Pass the written value for gatt characteristic and descriptor write

callbacks to the java layer

Tag: #feature
Bug: 195157393
Test: Manual
Merged-In: I3dee0abd0a0f9e931588d015dd0cd43dd9f8e3d5
Change-Id: I3dee0abd0a0f9e931588d015dd0cd43dd9f8e3d5

21 files changed, 102 insertions, 57 deletions

diff --git a/binder/android/bluetooth/IBluetoothGatt.aidl b/binder/android/bluetooth/IBluetoothGatt.aidl
index 0c5218015..9b6939855 100644
--- a/binder/android/bluetooth/IBluetoothGatt.aidl
+++ b/binder/android/bluetooth/IBluetoothGatt.aidl
@@ -124,7 +124,7 @@ interface IBluetoothGatt {
     @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     void readDescriptor(in int clientIf, in String address, in int handle, in int authReq, in AttributionSource attributionSource);
     @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
-    void writeDescriptor(in int clientIf, in String address, in int handle,
+    int writeDescriptor(in int clientIf, in String address, in int handle,
                             in int authReq, in byte[] value, in AttributionSource attributionSource);
     @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     void registerForNotification(in int clientIf, in String address, in int handle, in boolean enable, in AttributionSource attributionSource);
diff --git a/binder/android/bluetooth/IBluetoothGattCallback.aidl b/binder/android/bluetooth/IBluetoothGattCallback.aidl
index 3f80043d2..a140ea98d 100644
--- a/binder/android/bluetooth/IBluetoothGattCallback.aidl
+++ b/binder/android/bluetooth/IBluetoothGattCallback.aidl
@@ -30,10 +30,10 @@ oneway interface IBluetoothGattCallback {
     void onPhyRead(in String address, in int txPhy, in int rxPhy, in int status);
     void onSearchComplete(in String address, in List<BluetoothGattService> services, in int status);
     void onCharacteristicRead(in String address, in int status, in int handle, in byte[] value);
-    void onCharacteristicWrite(in String address, in int status, in int handle);
+    void onCharacteristicWrite(in String address, in int status, in int handle, in byte[] value);
     void onExecuteWrite(in String address, in int status);
     void onDescriptorRead(in String address, in int status, in int handle, in byte[] value);
-    void onDescriptorWrite(in String address, in int status, in int handle);
+    void onDescriptorWrite(in String address, in int status, in int handle, in byte[] value);
     void onNotify(in String address, in int handle, in byte[] value);
     void onReadRemoteRssi(in String address, in int rssi, in int status);
     void onConfigureMTU(in String address, in int mtu, in int status);
diff --git a/bta/csis/csis_client.cc b/bta/csis/csis_client.cc
index ba1613207..d5ab973fc 100644
--- a/bta/csis/csis_client.cc
+++ b/bta/csis/csis_client.cc
@@ -387,7 +387,8 @@ class CsisClientImpl : public CsisClient {
     BtaGattQueue::WriteCharacteristic(
         device->conn_id, csis_instance->svc_data.lock_handle.val_hdl, value,
         GATT_WRITE,
-        [](uint16_t conn_id, tGATT_STATUS status, uint16_t handle, void* data) {
+        [](uint16_t conn_id, tGATT_STATUS status, uint16_t handle, uint16_t len,
+           const uint8_t* value, void* data) {
           if (instance)
             instance->OnGattCsisWriteLockRsp(conn_id, status, handle, data);
         },
@@ -1809,7 +1810,7 @@ class CsisClientImpl : public CsisClient {
     BtaGattQueue::WriteDescriptor(
         conn_id, ccc_handle, std::move(value), GATT_WRITE,
         [](uint16_t conn_id, tGATT_STATUS status, uint16_t value_handle,
-           void* user_data) {
+           uint16_t len, const uint8_t* value, void* user_data) {
           if (instance)
             instance->OnGattWriteCcc(conn_id, status, value_handle, user_data);
         },
diff --git a/bta/csis/csis_client_test.cc b/bta/csis/csis_client_test.cc
index b553ced92..f3aaefe09 100644
--- a/bta/csis/csis_client_test.cc
+++ b/bta/csis/csis_client_test.cc
@@ -386,7 +386,9 @@ class CsisClientTest : public ::testing::Test {
             Invoke([](uint16_t conn_id, uint16_t handle,
                       std::vector<uint8_t> value, tGATT_WRITE_TYPE write_type,
                       GATT_WRITE_OP_CB cb, void* cb_data) -> void {
-              if (cb) cb(conn_id, GATT_SUCCESS, handle, cb_data);
+              if (cb)
+                cb(conn_id, GATT_SUCCESS, handle, value.size(), value.data(),
+                   cb_data);
             }));
   }
 
@@ -935,7 +937,9 @@ TEST_F(CsisMultiClientTest, test_lock_multiple_instances) {
           Invoke([](uint16_t conn_id, uint16_t handle,
                     std::vector<uint8_t> value, tGATT_WRITE_TYPE write_type,
                     GATT_WRITE_OP_CB cb, void* cb_data) -> void {
-            if (cb) cb(conn_id, GATT_SUCCESS, handle, cb_data);
+            if (cb)
+              cb(conn_id, GATT_SUCCESS, handle, value.size(), value.data(),
+                 cb_data);
           }));
   CsisClient::Get()->LockGroup(
       1, true,
@@ -964,7 +968,9 @@ TEST_F(CsisMultiClientTest, test_unlock_multiple_instances) {
           Invoke([](uint16_t conn_id, uint16_t handle,
                     std::vector<uint8_t> value, tGATT_WRITE_TYPE write_type,
                     GATT_WRITE_OP_CB cb, void* cb_data) -> void {
-            if (cb) cb(conn_id, GATT_SUCCESS, handle, cb_data);
+            if (cb)
+              cb(conn_id, GATT_SUCCESS, handle, value.size(), value.data(),
+                 cb_data);
           }));
   CsisClient::Get()->LockGroup(
       1, true,
@@ -1001,7 +1007,9 @@ TEST_F(CsisMultiClientTest, test_disconnect_locked_multiple_instances) {
           Invoke([](uint16_t conn_id, uint16_t handle,
                     std::vector<uint8_t> value, tGATT_WRITE_TYPE write_type,
                     GATT_WRITE_OP_CB cb, void* cb_data) -> void {
-            if (cb) cb(conn_id, GATT_SUCCESS, handle, cb_data);
+            if (cb)
+              cb(conn_id, GATT_SUCCESS, handle, value.size(), value.data(),
+                 cb_data);
           }));
   CsisClient::Get()->LockGroup(
       1, true,
diff --git a/bta/gatt/bta_gattc_act.cc b/bta/gatt/bta_gattc_act.cc
index 60c660b40..ac46809c4 100644
--- a/bta/gatt/bta_gattc_act.cc
+++ b/bta/gatt/bta_gattc_act.cc
@@ -932,6 +932,7 @@ static void bta_gattc_write_cmpl(tBTA_GATTC_CLCB* p_clcb,
 
   if (cb) {
     cb(p_clcb->bta_conn_id, p_data->status, p_data->p_cmpl->att_value.handle,
+       p_data->p_cmpl->att_value.len, p_data->p_cmpl->att_value.value,
        my_cb_data);
   }
 }
diff --git a/bta/gatt/bta_gattc_queue.cc b/bta/gatt/bta_gattc_queue.cc
index d9fb7009a..b4c4f51ac 100644
--- a/bta/gatt/bta_gattc_queue.cc
+++ b/bta/gatt/bta_gattc_queue.cc
@@ -69,7 +69,8 @@ struct gatt_write_op_data {
 };
 
 void BtaGattQueue::gatt_write_op_finished(uint16_t conn_id, tGATT_STATUS status,
-                                          uint16_t handle, void* data) {
+                                          uint16_t handle, uint16_t len,
+                                          const uint8_t* value, void* data) {
   gatt_write_op_data* tmp = (gatt_write_op_data*)data;
   GATT_WRITE_OP_CB tmp_cb = tmp->cb;
   void* tmp_cb_data = tmp->cb_data;
@@ -80,7 +81,7 @@ void BtaGattQueue::gatt_write_op_finished(uint16_t conn_id, tGATT_STATUS status,
   gatt_execute_next_op(conn_id);
 
   if (tmp_cb) {
-    tmp_cb(conn_id, status, handle, tmp_cb_data);
+    tmp_cb(conn_id, status, handle, len, value, tmp_cb_data);
     return;
   }
 }
diff --git a/bta/hearing_aid/hearing_aid.cc b/bta/hearing_aid/hearing_aid.cc
index 8ab5dfc76..dfc0ac325 100644
--- a/bta/hearing_aid/hearing_aid.cc
+++ b/bta/hearing_aid/hearing_aid.cc
@@ -209,10 +209,12 @@ class HearingDevices {
 };
 
 static void write_rpt_ctl_cfg_cb(uint16_t conn_id, tGATT_STATUS status,
-                                 uint16_t handle, void* data) {
+                                 uint16_t handle, uint16_t len,
+                                 const uint8_t* value, void* data) {
   if (status != GATT_SUCCESS) {
     LOG(ERROR) << __func__ << ": handle=" << handle << ", conn_id=" << conn_id
-               << ", status=" << loghex(static_cast<uint8_t>(status));
+               << ", status=" << loghex(static_cast<uint8_t>(status))
+               << ", length=" << len;
   }
 }
 
diff --git a/bta/hh/bta_hh_le.cc b/bta/hh/bta_hh_le.cc
index b20986fb5..afb37e299 100644
--- a/bta/hh/bta_hh_le.cc
+++ b/bta/hh/bta_hh_le.cc
@@ -672,7 +672,8 @@ static bool bta_hh_le_write_ccc(tBTA_HH_DEV_CB* p_cb, uint16_t char_handle,
 static bool bta_hh_le_write_rpt_clt_cfg(tBTA_HH_DEV_CB* p_cb);
 
 static void write_rpt_ctl_cfg_cb(uint16_t conn_id, tGATT_STATUS status,
-                                 uint16_t handle, void* data) {
+                                 uint16_t handle, uint16_t len,
+                                 const uint8_t* value, void* data) {
   uint8_t srvc_inst_id;
 
   tBTA_HH_DEV_CB* p_dev_cb = (tBTA_HH_DEV_CB*)data;
@@ -735,7 +736,8 @@ static bool bta_hh_le_write_rpt_clt_cfg(tBTA_HH_DEV_CB* p_cb) {
 }
 
 static void write_proto_mode_cb(uint16_t conn_id, tGATT_STATUS status,
-                                uint16_t handle, void* data) {
+                                uint16_t handle, uint16_t len,
+                                const uint8_t* value, void* data) {
   tBTA_HH_DEV_CB* p_dev_cb = (tBTA_HH_DEV_CB*)data;
 
   if (p_dev_cb->state == BTA_HH_CONN_ST) {
@@ -1820,7 +1822,8 @@ static void bta_hh_le_get_rpt(tBTA_HH_DEV_CB* p_cb, tBTA_HH_RPT_TYPE r_type,
 }
 
 static void write_report_cb(uint16_t conn_id, tGATT_STATUS status,
-                            uint16_t handle, void* data) {
+                            uint16_t handle, uint16_t len, const uint8_t* value,
+                            void* data) {
   tBTA_HH_CBDATA cback_data;
   tBTA_HH_DEV_CB* p_dev_cb = (tBTA_HH_DEV_CB*)data;
   uint16_t cb_evt = p_dev_cb->w4_evt;
diff --git a/bta/include/bta_gatt_api.h b/bta/include/bta_gatt_api.h
index 6bfe35356..9fe7c75f1 100644
--- a/bta/include/bta_gatt_api.h
+++ b/bta/include/bta_gatt_api.h
@@ -586,7 +586,8 @@ typedef void (*GATT_READ_OP_CB)(uint16_t conn_id, tGATT_STATUS status,
                                 uint16_t handle, uint16_t len, uint8_t* value,
                                 void* data);
 typedef void (*GATT_WRITE_OP_CB)(uint16_t conn_id, tGATT_STATUS status,
-                                 uint16_t handle, void* data);
+                                 uint16_t handle, uint16_t len,
+                                 const uint8_t* value, void* data);
 typedef void (*GATT_CONFIGURE_MTU_OP_CB)(uint16_t conn_id, tGATT_STATUS status,
                                          void* data);
 
diff --git a/bta/include/bta_gatt_queue.h b/bta/include/bta_gatt_queue.h
index 5e2a3a917..0c55b2cf4 100644
--- a/bta/include/bta_gatt_queue.h
+++ b/bta/include/bta_gatt_queue.h
@@ -73,7 +73,8 @@ class BtaGattQueue {
                                     uint16_t handle, uint16_t len,
                                     uint8_t* value, void* data);
   static void gatt_write_op_finished(uint16_t conn_id, tGATT_STATUS status,
-                                     uint16_t handle, void* data);
+                                     uint16_t handle, uint16_t len,
+                                     const uint8_t* value, void* data);
   static void gatt_configure_mtu_op_finished(uint16_t conn_id,
                                              tGATT_STATUS status, void* data);
 
diff --git a/bta/le_audio/client.cc b/bta/le_audio/client.cc
index 6522d76a6..dd1540856 100644
--- a/bta/le_audio/client.cc
+++ b/bta/le_audio/client.cc
@@ -1202,7 +1202,8 @@ class LeAudioClientImpl : public LeAudioClient {
 
     BtaGattQueue::WriteDescriptor(
         conn_id, ccc_handle, std::move(value), GATT_WRITE,
-        [](uint16_t conn_id, tGATT_STATUS status, uint16_t handle, void* data) {
+        [](uint16_t conn_id, tGATT_STATUS status, uint16_t handle, uint16_t len,
+           const uint8_t* value, void* data) {
           if (instance) instance->OnGattWriteCcc(conn_id, status, handle, data);
         },
         nullptr);
diff --git a/bta/le_audio/le_audio_client_test.cc b/bta/le_audio/le_audio_client_test.cc
index 8158ef299..3af1ed12b 100644
--- a/bta/le_audio/le_audio_client_test.cc
+++ b/bta/le_audio/le_audio_client_test.cc
@@ -370,13 +370,16 @@ class UnicastTestNoInit : public Test {
                       std::vector<uint8_t> value, tGATT_WRITE_TYPE write_type,
                       GATT_WRITE_OP_CB cb, void* cb_data) -> void {
               if (cb)
-                do_in_main_thread(
-                    FROM_HERE, base::BindOnce(
-                                   [](GATT_WRITE_OP_CB cb, uint16_t conn_id,
-                                      uint16_t handle, void* cb_data) {
-                                     cb(conn_id, GATT_SUCCESS, handle, cb_data);
-                                   },
-                                   cb, conn_id, handle, cb_data));
+                do_in_main_thread(FROM_HERE,
+                                  base::BindOnce(
+                                      [](GATT_WRITE_OP_CB cb, uint16_t conn_id,
+                                         uint16_t handle, uint16_t len,
+                                         uint8_t* value, void* cb_data) {
+                                        cb(conn_id, GATT_SUCCESS, handle, len,
+                                           value, cb_data);
+                                      },
+                                      cb, conn_id, handle, value.size(),
+                                      value.data(), cb_data));
             }));
 
     global_conn_id = 1;
diff --git a/bta/test/bta_gatt_test.cc b/bta/test/bta_gatt_test.cc
index 454e690e1..8d19b9f82 100644
--- a/bta/test/bta_gatt_test.cc
+++ b/bta/test/bta_gatt_test.cc
@@ -56,15 +56,20 @@ struct {
   uint16_t conn_id;
   tGATT_STATUS status;
   uint16_t handle;
+  uint16_t len;
+  const uint8_t* value;
   void* data;
 } bta_gatt_write_complete_callback;
 }  // namespace param
 
 void bta_gatt_write_complete_callback(uint16_t conn_id, tGATT_STATUS status,
-                                      uint16_t handle, void* data) {
+                                      uint16_t handle, uint16_t len,
+                                      const uint8_t* value, void* data) {
   param::bta_gatt_write_complete_callback.conn_id = conn_id;
   param::bta_gatt_write_complete_callback.status = status;
   param::bta_gatt_write_complete_callback.handle = handle;
+  param::bta_gatt_write_complete_callback.len = len;
+  param::bta_gatt_write_complete_callback.value = value;
   param::bta_gatt_write_complete_callback.data = data;
 }
 
diff --git a/bta/vc/devices_test.cc b/bta/vc/devices_test.cc
index 7a63d530b..691669275 100644
--- a/bta/vc/devices_test.cc
+++ b/bta/vc/devices_test.cc
@@ -357,7 +357,8 @@ TEST_F(VolumeControlDeviceTest, test_enqueue_initial_requests) {
   auto chrc_read_cb = [](uint16_t conn_id, tGATT_STATUS status, uint16_t handle,
                          uint16_t len, uint8_t* value, void* data) {};
   auto cccd_write_cb = [](uint16_t conn_id, tGATT_STATUS status,
-                          uint16_t handle, void* data) {};
+                          uint16_t handle, uint16_t len, const uint8_t* value,
+                          void* data) {};
   ASSERT_EQ(true, device->EnqueueInitialRequests(gatt_if, chrc_read_cb,
                                                  cccd_write_cb));
 };
@@ -383,7 +384,8 @@ TEST_F(VolumeControlDeviceTest, test_device_ready) {
   auto chrc_read_cb = [](uint16_t conn_id, tGATT_STATUS status, uint16_t handle,
                          uint16_t len, uint8_t* value, void* data) {};
   auto cccd_write_cb = [](uint16_t conn_id, tGATT_STATUS status,
-                          uint16_t handle, void* data) {};
+                          uint16_t handle, uint16_t len, const uint8_t* value,
+                          void* data) {};
   ASSERT_EQ(true, device->EnqueueInitialRequests(0x0001, chrc_read_cb,
                                                  cccd_write_cb));
   ASSERT_NE((size_t)0, requested_handles.size());
@@ -425,7 +427,8 @@ TEST_F(VolumeControlDeviceTest, test_enqueue_remaining_requests) {
   auto chrc_read_cb = [](uint16_t conn_id, tGATT_STATUS status, uint16_t handle,
                          uint16_t len, uint8_t* value, void* data) {};
   auto cccd_write_cb = [](uint16_t conn_id, tGATT_STATUS status,
-                          uint16_t handle, void* data) {};
+                          uint16_t handle, uint16_t len, const uint8_t* value,
+                          void* data) {};
   device->EnqueueRemainingRequests(gatt_if, chrc_read_cb, cccd_write_cb);
 }
 
@@ -441,7 +444,8 @@ TEST_F(VolumeControlDeviceTest, test_check_link_encrypted) {
 
 TEST_F(VolumeControlDeviceTest, test_control_point_operation) {
   GATT_WRITE_OP_CB write_cb = [](uint16_t conn_id, tGATT_STATUS status,
-                                 uint16_t handle, void* data) {};
+                                 uint16_t handle, uint16_t len,
+                                 const uint8_t* value, void* data) {};
   SetSampleDatabase1();
   device->change_counter = 0x01;
   std::vector<uint8_t> expected_data({0x03, 0x01});
@@ -452,7 +456,8 @@ TEST_F(VolumeControlDeviceTest, test_control_point_operation) {
 
 TEST_F(VolumeControlDeviceTest, test_control_point_operation_arg) {
   GATT_WRITE_OP_CB write_cb = [](uint16_t conn_id, tGATT_STATUS status,
-                                 uint16_t handle, void* data) {};
+                                 uint16_t handle, uint16_t len,
+                                 const uint8_t* value, void* data) {};
   SetSampleDatabase1();
   device->change_counter = 0x55;
   std::vector<uint8_t> expected_data({0x01, 0x55, 0x02, 0x03});
diff --git a/bta/vc/vc.cc b/bta/vc/vc.cc
index 7bc7fabb5..08f61e877 100644
--- a/bta/vc/vc.cc
+++ b/bta/vc/vc.cc
@@ -403,7 +403,8 @@ class VolumeControlImpl : public VolumeControl {
   }
 
   void OnGattWriteCcc(uint16_t connection_id, tGATT_STATUS status,
-                      uint16_t handle, void* /*data*/) {
+                      uint16_t handle, uint16_t len, const uint8_t* value,
+                      void* /*data*/) {
     VolumeControlDevice* device =
         volume_control_devices_.FindByConnId(connection_id);
     if (!device) {
@@ -428,13 +429,14 @@ class VolumeControlImpl : public VolumeControl {
   }
 
   static void OnGattWriteCccStatic(uint16_t connection_id, tGATT_STATUS status,
-                                   uint16_t handle, void* data) {
+                                   uint16_t handle, uint16_t len,
+                                   const uint8_t* value, void* data) {
     if (!instance) {
       LOG(ERROR) << __func__ << "No instance=" << handle;
       return;
     }
 
-    instance->OnGattWriteCcc(connection_id, status, handle, data);
+    instance->OnGattWriteCcc(connection_id, status, handle, len, value, data);
   }
 
   void Dump(int fd) { volume_control_devices_.DebugDump(fd); }
@@ -701,7 +703,7 @@ class VolumeControlImpl : public VolumeControl {
     volume_control_devices_.ControlPointOperation(
         devices, opcode, arg,
         [](uint16_t connection_id, tGATT_STATUS status, uint16_t handle,
-           void* data) {
+           uint16_t len, const uint8_t* value, void* data) {
           if (instance)
             instance->OnWriteControlResponse(connection_id, status, handle,
                                              data);
diff --git a/bta/vc/vc_test.cc b/bta/vc/vc_test.cc
index 81a73532e..41d4f2011 100644
--- a/bta/vc/vc_test.cc
+++ b/bta/vc/vc_test.cc
@@ -222,7 +222,9 @@ class VolumeControlTest : public ::testing::Test {
             Invoke([](uint16_t conn_id, uint16_t handle,
                       std::vector<uint8_t> value, tGATT_WRITE_TYPE write_type,
                       GATT_WRITE_OP_CB cb, void* cb_data) -> void {
-              if (cb) cb(conn_id, GATT_SUCCESS, handle, cb_data);
+              if (cb)
+                cb(conn_id, GATT_SUCCESS, handle, value.size(), value.data(),
+                   cb_data);
             }));
   }
 
diff --git a/btif/src/btif_gatt_client.cc b/btif/src/btif_gatt_client.cc
index 73dad7e2b..a3dcf48c9 100644
--- a/btif/src/btif_gatt_client.cc
+++ b/btif/src/btif_gatt_client.cc
@@ -488,8 +488,9 @@ static bt_status_t btif_gattc_read_char_descr(int conn_id, uint16_t handle,
 }
 
 void write_char_cb(uint16_t conn_id, tGATT_STATUS status, uint16_t handle,
-                   void* data) {
-  CLI_CBACK_IN_JNI(write_characteristic_cb, conn_id, status, handle);
+                   uint16_t len, const uint8_t* value, void* data) {
+  CLI_CBACK_IN_JNI(write_characteristic_cb, conn_id, status, handle, len,
+                   value);
 }
 
 static bt_status_t btif_gattc_write_char(int conn_id, uint16_t handle,
@@ -507,8 +508,8 @@ static bt_status_t btif_gattc_write_char(int conn_id, uint16_t handle,
 }
 
 void write_descr_cb(uint16_t conn_id, tGATT_STATUS status, uint16_t handle,
-                    void* data) {
-  CLI_CBACK_IN_JNI(write_descriptor_cb, conn_id, status, handle);
+                    uint16_t len, const uint8_t* value, void* data) {
+  CLI_CBACK_IN_JNI(write_descriptor_cb, conn_id, status, handle, len, value);
 }
 
 static bt_status_t btif_gattc_write_char_descr(int conn_id, uint16_t handle,
diff --git a/gd/rust/topshim/src/profiles/gatt.rs b/gd/rust/topshim/src/profiles/gatt.rs
index 6c2f17904..7ec65acf3 100644
--- a/gd/rust/topshim/src/profiles/gatt.rs
+++ b/gd/rust/topshim/src/profiles/gatt.rs
@@ -114,9 +114,9 @@ pub enum GattClientCallbacks {
     RegisterForNotification(i32, i32, i32, u16),
     Notify(i32, BtGattNotifyParams),
     ReadCharacteristic(i32, i32, BtGattReadParams),
-    WriteCharacteristic(i32, i32, u16),
+    WriteCharacteristic(i32, i32, u16, u16, *const u8),
     ReadDescriptor(i32, i32, BtGattReadParams),
-    WriteDescriptor(i32, i32, u16),
+    WriteDescriptor(i32, i32, u16, u16, *const u8),
     ExecuteWrite(i32, i32),
     ReadRemoteRssi(i32, RawAddress, i32, i32),
     ConfigureMtu(i32, i32, i32),
@@ -214,7 +214,7 @@ cb_variant!(
 cb_variant!(
     GattClientCb,
     gc_write_characteristic_cb -> GattClientCallbacks::WriteCharacteristic,
-    i32, i32, u16, {}
+    i32, i32, u16, u16, *const u8, {}
 );
 
 cb_variant!(
@@ -228,7 +228,7 @@ cb_variant!(
 cb_variant!(
     GattClientCb,
     gc_write_descriptor_cb -> GattClientCallbacks::WriteDescriptor,
-    i32, i32, u16, {}
+    i32, i32, u16, u16, *const u8, {}
 );
 
 cb_variant!(
diff --git a/include/hardware/bt_gatt_client.h b/include/hardware/bt_gatt_client.h
index 1dc5e91e3..42468deb1 100644
--- a/include/hardware/bt_gatt_client.h
+++ b/include/hardware/bt_gatt_client.h
@@ -130,7 +130,8 @@ typedef void (*read_characteristic_callback)(int conn_id, int status,
 
 /** GATT write characteristic operation callback */
 typedef void (*write_characteristic_callback)(int conn_id, int status,
-                                              uint16_t handle);
+                                              uint16_t handle, uint16_t len,
+                                              const uint8_t* value);
 
 /** GATT execute prepared write callback */
 typedef void (*execute_write_callback)(int conn_id, int status);
@@ -141,7 +142,8 @@ typedef void (*read_descriptor_callback)(int conn_id, int status,
 
 /** Callback invoked in response to write_descriptor */
 typedef void (*write_descriptor_callback)(int conn_id, int status,
-                                          uint16_t handle);
+                                          uint16_t handle, uint16_t len,
+                                          const uint8_t* value);
 
 /** Callback triggered in response to read_remote_rssi */
 typedef void (*read_remote_rssi_callback)(int client_if, const RawAddress& bda,
diff --git a/service/hal/bluetooth_gatt_interface.cc b/service/hal/bluetooth_gatt_interface.cc
index 80a9a1ad6..2131d7b8f 100644
--- a/service/hal/bluetooth_gatt_interface.cc
+++ b/service/hal/bluetooth_gatt_interface.cc
@@ -165,24 +165,26 @@ void NotifyCallback(int conn_id, const btgatt_notify_params_t& p_data) {
   FOR_EACH_CLIENT_OBSERVER(NotifyCallback(g_interface, conn_id, p_data));
 }
 
-void WriteCharacteristicCallback(int conn_id, int status, uint16_t handle) {
+void WriteCharacteristicCallback(int conn_id, int status, uint16_t handle,
+                                 uint16_t len, const uint8_t* value) {
   shared_lock<shared_mutex_impl> lock(g_instance_lock);
   VERIFY_INTERFACE_OR_RETURN();
 
   VLOG(2) << __func__ << " - conn_id: " << conn_id << " - status: " << status;
 
-  FOR_EACH_CLIENT_OBSERVER(
-      WriteCharacteristicCallback(g_interface, conn_id, status, handle));
+  FOR_EACH_CLIENT_OBSERVER(WriteCharacteristicCallback(
+      g_interface, conn_id, status, handle, len, value));
 }
 
-void WriteDescriptorCallback(int conn_id, int status, uint16_t handle) {
+void WriteDescriptorCallback(int conn_id, int status, uint16_t handle,
+                             uint16_t len, const uint8_t* value) {
   shared_lock<shared_mutex_impl> lock(g_instance_lock);
   VERIFY_INTERFACE_OR_RETURN();
 
   VLOG(2) << __func__ << " - conn_id: " << conn_id << " - status: " << status;
 
-  FOR_EACH_CLIENT_OBSERVER(
-      WriteDescriptorCallback(g_interface, conn_id, status, handle));
+  FOR_EACH_CLIENT_OBSERVER(WriteDescriptorCallback(g_interface, conn_id, status,
+                                                   handle, len, value));
 }
 
 void MtuChangedCallback(int conn_id, int status, int mtu) {
@@ -610,13 +612,15 @@ void BluetoothGattInterface::ClientObserver::NotifyCallback(
 
 void BluetoothGattInterface::ClientObserver::WriteCharacteristicCallback(
     BluetoothGattInterface* /* gatt_iface */, int /* conn_id */,
-    int /* status */, uint16_t /* handle */) {
+    int /* status */, uint16_t /* handle */, uint16_t /* len */,
+    const uint8_t* /* value */) {
   // Do nothing
 }
 
 void BluetoothGattInterface::ClientObserver::WriteDescriptorCallback(
     BluetoothGattInterface* /* gatt_iface */, int /* conn_id */,
-    int /* status */, uint16_t /* handle */) {
+    int /* status */, uint16_t /* handle */, uint16_t /* len */,
+    const uint8_t* /* value */) {
   // Do nothing
 }
 
diff --git a/service/hal/bluetooth_gatt_interface.h b/service/hal/bluetooth_gatt_interface.h
index eabe46458..471dfc4d0 100644
--- a/service/hal/bluetooth_gatt_interface.h
+++ b/service/hal/bluetooth_gatt_interface.h
@@ -91,11 +91,13 @@ class BluetoothGattInterface {
 
     virtual void WriteCharacteristicCallback(BluetoothGattInterface* gatt_iface,
                                              int conn_id, int status,
-                                             uint16_t handle);
+                                             uint16_t handle, uint16_t len,
+                                             const uint8_t* value);
 
     virtual void WriteDescriptorCallback(BluetoothGattInterface* gatt_iface,
                                          int conn_id, int status,
-                                         uint16_t handle);
+                                         uint16_t handle, uint16_t len,
+                                         const uint8_t* value);
 
     virtual void MtuChangedCallback(BluetoothGattInterface* gatt_iface,
                                     int conn_id, int status, int mtu);