You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mynewt.apache.org by cc...@apache.org on 2016/07/23 02:47:36 UTC

[09/11] incubator-mynewt-core git commit: BLE Host - Use mbufs instead of flat bufs.

BLE Host - Use mbufs instead of flat bufs.


Project: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/commit/ef7abf7d
Tree: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/tree/ef7abf7d
Diff: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/diff/ef7abf7d

Branch: refs/heads/develop
Commit: ef7abf7d06e4cbf90f0e11c0762ee83d7b5a5add
Parents: 6c457ca
Author: Christopher Collins <cc...@apache.org>
Authored: Fri Jul 22 12:02:37 2016 -0700
Committer: Christopher Collins <cc...@apache.org>
Committed: Fri Jul 22 18:34:01 2016 -0700

----------------------------------------------------------------------
 net/nimble/controller/src/ble_ll_conn.c         |   4 +-
 net/nimble/host/include/host/ble_att.h          |   8 +-
 net/nimble/host/include/host/ble_gap.h          |  14 +-
 net/nimble/host/include/host/ble_gatt.h         |  53 +-
 net/nimble/host/include/host/ble_hs.h           |   3 +
 net/nimble/host/include/host/ble_hs_mbuf.h      |  31 +
 net/nimble/host/include/host/host_hci.h         |   2 +-
 .../host/services/mandatory/src/ble_svc_gap.c   |  37 +-
 .../host/services/mandatory/src/ble_svc_gatt.c  |  10 +-
 net/nimble/host/src/ble_att.c                   |  50 +-
 net/nimble/host/src/ble_att_clt.c               | 741 +++++--------------
 net/nimble/host/src/ble_att_priv.h              |  22 +-
 net/nimble/host/src/ble_att_svr.c               | 642 +++++++---------
 net/nimble/host/src/ble_gap.c                   |   7 +-
 net/nimble/host/src/ble_gap_priv.h              |   3 +-
 net/nimble/host/src/ble_gatt_priv.h             |  12 +-
 net/nimble/host/src/ble_gattc.c                 | 541 ++++++++++----
 net/nimble/host/src/ble_gatts.c                 | 190 +++--
 net/nimble/host/src/ble_hs.c                    |  13 +-
 net/nimble/host/src/ble_hs_mbuf.c               | 171 +++++
 net/nimble/host/src/ble_hs_mbuf_priv.h          |  11 +
 net/nimble/host/src/ble_hs_misc.c               |  41 -
 net/nimble/host/src/ble_hs_priv.h               |   7 +-
 net/nimble/host/src/ble_l2cap.c                 |  18 +-
 net/nimble/host/src/ble_l2cap_priv.h            |   4 +-
 net/nimble/host/src/ble_l2cap_sig.c             |   6 +-
 net/nimble/host/src/ble_l2cap_sig_cmd.c         |  28 +-
 net/nimble/host/src/ble_sm.c                    |  22 +-
 net/nimble/host/src/ble_sm_cmd.c                |  84 ++-
 net/nimble/host/src/ble_sm_sc.c                 |   4 +-
 net/nimble/host/src/host_hci.c                  |  18 +-
 net/nimble/host/src/test/ble_att_clt_test.c     |  21 +-
 net/nimble/host/src/test/ble_att_svr_test.c     | 230 +++---
 net/nimble/host/src/test/ble_gap_test.c         |  20 +
 net/nimble/host/src/test/ble_gatt_conn_test.c   |  55 +-
 net/nimble/host/src/test/ble_gatt_disc_c_test.c |   2 +
 net/nimble/host/src/test/ble_gatt_disc_d_test.c |   2 +
 net/nimble/host/src/test/ble_gatt_disc_s_test.c |   2 +
 net/nimble/host/src/test/ble_gatt_find_s_test.c |   2 +
 net/nimble/host/src/test/ble_gatt_read_test.c   | 208 +++---
 net/nimble/host/src/test/ble_gatt_write_test.c  |  75 +-
 .../host/src/test/ble_gatts_notify_test.c       |  16 +-
 net/nimble/host/src/test/ble_gatts_read_test.c  |  31 +-
 net/nimble/host/src/test/ble_gatts_reg_test.c   |   2 +
 net/nimble/host/src/test/ble_host_hci_test.c    |   2 +
 net/nimble/host/src/test/ble_hs_adv_test.c      |   2 +
 net/nimble/host/src/test/ble_hs_conn_test.c     |   2 +
 net/nimble/host/src/test/ble_hs_test_util.c     | 204 ++++-
 net/nimble/host/src/test/ble_hs_test_util.h     |  33 +
 net/nimble/host/src/test/ble_l2cap_test.c       |   8 +-
 net/nimble/host/src/test/ble_os_test.c          |   2 +
 net/nimble/host/src/test/ble_sm_lgcy_test.c     |   2 +
 net/nimble/host/src/test/ble_sm_sc_test.c       |   2 +
 net/nimble/host/src/test/ble_sm_test.c          |   2 +
 net/nimble/host/src/test/ble_sm_test_util.c     |  22 +-
 net/nimble/host/src/test/ble_uuid_test.c        |   5 +-
 net/nimble/include/nimble/nimble_opt.h          |   8 +
 57 files changed, 2096 insertions(+), 1661 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/ef7abf7d/net/nimble/controller/src/ble_ll_conn.c
----------------------------------------------------------------------
diff --git a/net/nimble/controller/src/ble_ll_conn.c b/net/nimble/controller/src/ble_ll_conn.c
index ca94310..811b51f 100644
--- a/net/nimble/controller/src/ble_ll_conn.c
+++ b/net/nimble/controller/src/ble_ll_conn.c
@@ -104,7 +104,7 @@ extern void bletest_completed_pkt(uint16_t handle);
  */
 
 /* XXX: this does not belong here! Move to transport? */
-extern int ble_hs_rx_data(struct os_mbuf *om);
+extern int ble_hs_rx_data(struct os_mbuf **om);
 
 /*
  * The amount of time that we will wait to hear the start of a receive
@@ -2569,7 +2569,7 @@ ble_ll_conn_rx_data_pdu(struct os_mbuf *rxpdu, struct ble_mbuf_hdr *hdr)
                     acl_hdr = (acl_hdr << 12) | connsm->conn_handle;
                     htole16(rxbuf, acl_hdr);
                     htole16(rxbuf + 2, acl_len);
-                    ble_hs_rx_data(rxpdu);
+                    ble_hs_rx_data(&rxpdu);
                 }
 
                 /* NOTE: we dont free the mbuf since we handed it off! */

http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/ef7abf7d/net/nimble/host/include/host/ble_att.h
----------------------------------------------------------------------
diff --git a/net/nimble/host/include/host/ble_att.h b/net/nimble/host/include/host/ble_att.h
index 5ce4123..3bccea5 100644
--- a/net/nimble/host/include/host/ble_att.h
+++ b/net/nimble/host/include/host/ble_att.h
@@ -21,6 +21,7 @@
 #define H_BLE_ATT_
 
 #include "os/queue.h"
+struct os_mbuf;
 
 #define BLE_ATT_UUID_PRIMARY_SERVICE        0x2800
 #define BLE_ATT_UUID_SECONDARY_SERVICE      0x2801
@@ -167,11 +168,10 @@ struct ble_att_svr_access_ctxt {
     };
 };
 
-int ble_att_svr_read_local(uint16_t attr_handle, const void **out_data,
-                           uint16_t *out_attr_len);
-int ble_att_svr_write_local(uint16_t attr_handle, const void *data,
-                            uint16_t data_len);
+int ble_att_svr_read_local(uint16_t attr_handle, struct os_mbuf **out_om);
+int ble_att_svr_write_local(uint16_t attr_handle, struct os_mbuf **om);
 
+uint16_t ble_att_mtu(uint16_t conn_handle);
 int ble_att_set_preferred_mtu(uint16_t mtu);
 
 #endif

http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/ef7abf7d/net/nimble/host/include/host/ble_gap.h
----------------------------------------------------------------------
diff --git a/net/nimble/host/include/host/ble_gap.h b/net/nimble/host/include/host/ble_gap.h
index 8cd4402..46854e0 100644
--- a/net/nimble/host/include/host/ble_gap.h
+++ b/net/nimble/host/include/host/ble_gap.h
@@ -315,6 +315,9 @@ struct ble_gap_event {
          *     o L2CAP Connection Parameter Update Procedure
          *     o Link-Layer Connection Parameters Request Procedure
          *
+         * To reject the request, return a non-zero HCI error code.  The value
+         * returned is the reject reason given to the controller.
+         *
          * Valid for the following event types:
          *     o BLE_GAP_EVENT_L2CAP_UPDATE_REQ
          *     o BLE_GAP_EVENT_CONN_UPDATE_REQ
@@ -395,15 +398,16 @@ struct ble_gap_event {
          *     o BLE_GAP_EVENT_NOTIFY_RX
          */
         struct {
-            /** The contents of the notification or indication. */
-            void *attr_data;
+            /**
+             * The contents of the notification or indication.  If the
+             * application wishes to retain this mbuf for later use, it must
+             * set this pointer to NULL to prevent the stack from freeing it.
+             */
+            struct os_mbuf *om;
 
             /** The handle of the relevant ATT attribute. */
             uint16_t attr_handle;
 
-            /** The number of data bytes contained in the message. */
-            uint16_t attr_len;
-
             /** The handle of the relevant connection. */
             uint16_t conn_handle;
 

http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/ef7abf7d/net/nimble/host/include/host/ble_gatt.h
----------------------------------------------------------------------
diff --git a/net/nimble/host/include/host/ble_gatt.h b/net/nimble/host/include/host/ble_gatt.h
index 0f1310c..3695401 100644
--- a/net/nimble/host/include/host/ble_gatt.h
+++ b/net/nimble/host/include/host/ble_gatt.h
@@ -82,8 +82,7 @@ struct ble_gatt_svc {
 struct ble_gatt_attr {
     uint16_t handle;
     uint16_t offset;
-    uint16_t value_len;
-    const void *value;
+    struct os_mbuf *om;
 };
 
 struct ble_gatt_chr {
@@ -107,11 +106,11 @@ typedef int ble_gatt_disc_svc_fn(uint16_t conn_handle,
                                  void *arg);
 typedef int ble_gatt_attr_fn(uint16_t conn_handle,
                              const struct ble_gatt_error *error,
-                             const struct ble_gatt_attr *attr,
+                             struct ble_gatt_attr *attr,
                              void *arg);
 typedef int ble_gatt_reliable_attr_fn(uint16_t conn_handle,
                                       const struct ble_gatt_error *error,
-                                      const struct ble_gatt_attr *attrs,
+                                      struct ble_gatt_attr *attrs,
                                       uint8_t num_attrs, void *arg);
 
 typedef int ble_gatt_chr_fn(uint16_t conn_handle,
@@ -153,29 +152,26 @@ int ble_gattc_read_mult(uint16_t conn_handle, const uint16_t *handles,
                         uint8_t num_handles, ble_gatt_attr_fn *cb,
                         void *cb_arg);
 int ble_gattc_write_no_rsp(uint16_t conn_handle, uint16_t attr_handle,
-                           const void *value, uint16_t value_len);
+                           struct os_mbuf **om);
+int ble_gattc_write_no_rsp_flat(uint16_t conn_handle, uint16_t attr_handle,
+                                const void *data, uint16_t data_len);
 int ble_gattc_write(uint16_t conn_handle, uint16_t attr_handle,
-                    const void *value, uint16_t value_len,
+                    struct os_mbuf **om,
                     ble_gatt_attr_fn *cb, void *cb_arg);
+int ble_gattc_write_flat(uint16_t conn_handle, uint16_t attr_handle,
+                         const void *data, uint16_t data_len,
+                         ble_gatt_attr_fn *cb, void *cb_arg);
 int ble_gattc_write_long(uint16_t conn_handle, uint16_t attr_handle,
-                         const void *value, uint16_t value_len,
+                         struct os_mbuf **om,
                          ble_gatt_attr_fn *cb, void *cb_arg);
 int ble_gattc_write_reliable(uint16_t conn_handle,
-                             const struct ble_gatt_attr *attrs,
+                             struct ble_gatt_attr *attrs,
                              int num_attrs, ble_gatt_reliable_attr_fn *cb,
                              void *cb_arg);
-int ble_gattc_read_dsc(uint16_t conn_handle, uint16_t attr_handle,
-                       ble_gatt_attr_fn *cb, void *cb_arg);
-int ble_gattc_read_long_dsc(uint16_t conn_handle, uint16_t attr_handle,
-                            ble_gatt_attr_fn *cb, void *cb_arg);
-int ble_gattc_write_dsc(uint16_t conn_handle, uint16_t attr_handle,
-                        const void *value, uint16_t value_len,
-                        ble_gatt_attr_fn *cb, void *cb_arg);
-int ble_gattc_write_long_dsc(uint16_t conn_handle, uint16_t attr_handle,
-                             const void *value, uint16_t value_len,
-                             ble_gatt_attr_fn *cb, void *cb_arg);
 int ble_gattc_notify_custom(uint16_t conn_handle, uint16_t att_handle,
-                            const void *attr_data, uint16_t attr_data_len);
+                            struct os_mbuf **om);
+int ble_gattc_notify(uint16_t conn_handle, uint16_t chr_val_handle);
+int ble_gattc_indicate(uint16_t conn_handle, uint16_t chr_val_handle);
 
 int ble_gattc_init(void);
 
@@ -266,9 +262,20 @@ struct ble_gatt_access_ctxt {
     uint8_t op;
 
     /**
+     * A container for the GATT access data.
+     *     o For reads: The application populates this with the value of the
+     *       characteristic or descriptor being read.
+     *     o For writes: This is already populated with the value being written
+     *       by the peer.  If the application wishes to retain this mbuf for
+     *       later use, it must set this pointer to NULL to prevent the stack
+     *       from freeing it.
+     */
+    struct os_mbuf *om;
+
+    /**
      * The GATT operation being performed dictates which field in this union is
      * valid.  If a characteristic is being accessed, the chr field is valid.
-     * Otherwise, a descriptor is being accessed, in which case the dsc field
+     * Otherwise a descriptor is being accessed, in which case the dsc field
      * is valid.
      */
     union {
@@ -284,12 +291,6 @@ struct ble_gatt_access_ctxt {
          */
         const struct ble_gatt_dsc_def *dsc;
     };
-
-    /**
-     * Context describing the underlying ATT access.  Specifies additional
-     * details about the read or write being performed.
-     */
-    struct ble_att_svr_access_ctxt *att;
 };
 
 struct ble_gatt_dsc_def {

http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/ef7abf7d/net/nimble/host/include/host/ble_hs.h
----------------------------------------------------------------------
diff --git a/net/nimble/host/include/host/ble_hs.h b/net/nimble/host/include/host/ble_hs.h
index dbc8a5b..ec1b3d8 100644
--- a/net/nimble/host/include/host/ble_hs.h
+++ b/net/nimble/host/include/host/ble_hs.h
@@ -26,8 +26,10 @@
 #include "host/ble_gatt.h"
 #include "host/ble_hs.h"
 #include "host/ble_hs_adv.h"
+#include "host/ble_hs_id.h"
 #include "host/ble_hs_log.h"
 #include "host/ble_hs_test.h"
+#include "host/ble_hs_mbuf.h"
 #include "host/ble_sm.h"
 #include "host/ble_store.h"
 #include "host/ble_uuid.h"
@@ -216,6 +218,7 @@ struct ble_hs_cfg {
 
 extern const struct ble_hs_cfg ble_hs_cfg_dflt;
 
+int ble_hs_rx_data(struct os_mbuf **om);
 int ble_hs_start(void);
 void ble_hs_event_enqueue(struct os_event *ev);
 int ble_hs_init(struct os_eventq *app_evq, struct ble_hs_cfg *cfg);

http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/ef7abf7d/net/nimble/host/include/host/ble_hs_mbuf.h
----------------------------------------------------------------------
diff --git a/net/nimble/host/include/host/ble_hs_mbuf.h b/net/nimble/host/include/host/ble_hs_mbuf.h
new file mode 100644
index 0000000..d3606f2
--- /dev/null
+++ b/net/nimble/host/include/host/ble_hs_mbuf.h
@@ -0,0 +1,31 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+#ifndef H_BLE_HS_MBUF_
+#define H_BLE_HS_MBUF_
+
+#include <inttypes.h>
+struct os_mbuf;
+
+struct os_mbuf *ble_hs_mbuf_att_pkt(void);
+struct os_mbuf *ble_hs_mbuf_from_flat(const void *buf, uint16_t len);
+int ble_hs_mbuf_to_flat(const struct os_mbuf *om, void *flat, uint16_t max_len,
+                        uint16_t *out_copy_len);
+
+#endif

http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/ef7abf7d/net/nimble/host/include/host/host_hci.h
----------------------------------------------------------------------
diff --git a/net/nimble/host/include/host/host_hci.h b/net/nimble/host/include/host/host_hci.h
index 1bf3c06..bcec2ef 100644
--- a/net/nimble/host/include/host/host_hci.h
+++ b/net/nimble/host/include/host/host_hci.h
@@ -104,7 +104,7 @@ int host_hci_set_buf_size(uint16_t pktlen, uint8_t max_pkts);
 uint16_t host_hci_handle_pb_bc_join(uint16_t handle, uint8_t pb, uint8_t bc);
 
 int host_hci_data_rx(struct os_mbuf *om);
-int host_hci_data_tx(struct ble_hs_conn *connection, struct os_mbuf *om);
+int host_hci_data_tx(struct ble_hs_conn *connection, struct os_mbuf **txom);
 
 int host_hci_cmd_build_set_data_len(uint16_t connection_handle,
                                     uint16_t tx_octets, uint16_t tx_time,

http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/ef7abf7d/net/nimble/host/services/mandatory/src/ble_svc_gap.c
----------------------------------------------------------------------
diff --git a/net/nimble/host/services/mandatory/src/ble_svc_gap.c b/net/nimble/host/services/mandatory/src/ble_svc_gap.c
index 0afc5fc..d5d50f3 100644
--- a/net/nimble/host/services/mandatory/src/ble_svc_gap.c
+++ b/net/nimble/host/services/mandatory/src/ble_svc_gap.c
@@ -81,6 +81,7 @@ ble_svc_gap_access(uint16_t conn_handle, uint16_t attr_handle,
                    struct ble_gatt_access_ctxt *ctxt, void *arg)
 {
     uint16_t uuid16;
+    int rc;
 
     uuid16 = ble_uuid_128_to_16(ctxt->chr->uuid128);
     assert(uuid16 != 0);
@@ -88,43 +89,41 @@ ble_svc_gap_access(uint16_t conn_handle, uint16_t attr_handle,
     switch (uuid16) {
     case BLE_SVC_GAP_CHR_UUID16_DEVICE_NAME:
         assert(ctxt->op == BLE_GATT_ACCESS_OP_READ_CHR);
-        ctxt->att->read.data = ble_svc_gap_name;
-        ctxt->att->read.len = strlen(ble_svc_gap_name);
-        break;
+        rc = os_mbuf_append(ctxt->om, ble_svc_gap_name,
+                            strlen(ble_svc_gap_name));
+        return rc == 0 ? 0 : BLE_ATT_ERR_INSUFFICIENT_RES;
 
     case BLE_SVC_GAP_CHR_UUID16_APPEARANCE:
         assert(ctxt->op == BLE_GATT_ACCESS_OP_READ_CHR);
-        ctxt->att->read.data = &ble_svc_gap_appearance;
-        ctxt->att->read.len = sizeof ble_svc_gap_appearance;
-        break;
+        rc = os_mbuf_append(ctxt->om, &ble_svc_gap_appearance,
+                            sizeof ble_svc_gap_appearance);
+        return rc == 0 ? 0 : BLE_ATT_ERR_INSUFFICIENT_RES;
 
     case BLE_SVC_GAP_CHR_UUID16_PERIPH_PRIV_FLAG:
         assert(ctxt->op == BLE_GATT_ACCESS_OP_READ_CHR);
-        ctxt->att->read.data = &ble_svc_gap_privacy_flag;
-        ctxt->att->read.len = sizeof ble_svc_gap_privacy_flag;
-        break;
+        rc = os_mbuf_append(ctxt->om, &ble_svc_gap_privacy_flag,
+                            sizeof ble_svc_gap_privacy_flag);
+        return rc == 0 ? 0 : BLE_ATT_ERR_INSUFFICIENT_RES;
 
     case BLE_SVC_GAP_CHR_UUID16_RECONNECT_ADDR:
         assert(ctxt->op == BLE_GATT_ACCESS_OP_WRITE_CHR);
-        if (ctxt->att->write.len != sizeof ble_svc_gap_reconnect_addr) {
+        if (OS_MBUF_PKTLEN(ctxt->om) != sizeof ble_svc_gap_reconnect_addr) {
             return BLE_ATT_ERR_INVALID_ATTR_VALUE_LEN;
         }
-        memcpy(ble_svc_gap_reconnect_addr, ctxt->att->write.data,
-               sizeof ble_svc_gap_reconnect_addr);
-        break;
+        ble_hs_mbuf_to_flat(ctxt->om, ble_svc_gap_reconnect_addr,
+                            sizeof ble_svc_gap_reconnect_addr, NULL);
+        return 0;
 
     case BLE_SVC_GAP_CHR_UUID16_PERIPH_PREF_CONN_PARAMS:
         assert(ctxt->op == BLE_GATT_ACCESS_OP_READ_CHR);
-        ctxt->att->read.data = &ble_svc_gap_pref_conn_params;
-        ctxt->att->read.len = sizeof ble_svc_gap_pref_conn_params;
-        break;
+        rc = os_mbuf_append(ctxt->om, &ble_svc_gap_pref_conn_params,
+                            sizeof ble_svc_gap_pref_conn_params);
+        return rc == 0 ? 0 : BLE_ATT_ERR_INSUFFICIENT_RES;
 
     default:
         assert(0);
-        break;
+        return BLE_ATT_ERR_UNLIKELY;
     }
-
-    return 0;
 }
 
 const char *

http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/ef7abf7d/net/nimble/host/services/mandatory/src/ble_svc_gatt.c
----------------------------------------------------------------------
diff --git a/net/nimble/host/services/mandatory/src/ble_svc_gatt.c b/net/nimble/host/services/mandatory/src/ble_svc_gatt.c
index 566efd8..704f849 100644
--- a/net/nimble/host/services/mandatory/src/ble_svc_gatt.c
+++ b/net/nimble/host/services/mandatory/src/ble_svc_gatt.c
@@ -49,6 +49,8 @@ static int
 ble_svc_gatt_access(uint16_t conn_handle, uint16_t attr_handle,
                     struct ble_gatt_access_ctxt *ctxt, void *arg)
 {
+    uint8_t *u8;
+
     /* The only operation allowed for this characteristic is indicate.  This
      * access callback gets called by the stack when it needs to read the
      * characteristic value to populate the outgoing indication command.
@@ -59,8 +61,12 @@ ble_svc_gatt_access(uint16_t conn_handle, uint16_t attr_handle,
     assert(ctxt->chr == &ble_svc_gatt_defs[0].characteristics[0]);
 
     /* XXX: For now, always respond with 0 (unchanged). */
-    ctxt->att->read.buf[0] = 0;
-    ctxt->att->read.len = 1;
+    u8 = os_mbuf_extend(ctxt->om, 1);
+    if (u8 == NULL) {
+        return BLE_ATT_ERR_INSUFFICIENT_RES;
+    }
+
+    *u8 = 0;
 
     return 0;
 }

http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/ef7abf7d/net/nimble/host/src/ble_att.c
----------------------------------------------------------------------
diff --git a/net/nimble/host/src/ble_att.c b/net/nimble/host/src/ble_att.c
index 6866bc1..1743a4f 100644
--- a/net/nimble/host/src/ble_att.c
+++ b/net/nimble/host/src/ble_att.c
@@ -22,8 +22,6 @@
 #include "bsp/bsp.h"
 #include "ble_hs_priv.h"
 
-static bssnz_t uint8_t ble_att_flat_buf[BLE_ATT_ATTR_MAX_LEN];
-
 static uint16_t ble_att_preferred_mtu;
 
 /** Dispatch table for incoming ATT requests.  Sorted by op code. */
@@ -390,17 +388,29 @@ ble_att_inc_rx_stat(uint8_t att_op)
     }
 }
 
-/**
- * Retrieves a pointer to the global ATT flat buffer.  This buffer is only used
- * by the host parent task, so users can assume exclusive access.
- */
-uint8_t *
-ble_att_get_flat_buf(void)
+void
+ble_att_truncate_to_mtu(const struct ble_l2cap_chan *att_chan,
+                        struct os_mbuf *txom)
 {
-    BLE_HS_DBG_ASSERT(ble_hs_is_parent_task());
-    return ble_att_flat_buf;
+    int32_t extra_len;
+    uint16_t mtu;
+
+    mtu = ble_l2cap_chan_mtu(att_chan);
+    extra_len = OS_MBUF_PKTLEN(txom) - mtu;
+    if (extra_len > 0) {
+        os_mbuf_adj(txom, -extra_len);
+    }
 }
 
+/**
+ * Retrieves the ATT MTU of the specified connection.  If an MTU exchange for
+ * this connection has occurred, the MTU is the lower of the two peers'
+ * preferred values.  Otherwise, the MTU is the default value of 23.
+ *
+ * @param conn_handle           The handle of the connection to query.
+ *
+ * @return                      The specified connection's ATT MTU.
+ */
 uint16_t
 ble_att_mtu(uint16_t conn_handle)
 {
@@ -422,6 +432,16 @@ ble_att_mtu(uint16_t conn_handle)
     return mtu;
 }
 
+void
+ble_att_set_peer_mtu(struct ble_l2cap_chan *chan, uint16_t peer_mtu)
+{
+    if (peer_mtu < BLE_ATT_MTU_DFLT) {
+        peer_mtu = BLE_ATT_MTU_DFLT;
+    }
+
+    chan->blc_peer_mtu = peer_mtu;
+}
+
 static int
 ble_att_rx(uint16_t conn_handle, struct os_mbuf **om)
 {
@@ -449,16 +469,6 @@ ble_att_rx(uint16_t conn_handle, struct os_mbuf **om)
     return 0;
 }
 
-void
-ble_att_set_peer_mtu(struct ble_l2cap_chan *chan, uint16_t peer_mtu)
-{
-    if (peer_mtu < BLE_ATT_MTU_DFLT) {
-        peer_mtu = BLE_ATT_MTU_DFLT;
-    }
-
-    chan->blc_peer_mtu = peer_mtu;
-}
-
 /**
  * Sets the preferred ATT MTU; the device will indicate this value in all
  * subseqeunt ATT MTU exchanges.  The ATT MTU of a connection is equal to the

http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/ef7abf7d/net/nimble/host/src/ble_att_clt.c
----------------------------------------------------------------------
diff --git a/net/nimble/host/src/ble_att_clt.c b/net/nimble/host/src/ble_att_clt.c
index cb5acc7..5687a99 100644
--- a/net/nimble/host/src/ble_att_clt.c
+++ b/net/nimble/host/src/ble_att_clt.c
@@ -29,110 +29,61 @@
 static int
 ble_att_clt_init_req(uint16_t initial_sz, struct os_mbuf **out_txom)
 {
+    struct os_mbuf *om;
     void *buf;
     int rc;
 
-    *out_txom = ble_hs_misc_pkthdr();
-    if (*out_txom == NULL) {
+    *out_txom = NULL;
+
+    om = ble_hs_mbuf_l2cap_pkt();
+    if (om == NULL) {
         rc = BLE_HS_ENOMEM;
         goto err;
     }
 
-    buf = os_mbuf_extend(*out_txom, initial_sz);
+    buf = os_mbuf_extend(om, initial_sz);
     if (buf == NULL) {
         rc = BLE_HS_ENOMEM;
         goto err;
     }
 
     /* The caller expects the initial buffer to be at the start of the mbuf. */
-    BLE_HS_DBG_ASSERT(buf == (*out_txom)->om_data);
+    BLE_HS_DBG_ASSERT(buf == om->om_data);
 
+    *out_txom = om;
     return 0;
 
 err:
-    os_mbuf_free_chain(*out_txom);
-    *out_txom = NULL;
+    os_mbuf_free_chain(om);
     return rc;
 }
 
 static int
-ble_att_clt_append_blob(uint16_t conn_handle, struct os_mbuf *txom,
-                        const void *blob, int blob_len)
-{
-    int rc;
-
-    if (blob_len < 0) {
-        return BLE_HS_EINVAL;
-    }
-    if (blob_len == 0) {
-        return 0;
-    }
-
-    rc = os_mbuf_append(txom, blob, blob_len);
-    if (rc != 0) {
-        return rc;
-    }
-
-    return 0;
-}
-
-static int
-ble_att_clt_copy_attr_to_flatbuf(const struct os_mbuf *om, void **out_attr_val,
-                                 uint16_t *out_attr_len)
-{
-    uint8_t *flat_buf;
-    uint16_t attr_len;
-
-    /* Make sure the attribute value isn't too big. */
-    attr_len = OS_MBUF_PKTLEN(om);
-    if (attr_len > BLE_ATT_ATTR_MAX_LEN) {
-        *out_attr_len = 0;
-        *out_attr_val = NULL;
-        return BLE_HS_EBADDATA;
-    }
-
-    /* Copy the attribute data into the global ATT flat buffer. */
-    flat_buf = ble_att_get_flat_buf();
-    os_mbuf_copydata(om, 0, attr_len, flat_buf);
-    *out_attr_val = flat_buf;
-    *out_attr_len = attr_len;
-    return 0;
-}
-
-static int
-ble_att_clt_tx_req(uint16_t conn_handle, struct os_mbuf *txom)
+ble_att_clt_tx_req(uint16_t conn_handle, struct os_mbuf **txom)
 {
     struct ble_l2cap_chan *chan;
     struct ble_hs_conn *conn;
-    uint16_t total_len;
-    uint16_t mtu;
-    int extra_len;
+    struct os_mbuf *om;
     int rc;
 
-    BLE_HS_DBG_ASSERT_EVAL(txom->om_len >= 1);
-    ble_att_inc_tx_stat(txom->om_data[0]);
+    /* Consume mbuf from caller. */
+    om = *txom;
+    *txom = NULL;
+
+    BLE_HS_DBG_ASSERT_EVAL(om->om_len >= 1);
+    ble_att_inc_tx_stat(om->om_data[0]);
 
     ble_hs_lock();
 
     rc = ble_att_conn_chan_find(conn_handle, &conn, &chan);
     if (rc == 0) {
-        /* Reduce the size of the transmission to fit the connection's ATT
-         * MTU.
-         */
-        total_len = OS_MBUF_PKTLEN(txom);
-        mtu = ble_l2cap_chan_mtu(chan);
-        extra_len = total_len - mtu;
-        if (extra_len > 0) {
-            os_mbuf_adj(txom, -extra_len);
-        }
-
-        rc = ble_l2cap_tx(conn, chan, txom);
-        txom = NULL;
+        ble_att_truncate_to_mtu(chan, om);
+        rc = ble_l2cap_tx(conn, chan, &om);
     }
 
     ble_hs_unlock();
 
-    os_mbuf_free_chain(txom);
+    os_mbuf_free_chain(om);
     return rc;
 }
 
@@ -146,7 +97,7 @@ ble_att_clt_rx_error(uint16_t conn_handle, struct os_mbuf **rxom)
     struct ble_att_error_rsp rsp;
     int rc;
 
-    rc = ble_hs_misc_pullup_base(rxom, BLE_ATT_ERROR_RSP_SZ);
+    rc = ble_hs_mbuf_pullup_base(rxom, BLE_ATT_ERROR_RSP_SZ);
     if (rc != 0) {
         return rc;
     }
@@ -163,32 +114,6 @@ ble_att_clt_rx_error(uint16_t conn_handle, struct os_mbuf **rxom)
  * $mtu exchange                                                             *
  *****************************************************************************/
 
-static int
-ble_att_clt_build_mtu_req(const struct ble_att_mtu_cmd *req,
-                          struct os_mbuf **out_txom)
-{
-    struct os_mbuf *txom;
-    int rc;
-
-    txom = NULL;
-
-    rc = ble_att_clt_init_req(BLE_ATT_MTU_CMD_SZ, &txom);
-    if (rc != 0) {
-        goto done;
-    }
-
-    ble_att_mtu_req_write(txom->om_data, txom->om_len, req);
-
-done:
-    if (rc != 0) {
-        os_mbuf_free_chain(txom);
-        txom = NULL;
-    }
-
-    *out_txom = txom;
-    return rc;
-}
-
 int
 ble_att_clt_tx_mtu(uint16_t conn_handle, const struct ble_att_mtu_cmd *req)
 {
@@ -203,12 +128,13 @@ ble_att_clt_tx_mtu(uint16_t conn_handle, const struct ble_att_mtu_cmd *req)
         return BLE_HS_EINVAL;
     }
 
-    rc = ble_att_clt_build_mtu_req(req, &txom);
+    rc = ble_att_clt_init_req(BLE_ATT_MTU_CMD_SZ, &txom);
     if (rc != 0) {
         return rc;
     }
+    ble_att_mtu_req_write(txom->om_data, txom->om_len, req);
 
-    rc = ble_att_clt_tx_req(conn_handle, txom);
+    rc = ble_att_clt_tx_req(conn_handle, &txom);
     if (rc != 0) {
         return rc;
     }
@@ -235,7 +161,7 @@ ble_att_clt_rx_mtu(uint16_t conn_handle, struct os_mbuf **rxom)
 
     mtu = 0;
 
-    rc = ble_hs_misc_pullup_base(rxom, BLE_ATT_MTU_CMD_SZ);
+    rc = ble_hs_mbuf_pullup_base(rxom, BLE_ATT_MTU_CMD_SZ);
     if (rc == 0) {
         ble_att_mtu_cmd_parse((*rxom)->om_data, (*rxom)->om_len, &cmd);
         BLE_ATT_LOG_CMD(0, "mtu rsp", conn_handle, ble_att_mtu_cmd_log, &cmd);
@@ -259,24 +185,6 @@ ble_att_clt_rx_mtu(uint16_t conn_handle, struct os_mbuf **rxom)
  * $find information                                                         *
  *****************************************************************************/
 
-static int
-ble_att_clt_build_find_info_req(const struct ble_att_find_info_req *req,
-                                struct os_mbuf **out_txom)
-{
-    struct os_mbuf *txom;
-    int rc;
-
-    rc = ble_att_clt_init_req(BLE_ATT_FIND_INFO_REQ_SZ, &txom);
-    if (rc != 0) {
-        return rc;
-    }
-
-    ble_att_find_info_req_write(txom->om_data, txom->om_len, req);
-    *out_txom = txom;
-
-    return 0;
-}
-
 int
 ble_att_clt_tx_find_info(uint16_t conn_handle,
                          const struct ble_att_find_info_req *req)
@@ -297,12 +205,13 @@ ble_att_clt_tx_find_info(uint16_t conn_handle,
         return BLE_HS_EINVAL;
     }
 
-    rc = ble_att_clt_build_find_info_req(req, &txom);
+    rc = ble_att_clt_init_req(BLE_ATT_FIND_INFO_REQ_SZ, &txom);
     if (rc != 0) {
         return rc;
     }
+    ble_att_find_info_req_write(txom->om_data, txom->om_len, req);
 
-    rc = ble_att_clt_tx_req(conn_handle, txom);
+    rc = ble_att_clt_tx_req(conn_handle, &txom);
     if (rc != 0) {
         return rc;
     }
@@ -331,7 +240,7 @@ ble_att_clt_parse_find_info_entry(struct os_mbuf **rxom, uint8_t rsp_format,
         return BLE_HS_EBADDATA;
     }
 
-    rc = ble_hs_misc_pullup_base(rxom, entry_len);
+    rc = ble_hs_mbuf_pullup_base(rxom, entry_len);
     if (rc != 0) {
         return rc;
     }
@@ -374,7 +283,7 @@ ble_att_clt_rx_find_info(uint16_t conn_handle, struct os_mbuf **om)
     struct ble_att_find_info_rsp rsp;
     int rc;
 
-    rc = ble_hs_misc_pullup_base(om, BLE_ATT_FIND_INFO_RSP_BASE_SZ);
+    rc = ble_hs_mbuf_pullup_base(om, BLE_ATT_FIND_INFO_RSP_BASE_SZ);
     if (rc != 0) {
         goto done;
     }
@@ -408,31 +317,6 @@ done:
  * $find by type value                                                       *
  *****************************************************************************/
 
-static int
-ble_att_clt_build_find_type_value_req(
-    const struct ble_att_find_type_value_req *req,
-    const void *attribute_value, int value_len,
-    struct os_mbuf **out_txom)
-{
-    int rc;
-
-    rc = ble_att_clt_init_req(BLE_ATT_FIND_TYPE_VALUE_REQ_BASE_SZ, out_txom);
-    if (rc != 0) {
-        return rc;
-    }
-
-    ble_att_find_type_value_req_write((*out_txom)->om_data,
-                                      (*out_txom)->om_len,
-                                      req);
-    rc = os_mbuf_append(*out_txom, attribute_value, value_len);
-    if (rc != 0) {
-        os_mbuf_free_chain(*out_txom);
-        return BLE_HS_ENOMEM;
-    }
-
-    return 0;
-}
-
 int
 ble_att_clt_tx_find_type_value(uint16_t conn_handle,
                                const struct ble_att_find_type_value_req *req,
@@ -448,24 +332,35 @@ ble_att_clt_tx_find_type_value(uint16_t conn_handle,
     struct os_mbuf *txom;
     int rc;
 
+    txom = NULL;
+
     if (req->bavq_start_handle == 0 ||
         req->bavq_start_handle > req->bavq_end_handle) {
 
-        return BLE_HS_EINVAL;
+        rc = BLE_HS_EINVAL;
+        goto done;
     }
 
-    rc = ble_att_clt_build_find_type_value_req(req, attribute_value, value_len,
-                                               &txom);
+    rc = ble_att_clt_init_req(BLE_ATT_FIND_TYPE_VALUE_REQ_BASE_SZ, &txom);
     if (rc != 0) {
-        return rc;
+        goto done;
     }
 
-    rc = ble_att_clt_tx_req(conn_handle, txom);
+    ble_att_find_type_value_req_write(txom->om_data, txom->om_len, req);
+    rc = os_mbuf_append(txom, attribute_value, value_len);
     if (rc != 0) {
-        return rc;
+        rc = BLE_HS_ENOMEM;
+        goto done;
     }
 
-    return 0;
+    rc = ble_att_clt_tx_req(conn_handle, &txom);
+    if (rc != 0) {
+        goto done;
+    }
+
+done:
+    os_mbuf_free_chain(txom);
+    return rc;
 }
 
 static int
@@ -525,38 +420,6 @@ ble_att_clt_rx_find_type_value(uint16_t conn_handle, struct os_mbuf **rxom)
  * $read by type                                                             *
  *****************************************************************************/
 
-static int
-ble_att_clt_build_read_type_req(const struct ble_att_read_type_req *req,
-                                const void *uuid128, struct os_mbuf **out_txom)
-{
-    struct os_mbuf *txom;
-    int rc;
-
-    txom = NULL;
-
-    rc = ble_att_clt_init_req(BLE_ATT_READ_TYPE_REQ_BASE_SZ, &txom);
-    if (rc != 0) {
-        goto done;
-    }
-
-    ble_att_read_type_req_write(txom->om_data, txom->om_len, req);
-
-    rc = ble_uuid_append(txom, uuid128);
-    if (rc != 0) {
-        rc = BLE_HS_ENOMEM;
-        goto done;
-    }
-
-done:
-    if (rc != 0) {
-        os_mbuf_free_chain(txom);
-        txom = NULL;
-    }
-
-    *out_txom = txom;
-    return rc;
-}
-
 int
 ble_att_clt_tx_read_type(uint16_t conn_handle,
                          const struct ble_att_read_type_req *req,
@@ -569,25 +432,37 @@ ble_att_clt_tx_read_type(uint16_t conn_handle,
     struct os_mbuf *txom;
     int rc;
 
+    txom = NULL;
+
     BLE_ATT_LOG_CMD(1, "read type req", conn_handle,
                     ble_att_read_type_req_log, req);
 
     if (req->batq_start_handle == 0 ||
         req->batq_start_handle > req->batq_end_handle) {
 
-        return BLE_HS_EINVAL;
+        rc = BLE_HS_EINVAL;
+        goto done;
     }
 
-    rc = ble_att_clt_build_read_type_req(req, uuid128, &txom);
+    rc = ble_att_clt_init_req(BLE_ATT_READ_TYPE_REQ_BASE_SZ, &txom);
     if (rc != 0) {
-        return rc;
+        goto done;
     }
 
-    rc = ble_att_clt_tx_req(conn_handle, txom);
+    ble_att_read_type_req_write(txom->om_data, txom->om_len, req);
+    rc = ble_uuid_append(txom, uuid128);
     if (rc != 0) {
-        return rc;
+        rc = BLE_HS_ENOMEM;
+        goto done;
+    }
+
+    rc = ble_att_clt_tx_req(conn_handle, &txom);
+    if (rc != 0) {
+        goto done;
     }
 
+done:
+    os_mbuf_free_chain(txom);
     return 0;
 }
 
@@ -597,7 +472,7 @@ ble_att_clt_parse_read_type_adata(struct os_mbuf **om, int data_len,
 {
     int rc;
 
-    rc = ble_hs_misc_pullup_base(om, data_len);
+    rc = ble_hs_mbuf_pullup_base(om, data_len);
     if (rc != 0) {
         return rc;
     }
@@ -620,7 +495,7 @@ ble_att_clt_rx_read_type(uint16_t conn_handle, struct os_mbuf **rxom)
     struct ble_att_read_type_rsp rsp;
     int rc;
 
-    rc = ble_hs_misc_pullup_base(rxom, BLE_ATT_READ_TYPE_RSP_BASE_SZ);
+    rc = ble_hs_mbuf_pullup_base(rxom, BLE_ATT_READ_TYPE_RSP_BASE_SZ);
     if (rc != 0) {
         goto done;
     }
@@ -654,32 +529,6 @@ done:
  * $read                                                                     *
  *****************************************************************************/
 
-static int
-ble_att_clt_build_read_req(const struct ble_att_read_req *req,
-                           struct os_mbuf **out_txom)
-{
-    struct os_mbuf *txom;
-    int rc;
-
-    txom = NULL;
-
-    rc = ble_att_clt_init_req(BLE_ATT_READ_REQ_SZ, &txom);
-    if (rc != 0) {
-        goto done;
-    }
-
-    ble_att_read_req_write(txom->om_data, txom->om_len, req);
-
-done:
-    if (rc != 0) {
-        os_mbuf_free_chain(txom);
-        txom = NULL;
-    }
-
-    *out_txom = txom;
-    return rc;
-}
-
 int
 ble_att_clt_tx_read(uint16_t conn_handle, const struct ble_att_read_req *req)
 {
@@ -690,19 +539,19 @@ ble_att_clt_tx_read(uint16_t conn_handle, const struct ble_att_read_req *req)
     struct os_mbuf *txom;
     int rc;
 
-    BLE_ATT_LOG_CMD(1, "read req", conn_handle,
-                    ble_att_read_req_log, req);
+    BLE_ATT_LOG_CMD(1, "read req", conn_handle, ble_att_read_req_log, req);
 
     if (req->barq_handle == 0) {
         return BLE_HS_EINVAL;
     }
 
-    rc = ble_att_clt_build_read_req(req, &txom);
+    rc = ble_att_clt_init_req(BLE_ATT_READ_REQ_SZ, &txom);
     if (rc != 0) {
         return rc;
     }
+    ble_att_read_req_write(txom->om_data, txom->om_len, req);
 
-    rc = ble_att_clt_tx_req(conn_handle, txom);
+    rc = ble_att_clt_tx_req(conn_handle, &txom);
     if (rc != 0) {
         return rc;
     }
@@ -717,10 +566,6 @@ ble_att_clt_rx_read(uint16_t conn_handle, struct os_mbuf **rxom)
     return BLE_HS_ENOTSUP;
 #endif
 
-    uint16_t value_len;
-    void *value;
-    int rc;
-
     BLE_ATT_LOG_EMPTY_CMD(0, "read rsp", conn_handle);
 
     /* Reponse consists of a one-byte opcode (already verified) and a variable
@@ -728,44 +573,15 @@ ble_att_clt_rx_read(uint16_t conn_handle, struct os_mbuf **rxom)
      */
     os_mbuf_adj(*rxom, BLE_ATT_READ_RSP_BASE_SZ);
 
-    /* Copy the attribute data into the global ATT flat buffer. */
-    rc = ble_att_clt_copy_attr_to_flatbuf(*rxom, &value, &value_len);
-
     /* Pass the Attribute Value field to GATT. */
-    ble_gattc_rx_read_rsp(conn_handle, rc, value, value_len);
-    return rc;
+    ble_gattc_rx_read_rsp(conn_handle, 0, rxom);
+    return 0;
 }
 
 /*****************************************************************************
  * $read blob                                                                *
  *****************************************************************************/
 
-static int
-ble_att_clt_build_read_blob_req(const struct ble_att_read_blob_req *req,
-                                struct os_mbuf **out_txom)
-{
-    struct os_mbuf *txom;
-    int rc;
-
-    txom = NULL;
-
-    rc = ble_att_clt_init_req(BLE_ATT_READ_BLOB_REQ_SZ, &txom);
-    if (rc != 0) {
-        goto done;
-    }
-
-    ble_att_read_blob_req_write(txom->om_data, txom->om_len, req);
-
-done:
-    if (rc != 0) {
-        os_mbuf_free_chain(txom);
-        txom = NULL;
-    }
-
-    *out_txom = txom;
-    return rc;
-}
-
 int
 ble_att_clt_tx_read_blob(uint16_t conn_handle,
                          const struct ble_att_read_blob_req *req)
@@ -784,12 +600,13 @@ ble_att_clt_tx_read_blob(uint16_t conn_handle,
         return BLE_HS_EINVAL;
     }
 
-    rc = ble_att_clt_build_read_blob_req(req, &txom);
+    rc = ble_att_clt_init_req(BLE_ATT_READ_BLOB_REQ_SZ, &txom);
     if (rc != 0) {
         return rc;
     }
+    ble_att_read_blob_req_write(txom->om_data, txom->om_len, req);
 
-    rc = ble_att_clt_tx_req(conn_handle, txom);
+    rc = ble_att_clt_tx_req(conn_handle, &txom);
     if (rc != 0) {
         return rc;
     }
@@ -804,10 +621,6 @@ ble_att_clt_rx_read_blob(uint16_t conn_handle, struct os_mbuf **rxom)
     return BLE_HS_ENOTSUP;
 #endif
 
-    uint16_t value_len;
-    void *value;
-    int rc;
-
     BLE_ATT_LOG_EMPTY_CMD(0, "read blob rsp", conn_handle);
 
     /* Reponse consists of a one-byte opcode (already verified) and a variable
@@ -815,12 +628,9 @@ ble_att_clt_rx_read_blob(uint16_t conn_handle, struct os_mbuf **rxom)
      */
     os_mbuf_adj(*rxom, BLE_ATT_READ_BLOB_RSP_BASE_SZ);
 
-    /* Copy the attribute data into the global ATT flat buffer. */
-    rc = ble_att_clt_copy_attr_to_flatbuf(*rxom, &value, &value_len);
-
     /* Pass the Attribute Value field to GATT. */
-    ble_gattc_rx_read_blob_rsp(conn_handle, rc, value, value_len);
-    return rc;
+    ble_gattc_rx_read_blob_rsp(conn_handle, 0, rxom);
+    return 0;
 }
 
 /*****************************************************************************
@@ -837,34 +647,29 @@ ble_att_clt_build_read_mult_req(const uint16_t *att_handles,
     int rc;
     int i;
 
-    txom = NULL;
+    *out_txom = NULL;
 
     rc = ble_att_clt_init_req(BLE_ATT_READ_MULT_REQ_BASE_SZ, &txom);
     if (rc != 0) {
-        goto done;
+        goto err;
     }
-
     ble_att_read_mult_req_write(txom->om_data, txom->om_len);
 
     for (i = 0; i < num_att_handles; i++) {
         buf = os_mbuf_extend(txom, 2);
         if (buf == NULL) {
             rc = BLE_HS_ENOMEM;
-            goto done;
+            goto err;
         }
 
         htole16(buf, att_handles[i]);
     }
 
-    rc = 0;
-
-done:
-    if (rc != 0) {
-        os_mbuf_free_chain(txom);
-        txom = NULL;
-    }
-
     *out_txom = txom;
+    return 0;
+
+err:
+    os_mbuf_free_chain(txom);
     return rc;
 }
 
@@ -890,7 +695,7 @@ ble_att_clt_tx_read_mult(uint16_t conn_handle, const uint16_t *att_handles,
         return rc;
     }
 
-    rc = ble_att_clt_tx_req(conn_handle, txom);
+    rc = ble_att_clt_tx_req(conn_handle, &txom);
     if (rc != 0) {
         return rc;
     }
@@ -905,10 +710,6 @@ ble_att_clt_rx_read_mult(uint16_t conn_handle, struct os_mbuf **rxom)
     return BLE_HS_ENOTSUP;
 #endif
 
-    uint16_t value_len;
-    void *value;
-    int rc;
-
     BLE_ATT_LOG_EMPTY_CMD(0, "read mult rsp", conn_handle);
 
     /* Reponse consists of a one-byte opcode (already verified) and a variable
@@ -916,50 +717,15 @@ ble_att_clt_rx_read_mult(uint16_t conn_handle, struct os_mbuf **rxom)
      */
     os_mbuf_adj(*rxom, BLE_ATT_READ_MULT_RSP_BASE_SZ);
 
-    /* Copy the attribute data into the global ATT flat buffer. */
-    rc = ble_att_clt_copy_attr_to_flatbuf(*rxom, &value, &value_len);
-
     /* Pass the Attribute Value field to GATT. */
-    ble_gattc_rx_read_mult_rsp(conn_handle, rc, value, value_len);
-    return rc;
+    ble_gattc_rx_read_mult_rsp(conn_handle, 0, rxom);
+    return 0;
 }
 
 /*****************************************************************************
  * $read by group type                                                       *
  *****************************************************************************/
 
-static int
-ble_att_clt_build_read_group_type_req(
-    const struct ble_att_read_group_type_req *req, const void *uuid128,
-    struct os_mbuf **out_txom)
-{
-    struct os_mbuf *txom;
-    int rc;
-
-    txom = NULL;
-
-    rc = ble_att_clt_init_req(BLE_ATT_READ_GROUP_TYPE_REQ_BASE_SZ, &txom);
-    if (rc != 0) {
-        goto done;
-    }
-
-    ble_att_read_group_type_req_write(txom->om_data, txom->om_len, req);
-
-    rc = ble_uuid_append(txom, uuid128);
-    if (rc != 0) {
-        goto done;
-    }
-
-done:
-    if (rc != 0) {
-        os_mbuf_free_chain(txom);
-        txom = NULL;
-    }
-
-    *out_txom = txom;
-    return rc;
-}
-
 int
 ble_att_clt_tx_read_group_type(uint16_t conn_handle,
                                const struct ble_att_read_group_type_req *req,
@@ -980,20 +746,29 @@ ble_att_clt_tx_read_group_type(uint16_t conn_handle,
     if (req->bagq_start_handle == 0 ||
         req->bagq_start_handle > req->bagq_end_handle) {
 
-        return BLE_HS_EINVAL;
+        rc = BLE_HS_EINVAL;
+        goto done;
     }
 
-    rc = ble_att_clt_build_read_group_type_req(req, uuid128, &txom);
+    rc = ble_att_clt_init_req(BLE_ATT_READ_GROUP_TYPE_REQ_BASE_SZ, &txom);
     if (rc != 0) {
-        return rc;
+        goto done;
+    }
+    ble_att_read_group_type_req_write(txom->om_data, txom->om_len, req);
+
+    rc = ble_uuid_append(txom, uuid128);
+    if (rc != 0) {
+        goto done;
     }
 
-    rc = ble_att_clt_tx_req(conn_handle, txom);
+    rc = ble_att_clt_tx_req(conn_handle, &txom);
     if (rc != 0) {
-        return rc;
+        goto done;
     }
 
-    return 0;
+done:
+    os_mbuf_free_chain(txom);
+    return rc;
 }
 
 static int
@@ -1007,7 +782,7 @@ ble_att_clt_parse_read_group_type_adata(
         return BLE_HS_EMSGSIZE;
     }
 
-    rc = ble_hs_misc_pullup_base(om, data_len);
+    rc = ble_hs_mbuf_pullup_base(om, data_len);
     if (rc != 0) {
         return rc;
     }
@@ -1031,7 +806,7 @@ ble_att_clt_rx_read_group_type(uint16_t conn_handle, struct os_mbuf **rxom)
     struct ble_att_read_group_type_rsp rsp;
     int rc;
 
-    rc = ble_hs_misc_pullup_base(rxom, BLE_ATT_READ_GROUP_TYPE_RSP_BASE_SZ);
+    rc = ble_hs_mbuf_pullup_base(rxom, BLE_ATT_READ_GROUP_TYPE_RSP_BASE_SZ);
     if (rc != 0) {
         goto done;
     }
@@ -1066,59 +841,29 @@ done:
  *****************************************************************************/
 
 static int
-ble_att_clt_build_write_req_or_cmd(uint16_t conn_handle,
-                                   const struct ble_att_write_req *req,
-                                   const void *value, uint16_t value_len,
-                                   int is_req,
-                                   struct os_mbuf **out_txom)
+ble_att_clt_tx_write_req_or_cmd(uint16_t conn_handle,
+                                const struct ble_att_write_req *req,
+                                struct os_mbuf **txom, int is_req)
 {
-    struct os_mbuf *txom;
+    struct os_mbuf *om;
     int rc;
 
-    txom = NULL;
+    /* Consume mbuf from caller. */
+    om = *txom;
+    *txom = NULL;
 
-    rc = ble_att_clt_init_req(BLE_ATT_WRITE_REQ_BASE_SZ, &txom);
-    if (rc != 0) {
-        goto done;
+    om = os_mbuf_prepend_pullup(om, BLE_ATT_WRITE_REQ_BASE_SZ);
+    if (om == NULL) {
+        return BLE_HS_ENOMEM;
     }
 
     if (is_req) {
-        ble_att_write_req_write(txom->om_data, txom->om_len, req);
+        ble_att_write_req_write(om->om_data, BLE_ATT_WRITE_REQ_BASE_SZ, req);
     } else {
-        ble_att_write_cmd_write(txom->om_data, txom->om_len, req);
-    }
-
-    rc = ble_att_clt_append_blob(conn_handle, txom, value, value_len);
-    if (rc != 0) {
-        goto done;
-    }
-
-done:
-    if (rc != 0) {
-        os_mbuf_free_chain(txom);
-        txom = NULL;
-    }
-
-    *out_txom = txom;
-    return rc;
-}
-
-static int
-ble_att_clt_tx_write_req_or_cmd(uint16_t conn_handle,
-                                const struct ble_att_write_req *req,
-                                const void *value, uint16_t value_len,
-                                int is_req)
-{
-    struct os_mbuf *txom;
-    int rc;
-
-    rc = ble_att_clt_build_write_req_or_cmd(conn_handle, req, value, value_len,
-                                            is_req, &txom);
-    if (rc != 0) {
-        return rc;
+        ble_att_write_cmd_write(om->om_data, BLE_ATT_WRITE_REQ_BASE_SZ, req);
     }
 
-    rc = ble_att_clt_tx_req(conn_handle, txom);
+    rc = ble_att_clt_tx_req(conn_handle, &om);
     if (rc != 0) {
         return rc;
     }
@@ -1129,7 +874,7 @@ ble_att_clt_tx_write_req_or_cmd(uint16_t conn_handle,
 int
 ble_att_clt_tx_write_req(uint16_t conn_handle,
                          const struct ble_att_write_req *req,
-                         const void *value, uint16_t value_len)
+                         struct os_mbuf **txom)
 {
 #if !NIMBLE_OPT(ATT_CLT_WRITE)
     return BLE_HS_ENOTSUP;
@@ -1139,15 +884,14 @@ ble_att_clt_tx_write_req(uint16_t conn_handle,
 
     BLE_ATT_LOG_CMD(1, "write req", conn_handle, ble_att_write_cmd_log, req);
 
-    rc = ble_att_clt_tx_write_req_or_cmd(conn_handle, req, value, value_len,
-                                         1);
+    rc = ble_att_clt_tx_write_req_or_cmd(conn_handle, req, txom, 1);
     return rc;
 }
 
 int
 ble_att_clt_tx_write_cmd(uint16_t conn_handle,
                          const struct ble_att_write_req *req,
-                         const void *value, uint16_t value_len)
+                         struct os_mbuf **txom)
 {
 #if !NIMBLE_OPT(ATT_CLT_WRITE_NO_RSP)
     return BLE_HS_ENOTSUP;
@@ -1157,8 +901,7 @@ ble_att_clt_tx_write_cmd(uint16_t conn_handle,
 
     BLE_ATT_LOG_CMD(1, "write cmd", conn_handle, ble_att_write_cmd_log, req);
 
-    rc = ble_att_clt_tx_write_req_or_cmd(conn_handle, req, value, value_len,
-                                         0);
+    rc = ble_att_clt_tx_write_req_or_cmd(conn_handle, req, txom, 0);
     return rc;
 }
 
@@ -1180,80 +923,59 @@ ble_att_clt_rx_write(uint16_t conn_handle, struct os_mbuf **rxom)
  * $prepare write request                                                    *
  *****************************************************************************/
 
-static int
-ble_att_clt_build_prep_write_req(uint16_t conn_handle,
-                                 const struct ble_att_prep_write_cmd *req,
-                                 const void *value, uint16_t value_len,
-                                 struct os_mbuf **out_txom)
-{
-    struct os_mbuf *txom;
-    int rc;
-
-    txom = NULL;
-
-    rc = ble_att_clt_init_req(BLE_ATT_PREP_WRITE_CMD_BASE_SZ, &txom);
-    if (rc != 0) {
-        goto done;
-    }
-
-    ble_att_prep_write_req_write(txom->om_data, txom->om_len, req);
-
-    rc = ble_att_clt_append_blob(conn_handle, txom, value, value_len);
-    if (rc != 0) {
-        goto done;
-    }
-
-done:
-    if (rc != 0) {
-        os_mbuf_free_chain(txom);
-        txom = NULL;
-    }
-
-    *out_txom = txom;
-    return rc;
-}
-
 int
 ble_att_clt_tx_prep_write(uint16_t conn_handle,
                           const struct ble_att_prep_write_cmd *req,
-                          const void *value, uint16_t value_len)
+                          struct os_mbuf **txom)
 {
 #if !NIMBLE_OPT(ATT_CLT_PREP_WRITE)
     return BLE_HS_ENOTSUP;
 #endif
 
-    struct os_mbuf *txom;
+    struct os_mbuf *om;
     int rc;
 
+    /* Consume mbuf from caller. */
+    om = *txom;
+    *txom = NULL;
+
     BLE_ATT_LOG_CMD(1, "prep write req", conn_handle,
                     ble_att_prep_write_cmd_log, req);
 
     if (req->bapc_handle == 0) {
-        return BLE_HS_EINVAL;
+        rc = BLE_HS_EINVAL;
+        goto done;
     }
 
-    if (req->bapc_offset + value_len > BLE_ATT_ATTR_MAX_LEN) {
-        return BLE_HS_EINVAL;
+    if (req->bapc_offset + OS_MBUF_PKTLEN(om) > BLE_ATT_ATTR_MAX_LEN) {
+        rc = BLE_HS_EINVAL;
+        goto done;
     }
 
-    if (value_len >
+    if (OS_MBUF_PKTLEN(om) >
         ble_att_mtu(conn_handle) - BLE_ATT_PREP_WRITE_CMD_BASE_SZ) {
 
-        return BLE_HS_EINVAL;
+        rc = BLE_HS_EINVAL;
+        goto done;
     }
 
-    rc = ble_att_clt_build_prep_write_req(conn_handle, req, value, value_len,
-                                          &txom);
-    if (rc != 0) {
-        return rc;
+    om = os_mbuf_prepend_pullup(om, BLE_ATT_PREP_WRITE_CMD_BASE_SZ);
+    if (om == NULL) {
+        rc = BLE_HS_ENOMEM;
+        goto done;
     }
 
-    rc = ble_att_clt_tx_req(conn_handle, txom);
+    ble_att_prep_write_req_write(om->om_data, BLE_ATT_PREP_WRITE_CMD_BASE_SZ,
+                                 req);
+
+    rc = ble_att_clt_tx_req(conn_handle, &om);
     if (rc != 0) {
-        return rc;
+        goto done;
     }
 
-    return 0;
+done:
+    os_mbuf_free_chain(om);
+    return rc;
 }
 
 int
@@ -1264,16 +986,12 @@ ble_att_clt_rx_prep_write(uint16_t conn_handle, struct os_mbuf **rxom)
 #endif
 
     struct ble_att_prep_write_cmd rsp;
-    uint16_t value_len;
-    void *value;
     int rc;
 
     /* Initialize some values in case of early error. */
     memset(&rsp, 0, sizeof rsp);
-    value = NULL;
-    value_len = 0;
 
-    rc = ble_hs_misc_pullup_base(rxom, BLE_ATT_PREP_WRITE_CMD_BASE_SZ);
+    rc = ble_hs_mbuf_pullup_base(rxom, BLE_ATT_PREP_WRITE_CMD_BASE_SZ);
     if (rc != 0) {
         goto done;
     }
@@ -1285,12 +1003,9 @@ ble_att_clt_rx_prep_write(uint16_t conn_handle, struct os_mbuf **rxom)
     /* Strip the base from the front of the response. */
     os_mbuf_adj(*rxom, BLE_ATT_PREP_WRITE_CMD_BASE_SZ);
 
-    /* Copy the attribute data into the global ATT flat buffer. */
-    rc = ble_att_clt_copy_attr_to_flatbuf(*rxom, &value, &value_len);
-
 done:
     /* Notify GATT client that the full response has been parsed. */
-    ble_gattc_rx_prep_write_rsp(conn_handle, rc, &rsp, value, value_len);
+    ble_gattc_rx_prep_write_rsp(conn_handle, rc, &rsp, rxom);
     return rc;
 }
 
@@ -1298,32 +1013,6 @@ done:
  * $execute write request                                                    *
  *****************************************************************************/
 
-static int
-ble_att_clt_build_exec_write_req(const struct ble_att_exec_write_req *req,
-                                 struct os_mbuf **out_txom)
-{
-    struct os_mbuf *txom;
-    int rc;
-
-    txom = NULL;
-
-    rc = ble_att_clt_init_req(BLE_ATT_EXEC_WRITE_REQ_SZ, &txom);
-    if (rc != 0) {
-        goto done;
-    }
-
-    ble_att_exec_write_req_write(txom->om_data, txom->om_len, req);
-
-done:
-    if (rc != 0) {
-        os_mbuf_free_chain(txom);
-        txom = NULL;
-    }
-
-    *out_txom = txom;
-    return rc;
-}
-
 int
 ble_att_clt_tx_exec_write(uint16_t conn_handle,
                           const struct ble_att_exec_write_req *req)
@@ -1342,12 +1031,13 @@ ble_att_clt_tx_exec_write(uint16_t conn_handle,
         return BLE_HS_EINVAL;
     }
 
-    rc = ble_att_clt_build_exec_write_req(req, &txom);
+    rc = ble_att_clt_init_req(BLE_ATT_EXEC_WRITE_REQ_SZ, &txom);
     if (rc != 0) {
         return rc;
     }
+    ble_att_exec_write_req_write(txom->om_data, txom->om_len, req);
 
-    rc = ble_att_clt_tx_req(conn_handle, txom);
+    rc = ble_att_clt_tx_req(conn_handle, &txom);
     if (rc != 0) {
         return rc;
     }
@@ -1366,7 +1056,7 @@ ble_att_clt_rx_exec_write(uint16_t conn_handle, struct os_mbuf **rxom)
 
     BLE_ATT_LOG_EMPTY_CMD(0, "exec write rsp", conn_handle);
 
-    rc = ble_hs_misc_pullup_base(rxom, BLE_ATT_EXEC_WRITE_RSP_SZ);
+    rc = ble_hs_mbuf_pullup_base(rxom, BLE_ATT_EXEC_WRITE_RSP_SZ);
     if (rc == 0) {
         ble_att_exec_write_rsp_parse((*rxom)->om_data, (*rxom)->om_len);
     }
@@ -1379,139 +1069,94 @@ ble_att_clt_rx_exec_write(uint16_t conn_handle, struct os_mbuf **rxom)
  * $handle value notification                                                *
  *****************************************************************************/
 
-static int
-ble_att_clt_build_notify_req(uint16_t conn_handle,
-                             const struct ble_att_notify_req *req,
-                             const void *value, uint16_t value_len,
-                             struct os_mbuf **out_txom)
-{
-    struct os_mbuf *txom;
-    int rc;
-
-    txom = NULL;
-
-    rc = ble_att_clt_init_req(BLE_ATT_NOTIFY_REQ_BASE_SZ, &txom);
-    if (rc != 0) {
-        goto done;
-    }
-
-    ble_att_notify_req_write(txom->om_data, txom->om_len, req);
-
-    rc = ble_att_clt_append_blob(conn_handle, txom, value, value_len);
-    if (rc != 0) {
-        goto done;
-    }
-
-done:
-    if (rc != 0) {
-        os_mbuf_free_chain(txom);
-        txom = NULL;
-    }
-
-    *out_txom = txom;
-    return rc;
-}
-
 int
 ble_att_clt_tx_notify(uint16_t conn_handle,
                       const struct ble_att_notify_req *req,
-                      const void *value, uint16_t value_len)
+                      struct os_mbuf **txom)
 {
 #if !NIMBLE_OPT(ATT_CLT_NOTIFY)
     return BLE_HS_ENOTSUP;
 #endif
 
-    struct os_mbuf *txom;
+    struct os_mbuf *om;
     int rc;
 
+    /* Consume mbuf from caller. */
+    om = *txom;
+    *txom = NULL;
+
     BLE_ATT_LOG_CMD(1, "notify req", conn_handle, ble_att_notify_req_log, req);
 
     if (req->banq_handle == 0) {
-        return BLE_HS_EINVAL;
+        rc = BLE_HS_EINVAL;
+        goto err;
     }
 
-    rc = ble_att_clt_build_notify_req(conn_handle, req, value, value_len,
-                                      &txom);
-    if (rc != 0) {
-        return rc;
+    om = os_mbuf_prepend_pullup(om, BLE_ATT_NOTIFY_REQ_BASE_SZ);
+    if (om == NULL) {
+        rc = BLE_HS_ENOMEM;
+        goto err;
     }
+    ble_att_notify_req_write(om->om_data, BLE_ATT_NOTIFY_REQ_BASE_SZ, req);
 
-    rc = ble_att_clt_tx_req(conn_handle, txom);
+    rc = ble_att_clt_tx_req(conn_handle, &om);
     if (rc != 0) {
-        return rc;
+        goto err;
     }
 
     return 0;
+
+err:
+    os_mbuf_free_chain(om);
+    return rc;
 }
 
 /*****************************************************************************
  * $handle value indication                                                  *
  *****************************************************************************/
 
-static int
-ble_att_clt_build_indicate_req(uint16_t conn_handle,
-                               const struct ble_att_indicate_req *req,
-                               const void *value, uint16_t value_len,
-                               struct os_mbuf **out_txom)
-{
-    struct os_mbuf *txom;
-    int rc;
-
-    txom = NULL;
-
-    rc = ble_att_clt_init_req(BLE_ATT_INDICATE_REQ_BASE_SZ, &txom);
-    if (rc != 0) {
-        goto done;
-    }
-
-    ble_att_indicate_req_write(txom->om_data, txom->om_len, req);
-
-    rc = ble_att_clt_append_blob(conn_handle, txom, value, value_len);
-    if (rc != 0) {
-        goto done;
-    }
-
-done:
-    if (rc != 0) {
-        os_mbuf_free_chain(txom);
-        txom = NULL;
-    }
-
-    *out_txom = txom;
-    return rc;
-}
-
 int
 ble_att_clt_tx_indicate(uint16_t conn_handle,
                         const struct ble_att_indicate_req *req,
-                        const void *value, uint16_t value_len)
+                        struct os_mbuf **txom)
 {
 #if !NIMBLE_OPT(ATT_CLT_INDICATE)
     return BLE_HS_ENOTSUP;
 #endif
 
-    struct os_mbuf *txom;
+    struct os_mbuf *om;
     int rc;
 
+    /* Consume mbuf from caller. */
+    om = *txom;
+    *txom = NULL;
+
     BLE_ATT_LOG_CMD(1, "indicate req", conn_handle, ble_att_indicate_req_log,
                     req);
 
     if (req->baiq_handle == 0) {
-        return BLE_HS_EINVAL;
+        rc = BLE_HS_EINVAL;
+        goto err;
     }
 
-    rc = ble_att_clt_build_indicate_req(conn_handle, req, value, value_len,
-                                        &txom);
-    if (rc != 0) {
-        return rc;
+    om = os_mbuf_prepend_pullup(om, BLE_ATT_INDICATE_REQ_BASE_SZ);
+    if (om == NULL) {
+        rc = BLE_HS_ENOMEM;
+        goto err;
     }
 
-    rc = ble_att_clt_tx_req(conn_handle, txom);
+    ble_att_indicate_req_write(om->om_data, BLE_ATT_INDICATE_REQ_BASE_SZ, req);
+
+    rc = ble_att_clt_tx_req(conn_handle, &om);
     if (rc != 0) {
-        return rc;
+        goto err;
     }
 
     return 0;
+
+err:
+    os_mbuf_free_chain(om);
+    return rc;
 }
 
 int

http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/ef7abf7d/net/nimble/host/src/ble_att_priv.h
----------------------------------------------------------------------
diff --git a/net/nimble/host/src/ble_att_priv.h b/net/nimble/host/src/ble_att_priv.h
index 4c50a49..f20817c 100644
--- a/net/nimble/host/src/ble_att_priv.h
+++ b/net/nimble/host/src/ble_att_priv.h
@@ -132,9 +132,8 @@ struct ble_att_svr_conn {
  *                                  failure.
  */
 typedef int ble_att_svr_access_fn(uint16_t conn_handle, uint16_t attr_handle,
-                                  uint8_t *uuid128, uint8_t op,
-                                  struct ble_att_svr_access_ctxt *ctxt,
-                                  void *arg);
+                                  uint8_t op, uint16_t offset,
+                                  struct os_mbuf **om, void *arg);
 
 int ble_att_svr_register(const uint8_t *uuid, uint8_t flags,
                          uint16_t *handle_id,
@@ -162,8 +161,8 @@ struct ble_l2cap_chan *ble_att_create_chan(void);
 int ble_att_conn_chan_find(uint16_t conn_handle, struct ble_hs_conn **out_conn,
                            struct ble_l2cap_chan **out_chan);
 void ble_att_inc_tx_stat(uint8_t att_op);
-uint8_t *ble_att_get_flat_buf(void);
-uint16_t ble_att_mtu(uint16_t conn_handle);
+void ble_att_truncate_to_mtu(const struct ble_l2cap_chan *att_chan,
+                             struct os_mbuf *txom);
 void ble_att_set_peer_mtu(struct ble_l2cap_chan *chan, uint16_t peer_mtu);
 int ble_att_init(void);
 
@@ -208,7 +207,7 @@ int ble_att_svr_rx_indicate(uint16_t conn_handle,
                             struct os_mbuf **rxom);
 void ble_att_svr_prep_clear(struct ble_att_prep_entry_list *prep_list);
 int ble_att_svr_read_handle(uint16_t conn_handle, uint16_t attr_handle,
-                            struct ble_att_svr_access_ctxt *ctxt,
+                            uint16_t offset, struct os_mbuf *om,
                             uint8_t *out_att_err);
 int ble_att_svr_init(void);
 
@@ -232,6 +231,7 @@ struct ble_att_read_type_adata {
     uint16_t att_handle;
     int value_len;
     uint8_t *value;
+
 };
 
 /** An attribute-data entry in a read by group type response. */
@@ -274,13 +274,13 @@ int ble_att_clt_rx_find_type_value(uint16_t conn_handle,
                                    struct os_mbuf **rxom);
 int ble_att_clt_tx_write_req(uint16_t conn_handle,
                              const struct ble_att_write_req *req,
-                             const void *value, uint16_t value_len);
+                             struct os_mbuf **txom);
 int ble_att_clt_tx_write_cmd(uint16_t conn_handle,
                              const struct ble_att_write_req *req,
-                             const void *value, uint16_t value_len);
+                             struct os_mbuf **txom);
 int ble_att_clt_tx_prep_write(uint16_t conn_handle,
                               const struct ble_att_prep_write_cmd *req,
-                              const void *value, uint16_t value_len);
+                              struct os_mbuf **om);
 int ble_att_clt_rx_prep_write(uint16_t conn_handle, struct os_mbuf **rxom);
 int ble_att_clt_tx_exec_write(uint16_t conn_handle,
                               const struct ble_att_exec_write_req *req);
@@ -288,10 +288,10 @@ int ble_att_clt_rx_exec_write(uint16_t conn_handle, struct os_mbuf **rxom);
 int ble_att_clt_rx_write(uint16_t conn_handle, struct os_mbuf **rxom);
 int ble_att_clt_tx_notify(uint16_t conn_handle,
                           const struct ble_att_notify_req *req,
-                          const void *value, uint16_t value_len);
+                          struct os_mbuf **txom);
 int ble_att_clt_tx_indicate(uint16_t conn_handle,
                             const struct ble_att_indicate_req *req,
-                            const void *value, uint16_t value_len);
+                            struct os_mbuf **txom);
 int ble_att_clt_rx_indicate(uint16_t conn_handle, struct os_mbuf **rxom);
 
 #endif