1/****************************************************************************** 2 * 3 * Copyright (C) 1999-2012 Broadcom Corporation 4 * 5 * Licensed under the Apache License, Version 2.0 (the "License"); 6 * you may not use this file except in compliance with the License. 7 * You may obtain a copy of the License at: 8 * 9 * http://www.apache.org/licenses/LICENSE-2.0 10 * 11 * Unless required by applicable law or agreed to in writing, software 12 * distributed under the License is distributed on an "AS IS" BASIS, 13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 * See the License for the specific language governing permissions and 15 * limitations under the License. 16 * 17 ******************************************************************************/ 18 19/****************************************************************************** 20 * 21 * this file contains SDP discovery functions 22 * 23 ******************************************************************************/ 24 25#include <stdlib.h> 26#include <string.h> 27#include <stdio.h> 28 29#include "bt_target.h" 30#include "gki.h" 31#include "l2cdefs.h" 32#include "hcidefs.h" 33#include "hcimsgs.h" 34#include "sdp_api.h" 35#include "sdpint.h" 36#include "btu.h" 37#include "btm_api.h" 38 39 40#ifndef SDP_DEBUG_RAW 41#define SDP_DEBUG_RAW FALSE 42#endif 43 44/********************************************************************************/ 45/* L O C A L F U N C T I O N P R O T O T Y P E S */ 46/********************************************************************************/ 47#if SDP_CLIENT_ENABLED == TRUE 48static void process_service_search_rsp (tCONN_CB *p_ccb, UINT8 *p_reply, UINT16 len); 49static void process_service_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply, UINT16 len); 50static void process_service_search_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply, UINT16 len); 51static UINT8 *save_attr_seq (tCONN_CB *p_ccb, UINT8 *p, UINT8 *p_msg_end); 52static tSDP_DISC_REC *add_record (tSDP_DISCOVERY_DB *p_db, BD_ADDR p_bda); 53static UINT8 *add_attr (UINT8 *p, tSDP_DISCOVERY_DB *p_db, tSDP_DISC_REC *p_rec, 54 UINT16 attr_id, tSDP_DISC_ATTR *p_parent_attr, UINT8 nest_level); 55 56/* Safety check in case we go crazy */ 57#define MAX_NEST_LEVELS 5 58 59 60/******************************************************************************* 61** 62** Function sdpu_build_uuid_seq 63** 64** Description This function builds a UUID sequence from the list of 65** passed UUIDs. It is also passed the address of the output 66** buffer. 67** 68** Returns Pointer to next byte in the output buffer. 69** 70*******************************************************************************/ 71static UINT8 *sdpu_build_uuid_seq (UINT8 *p_out, UINT16 num_uuids, tSDP_UUID *p_uuid_list) 72{ 73 UINT16 xx; 74 UINT8 *p_len; 75 76 /* First thing is the data element header */ 77 UINT8_TO_BE_STREAM (p_out, (DATA_ELE_SEQ_DESC_TYPE << 3) | SIZE_IN_NEXT_BYTE); 78 79 /* Remember where the length goes. Leave space for it. */ 80 p_len = p_out; 81 p_out += 1; 82 83 /* Now, loop through and put in all the UUID(s) */ 84 for (xx = 0; xx < num_uuids; xx++, p_uuid_list++) 85 { 86 if (p_uuid_list->len == 2) 87 { 88 UINT8_TO_BE_STREAM (p_out, (UUID_DESC_TYPE << 3) | SIZE_TWO_BYTES); 89 UINT16_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid16); 90 } 91 else if (p_uuid_list->len == 4) 92 { 93 UINT8_TO_BE_STREAM (p_out, (UUID_DESC_TYPE << 3) | SIZE_FOUR_BYTES); 94 UINT32_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid32); 95 } 96 else 97 { 98 UINT8_TO_BE_STREAM (p_out, (UUID_DESC_TYPE << 3) | SIZE_SIXTEEN_BYTES); 99 ARRAY_TO_BE_STREAM (p_out, p_uuid_list->uu.uuid128, p_uuid_list->len); 100 } 101 } 102 103 /* Now, put in the length */ 104 xx = (UINT16)(p_out - p_len - 1); 105 UINT8_TO_BE_STREAM (p_len, xx); 106 107 return (p_out); 108} 109 110/******************************************************************************* 111** 112** Function sdp_snd_service_search_req 113** 114** Description Send a service search request to the SDP server. 115** 116** Returns void 117** 118*******************************************************************************/ 119static void sdp_snd_service_search_req(tCONN_CB *p_ccb, UINT8 cont_len, UINT8 * p_cont) 120{ 121 UINT8 *p, *p_start, *p_param_len; 122 BT_HDR *p_cmd; 123 UINT16 param_len; 124 125 /* Get a buffer to send the packet to L2CAP */ 126 if ((p_cmd = (BT_HDR *) GKI_getpoolbuf (SDP_POOL_ID)) == NULL) 127 { 128 sdp_disconnect (p_ccb, SDP_NO_RESOURCES); 129 return; 130 } 131 132 p_cmd->offset = L2CAP_MIN_OFFSET; 133 p = p_start = (UINT8 *)(p_cmd + 1) + L2CAP_MIN_OFFSET; 134 135 /* Build a service search request packet */ 136 UINT8_TO_BE_STREAM (p, SDP_PDU_SERVICE_SEARCH_REQ); 137 UINT16_TO_BE_STREAM (p, p_ccb->transaction_id); 138 p_ccb->transaction_id++; 139 140 /* Skip the length, we need to add it at the end */ 141 p_param_len = p; 142 p += 2; 143 144 /* Build the UID sequence. */ 145#if (defined(SDP_BROWSE_PLUS) && SDP_BROWSE_PLUS == TRUE) 146 p = sdpu_build_uuid_seq (p, 1, &p_ccb->p_db->uuid_filters[p_ccb->cur_uuid_idx]); 147#else 148 p = sdpu_build_uuid_seq (p, p_ccb->p_db->num_uuid_filters, p_ccb->p_db->uuid_filters); 149#endif 150 151 /* Set max service record count */ 152 UINT16_TO_BE_STREAM (p, sdp_cb.max_recs_per_search); 153 154 /* Set continuation state */ 155 UINT8_TO_BE_STREAM (p, cont_len); 156 157 /* if this is not the first request */ 158 if(cont_len && p_cont) 159 { 160 memcpy(p, p_cont, cont_len); 161 p += cont_len; 162 } 163 164 /* Go back and put the parameter length into the buffer */ 165 param_len = (UINT16)(p - p_param_len - 2); 166 UINT16_TO_BE_STREAM (p_param_len, param_len); 167 168 p_ccb->disc_state = SDP_DISC_WAIT_HANDLES; 169 170 /* Set the length of the SDP data in the buffer */ 171 p_cmd->len = (UINT16)(p - p_start); 172 173#if (SDP_DEBUG_RAW == TRUE) 174 SDP_TRACE_WARNING2("sdp_snd_service_search_req cont_len :%d disc_state:%d",cont_len, p_ccb->disc_state); 175#endif 176 177 178 L2CA_DataWrite (p_ccb->connection_id, p_cmd); 179 180 /* Start inactivity timer */ 181 btu_start_timer (&p_ccb->timer_entry, BTU_TTYPE_SDP, SDP_INACT_TIMEOUT); 182 183} 184 185/******************************************************************************* 186** 187** Function sdp_disc_connected 188** 189** Description This function is called when an SDP discovery attempt is 190** connected. 191** 192** Returns void 193** 194*******************************************************************************/ 195void sdp_disc_connected (tCONN_CB *p_ccb) 196{ 197 198#if SDP_FOR_JV_INCLUDED == TRUE 199 if (SDP_IS_PASS_THRU == p_ccb->is_attr_search) 200 { 201 tSDP_DISC_RES_CB *p_rcb = (tSDP_DISC_RES_CB *) p_ccb->p_db; 202 tSDP_DR_OPEN evt_data; 203 /* report connected */ 204 p_ccb->disc_state = SDP_DISC_WAIT_PASS_THRU; 205 if (p_rcb) 206 { 207 memcpy(evt_data.peer_addr, p_ccb->device_address, BD_ADDR_LEN); 208 evt_data.peer_mtu = p_ccb->rem_mtu_size; 209 (*p_rcb)(SDP_EVT_OPEN, (void *)&evt_data); 210 } 211 } 212 else 213#endif 214 if (p_ccb->is_attr_search) 215 { 216 p_ccb->disc_state = SDP_DISC_WAIT_SEARCH_ATTR; 217 218 process_service_search_attr_rsp (p_ccb, NULL, 0); 219 } 220 else 221 { 222 /* First step is to get a list of the handles from the server. */ 223 /* We are not searching for a specific attribute, so we will */ 224 /* first search for the service, then get all attributes of it */ 225 226 p_ccb->num_handles = 0; 227 sdp_snd_service_search_req(p_ccb, 0, NULL); 228 } 229 230} 231 232/******************************************************************************* 233** 234** Function sdp_disc_server_rsp 235** 236** Description This function is called when there is a response from 237** the server. 238** 239** Returns void 240** 241*******************************************************************************/ 242void sdp_disc_server_rsp (tCONN_CB *p_ccb, BT_HDR *p_msg) 243{ 244 UINT8 *p, rsp_pdu; 245 BOOLEAN invalid_pdu = TRUE; 246 247#if (SDP_DEBUG_RAW == TRUE) 248 SDP_TRACE_WARNING1("sdp_disc_server_rsp disc_state:%d", p_ccb->disc_state); 249#endif 250 251 /* stop inactivity timer when we receive a response */ 252 btu_stop_timer (&p_ccb->timer_entry); 253 254#if SDP_FOR_JV_INCLUDED == TRUE 255 if(SDP_IS_PASS_THRU == p_ccb->is_attr_search) 256 { 257 tSDP_DISC_RES_CB *p_rcb = (tSDP_DISC_RES_CB *) p_ccb->p_db; 258 tSDP_DR_DATA data; 259 if (p_rcb) 260 { 261 data.p_data = (UINT8 *)(p_msg + 1) + p_msg->offset; 262 data.data_len = p_msg->len; 263 (*p_rcb)(SDP_EVT_DATA_IND, (void *)&data); 264 } 265 return; 266 } 267#endif 268 269 /* Got a reply!! Check what we got back */ 270 p = (UINT8 *)(p_msg + 1) + p_msg->offset; 271 272 BE_STREAM_TO_UINT8 (rsp_pdu, p); 273 274 p_msg->len--; 275 276 switch (rsp_pdu) 277 { 278 case SDP_PDU_SERVICE_SEARCH_RSP: 279 if (p_ccb->disc_state == SDP_DISC_WAIT_HANDLES) 280 { 281 process_service_search_rsp (p_ccb, p, p_msg->len); 282 invalid_pdu = FALSE; 283 } 284 break; 285 286 case SDP_PDU_SERVICE_ATTR_RSP: 287 if (p_ccb->disc_state == SDP_DISC_WAIT_ATTR) 288 { 289 process_service_attr_rsp (p_ccb, p, p_msg->len); 290 invalid_pdu = FALSE; 291 } 292 break; 293 294 case SDP_PDU_SERVICE_SEARCH_ATTR_RSP: 295 if (p_ccb->disc_state == SDP_DISC_WAIT_SEARCH_ATTR) 296 { 297 process_service_search_attr_rsp (p_ccb, p, p_msg->len); 298 invalid_pdu = FALSE; 299 } 300 break; 301 } 302 303 if (invalid_pdu) 304 { 305 SDP_TRACE_WARNING2 ("SDP - Unexp. PDU: %d in state: %d", rsp_pdu, p_ccb->disc_state); 306 sdp_disconnect (p_ccb, SDP_GENERIC_ERROR); 307 } 308} 309 310/****************************************************************************** 311** 312** Function process_service_search_rsp 313** 314** Description This function is called when there is a search response from 315** the server. 316** 317** Returns void 318** 319*******************************************************************************/ 320static void process_service_search_rsp (tCONN_CB *p_ccb, UINT8 *p_reply, UINT16 len) 321{ 322 UINT16 xx; 323 UINT16 total, cur_handles, orig; 324 UINT8 cont_len; 325 326 /* Skip transaction, and param len */ 327 p_reply += 4; 328 BE_STREAM_TO_UINT16 (total, p_reply); 329 BE_STREAM_TO_UINT16 (cur_handles, p_reply); 330 331 orig = p_ccb->num_handles; 332 p_ccb->num_handles += cur_handles; 333 if (p_ccb->num_handles == 0) 334 { 335 SDP_TRACE_WARNING0 ("SDP - Rcvd ServiceSearchRsp, no matches"); 336 sdp_disconnect (p_ccb, SDP_NO_RECS_MATCH); 337 return; 338 } 339 340 /* Save the handles that match. We will can only process a certain number. */ 341 if (total > sdp_cb.max_recs_per_search) 342 total = sdp_cb.max_recs_per_search; 343 if (p_ccb->num_handles > sdp_cb.max_recs_per_search) 344 p_ccb->num_handles = sdp_cb.max_recs_per_search; 345 346 for (xx = orig; xx < p_ccb->num_handles; xx++) 347 BE_STREAM_TO_UINT32 (p_ccb->handles[xx], p_reply); 348 349 BE_STREAM_TO_UINT8 (cont_len, p_reply); 350 if(cont_len != 0) 351 { 352 if(cont_len > SDP_MAX_CONTINUATION_LEN) 353 { 354 sdp_disconnect (p_ccb, SDP_INVALID_CONT_STATE); 355 return; 356 } 357 /* stay in the same state */ 358 sdp_snd_service_search_req(p_ccb, cont_len, p_reply); 359 } 360 else 361 { 362 /* change state */ 363 p_ccb->disc_state = SDP_DISC_WAIT_ATTR; 364 365 /* Kick off the first attribute request */ 366 process_service_attr_rsp (p_ccb, NULL, 0); 367 } 368} 369 370/******************************************************************************* 371** 372** Function sdp_copy_raw_data 373** 374** Description copy the raw data 375** 376** 377** Returns void 378** 379*******************************************************************************/ 380#if (SDP_RAW_DATA_INCLUDED == TRUE) 381static void sdp_copy_raw_data (tCONN_CB *p_ccb, UINT16 len, BOOLEAN offset) 382{ 383 unsigned int cpy_len; 384 UINT32 list_len; 385 UINT8 *p; 386 UINT8 * p_temp; 387 UINT8 type; 388 UINT32 delta_len = 0; 389 390#if (SDP_DEBUG_RAW == TRUE) 391 UINT8 num_array[SDP_MAX_LIST_BYTE_COUNT]; 392 UINT32 i; 393 394 for (i = 0; i < p_ccb->list_len; i++) 395 { 396 sprintf((char *)&num_array[i*2],"%02X",(UINT8)(p_ccb->rsp_list[i])); 397 } 398 SDP_TRACE_WARNING1("result :%s",num_array); 399#endif 400 401 if(p_ccb->p_db->raw_data) 402 { 403 cpy_len = p_ccb->p_db->raw_size - p_ccb->p_db->raw_used; 404 list_len = p_ccb->list_len; 405 p_temp = p = &p_ccb->rsp_list[0]; 406 407 if(offset) 408 { 409 type = *p++; 410 p = sdpu_get_len_from_type (p, type, &list_len); 411 } 412 if(list_len && list_len < cpy_len ) 413 { 414 cpy_len = list_len; 415 } 416#if (SDP_DEBUG_RAW == TRUE) 417 SDP_TRACE_WARNING4("list_len :%d cpy_len:%d raw_size:%d raw_used:%d", 418 list_len, cpy_len, p_ccb->p_db->raw_size, p_ccb->p_db->raw_used); 419#endif 420 memcpy (&p_ccb->p_db->raw_data[p_ccb->p_db->raw_used], p, cpy_len); 421 p_ccb->p_db->raw_used += cpy_len; 422 } 423} 424#endif 425 426/******************************************************************************* 427** 428** Function process_service_attr_rsp 429** 430** Description This function is called when there is a attribute response from 431** the server. 432** 433** Returns void 434** 435*******************************************************************************/ 436static void process_service_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply, UINT16 len) 437{ 438 UINT8 *p_start, *p_param_len; 439 UINT16 param_len, list_byte_count; 440 BOOLEAN cont_request_needed = FALSE; 441 442#if (SDP_DEBUG_RAW == TRUE) 443 SDP_TRACE_WARNING2("process_service_attr_rsp len:%d raw inc:%d", 444 len, SDP_RAW_DATA_INCLUDED); 445#endif 446 /* If p_reply is NULL, we were called after the records handles were read */ 447 if (p_reply) 448 { 449#if (SDP_DEBUG_RAW == TRUE) 450 SDP_TRACE_WARNING4("ID & len: 0x%02x-%02x-%02x-%02x", 451 p_reply[0], p_reply[1], p_reply[2], p_reply[3]); 452#endif 453 /* Skip transaction ID and length */ 454 p_reply += 4; 455 456 BE_STREAM_TO_UINT16 (list_byte_count, p_reply); 457#if (SDP_DEBUG_RAW == TRUE) 458 SDP_TRACE_WARNING1("list_byte_count:%d", list_byte_count); 459#endif 460 461 /* Copy the response to the scratchpad. First, a safety check on the length */ 462 if ((p_ccb->list_len + list_byte_count) > SDP_MAX_LIST_BYTE_COUNT) 463 { 464 sdp_disconnect (p_ccb, SDP_INVALID_PDU_SIZE); 465 return; 466 } 467 468#if (SDP_DEBUG_RAW == TRUE) 469 SDP_TRACE_WARNING2("list_len: %d, list_byte_count: %d", 470 p_ccb->list_len, list_byte_count); 471#endif 472 if (p_ccb->rsp_list == NULL) 473 { 474 p_ccb->rsp_list = (UINT8 *)GKI_getbuf (SDP_MAX_LIST_BYTE_COUNT); 475 if (p_ccb->rsp_list == NULL) 476 { 477 SDP_TRACE_ERROR0 ("SDP - no gki buf to save rsp"); 478 sdp_disconnect (p_ccb, SDP_NO_RESOURCES); 479 return; 480 } 481 } 482 memcpy (&p_ccb->rsp_list[p_ccb->list_len], p_reply, list_byte_count); 483 p_ccb->list_len += list_byte_count; 484 p_reply += list_byte_count; 485#if (SDP_DEBUG_RAW == TRUE) 486 SDP_TRACE_WARNING1("list_len: %d(attr_rsp)", p_ccb->list_len); 487 488 /* Check if we need to request a continuation */ 489 SDP_TRACE_WARNING2("*p_reply:%d(%d)", *p_reply, SDP_MAX_CONTINUATION_LEN); 490#endif 491 if (*p_reply) 492 { 493 if (*p_reply > SDP_MAX_CONTINUATION_LEN) 494 { 495 sdp_disconnect (p_ccb, SDP_INVALID_CONT_STATE); 496 return; 497 } 498 cont_request_needed = TRUE; 499 } 500 else 501 { 502 503#if (SDP_RAW_DATA_INCLUDED == TRUE) 504 SDP_TRACE_WARNING0("process_service_attr_rsp"); 505 sdp_copy_raw_data (p_ccb, len, FALSE); 506#endif 507 508 /* Save the response in the database. Stop on any error */ 509 if (!save_attr_seq (p_ccb, &p_ccb->rsp_list[0], &p_ccb->rsp_list[p_ccb->list_len])) 510 { 511 sdp_disconnect (p_ccb, SDP_DB_FULL); 512 return; 513 } 514 p_ccb->list_len = 0; 515 p_ccb->cur_handle++; 516 } 517 } 518 519 /* Now, ask for the next handle. Re-use the buffer we just got. */ 520 if (p_ccb->cur_handle < p_ccb->num_handles) 521 { 522 BT_HDR *p_msg = (BT_HDR *) GKI_getpoolbuf (SDP_POOL_ID); 523 UINT8 *p; 524 525 if (!p_msg) 526 { 527 sdp_disconnect (p_ccb, SDP_NO_RESOURCES); 528 return; 529 } 530 531 p_msg->offset = L2CAP_MIN_OFFSET; 532 p = p_start = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET; 533 534 /* Get all the attributes from the server */ 535 UINT8_TO_BE_STREAM (p, SDP_PDU_SERVICE_ATTR_REQ); 536 UINT16_TO_BE_STREAM (p, p_ccb->transaction_id); 537 p_ccb->transaction_id++; 538 539 /* Skip the length, we need to add it at the end */ 540 p_param_len = p; 541 p += 2; 542 543 UINT32_TO_BE_STREAM (p, p_ccb->handles[p_ccb->cur_handle]); 544 545 /* Max attribute byte count */ 546 UINT16_TO_BE_STREAM (p, sdp_cb.max_attr_list_size); 547 548 /* If no attribute filters, build a wildcard attribute sequence */ 549 if (p_ccb->p_db->num_attr_filters) 550 p = sdpu_build_attrib_seq (p, p_ccb->p_db->attr_filters, p_ccb->p_db->num_attr_filters); 551 else 552 p = sdpu_build_attrib_seq (p, NULL, 0); 553 554 /* Was this a continuation request ? */ 555 if (cont_request_needed) 556 { 557 memcpy (p, p_reply, *p_reply + 1); 558 p += *p_reply + 1; 559 } 560 else 561 UINT8_TO_BE_STREAM (p, 0); 562 563 /* Go back and put the parameter length into the buffer */ 564 param_len = (UINT16)(p - p_param_len - 2); 565 UINT16_TO_BE_STREAM (p_param_len, param_len); 566 567 /* Set the length of the SDP data in the buffer */ 568 p_msg->len = (UINT16)(p - p_start); 569 570 571 L2CA_DataWrite (p_ccb->connection_id, p_msg); 572 573 /* Start inactivity timer */ 574 btu_start_timer (&p_ccb->timer_entry, BTU_TTYPE_SDP, SDP_INACT_TIMEOUT); 575 } 576 else 577 { 578 sdp_disconnect (p_ccb, SDP_SUCCESS); 579 return; 580 } 581} 582 583 584/******************************************************************************* 585** 586** Function process_service_search_attr_rsp 587** 588** Description This function is called when there is a search attribute 589** response from the server. 590** 591** Returns void 592** 593*******************************************************************************/ 594static void process_service_search_attr_rsp (tCONN_CB *p_ccb, UINT8 *p_reply, UINT16 len) 595{ 596 UINT8 *p, *p_start, *p_end, *p_param_len; 597 UINT8 type; 598 UINT32 seq_len; 599 UINT16 param_len, lists_byte_count = 0; 600 BOOLEAN cont_request_needed = FALSE; 601 602#if (SDP_DEBUG_RAW == TRUE) 603 SDP_TRACE_WARNING1("process_service_search_attr_rsp len:%d", len); 604#endif 605 /* If p_reply is NULL, we were called for the initial read */ 606 if (p_reply) 607 { 608#if (SDP_DEBUG_RAW == TRUE) 609 SDP_TRACE_WARNING4("ID & len: 0x%02x-%02x-%02x-%02x", 610 p_reply[0], p_reply[1], p_reply[2], p_reply[3]); 611#endif 612 /* Skip transaction ID and length */ 613 p_reply += 4; 614 615 BE_STREAM_TO_UINT16 (lists_byte_count, p_reply); 616#if (SDP_DEBUG_RAW == TRUE) 617 SDP_TRACE_WARNING1("lists_byte_count:%d", lists_byte_count); 618#endif 619 620 /* Copy the response to the scratchpad. First, a safety check on the length */ 621 if ((p_ccb->list_len + lists_byte_count) > SDP_MAX_LIST_BYTE_COUNT) 622 { 623 sdp_disconnect (p_ccb, SDP_INVALID_PDU_SIZE); 624 return; 625 } 626 627#if (SDP_DEBUG_RAW == TRUE) 628 SDP_TRACE_WARNING2("list_len: %d, list_byte_count: %d", 629 p_ccb->list_len, lists_byte_count); 630#endif 631 if (p_ccb->rsp_list == NULL) 632 { 633 p_ccb->rsp_list = (UINT8 *)GKI_getbuf (SDP_MAX_LIST_BYTE_COUNT); 634 if (p_ccb->rsp_list == NULL) 635 { 636 SDP_TRACE_ERROR0 ("SDP - no gki buf to save rsp"); 637 sdp_disconnect (p_ccb, SDP_NO_RESOURCES); 638 return; 639 } 640 } 641 memcpy (&p_ccb->rsp_list[p_ccb->list_len], p_reply, lists_byte_count); 642 p_ccb->list_len += lists_byte_count; 643 p_reply += lists_byte_count; 644#if (SDP_DEBUG_RAW == TRUE) 645 SDP_TRACE_WARNING1("list_len: %d(search_attr_rsp)", p_ccb->list_len); 646 647 /* Check if we need to request a continuation */ 648 SDP_TRACE_WARNING2("*p_reply:%d(%d)", *p_reply, SDP_MAX_CONTINUATION_LEN); 649#endif 650 if (*p_reply) 651 { 652 if (*p_reply > SDP_MAX_CONTINUATION_LEN) 653 { 654 sdp_disconnect (p_ccb, SDP_INVALID_CONT_STATE); 655 return; 656 } 657 658 cont_request_needed = TRUE; 659 } 660 } 661 662#if (SDP_DEBUG_RAW == TRUE) 663 SDP_TRACE_WARNING1("cont_request_needed:%d", cont_request_needed); 664#endif 665 /* If continuation request (or first time request) */ 666 if ((cont_request_needed) || (!p_reply)) 667 { 668 BT_HDR *p_msg = (BT_HDR *) GKI_getpoolbuf (SDP_POOL_ID); 669 UINT8 *p; 670 671 if (!p_msg) 672 { 673 sdp_disconnect (p_ccb, SDP_NO_RESOURCES); 674 return; 675 } 676 677 p_msg->offset = L2CAP_MIN_OFFSET; 678 p = p_start = (UINT8 *)(p_msg + 1) + L2CAP_MIN_OFFSET; 679 680 /* Build a service search request packet */ 681 UINT8_TO_BE_STREAM (p, SDP_PDU_SERVICE_SEARCH_ATTR_REQ); 682 UINT16_TO_BE_STREAM (p, p_ccb->transaction_id); 683 p_ccb->transaction_id++; 684 685 /* Skip the length, we need to add it at the end */ 686 p_param_len = p; 687 p += 2; 688 689 /* Build the UID sequence. */ 690#if (defined(SDP_BROWSE_PLUS) && SDP_BROWSE_PLUS == TRUE) 691 p = sdpu_build_uuid_seq (p, 1, &p_ccb->p_db->uuid_filters[p_ccb->cur_uuid_idx]); 692#else 693 p = sdpu_build_uuid_seq (p, p_ccb->p_db->num_uuid_filters, p_ccb->p_db->uuid_filters); 694#endif 695 696 /* Max attribute byte count */ 697 UINT16_TO_BE_STREAM (p, sdp_cb.max_attr_list_size); 698 699 /* If no attribute filters, build a wildcard attribute sequence */ 700 if (p_ccb->p_db->num_attr_filters) 701 p = sdpu_build_attrib_seq (p, p_ccb->p_db->attr_filters, p_ccb->p_db->num_attr_filters); 702 else 703 p = sdpu_build_attrib_seq (p, NULL, 0); 704 705 /* No continuation for first request */ 706 if (p_reply) 707 { 708 memcpy (p, p_reply, *p_reply + 1); 709 p += *p_reply + 1; 710 } 711 else 712 UINT8_TO_BE_STREAM (p, 0); 713 714 /* Go back and put the parameter length into the buffer */ 715 param_len = p - p_param_len - 2; 716 UINT16_TO_BE_STREAM (p_param_len, param_len); 717 718 /* Set the length of the SDP data in the buffer */ 719 p_msg->len = p - p_start; 720 721 722 L2CA_DataWrite (p_ccb->connection_id, p_msg); 723 724 /* Start inactivity timer */ 725 btu_start_timer (&p_ccb->timer_entry, BTU_TTYPE_SDP, SDP_INACT_TIMEOUT); 726 727 return; 728 } 729 730 731 /*******************************************************************/ 732 /* We now have the full response, which is a sequence of sequences */ 733 /*******************************************************************/ 734 735#if (SDP_RAW_DATA_INCLUDED == TRUE) 736 SDP_TRACE_WARNING0("process_service_search_attr_rsp"); 737 sdp_copy_raw_data (p_ccb, len, TRUE); 738#endif 739 740 p = &p_ccb->rsp_list[0]; 741 742 /* The contents is a sequence of attribute sequences */ 743 type = *p++; 744 745 if ((type >> 3) != DATA_ELE_SEQ_DESC_TYPE) 746 { 747 SDP_TRACE_WARNING1 ("SDP - Wrong type: 0x%02x in attr_rsp", type); 748 return; 749 } 750 p = sdpu_get_len_from_type (p, type, &seq_len); 751 752 p_end = &p_ccb->rsp_list[p_ccb->list_len]; 753 754 if ((p + seq_len) != p_end) 755 { 756 sdp_disconnect (p_ccb, SDP_INVALID_CONT_STATE); 757 return; 758 } 759 760 while (p < p_end) 761 { 762 p = save_attr_seq (p_ccb, p, &p_ccb->rsp_list[p_ccb->list_len]); 763 if (!p) 764 { 765 sdp_disconnect (p_ccb, SDP_DB_FULL); 766 return; 767 } 768 } 769 770 /* Since we got everything we need, disconnect the call */ 771 sdp_disconnect (p_ccb, SDP_SUCCESS); 772} 773 774/******************************************************************************* 775** 776** Function save_attr_seq 777** 778** Description This function is called when there is a response from 779** the server. 780** 781** Returns pointer to next byte or NULL if error 782** 783*******************************************************************************/ 784static UINT8 *save_attr_seq (tCONN_CB *p_ccb, UINT8 *p, UINT8 *p_msg_end) 785{ 786 UINT32 seq_len, attr_len; 787 UINT16 attr_id; 788 UINT8 type, *p_seq_end; 789 tSDP_DISC_REC *p_rec; 790 791 type = *p++; 792 793 if ((type >> 3) != DATA_ELE_SEQ_DESC_TYPE) 794 { 795 SDP_TRACE_WARNING1 ("SDP - Wrong type: 0x%02x in attr_rsp", type); 796 return (NULL); 797 } 798 799 p = sdpu_get_len_from_type (p, type, &seq_len); 800 if ((p + seq_len) > p_msg_end) 801 { 802 SDP_TRACE_WARNING1 ("SDP - Bad len in attr_rsp %d", seq_len); 803 return (NULL); 804 } 805 806 /* Create a record */ 807 p_rec = add_record (p_ccb->p_db, p_ccb->device_address); 808 if (!p_rec) 809 { 810 SDP_TRACE_WARNING0 ("SDP - DB full add_record"); 811 return (NULL); 812 } 813 814 p_seq_end = p + seq_len; 815 816 while (p < p_seq_end) 817 { 818 /* First get the attribute ID */ 819 type = *p++; 820 p = sdpu_get_len_from_type (p, type, &attr_len); 821 if (((type >> 3) != UINT_DESC_TYPE) || (attr_len != 2)) 822 { 823 SDP_TRACE_WARNING2 ("SDP - Bad type: 0x%02x or len: %d in attr_rsp", type, attr_len); 824 return (NULL); 825 } 826 BE_STREAM_TO_UINT16 (attr_id, p); 827 828 /* Now, add the attribute value */ 829 p = add_attr (p, p_ccb->p_db, p_rec, attr_id, NULL, 0); 830 831 if (!p) 832 { 833 SDP_TRACE_WARNING0 ("SDP - DB full add_attr"); 834 return (NULL); 835 } 836 } 837 838 return (p); 839} 840 841 842/******************************************************************************* 843** 844** Function add_record 845** 846** Description This function allocates space for a record from the DB. 847** 848** Returns pointer to next byte in data stream 849** 850*******************************************************************************/ 851tSDP_DISC_REC *add_record (tSDP_DISCOVERY_DB *p_db, BD_ADDR p_bda) 852{ 853 tSDP_DISC_REC *p_rec; 854 855 /* See if there is enough space in the database */ 856 if (p_db->mem_free < sizeof (tSDP_DISC_REC)) 857 return (NULL); 858 859 p_rec = (tSDP_DISC_REC *) p_db->p_free_mem; 860 p_db->p_free_mem += sizeof (tSDP_DISC_REC); 861 p_db->mem_free -= sizeof (tSDP_DISC_REC); 862 863 p_rec->p_first_attr = NULL; 864 p_rec->p_next_rec = NULL; 865 866 memcpy (p_rec->remote_bd_addr, p_bda, BD_ADDR_LEN); 867 868 /* Add the record to the end of chain */ 869 if (!p_db->p_first_rec) 870 p_db->p_first_rec = p_rec; 871 else 872 { 873 tSDP_DISC_REC *p_rec1 = p_db->p_first_rec; 874 875 while (p_rec1->p_next_rec) 876 p_rec1 = p_rec1->p_next_rec; 877 878 p_rec1->p_next_rec = p_rec; 879 } 880 881 return (p_rec); 882} 883 884#define SDP_ADDITIONAL_LIST_MASK 0x80 885/******************************************************************************* 886** 887** Function add_attr 888** 889** Description This function allocates space for an attribute from the DB 890** and copies the data into it. 891** 892** Returns pointer to next byte in data stream 893** 894*******************************************************************************/ 895static UINT8 *add_attr (UINT8 *p, tSDP_DISCOVERY_DB *p_db, tSDP_DISC_REC *p_rec, 896 UINT16 attr_id, tSDP_DISC_ATTR *p_parent_attr, UINT8 nest_level) 897{ 898 tSDP_DISC_ATTR *p_attr; 899 UINT32 attr_len; 900 UINT32 total_len; 901 UINT16 attr_type; 902 UINT16 id; 903 UINT8 type; 904 UINT8 *p_end; 905 UINT8 is_additional_list = nest_level & SDP_ADDITIONAL_LIST_MASK; 906 907 nest_level &= ~(SDP_ADDITIONAL_LIST_MASK); 908 909 type = *p++; 910 p = sdpu_get_len_from_type (p, type, &attr_len); 911 912 attr_len &= SDP_DISC_ATTR_LEN_MASK; 913 attr_type = (type >> 3) & 0x0f; 914 915 /* See if there is enough space in the database */ 916 if (attr_len > 4) 917 total_len = attr_len - 4 + (UINT16)sizeof (tSDP_DISC_ATTR); 918 else 919 total_len = sizeof (tSDP_DISC_ATTR); 920 921 /* Ensure it is a multiple of 4 */ 922 total_len = (total_len + 3) & ~3; 923 924 /* See if there is enough space in the database */ 925 if (p_db->mem_free < total_len) 926 return (NULL); 927 928 p_attr = (tSDP_DISC_ATTR *) p_db->p_free_mem; 929 p_attr->attr_id = attr_id; 930 p_attr->attr_len_type = (UINT16)attr_len | (attr_type << 12); 931 p_attr->p_next_attr = NULL; 932 933 /* Store the attribute value */ 934 switch (attr_type) 935 { 936 case UINT_DESC_TYPE: 937 if( (is_additional_list != 0) && (attr_len == 2) ) 938 { 939 BE_STREAM_TO_UINT16 (id, p); 940 if(id != ATTR_ID_PROTOCOL_DESC_LIST) 941 p -= 2; 942 else 943 { 944 /* Reserve the memory for the attribute now, as we need to add sub-attributes */ 945 p_db->p_free_mem += sizeof (tSDP_DISC_ATTR); 946 p_db->mem_free -= sizeof (tSDP_DISC_ATTR); 947 p_end = p + attr_len; 948 total_len = 0; 949 950 /* SDP_TRACE_DEBUG1 ("SDP - attr nest level:%d(list)", nest_level); */ 951 if (nest_level >= MAX_NEST_LEVELS) 952 { 953 SDP_TRACE_ERROR0 ("SDP - attr nesting too deep"); 954 return (p_end); 955 } 956 957 /* Now, add the list entry */ 958 p = add_attr (p, p_db, p_rec, ATTR_ID_PROTOCOL_DESC_LIST, p_attr, (UINT8)(nest_level + 1)); 959 960 break; 961 } 962 } 963 /* Case falls through */ 964 965 case TWO_COMP_INT_DESC_TYPE: 966 switch (attr_len) 967 { 968 case 1: 969 p_attr->attr_value.v.u8 = *p++; 970 break; 971 case 2: 972 BE_STREAM_TO_UINT16 (p_attr->attr_value.v.u16, p); 973 break; 974 case 4: 975 BE_STREAM_TO_UINT32 (p_attr->attr_value.v.u32, p); 976 break; 977 default: 978 BE_STREAM_TO_ARRAY (p, p_attr->attr_value.v.array, (INT32)attr_len); 979 break; 980 } 981 break; 982 983 case UUID_DESC_TYPE: 984 switch (attr_len) 985 { 986 case 2: 987 BE_STREAM_TO_UINT16 (p_attr->attr_value.v.u16, p); 988 break; 989 case 4: 990 BE_STREAM_TO_UINT32 (p_attr->attr_value.v.u32, p); 991 if (p_attr->attr_value.v.u32 < 0x10000) 992 { 993 attr_len = 2; 994 p_attr->attr_len_type = (UINT16)attr_len | (attr_type << 12); 995 p_attr->attr_value.v.u16 = (UINT16) p_attr->attr_value.v.u32; 996 997 } 998 break; 999 case 16: 1000 /* See if we can compress his UUID down to 16 or 32bit UUIDs */ 1001 if (sdpu_is_base_uuid (p)) 1002 { 1003 if ((p[0] == 0) && (p[1] == 0)) 1004 { 1005 p_attr->attr_len_type = (p_attr->attr_len_type & ~SDP_DISC_ATTR_LEN_MASK) | 2; 1006 p += 2; 1007 BE_STREAM_TO_UINT16 (p_attr->attr_value.v.u16, p); 1008 p += MAX_UUID_SIZE - 4; 1009 } 1010 else 1011 { 1012 p_attr->attr_len_type = (p_attr->attr_len_type & ~SDP_DISC_ATTR_LEN_MASK) | 4; 1013 BE_STREAM_TO_UINT32 (p_attr->attr_value.v.u32, p); 1014 p += MAX_UUID_SIZE - 4; 1015 } 1016 } 1017 else 1018 { 1019 /* coverity[overrun-local] */ 1020 /* 1021 Event overrun-local: Overrun of static array "p_attr->attr_value.v.array" of size 4 at position 15 with index variable "ijk" 1022 False-positive: SDP uses scratch buffer to hold the attribute value. 1023 The actual size of tSDP_DISC_ATVAL does not matter. 1024 If the array size in tSDP_DISC_ATVAL is increase, we would increase the system RAM usage unnecessarily 1025 */ 1026 BE_STREAM_TO_ARRAY (p, p_attr->attr_value.v.array, (INT32)attr_len); 1027 } 1028 break; 1029 default: 1030 SDP_TRACE_WARNING1 ("SDP - bad len in UUID attr: %d", attr_len); 1031 return (p + attr_len); 1032 } 1033 break; 1034 1035 case DATA_ELE_SEQ_DESC_TYPE: 1036 case DATA_ELE_ALT_DESC_TYPE: 1037 /* Reserve the memory for the attribute now, as we need to add sub-attributes */ 1038 p_db->p_free_mem += sizeof (tSDP_DISC_ATTR); 1039 p_db->mem_free -= sizeof (tSDP_DISC_ATTR); 1040 p_end = p + attr_len; 1041 total_len = 0; 1042 1043 /* SDP_TRACE_DEBUG1 ("SDP - attr nest level:%d", nest_level); */ 1044 if (nest_level >= MAX_NEST_LEVELS) 1045 { 1046 SDP_TRACE_ERROR0 ("SDP - attr nesting too deep"); 1047 return (p_end); 1048 } 1049 if(is_additional_list != 0 || attr_id == ATTR_ID_ADDITION_PROTO_DESC_LISTS) 1050 nest_level |= SDP_ADDITIONAL_LIST_MASK; 1051 /* SDP_TRACE_DEBUG1 ("SDP - attr nest level:0x%x(finish)", nest_level); */ 1052 1053 while (p < p_end) 1054 { 1055 /* Now, add the list entry */ 1056 p = add_attr (p, p_db, p_rec, 0, p_attr, (UINT8)(nest_level + 1)); 1057 1058 if (!p) 1059 return (NULL); 1060 } 1061 break; 1062 1063 case TEXT_STR_DESC_TYPE: 1064 case URL_DESC_TYPE: 1065 BE_STREAM_TO_ARRAY (p, p_attr->attr_value.v.array, (INT32)attr_len); 1066 break; 1067 1068 case BOOLEAN_DESC_TYPE: 1069 switch (attr_len) 1070 { 1071 case 1: 1072 p_attr->attr_value.v.u8 = *p++; 1073 break; 1074 default: 1075 SDP_TRACE_WARNING1 ("SDP - bad len in boolean attr: %d", attr_len); 1076 return (p + attr_len); 1077 } 1078 break; 1079 1080 default: /* switch (attr_type) */ 1081 break; 1082 } 1083 1084 p_db->p_free_mem += total_len; 1085 p_db->mem_free -= total_len; 1086 1087 /* Add the attribute to the end of the chain */ 1088 if (!p_parent_attr) 1089 { 1090 if (!p_rec->p_first_attr) 1091 p_rec->p_first_attr = p_attr; 1092 else 1093 { 1094 tSDP_DISC_ATTR *p_attr1 = p_rec->p_first_attr; 1095 1096 while (p_attr1->p_next_attr) 1097 p_attr1 = p_attr1->p_next_attr; 1098 1099 p_attr1->p_next_attr = p_attr; 1100 } 1101 } 1102 else 1103 { 1104 if (!p_parent_attr->attr_value.v.p_sub_attr) 1105 { 1106 p_parent_attr->attr_value.v.p_sub_attr = p_attr; 1107 /* SDP_TRACE_DEBUG4 ("parent:0x%x(id:%d), ch:0x%x(id:%d)", 1108 p_parent_attr, p_parent_attr->attr_id, p_attr, p_attr->attr_id); */ 1109 } 1110 else 1111 { 1112 tSDP_DISC_ATTR *p_attr1 = p_parent_attr->attr_value.v.p_sub_attr; 1113 /* SDP_TRACE_DEBUG4 ("parent:0x%x(id:%d), ch1:0x%x(id:%d)", 1114 p_parent_attr, p_parent_attr->attr_id, p_attr1, p_attr1->attr_id); */ 1115 1116 while (p_attr1->p_next_attr) 1117 p_attr1 = p_attr1->p_next_attr; 1118 1119 p_attr1->p_next_attr = p_attr; 1120 /* SDP_TRACE_DEBUG2 ("new ch:0x%x(id:%d)", p_attr, p_attr->attr_id); */ 1121 } 1122 } 1123 1124 return (p); 1125} 1126 1127#endif /* CLIENT_ENABLED == TRUE */ 1128