = little_endian_read_16(packet, 6);
1385                         gatt_client->gatt_client_state = P_W2_SEND_INCLUDED_SERVICE_WITH_UUID_QUERY;
1386                         break;
1387                     }
1388 
1389                     if (pair_size != 8u) break;
1390 
1391                     // UUIDs included, report all of them
1392                     uint16_t offset;
1393                     for (offset = 2u; (offset + 8u) <= size; offset += pair_size){
1394                         uint16_t include_handle = little_endian_read_16(packet, offset);
1395                         gatt_client->query_start_handle = little_endian_read_16(packet, offset + 2u);
1396                         gatt_client->query_end_handle = little_endian_read_16(packet, offset + 4u);
1397                         uuid16 = little_endian_read_16(packet, offset+6u);
1398                         report_gatt_included_service_uuid16(gatt_client, include_handle, uuid16);
1399                     }
1400 
1401                     trigger_next_included_service_query(gatt_client, get_last_result_handle_from_included_services_list(packet, size));
1402                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1403                     break;
1404                 }
1405 #ifndef ENABLE_GATT_FIND_INFORMATION_FOR_CCC_DISCOVERY
1406                 case P_W4_READ_CLIENT_CHARACTERISTIC_CONFIGURATION_QUERY_RESULT:
1407                     gatt_client->client_characteristic_configuration_handle = little_endian_read_16(packet, 2);
1408                     gatt_client->gatt_client_state = P_W2_WRITE_CLIENT_CHARACTERISTIC_CONFIGURATION;
1409                     break;
1410 #endif
1411                 case P_W4_READ_BY_TYPE_RESPONSE: {
1412                     uint16_t pair_size = packet[1];
1413                     uint16_t offset;
1414                     uint16_t last_result_handle = 0;
1415                     for (offset = 2; offset < size ; offset += pair_size){
1416                         uint16_t value_handle = little_endian_read_16(packet, offset);
1417                         report_gatt_characteristic_value(gatt_client, value_handle, &packet[offset + 2u], pair_size - 2u);
1418                         last_result_handle = value_handle;
1419                     }
1420                     trigger_next_read_by_type_query(gatt_client, last_result_handle);
1421                     break;
1422                 }
1423                 default:
1424                     break;
1425             }
1426             break;
1427         case ATT_READ_RESPONSE:
1428             switch (gatt_client->gatt_client_state){
1429                 case P_W4_INCLUDED_SERVICE_UUID_WITH_QUERY_RESULT: {
1430                     uint8_t uuid128[16];
1431                     reverse_128(&packet[1], uuid128);
1432                     report_gatt_included_service_uuid128(gatt_client, gatt_client->start_group_handle, uuid128);
1433                     trigger_next_included_service_query(gatt_client, gatt_client->start_group_handle);
1434                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1435                     break;
1436                 }
1437                 case P_W4_READ_CHARACTERISTIC_VALUE_RESULT:
1438                     gatt_client_handle_transaction_complete(gatt_client);
1439                     report_gatt_characteristic_value(gatt_client, gatt_client->attribute_handle, &packet[1], size - 1u);
1440                     emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
1441                     break;
1442 
1443                 case P_W4_READ_CHARACTERISTIC_DESCRIPTOR_RESULT:{
1444                     gatt_client_handle_transaction_complete(gatt_client);
1445                     report_gatt_characteristic_descriptor(gatt_client, gatt_client->attribute_handle, &packet[1], size - 1u, 0u);
1446                     emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
1447                     break;
1448                 }
1449                 default:
1450                     break;
1451             }
1452             break;
1453 
1454         case ATT_FIND_BY_TYPE_VALUE_RESPONSE:
1455         {
1456             uint8_t pair_size = 4;
1457             int i;
1458             uint16_t start_group_handle;
1459             uint16_t   end_group_handle= 0xffff; // asserts GATT_EVENT_QUERY_COMPLETE is emitted if no results
1460             for (i = 1u; (i + pair_size) <= size; i += pair_size){
1461                 start_group_handle = little_endian_read_16(packet,i);
1462                 end_group_handle = little_endian_read_16(packet,i+2);
1463                 emit_gatt_service_query_result_event(gatt_client, start_group_handle, end_group_handle, gatt_client->uuid128);
1464             }
1465             trigger_next_service_by_uuid_query(gatt_client, end_group_handle);
1466             // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1467             break;
1468         }
1469         case ATT_FIND_INFORMATION_REPLY:
1470         {
1471             if (size < 2u) break;
1472 
1473             uint8_t pair_size = 4;
1474             if (packet[1u] == 2u){
1475                 pair_size = 18;
1476             }
1477             uint16_t offset = 2;
1478 
1479             if (size < (pair_size + offset)) break;
1480             uint16_t last_descriptor_handle = little_endian_read_16(packet, size - pair_size);
1481 
1482 #ifdef ENABLE_GATT_FIND_INFORMATION_FOR_CCC_DISCOVERY
1483             log_info("ENABLE_GATT_FIND_INFORMATION_FOR_CCC_DISCOVERY, state %x", gatt_client->gatt_client_state);
1484             if (gatt_client->gatt_client_state == P_W4_FIND_CLIENT_CHARACTERISTIC_CONFIGURATION_QUERY_RESULT){
1485                 // iterate over descriptors looking for CCC
1486                 if (pair_size == 4){
1487                     while ((offset + 4) <= size){
1488                         uint16_t uuid16 = little_endian_read_16(packet, offset + 2);
1489                         if (uuid16 == GATT_CLIENT_CHARACTERISTICS_CONFIGURATION){
1490                             gatt_client->client_characteristic_configuration_handle = little_endian_read_16(packet, offset);
1491                             gatt_client->gatt_client_state = P_W2_WRITE_CLIENT_CHARACTERISTIC_CONFIGURATION;
1492                             log_info("CCC found %x", gatt_client->client_characteristic_configuration_handle);
1493                             break;
1494                         }
1495                         offset += pair_size;
1496                     }
1497                 }
1498                 if (is_query_done(gatt_client, last_descriptor_handle)){
1499 
1500                 } else {
1501                     // next
1502                     gatt_client->start_group_handle = last_descriptor_handle + 1;
1503                     gatt_client->gatt_client_state = P_W2_SEND_FIND_CLIENT_CHARACTERISTIC_CONFIGURATION_QUERY;
1504                 }
1505                 break;
1506             }
1507 #endif
1508             report_gatt_all_characteristic_descriptors(gatt_client, &packet[2], size - 2u, pair_size);
1509             trigger_next_characteristic_descriptor_query(gatt_client, last_descriptor_handle);
1510             // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1511             break;
1512         }
1513 
1514         case ATT_WRITE_RESPONSE:
1515             switch (gatt_client->gatt_client_state){
1516                 case P_W4_WRITE_CHARACTERISTIC_VALUE_RESULT:
1517                     gatt_client_handle_transaction_complete(gatt_client);
1518                     emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
1519                     break;
1520                 case P_W4_CLIENT_CHARACTERISTIC_CONFIGURATION_RESULT:
1521                     gatt_client_handle_transaction_complete(gatt_client);
1522                     emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
1523                     break;
1524                 case P_W4_WRITE_CHARACTERISTIC_DESCRIPTOR_RESULT:
1525                     gatt_client_handle_transaction_complete(gatt_client);
1526                     emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
1527                     break;
1528                 default:
1529                     break;
1530             }
1531             break;
1532 
1533         case ATT_READ_BLOB_RESPONSE:{
1534             uint16_t received_blob_length = size-1u;
1535             switch(gatt_client->gatt_client_state){
1536                 case P_W4_READ_BLOB_RESULT:
1537                     report_gatt_long_characteristic_value_blob(gatt_client, gatt_client->attribute_handle, &packet[1], received_blob_length, gatt_client->attribute_offset);
1538                     trigger_next_blob_query(gatt_client, P_W2_SEND_READ_BLOB_QUERY, received_blob_length);
1539                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1540                     break;
1541                 case P_W4_READ_BLOB_CHARACTERISTIC_DESCRIPTOR_RESULT:
1542                     report_gatt_long_characteristic_descriptor(gatt_client, gatt_client->attribute_handle,
1543                                                                &packet[1], received_blob_length,
1544                                                                gatt_client->attribute_offset);
1545                     trigger_next_blob_query(gatt_client, P_W2_SEND_READ_BLOB_CHARACTERISTIC_DESCRIPTOR_QUERY, received_blob_length);
1546                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1547                     break;
1548                 default:
1549                     break;
1550             }
1551             break;
1552         }
1553         case ATT_PREPARE_WRITE_RESPONSE:
1554             switch (gatt_client->gatt_client_state){
1555                 case P_W4_PREPARE_WRITE_SINGLE_RESULT:
1556                     gatt_client_handle_transaction_complete(gatt_client);
1557                     if (is_value_valid(gatt_client, packet, size)){
1558                         emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
1559                     } else {
1560                         emit_gatt_complete_event(gatt_client, ATT_ERROR_DATA_MISMATCH);
1561                     }
1562                     break;
1563 
1564                 case P_W4_PREPARE_WRITE_RESULT:{
1565                     gatt_client->attribute_offset = little_endian_read_16(packet, 3);
1566                     trigger_next_prepare_write_query(gatt_client, P_W2_PREPARE_WRITE, P_W2_EXECUTE_PREPARED_WRITE);
1567                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1568                     break;
1569                 }
1570                 case P_W4_PREPARE_WRITE_CHARACTERISTIC_DESCRIPTOR_RESULT:{
1571                     gatt_client->attribute_offset = little_endian_read_16(packet, 3);
1572                     trigger_next_prepare_write_query(gatt_client, P_W2_PREPARE_WRITE_CHARACTERISTIC_DESCRIPTOR, P_W2_EXECUTE_PREPARED_WRITE_CHARACTERISTIC_DESCRIPTOR);
1573                     // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1574                     break;
1575                 }
1576                 case P_W4_PREPARE_RELIABLE_WRITE_RESULT:{
1577                     if (is_value_valid(gatt_client, packet, size)){
1578                         gatt_client->attribute_offset = little_endian_read_16(packet, 3);
1579                         trigger_next_prepare_write_query(gatt_client, P_W2_PREPARE_RELIABLE_WRITE, P_W2_EXECUTE_PREPARED_WRITE);
1580                         // GATT_EVENT_QUERY_COMPLETE is emitted by trigger_next_xxx when done
1581                         break;
1582                     }
1583                     gatt_client->gatt_client_state = P_W2_CANCEL_PREPARED_WRITE_DATA_MISMATCH;
1584                     break;
1585                 }
1586                 default:
1587                     break;
1588             }
1589             break;
1590 
1591         case ATT_EXECUTE_WRITE_RESPONSE:
1592             switch (gatt_client->gatt_client_state){
1593                 case P_W4_EXECUTE_PREPARED_WRITE_RESULT:
1594                     gatt_client_handle_transaction_complete(gatt_client);
1595                     emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
1596                     break;
1597                 case P_W4_CANCEL_PREPARED_WRITE_RESULT:
1598                     gatt_client_handle_transaction_complete(gatt_client);
1599                     emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
1600                     break;
1601                 case P_W4_CANCEL_PREPARED_WRITE_DATA_MISMATCH_RESULT:
1602                     gatt_client_handle_transaction_complete(gatt_client);
1603                     emit_gatt_complete_event(gatt_client, ATT_ERROR_DATA_MISMATCH);
1604                     break;
1605                 case P_W4_EXECUTE_PREPARED_WRITE_CHARACTERISTIC_DESCRIPTOR_RESULT:
1606                     gatt_client_handle_transaction_complete(gatt_client);
1607                     emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
1608                     break;
1609                 default:
1610                     break;
1611 
1612             }
1613             break;
1614 
1615         case ATT_READ_MULTIPLE_RESPONSE:
1616             switch(gatt_client->gatt_client_state){
1617                 case P_W4_READ_MULTIPLE_RESPONSE:
1618                     report_gatt_characteristic_value(gatt_client, 0u, &packet[1], size - 1u);
1619                     gatt_client_handle_transaction_complete(gatt_client);
1620                     emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
1621                     break;
1622                 default:
1623                     break;
1624             }
1625             break;
1626 
1627         case ATT_ERROR_RESPONSE:
1628             if (size < 5u) return;
1629             error_code = packet[4];
1630             switch (error_code){
1631                 case ATT_ERROR_ATTRIBUTE_NOT_FOUND: {
1632                     switch(gatt_client->gatt_client_state){
1633                         case P_W4_SERVICE_QUERY_RESULT:
1634                         case P_W4_SERVICE_WITH_UUID_RESULT:
1635                         case P_W4_INCLUDED_SERVICE_QUERY_RESULT:
1636                         case P_W4_ALL_CHARACTERISTIC_DESCRIPTORS_QUERY_RESULT:
1637                             gatt_client_handle_transaction_complete(gatt_client);
1638                             emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
1639                             break;
1640                         case P_W4_ALL_CHARACTERISTICS_OF_SERVICE_QUERY_RESULT:
1641                         case P_W4_CHARACTERISTIC_WITH_UUID_QUERY_RESULT:
1642                             characteristic_end_found(gatt_client, gatt_client->end_group_handle);
1643                             gatt_client_handle_transaction_complete(gatt_client);
1644                             emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
1645                             break;
1646                         case P_W4_READ_BY_TYPE_RESPONSE:
1647                             gatt_client_handle_transaction_complete(gatt_client);
1648                             if (gatt_client->start_group_handle == gatt_client->query_start_handle){
1649                                 emit_gatt_complete_event(gatt_client, ATT_ERROR_ATTRIBUTE_NOT_FOUND);
1650                             } else {
1651                                 emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
1652                             }
1653                             break;
1654                         default:
1655                             gatt_client_report_error_if_pending(gatt_client, error_code);
1656                             break;
1657                     }
1658                     break;
1659                 }
1660 
1661 #ifdef ENABLE_GATT_CLIENT_PAIRING
1662 
1663                 case ATT_ERROR_INSUFFICIENT_AUTHENTICATION:
1664                 case ATT_ERROR_INSUFFICIENT_ENCRYPTION_KEY_SIZE:
1665                 case ATT_ERROR_INSUFFICIENT_ENCRYPTION: {
1666 
1667                     // security too low
1668                     if (gatt_client->security_counter > 0) {
1669                         gatt_client_report_error_if_pending(gatt_client, error_code);
1670                         break;
1671                     }
1672                     // start security
1673                     gatt_client->security_counter++;
1674 
1675                     // setup action
1676                     int retry = 1;
1677                     switch (gatt_client->gatt_client_state){
1678                         case P_W4_READ_CHARACTERISTIC_VALUE_RESULT:
1679                             gatt_client->gatt_client_state = P_W2_SEND_READ_CHARACTERISTIC_VALUE_QUERY ;
1680                             break;
1681                         case P_W4_READ_BLOB_RESULT:
1682                             gatt_client->gatt_client_state = P_W2_SEND_READ_BLOB_QUERY;
1683                             break;
1684                         case P_W4_READ_BY_TYPE_RESPONSE:
1685                             gatt_client->gatt_client_state = P_W2_SEND_READ_BY_TYPE_REQUEST;
1686                             break;
1687                         case P_W4_READ_MULTIPLE_RESPONSE:
1688                             gatt_client->gatt_client_state = P_W2_SEND_READ_MULTIPLE_REQUEST;
1689                             break;
1690                         case P_W4_WRITE_CHARACTERISTIC_VALUE_RESULT:
1691                             gatt_client->gatt_client_state = P_W2_SEND_WRITE_CHARACTERISTIC_VALUE;
1692                             break;
1693                         case P_W4_PREPARE_WRITE_RESULT:
1694                             gatt_client->gatt_client_state = P_W2_PREPARE_WRITE;
1695                             break;
1696                         case P_W4_PREPARE_WRITE_SINGLE_RESULT:
1697                             gatt_client->gatt_client_state = P_W2_PREPARE_WRITE_SINGLE;
1698                             break;
1699                         case P_W4_PREPARE_RELIABLE_WRITE_RESULT:
1700                             gatt_client->gatt_client_state = P_W2_PREPARE_RELIABLE_WRITE;
1701                             break;
1702                         case P_W4_EXECUTE_PREPARED_WRITE_RESULT:
1703                             gatt_client->gatt_client_state = P_W2_EXECUTE_PREPARED_WRITE;
1704                             break;
1705                         case P_W4_CANCEL_PREPARED_WRITE_RESULT:
1706                             gatt_client->gatt_client_state = P_W2_CANCEL_PREPARED_WRITE;
1707                             break;
1708                         case P_W4_CANCEL_PREPARED_WRITE_DATA_MISMATCH_RESULT:
1709                             gatt_client->gatt_client_state = P_W2_CANCEL_PREPARED_WRITE_DATA_MISMATCH;
1710                             break;
1711                         case P_W4_READ_CHARACTERISTIC_DESCRIPTOR_RESULT:
1712                             gatt_client->gatt_client_state = P_W2_SEND_READ_CHARACTERISTIC_DESCRIPTOR_QUERY;
1713                             break;
1714                         case P_W4_READ_BLOB_CHARACTERISTIC_DESCRIPTOR_RESULT:
1715                             gatt_client->gatt_client_state = P_W2_SEND_READ_BLOB_CHARACTERISTIC_DESCRIPTOR_QUERY;
1716                             break;
1717                         case P_W4_WRITE_CHARACTERISTIC_DESCRIPTOR_RESULT:
1718                             gatt_client->gatt_client_state = P_W2_SEND_WRITE_CHARACTERISTIC_DESCRIPTOR;
1719                             break;
1720                         case P_W4_CLIENT_CHARACTERISTIC_CONFIGURATION_RESULT:
1721                             gatt_client->gatt_client_state = P_W2_WRITE_CLIENT_CHARACTERISTIC_CONFIGURATION;
1722                             break;
1723                         case P_W4_PREPARE_WRITE_CHARACTERISTIC_DESCRIPTOR_RESULT:
1724                             gatt_client->gatt_client_state = P_W2_PREPARE_WRITE_CHARACTERISTIC_DESCRIPTOR;
1725                             break;
1726                         case P_W4_EXECUTE_PREPARED_WRITE_CHARACTERISTIC_DESCRIPTOR_RESULT:
1727                             gatt_client->gatt_client_state = P_W2_EXECUTE_PREPARED_WRITE_CHARACTERISTIC_DESCRIPTOR;
1728                             break;
1729 #ifdef ENABLE_LE_SIGNED_WRITE
1730                         case P_W4_SEND_SINGED_WRITE_DONE:
1731                             gatt_client->gatt_client_state = P_W2_SEND_SIGNED_WRITE;
1732                             break;
1733 #endif
1734                         default:
1735                             log_info("retry not supported for state %x", gatt_client->gatt_client_state);
1736                             retry = 0;
1737                             break;
1738                     }
1739 
1740                     if (!retry) {
1741                         gatt_client_report_error_if_pending(gatt_client, error_code);
1742                         break;
1743                     }
1744 
1745                     log_info("security error, start pairing");
1746 
1747                     // start pairing for higher security level
1748                     gatt_client->wait_for_authentication_complete = 1;
1749                     gatt_client->pending_error_code = error_code;
1750                     sm_request_pairing(gatt_client->con_handle);
1751                     break;
1752                 }
1753 #endif
1754 
1755                 // nothing we can do about that
1756                 case ATT_ERROR_INSUFFICIENT_AUTHORIZATION:
1757                 default:
1758                     gatt_client_report_error_if_pending(gatt_client, error_code);
1759                     break;
1760             }
1761             break;
1762 
1763         default:
1764             log_info("ATT Handler, unhandled response type 0x%02x", packet[0]);
1765             break;
1766     }
1767     gatt_client_run();
1768 }
1769 
1770 #ifdef ENABLE_LE_SIGNED_WRITE
1771 static void att_signed_write_handle_cmac_result(uint8_t hash[8]){
1772     btstack_linked_list_iterator_t it;
1773     btstack_linked_list_iterator_init(&it, &gatt_client_connections);
1774     while (btstack_linked_list_iterator_has_next(&it)){
1775         gatt_client_t * gatt_client = (gatt_client_t *) btstack_linked_list_iterator_next(&it);
1776         if (gatt_client->gatt_client_state == P_W4_CMAC_RESULT){
1777             // store result
1778             (void)memcpy(gatt_client->cmac, hash, 8);
1779             // reverse_64(hash, gatt_client->cmac);
1780             gatt_client->gatt_client_state = P_W2_SEND_SIGNED_WRITE;
1781             gatt_client_run();
1782             return;
1783         }
1784     }
1785 }
1786 
1787 uint8_t gatt_client_signed_write_without_response(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t handle, uint16_t message_len, uint8_t * message){
1788     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle(con_handle);
1789     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
1790     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
1791 
1792     gatt_client->callback = callback;
1793     gatt_client->attribute_handle = handle;
1794     gatt_client->attribute_length = message_len;
1795     gatt_client->attribute_value = message;
1796     gatt_client->gatt_client_state = P_W4_IDENTITY_RESOLVING;
1797     gatt_client_run();
1798     return ERROR_CODE_SUCCESS;
1799 }
1800 #endif
1801 
1802 uint8_t gatt_client_discover_primary_services(btstack_packet_handler_t callback, hci_con_handle_t con_handle){
1803     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
1804     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
1805     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
1806 
1807     gatt_client->callback = callback;
1808     gatt_client->start_group_handle = 0x0001;
1809     gatt_client->end_group_handle   = 0xffff;
1810     gatt_client->gatt_client_state = P_W2_SEND_SERVICE_QUERY;
1811     gatt_client->uuid16 = 0;
1812     gatt_client_run();
1813     return ERROR_CODE_SUCCESS;
1814 }
1815 
1816 
1817 uint8_t gatt_client_discover_primary_services_by_uuid16(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t uuid16){
1818     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
1819     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
1820     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
1821 
1822     gatt_client->callback = callback;
1823     gatt_client->start_group_handle = 0x0001;
1824     gatt_client->end_group_handle   = 0xffff;
1825     gatt_client->gatt_client_state = P_W2_SEND_SERVICE_WITH_UUID_QUERY;
1826     gatt_client->uuid16 = uuid16;
1827     uuid_add_bluetooth_prefix((uint8_t*) &(gatt_client->uuid128), gatt_client->uuid16);
1828     gatt_client_run();
1829     return ERROR_CODE_SUCCESS;
1830 }
1831 
1832 uint8_t gatt_client_discover_primary_services_by_uuid128(btstack_packet_handler_t callback, hci_con_handle_t con_handle, const uint8_t * uuid128){
1833     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
1834     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
1835     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
1836 
1837     gatt_client->callback = callback;
1838     gatt_client->start_group_handle = 0x0001;
1839     gatt_client->end_group_handle   = 0xffff;
1840     gatt_client->uuid16 = 0;
1841     (void)memcpy(gatt_client->uuid128, uuid128, 16);
1842     gatt_client->gatt_client_state = P_W2_SEND_SERVICE_WITH_UUID_QUERY;
1843     gatt_client_run();
1844     return ERROR_CODE_SUCCESS;
1845 }
1846 
1847 uint8_t gatt_client_discover_characteristics_for_service(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_service_t *service){
1848     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
1849     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
1850     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
1851 
1852     gatt_client->callback = callback;
1853     gatt_client->start_group_handle = service->start_group_handle;
1854     gatt_client->end_group_handle   = service->end_group_handle;
1855     gatt_client->filter_with_uuid = 0;
1856     gatt_client->characteristic_start_handle = 0;
1857     gatt_client->gatt_client_state = P_W2_SEND_ALL_CHARACTERISTICS_OF_SERVICE_QUERY;
1858     gatt_client_run();
1859     return ERROR_CODE_SUCCESS;
1860 }
1861 
1862 uint8_t gatt_client_find_included_services_for_service(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_service_t *service){
1863     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
1864     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
1865     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
1866     gatt_client->callback = callback;
1867     gatt_client->start_group_handle = service->start_group_handle;
1868     gatt_client->end_group_handle   = service->end_group_handle;
1869     gatt_client->gatt_client_state = P_W2_SEND_INCLUDED_SERVICE_QUERY;
1870 
1871     gatt_client_run();
1872     return ERROR_CODE_SUCCESS;
1873 }
1874 
1875 uint8_t gatt_client_discover_characteristics_for_handle_range_by_uuid16(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t start_handle, uint16_t end_handle, uint16_t uuid16){
1876     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
1877     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
1878     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
1879 
1880     gatt_client->callback = callback;
1881     gatt_client->start_group_handle = start_handle;
1882     gatt_client->end_group_handle   = end_handle;
1883     gatt_client->filter_with_uuid = 1;
1884     gatt_client->uuid16 = uuid16;
1885     uuid_add_bluetooth_prefix((uint8_t*) &(gatt_client->uuid128), uuid16);
1886     gatt_client->characteristic_start_handle = 0;
1887     gatt_client->gatt_client_state = P_W2_SEND_CHARACTERISTIC_WITH_UUID_QUERY;
1888     gatt_client_run();
1889     return ERROR_CODE_SUCCESS;
1890 }
1891 
1892 uint8_t gatt_client_discover_characteristics_for_handle_range_by_uuid128(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t start_handle, uint16_t end_handle, uint8_t * uuid128){
1893     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
1894     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
1895     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
1896 
1897     gatt_client->callback = callback;
1898     gatt_client->start_group_handle = start_handle;
1899     gatt_client->end_group_handle   = end_handle;
1900     gatt_client->filter_with_uuid = 1;
1901     gatt_client->uuid16 = 0;
1902     (void)memcpy(gatt_client->uuid128, uuid128, 16);
1903     gatt_client->characteristic_start_handle = 0;
1904     gatt_client->gatt_client_state = P_W2_SEND_CHARACTERISTIC_WITH_UUID_QUERY;
1905     gatt_client_run();
1906     return ERROR_CODE_SUCCESS;
1907 }
1908 
1909 
1910 uint8_t gatt_client_discover_characteristics_for_service_by_uuid16(btstack_packet_handler_t callback, uint16_t handle, gatt_client_service_t *service, uint16_t  uuid16){
1911     return gatt_client_discover_characteristics_for_handle_range_by_uuid16(callback, handle, service->start_group_handle, service->end_group_handle, uuid16);
1912 }
1913 
1914 uint8_t gatt_client_discover_characteristics_for_service_by_uuid128(btstack_packet_handler_t callback, uint16_t handle, gatt_client_service_t *service, uint8_t * uuid128){
1915     return gatt_client_discover_characteristics_for_handle_range_by_uuid128(callback, handle, service->start_group_handle, service->end_group_handle, uuid128);
1916 }
1917 
1918 uint8_t gatt_client_discover_characteristic_descriptors(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_characteristic_t *characteristic){
1919     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
1920     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
1921     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
1922 
1923     if (characteristic->value_handle == characteristic->end_handle){
1924         emit_gatt_complete_event(gatt_client, ATT_ERROR_SUCCESS);
1925         return ERROR_CODE_SUCCESS;
1926     }
1927     gatt_client->callback = callback;
1928     gatt_client->start_group_handle = characteristic->value_handle + 1u;
1929     gatt_client->end_group_handle   = characteristic->end_handle;
1930     gatt_client->gatt_client_state = P_W2_SEND_ALL_CHARACTERISTIC_DESCRIPTORS_QUERY;
1931     gatt_client_run();
1932     return ERROR_CODE_SUCCESS;
1933 }
1934 
1935 uint8_t gatt_client_read_value_of_characteristic_using_value_handle(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t value_handle){
1936     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
1937     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
1938     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
1939 
1940     gatt_client->callback = callback;
1941     gatt_client->attribute_handle = value_handle;
1942     gatt_client->attribute_offset = 0;
1943     gatt_client->gatt_client_state = P_W2_SEND_READ_CHARACTERISTIC_VALUE_QUERY;
1944     gatt_client_run();
1945     return ERROR_CODE_SUCCESS;
1946 }
1947 
1948 uint8_t gatt_client_read_value_of_characteristics_by_uuid16(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t start_handle, uint16_t end_handle, uint16_t uuid16){
1949     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
1950     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
1951     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
1952 
1953     gatt_client->callback = callback;
1954     gatt_client->start_group_handle = start_handle;
1955     gatt_client->end_group_handle = end_handle;
1956     gatt_client->query_start_handle = start_handle;
1957     gatt_client->query_end_handle = end_handle;
1958     gatt_client->uuid16 = uuid16;
1959     uuid_add_bluetooth_prefix((uint8_t*) &(gatt_client->uuid128), uuid16);
1960     gatt_client->gatt_client_state = P_W2_SEND_READ_BY_TYPE_REQUEST;
1961     gatt_client_run();
1962     return ERROR_CODE_SUCCESS;
1963 }
1964 
1965 uint8_t gatt_client_read_value_of_characteristics_by_uuid128(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t start_handle, uint16_t end_handle, uint8_t * uuid128){
1966     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
1967     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
1968     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
1969 
1970     gatt_client->callback = callback;
1971     gatt_client->start_group_handle = start_handle;
1972     gatt_client->end_group_handle = end_handle;
1973     gatt_client->query_start_handle = start_handle;
1974     gatt_client->query_end_handle = end_handle;
1975     gatt_client->uuid16 = 0;
1976     (void)memcpy(gatt_client->uuid128, uuid128, 16);
1977     gatt_client->gatt_client_state = P_W2_SEND_READ_BY_TYPE_REQUEST;
1978     gatt_client_run();
1979     return ERROR_CODE_SUCCESS;
1980 }
1981 
1982 
1983 uint8_t gatt_client_read_value_of_characteristic(btstack_packet_handler_t callback, uint16_t handle, gatt_client_characteristic_t *characteristic){
1984     return gatt_client_read_value_of_characteristic_using_value_handle(callback, handle, characteristic->value_handle);
1985 }
1986 
1987 uint8_t gatt_client_read_long_value_of_characteristic_using_value_handle_with_offset(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t characteristic_value_handle, uint16_t offset){
1988     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
1989     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
1990     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
1991 
1992     gatt_client->callback = callback;
1993     gatt_client->attribute_handle = characteristic_value_handle;
1994     gatt_client->attribute_offset = offset;
1995     gatt_client->gatt_client_state = P_W2_SEND_READ_BLOB_QUERY;
1996     gatt_client_run();
1997     return ERROR_CODE_SUCCESS;
1998 }
1999 
2000 uint8_t gatt_client_read_long_value_of_characteristic_using_value_handle(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t characteristic_value_handle){
2001     return gatt_client_read_long_value_of_characteristic_using_value_handle_with_offset(callback, con_handle, characteristic_value_handle, 0);
2002 }
2003 
2004 uint8_t gatt_client_read_long_value_of_characteristic(btstack_packet_handler_t callback, uint16_t handle, gatt_client_characteristic_t *characteristic){
2005     return gatt_client_read_long_value_of_characteristic_using_value_handle(callback, handle, characteristic->value_handle);
2006 }
2007 
2008 uint8_t gatt_client_read_multiple_characteristic_values(btstack_packet_handler_t callback, hci_con_handle_t con_handle, int num_value_handles, uint16_t * value_handles){
2009     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
2010     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
2011     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
2012 
2013     gatt_client->callback = callback;
2014     gatt_client->read_multiple_handle_count = num_value_handles;
2015     gatt_client->read_multiple_handles = value_handles;
2016     gatt_client->gatt_client_state = P_W2_SEND_READ_MULTIPLE_REQUEST;
2017     gatt_client_run();
2018     return ERROR_CODE_SUCCESS;
2019 }
2020 
2021 uint8_t gatt_client_write_value_of_characteristic_without_response(hci_con_handle_t con_handle, uint16_t value_handle, uint16_t value_length, uint8_t * value){
2022     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle(con_handle);
2023     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
2024 
2025     if (value_length > (gatt_client->mtu - 3u)) return GATT_CLIENT_VALUE_TOO_LONG;
2026     if (!att_dispatch_client_can_send_now(gatt_client->con_handle)) return GATT_CLIENT_BUSY;
2027 
2028     return att_write_request(ATT_WRITE_COMMAND, gatt_client->con_handle, value_handle, value_length, value);
2029 }
2030 
2031 uint8_t gatt_client_write_value_of_characteristic(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t value_handle, uint16_t value_length, uint8_t * data){
2032     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
2033     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
2034     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
2035 
2036     gatt_client->callback = callback;
2037     gatt_client->attribute_handle = value_handle;
2038     gatt_client->attribute_length = value_length;
2039     gatt_client->attribute_value = data;
2040     gatt_client->gatt_client_state = P_W2_SEND_WRITE_CHARACTERISTIC_VALUE;
2041     gatt_client_run();
2042     return ERROR_CODE_SUCCESS;
2043 }
2044 
2045 uint8_t gatt_client_write_long_value_of_characteristic_with_offset(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t value_handle, uint16_t offset, uint16_t value_length, uint8_t  * data){
2046     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
2047     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
2048     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
2049 
2050     gatt_client->callback = callback;
2051     gatt_client->attribute_handle = value_handle;
2052     gatt_client->attribute_length = value_length;
2053     gatt_client->attribute_offset = offset;
2054     gatt_client->attribute_value = data;
2055     gatt_client->gatt_client_state = P_W2_PREPARE_WRITE;
2056     gatt_client_run();
2057     return ERROR_CODE_SUCCESS;
2058 }
2059 
2060 uint8_t gatt_client_write_long_value_of_characteristic(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t value_handle, uint16_t value_length, uint8_t * value){
2061     return gatt_client_write_long_value_of_characteristic_with_offset(callback, con_handle, value_handle, 0, value_length, value);
2062 }
2063 
2064 uint8_t gatt_client_reliable_write_long_value_of_characteristic(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t value_handle, uint16_t value_length, uint8_t * value){
2065     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
2066     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
2067     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
2068 
2069     gatt_client->callback = callback;
2070     gatt_client->attribute_handle = value_handle;
2071     gatt_client->attribute_length = value_length;
2072     gatt_client->attribute_offset = 0;
2073     gatt_client->attribute_value = value;
2074     gatt_client->gatt_client_state = P_W2_PREPARE_RELIABLE_WRITE;
2075     gatt_client_run();
2076     return ERROR_CODE_SUCCESS;
2077 }
2078 
2079 uint8_t gatt_client_write_client_characteristic_configuration(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_characteristic_t * characteristic, uint16_t configuration){
2080     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
2081     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
2082     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
2083 
2084     if ( (configuration & GATT_CLIENT_CHARACTERISTICS_CONFIGURATION_NOTIFICATION) &&
2085         ((characteristic->properties & ATT_PROPERTY_NOTIFY) == 0u)) {
2086         log_info("gatt_client_write_client_characteristic_configuration: GATT_CLIENT_CHARACTERISTIC_NOTIFICATION_NOT_SUPPORTED");
2087         return GATT_CLIENT_CHARACTERISTIC_NOTIFICATION_NOT_SUPPORTED;
2088     } else if ( (configuration & GATT_CLIENT_CHARACTERISTICS_CONFIGURATION_INDICATION) &&
2089                ((characteristic->properties & ATT_PROPERTY_INDICATE) == 0u)){
2090         log_info("gatt_client_write_client_characteristic_configuration: GATT_CLIENT_CHARACTERISTIC_INDICATION_NOT_SUPPORTED");
2091         return GATT_CLIENT_CHARACTERISTIC_INDICATION_NOT_SUPPORTED;
2092     }
2093 
2094     gatt_client->callback = callback;
2095     gatt_client->start_group_handle = characteristic->value_handle;
2096     gatt_client->end_group_handle = characteristic->end_handle;
2097     little_endian_store_16(gatt_client->client_characteristic_configuration_value, 0, configuration);
2098 
2099 #ifdef ENABLE_GATT_FIND_INFORMATION_FOR_CCC_DISCOVERY
2100     gatt_client->gatt_client_state = P_W2_SEND_FIND_CLIENT_CHARACTERISTIC_CONFIGURATION_QUERY;
2101 #else
2102     gatt_client->gatt_client_state = P_W2_SEND_READ_CLIENT_CHARACTERISTIC_CONFIGURATION_QUERY;
2103 #endif
2104     gatt_client_run();
2105     return ERROR_CODE_SUCCESS;
2106 }
2107 
2108 uint8_t gatt_client_read_characteristic_descriptor_using_descriptor_handle(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t descriptor_handle){
2109     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
2110     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
2111     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
2112 
2113     gatt_client->callback = callback;
2114     gatt_client->attribute_handle = descriptor_handle;
2115 
2116     gatt_client->gatt_client_state = P_W2_SEND_READ_CHARACTERISTIC_DESCRIPTOR_QUERY;
2117     gatt_client_run();
2118     return ERROR_CODE_SUCCESS;
2119 }
2120 
2121 uint8_t gatt_client_read_characteristic_descriptor(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_characteristic_descriptor_t * descriptor){
2122     return gatt_client_read_characteristic_descriptor_using_descriptor_handle(callback, con_handle, descriptor->handle);
2123 }
2124 
2125 uint8_t gatt_client_read_long_characteristic_descriptor_using_descriptor_handle_with_offset(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t descriptor_handle, uint16_t offset){
2126     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
2127     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
2128     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
2129 
2130     gatt_client->callback = callback;
2131     gatt_client->attribute_handle = descriptor_handle;
2132     gatt_client->attribute_offset = offset;
2133     gatt_client->gatt_client_state = P_W2_SEND_READ_BLOB_CHARACTERISTIC_DESCRIPTOR_QUERY;
2134     gatt_client_run();
2135     return ERROR_CODE_SUCCESS;
2136 }
2137 
2138 uint8_t gatt_client_read_long_characteristic_descriptor_using_descriptor_handle(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t descriptor_handle){
2139     return gatt_client_read_long_characteristic_descriptor_using_descriptor_handle_with_offset(callback, con_handle, descriptor_handle, 0);
2140 }
2141 
2142 uint8_t gatt_client_read_long_characteristic_descriptor(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_characteristic_descriptor_t * descriptor){
2143     return gatt_client_read_long_characteristic_descriptor_using_descriptor_handle(callback, con_handle, descriptor->handle);
2144 }
2145 
2146 uint8_t gatt_client_write_characteristic_descriptor_using_descriptor_handle(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t descriptor_handle, uint16_t length, uint8_t  * data){
2147     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
2148     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
2149     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
2150 
2151     gatt_client->callback = callback;
2152     gatt_client->attribute_handle = descriptor_handle;
2153     gatt_client->attribute_length = length;
2154     gatt_client->attribute_offset = 0;
2155     gatt_client->attribute_value = data;
2156     gatt_client->gatt_client_state = P_W2_SEND_WRITE_CHARACTERISTIC_DESCRIPTOR;
2157     gatt_client_run();
2158     return ERROR_CODE_SUCCESS;
2159 }
2160 
2161 uint8_t gatt_client_write_characteristic_descriptor(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_characteristic_descriptor_t * descriptor, uint16_t length, uint8_t * value){
2162     return gatt_client_write_characteristic_descriptor_using_descriptor_handle(callback, con_handle, descriptor->handle, length, value);
2163 }
2164 
2165 uint8_t gatt_client_write_long_characteristic_descriptor_using_descriptor_handle_with_offset(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t descriptor_handle, uint16_t offset, uint16_t length, uint8_t  * data){
2166     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
2167     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
2168     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
2169 
2170     gatt_client->callback = callback;
2171     gatt_client->attribute_handle = descriptor_handle;
2172     gatt_client->attribute_length = length;
2173     gatt_client->attribute_offset = offset;
2174     gatt_client->attribute_value = data;
2175     gatt_client->gatt_client_state = P_W2_PREPARE_WRITE_CHARACTERISTIC_DESCRIPTOR;
2176     gatt_client_run();
2177     return ERROR_CODE_SUCCESS;
2178 }
2179 
2180 uint8_t gatt_client_write_long_characteristic_descriptor_using_descriptor_handle(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t descriptor_handle, uint16_t length, uint8_t * data){
2181     return gatt_client_write_long_characteristic_descriptor_using_descriptor_handle_with_offset(callback, con_handle, descriptor_handle, 0, length, data );
2182 }
2183 
2184 uint8_t gatt_client_write_long_characteristic_descriptor(btstack_packet_handler_t callback, hci_con_handle_t con_handle, gatt_client_characteristic_descriptor_t * descriptor, uint16_t length, uint8_t * value){
2185     return gatt_client_write_long_characteristic_descriptor_using_descriptor_handle(callback, con_handle, descriptor->handle, length, value);
2186 }
2187 
2188 /**
2189  * @brief -> gatt complete event
2190  */
2191 uint8_t gatt_client_prepare_write(btstack_packet_handler_t callback, hci_con_handle_t con_handle, uint16_t attribute_handle, uint16_t offset, uint16_t length, uint8_t * data){
2192     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
2193     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
2194     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
2195 
2196     gatt_client->callback = callback;
2197     gatt_client->attribute_handle = attribute_handle;
2198     gatt_client->attribute_length = length;
2199     gatt_client->attribute_offset = offset;
2200     gatt_client->attribute_value = data;
2201     gatt_client->gatt_client_state = P_W2_PREPARE_WRITE_SINGLE;
2202     gatt_client_run();
2203     return ERROR_CODE_SUCCESS;
2204 }
2205 
2206 /**
2207  * @brief -> gatt complete event
2208  */
2209 uint8_t gatt_client_execute_write(btstack_packet_handler_t callback, hci_con_handle_t con_handle){
2210     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
2211 
2212     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
2213     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
2214 
2215     gatt_client->callback = callback;
2216     gatt_client->gatt_client_state = P_W2_EXECUTE_PREPARED_WRITE;
2217     gatt_client_run();
2218     return ERROR_CODE_SUCCESS;
2219 }
2220 
2221 /**
2222  * @brief -> gatt complete event
2223  */
2224 uint8_t gatt_client_cancel_write(btstack_packet_handler_t callback, hci_con_handle_t con_handle){
2225     gatt_client_t * gatt_client = gatt_client_provide_context_for_handle_and_start_timer(con_handle);
2226     if (gatt_client == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
2227     if (is_ready(gatt_client) == 0) return GATT_CLIENT_IN_WRONG_STATE;
2228 
2229     gatt_client->callback = callback;
2230     gatt_client->gatt_client_state = P_W2_CANCEL_PREPARED_WRITE;
2231     gatt_client_run();
2232     return ERROR_CODE_SUCCESS;
2233 }
2234 
2235 void gatt_client_deserialize_service(const uint8_t *packet, int offset, gatt_client_service_t *service){
2236     service->start_group_handle = little_endian_read_16(packet, offset);
2237     service->end_group_handle = little_endian_read_16(packet, offset + 2);
2238     reverse_128(&packet[offset + 4], service->uuid128);
2239     if (uuid_has_bluetooth_prefix(service->uuid128)){
2240         service->uuid16 = big_endian_read_32(service->uuid128, 0);
2241     } else {
2242         service->uuid16 = 0;
2243     }
2244 }
2245 
2246 void gatt_client_deserialize_characteristic(const uint8_t * packet, int offset, gatt_client_characteristic_t * characteristic){
2247     characteristic->start_handle = little_endian_read_16(packet, offset);
2248     characteristic->value_handle = little_endian_read_16(packet, offset + 2);
2249     characteristic->end_handle = little_endian_read_16(packet, offset + 4);
2250     characteristic->properties = little_endian_read_16(packet, offset + 6);
2251     reverse_128(&packet[offset+8], characteristic->uuid128);
2252     if (uuid_has_bluetooth_prefix(characteristic->uuid128)){
2253         characteristic->uuid16 = big_endian_read_32(characteristic->uuid128, 0);
2254     } else {
2255         characteristic->uuid16 = 0;
2256     }
2257 }
2258 
2259 void gatt_client_deserialize_characteristic_descriptor(const uint8_t * packet, int offset, gatt_client_characteristic_descriptor_t * descriptor){
2260     descriptor->handle = little_endian_read_16(packet, offset);
2261     reverse_128(&packet[offset+2], descriptor->uuid128);
2262     if (uuid_has_bluetooth_prefix(descriptor->uuid128)){
2263         descriptor->uuid16 = big_endian_read_32(descriptor->uuid128, 0);
2264     } else {
2265         descriptor->uuid16 = 0;
2266     }
2267 }
2268 
2269 void gatt_client_send_mtu_negotiation(btstack_packet_handler_t callback, hci_con_handle_t con_handle){
2270     gatt_client_t * context = gatt_client_provide_context_for_handle(con_handle);
2271     if (context == NULL) return;
2272     if (context->mtu_state == MTU_AUTO_EXCHANGE_DISABLED){
2273         context->callback = callback;
2274         context->mtu_state = SEND_MTU_EXCHANGE;
2275         gatt_client_run();
2276     }
2277 }
2278 
2279 uint8_t gatt_client_request_can_write_without_response_event(btstack_packet_handler_t callback, hci_con_handle_t con_handle){
2280     gatt_client_t * context = gatt_client_provide_context_for_handle(con_handle);
2281     if (context == NULL) return BTSTACK_MEMORY_ALLOC_FAILED;
2282     if (context->write_without_response_callback != NULL) return GATT_CLIENT_IN_WRONG_STATE;
2283     context->write_without_response_callback = callback;
2284     att_dispatch_client_request_can_send_now_event(context->con_handle);
2285     return ERROR_CODE_SUCCESS;
2286 }
2287 
2288 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
2289 void gatt_client_att_packet_handler_fuzz(uint8_t packet_type, uint16_t handle, uint8_t *packet, uint16_t size){
2290     gatt_client_att_packet_handler(packet_type, handle, packet, size);
2291 }
2292 #endif
2293