Increase the limit of cl_rcb

This change increases the limit of
gatt_cb.cl_rcb to 255(1~255), which is the maximum
of uint8_t.

Bug: 348559823
Bug: 273561907
Test: atest BluetoothInstrumentationTests
Change-Id: I413f29e9b9b5797d6df9506253233e3807b57e62

10 files changed, 330 insertions, 91 deletions

diff --git a/system/bta/gatt/bta_gattc_act.cc b/system/bta/gatt/bta_gattc_act.cc
index e2fd540d1c..e4ec64f131 100644
--- a/system/bta/gatt/bta_gattc_act.cc
+++ b/system/bta/gatt/bta_gattc_act.cc
@@ -224,11 +224,26 @@ void bta_gattc_deregister(tBTA_GATTC_RCB* p_clreg) {
       continue;
     }
 
-    if (bta_gattc_cb.bg_track[i].cif_mask & ((tBTA_GATTC_CIF_MASK)1 << (p_clreg->client_if - 1))) {
-      bta_gattc_mark_bg_conn(p_clreg->client_if, bta_gattc_cb.bg_track[i].remote_bda, false);
-      if (!GATT_CancelConnect(p_clreg->client_if, bta_gattc_cb.bg_track[i].remote_bda, false)) {
-        log::warn("Unable to cancel GATT connection client_if:{} peer:{} is_direct:{}",
+    if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+      if (bta_gattc_cb.bg_track[i].cif_set.contains(p_clreg->client_if)) {
+        bta_gattc_mark_bg_conn(p_clreg->client_if, bta_gattc_cb.bg_track[i].remote_bda, false);
+        if (!GATT_CancelConnect(p_clreg->client_if, bta_gattc_cb.bg_track[i].remote_bda, false)) {
+          log::warn(
+                  "Unable to cancel GATT connection client_if:{} peer:{} "
+                  "is_direct:{}",
                   p_clreg->client_if, bta_gattc_cb.bg_track[i].remote_bda, false);
+        }
+      }
+    } else {
+      if (bta_gattc_cb.bg_track[i].cif_mask &
+          ((tBTA_GATTC_CIF_MASK)1 << (p_clreg->client_if - 1))) {
+        bta_gattc_mark_bg_conn(p_clreg->client_if, bta_gattc_cb.bg_track[i].remote_bda, false);
+        if (!GATT_CancelConnect(p_clreg->client_if, bta_gattc_cb.bg_track[i].remote_bda, false)) {
+          log::warn(
+                  "Unable to cancel GATT connection client_if:{} peer:{} "
+                  "is_direct:{}",
+                  p_clreg->client_if, bta_gattc_cb.bg_track[i].remote_bda, false);
+        }
       }
     }
   }
diff --git a/system/bta/gatt/bta_gattc_int.h b/system/bta/gatt/bta_gattc_int.h
index bf5e4cb56d..dad81e05e8 100644
--- a/system/bta/gatt/bta_gattc_int.h
+++ b/system/bta/gatt/bta_gattc_int.h
@@ -28,6 +28,7 @@
 
 #include <cstdint>
 #include <deque>
+#include <unordered_set>
 
 #include "bta/gatt/database.h"
 #include "bta/gatt/database_builder.h"
@@ -322,7 +323,7 @@ typedef struct {
   bool in_use;
   RawAddress remote_bda;
   tBTA_GATTC_CIF_MASK cif_mask;
-
+  std::unordered_set<tGATT_IF> cif_set;
 } tBTA_GATTC_BG_TCK;
 
 typedef struct {
diff --git a/system/bta/gatt/bta_gattc_utils.cc b/system/bta/gatt/bta_gattc_utils.cc
index 005ef08204..77395338e5 100644
--- a/system/bta/gatt/bta_gattc_utils.cc
+++ b/system/bta/gatt/bta_gattc_utils.cc
@@ -25,6 +25,7 @@
 #define LOG_TAG "bt_bta_gattc"
 
 #include <bluetooth/log.h>
+#include <com_android_bluetooth_flags.h>
 
 #include <cstdint>
 
@@ -555,20 +556,38 @@ bool bta_gattc_mark_bg_conn(tGATT_IF client_if, const RawAddress& remote_bda_ptr
   for (i = 0; i < ble_acceptlist_size(); i++, p_bg_tck++) {
     if (p_bg_tck->in_use &&
         ((p_bg_tck->remote_bda == remote_bda_ptr) || (p_bg_tck->remote_bda.IsEmpty()))) {
-      p_cif_mask = &p_bg_tck->cif_mask;
-
-      if (add) { /* mask on the cif bit */
-        *p_cif_mask |= (1 << (client_if - 1));
+      if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+        auto& p_cif_set = p_bg_tck->cif_set;
+        if (add) { /* mask on the cif bit */
+          p_cif_set.insert(client_if);
+        } else {
+          if (client_if != 0) {
+            p_cif_set.erase(client_if);
+          } else {
+            p_cif_set.clear();
+          }
+        }
+        /* no BG connection for this device, make it available */
+        if (p_bg_tck->cif_set.empty()) {
+          p_bg_tck->in_use = false;
+          p_bg_tck->remote_bda = RawAddress::kEmpty;
+        }
       } else {
-        if (client_if != 0) {
-          *p_cif_mask &= (~(1 << (client_if - 1)));
+        p_cif_mask = &p_bg_tck->cif_mask;
+
+        if (add) { /* mask on the cif bit */
+          *p_cif_mask |= (1 << (client_if - 1));
         } else {
-          *p_cif_mask = 0;
+          if (client_if != 0) {
+            *p_cif_mask &= (~(1 << (client_if - 1)));
+          } else {
+            *p_cif_mask = 0;
+          }
+        }
+        /* no BG connection for this device, make it available */
+        if (p_bg_tck->cif_mask == 0) {
+          memset(p_bg_tck, 0, sizeof(tBTA_GATTC_BG_TCK));
         }
-      }
-      /* no BG connection for this device, make it available */
-      if (p_bg_tck->cif_mask == 0) {
-        memset(p_bg_tck, 0, sizeof(tBTA_GATTC_BG_TCK));
       }
       return true;
     }
diff --git a/system/stack/gatt/gatt_api.cc b/system/stack/gatt/gatt_api.cc
index bc9fcc622c..c6ea0cf5b0 100644
--- a/system/stack/gatt/gatt_api.cc
+++ b/system/stack/gatt/gatt_api.cc
@@ -72,6 +72,9 @@ tGATT_HDL_LIST_ELEM& gatt_add_an_item_to_list(uint16_t s_handle) {
   return *rit;
 }
 
+static tGATT_IF GATT_Register_Dynamic(const Uuid& app_uuid128, const std::string& name,
+                                      tGATT_CBACK* p_cb_info, bool eatt_support);
+
 /*****************************************************************************
  *
  *                  GATT SERVER API
@@ -1216,6 +1219,9 @@ void GATT_SetIdleTimeout(const RawAddress& bd_addr, uint16_t idle_tout, tBT_TRAN
  ******************************************************************************/
 tGATT_IF GATT_Register(const Uuid& app_uuid128, const std::string& name, tGATT_CBACK* p_cb_info,
                        bool eatt_support) {
+  if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+    return GATT_Register_Dynamic(app_uuid128, name, p_cb_info, eatt_support);
+  }
   tGATT_REG* p_reg;
   uint8_t i_gatt_if = 0;
   tGATT_IF gatt_if = 0;
@@ -1252,6 +1258,54 @@ tGATT_IF GATT_Register(const Uuid& app_uuid128, const std::string& name, tGATT_C
   return 0;
 }
 
+static tGATT_IF GATT_Register_Dynamic(const Uuid& app_uuid128, const std::string& name,
+                                      tGATT_CBACK* p_cb_info, bool eatt_support) {
+  for (auto& [gatt_if, p_reg] : gatt_cb.cl_rcb_map) {
+    if (p_reg->app_uuid128 == app_uuid128) {
+      log::error("Application already registered, uuid={}", app_uuid128.ToString());
+      return 0;
+    }
+  }
+
+  if (stack_config_get_interface()->get_pts_use_eatt_for_all_services()) {
+    log::info("PTS: Force to use EATT for servers");
+    eatt_support = true;
+  }
+
+  if (gatt_cb.cl_rcb_map.size() >= GATT_CL_RCB_MAX) {
+    log::error("Unable to register GATT client, MAX client reached: {}", gatt_cb.cl_rcb_map.size());
+    return 0;
+  }
+
+  uint8_t i_gatt_if = gatt_cb.next_gatt_if;
+  for (int i = 0; i < GATT_CL_RCB_MAX; i++) {
+    if (gatt_cb.cl_rcb_map.find(static_cast<tGATT_IF>(i_gatt_if)) == gatt_cb.cl_rcb_map.end()) {
+      gatt_cb.cl_rcb_map.emplace(i_gatt_if, std::make_unique<tGATT_REG>());
+      tGATT_REG* p_reg = gatt_cb.cl_rcb_map[i_gatt_if].get();
+      p_reg->app_uuid128 = app_uuid128;
+      p_reg->gatt_if = (tGATT_IF)i_gatt_if;
+      p_reg->app_cb = *p_cb_info;
+      p_reg->in_use = true;
+      p_reg->eatt_support = eatt_support;
+      p_reg->name = name;
+      log::info("Allocated name:{} uuid:{} gatt_if:{} eatt_support:{}", name,
+                app_uuid128.ToString(), p_reg->gatt_if, eatt_support);
+
+      gatt_cb.next_gatt_if = (tGATT_IF)(i_gatt_if + 1);
+      if (gatt_cb.next_gatt_if == 0) {
+        gatt_cb.next_gatt_if = 1;
+      }
+    }
+    i_gatt_if++;
+    if (i_gatt_if == 0) {
+      i_gatt_if = 1;
+    }
+  }
+
+  log::error("Unable to register GATT client, MAX client reached: {}", gatt_cb.cl_rcb_map.size());
+  return 0;
+}
+
 /*******************************************************************************
  *
  * Function         GATT_Deregister
@@ -1319,7 +1373,11 @@ void GATT_Deregister(tGATT_IF gatt_if) {
     connection_manager::on_app_deregistered(gatt_if);
   }
 
-  *p_reg = {};
+  if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+    gatt_cb.cl_rcb_map.erase(gatt_if);
+  } else {
+    *p_reg = {};
+  }
 }
 
 /*******************************************************************************
diff --git a/system/stack/gatt/gatt_auth.cc b/system/stack/gatt/gatt_auth.cc
index 5d47fc1555..8b893e2354 100644
--- a/system/stack/gatt/gatt_auth.cc
+++ b/system/stack/gatt/gatt_auth.cc
@@ -23,6 +23,7 @@
  ******************************************************************************/
 
 #include <bluetooth/log.h>
+#include <com_android_bluetooth_flags.h>
 #include <string.h>
 
 #include "gatt_api.h"
@@ -214,9 +215,17 @@ void gatt_notify_enc_cmpl(const RawAddress& bd_addr) {
     return;
   }
 
-  for (uint8_t i = 0; i < GATT_MAX_APPS; i++) {
-    if (gatt_cb.cl_rcb[i].in_use && gatt_cb.cl_rcb[i].app_cb.p_enc_cmpl_cb) {
-      (*gatt_cb.cl_rcb[i].app_cb.p_enc_cmpl_cb)(gatt_cb.cl_rcb[i].gatt_if, bd_addr);
+  if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+    for (auto& [i, p_rcb] : gatt_cb.cl_rcb_map) {
+      if (p_rcb->app_cb.p_enc_cmpl_cb) {
+        (*p_rcb->app_cb.p_enc_cmpl_cb)(p_rcb->gatt_if, bd_addr);
+      }
+    }
+  } else {
+    for (uint8_t i = 0; i < GATT_MAX_APPS; i++) {
+      if (gatt_cb.cl_rcb[i].in_use && gatt_cb.cl_rcb[i].app_cb.p_enc_cmpl_cb) {
+        (*gatt_cb.cl_rcb[i].app_cb.p_enc_cmpl_cb)(gatt_cb.cl_rcb[i].gatt_if, bd_addr);
+      }
     }
   }
 
diff --git a/system/stack/gatt/gatt_cl.cc b/system/stack/gatt/gatt_cl.cc
index 3975c92098..9d4577eda1 100644
--- a/system/stack/gatt/gatt_cl.cc
+++ b/system/stack/gatt/gatt_cl.cc
@@ -25,6 +25,7 @@
 #define LOG_TAG "bluetooth"
 
 #include <bluetooth/log.h>
+#include <com_android_bluetooth_flags.h>
 #include <string.h>
 
 #include "gatt_int.h"
@@ -696,9 +697,17 @@ void gatt_process_notification(tGATT_TCB& tcb, uint16_t cid, uint8_t op_code, ui
     // notification/indication
     // Note: need to do the indication count and start timer first then do
     // callback
-    for (i = 0, p_reg = gatt_cb.cl_rcb; i < GATT_MAX_APPS; i++, p_reg++) {
-      if (p_reg->in_use && p_reg->app_cb.p_cmpl_cb) {
-        tcb.ind_count++;
+    if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+      for (auto& [i, p_reg] : gatt_cb.cl_rcb_map) {
+        if (p_reg->in_use && p_reg->app_cb.p_cmpl_cb) {
+          tcb.ind_count++;
+        }
+      }
+    } else {
+      for (i = 0, p_reg = gatt_cb.cl_rcb; i < GATT_MAX_APPS; i++, p_reg++) {
+        if (p_reg->in_use && p_reg->app_cb.p_cmpl_cb) {
+          tcb.ind_count++;
+        }
       }
     }
 
@@ -718,10 +727,19 @@ void gatt_process_notification(tGATT_TCB& tcb, uint16_t cid, uint8_t op_code, ui
   gatt_cl_complete.att_value = value;
   gatt_cl_complete.cid = cid;
 
-  for (i = 0, p_reg = gatt_cb.cl_rcb; i < GATT_MAX_APPS; i++, p_reg++) {
-    if (p_reg->in_use && p_reg->app_cb.p_cmpl_cb) {
-      conn_id = GATT_CREATE_CONN_ID(tcb.tcb_idx, p_reg->gatt_if);
-      (*p_reg->app_cb.p_cmpl_cb)(conn_id, event, encrypt_status, &gatt_cl_complete);
+  if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+    for (auto& [i, p_reg] : gatt_cb.cl_rcb_map) {
+      if (p_reg->in_use && p_reg->app_cb.p_cmpl_cb) {
+        conn_id = GATT_CREATE_CONN_ID(tcb.tcb_idx, p_reg->gatt_if);
+        (*p_reg->app_cb.p_cmpl_cb)(conn_id, event, encrypt_status, &gatt_cl_complete);
+      }
+    }
+  } else {
+    for (i = 0, p_reg = gatt_cb.cl_rcb; i < GATT_MAX_APPS; i++, p_reg++) {
+      if (p_reg->in_use && p_reg->app_cb.p_cmpl_cb) {
+        conn_id = GATT_CREATE_CONN_ID(tcb.tcb_idx, p_reg->gatt_if);
+        (*p_reg->app_cb.p_cmpl_cb)(conn_id, event, encrypt_status, &gatt_cl_complete);
+      }
     }
   }
 
@@ -759,10 +777,19 @@ void gatt_process_notification(tGATT_TCB& tcb, uint16_t cid, uint8_t op_code, ui
     gatt_cl_complete.att_value = value;
     gatt_cl_complete.cid = cid;
 
-    for (i = 0, p_reg = gatt_cb.cl_rcb; i < GATT_MAX_APPS; i++, p_reg++) {
-      if (p_reg->in_use && p_reg->app_cb.p_cmpl_cb) {
-        conn_id = GATT_CREATE_CONN_ID(tcb.tcb_idx, p_reg->gatt_if);
-        (*p_reg->app_cb.p_cmpl_cb)(conn_id, event, encrypt_status, &gatt_cl_complete);
+    if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+      for (auto& [i, p_reg] : gatt_cb.cl_rcb_map) {
+        if (p_reg->in_use && p_reg->app_cb.p_cmpl_cb) {
+          conn_id = GATT_CREATE_CONN_ID(tcb.tcb_idx, p_reg->gatt_if);
+          (*p_reg->app_cb.p_cmpl_cb)(conn_id, event, encrypt_status, &gatt_cl_complete);
+        }
+      }
+    } else {
+      for (i = 0, p_reg = gatt_cb.cl_rcb; i < GATT_MAX_APPS; i++, p_reg++) {
+        if (p_reg->in_use && p_reg->app_cb.p_cmpl_cb) {
+          conn_id = GATT_CREATE_CONN_ID(tcb.tcb_idx, p_reg->gatt_if);
+          (*p_reg->app_cb.p_cmpl_cb)(conn_id, event, encrypt_status, &gatt_cl_complete);
+        }
       }
     }
   }
diff --git a/system/stack/gatt/gatt_int.h b/system/stack/gatt/gatt_int.h
index 998e401371..0b74334291 100644
--- a/system/stack/gatt/gatt_int.h
+++ b/system/stack/gatt/gatt_int.h
@@ -43,6 +43,7 @@
 #define GATT_GET_GATT_IF(conn_id) ((tGATT_IF)((uint8_t)(conn_id)))
 
 #define GATT_TRANS_ID_MAX 0x0fffffff /* 4 MSB is reserved */
+#define GATT_CL_RCB_MAX 255          /* Maximum number of cl_rcb */
 
 /* security action for GATT write and read request */
 typedef enum : uint8_t {
@@ -414,6 +415,9 @@ typedef struct {
   fixed_queue_t* srv_chg_clt_q; /* service change clients queue */
   tGATT_REG cl_rcb[GATT_MAX_APPS];
 
+  tGATT_IF next_gatt_if; /* potential next gatt if, should be greater than 0 */
+  std::unordered_map<tGATT_IF, std::unique_ptr<tGATT_REG>> cl_rcb_map;
+
   /* list of connection link control blocks.
    * Since clcbs are also keep in the channels (ATT and EATT) queues while
    * processing, we want to make sure that references to elements are not
diff --git a/system/stack/gatt/gatt_main.cc b/system/stack/gatt/gatt_main.cc
index 88ef13fe01..c26de0daa6 100644
--- a/system/stack/gatt/gatt_main.cc
+++ b/system/stack/gatt/gatt_main.cc
@@ -113,6 +113,9 @@ void gatt_init(void) {
   connection_manager::reset(true);
   memset(&fixed_reg, 0, sizeof(tL2CAP_FIXED_CHNL_REG));
 
+  // To catch a potential OOB.
+  gatt_cb.next_gatt_if = 40;
+
   gatt_cb.sign_op_queue = fixed_queue_new(SIZE_MAX);
   gatt_cb.srv_chg_clt_q = fixed_queue_new(SIZE_MAX);
   /* First, register fixed L2CAP channel for ATT over BLE */
@@ -607,13 +610,22 @@ static void gatt_channel_congestion(tGATT_TCB* p_tcb, bool congested) {
     gatt_cl_send_next_cmd_inq(*p_tcb);
   }
   /* notifying all applications for the connection up event */
-  for (i = 0, p_reg = gatt_cb.cl_rcb; i < GATT_MAX_APPS; i++, p_reg++) {
-    if (p_reg->in_use) {
-      if (p_reg->app_cb.p_congestion_cb) {
+  if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+    for (auto& [i, p_reg] : gatt_cb.cl_rcb_map) {
+      if (p_reg->in_use && p_reg->app_cb.p_congestion_cb) {
         conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
         (*p_reg->app_cb.p_congestion_cb)(conn_id, congested);
       }
     }
+  } else {
+    for (i = 0, p_reg = gatt_cb.cl_rcb; i < GATT_MAX_APPS; i++, p_reg++) {
+      if (p_reg->in_use) {
+        if (p_reg->app_cb.p_congestion_cb) {
+          conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
+          (*p_reg->app_cb.p_congestion_cb)(conn_id, congested);
+        }
+      }
+    }
   }
 }
 
@@ -632,11 +644,20 @@ void gatt_notify_phy_updated(tHCI_STATUS status, uint16_t handle, uint8_t tx_phy
   // TODO: Clean up this status conversion.
   tGATT_STATUS gatt_status = static_cast<tGATT_STATUS>(status);
 
-  for (int i = 0; i < GATT_MAX_APPS; i++) {
-    tGATT_REG* p_reg = &gatt_cb.cl_rcb[i];
-    if (p_reg->in_use && p_reg->app_cb.p_phy_update_cb) {
-      uint16_t conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
-      (*p_reg->app_cb.p_phy_update_cb)(p_reg->gatt_if, conn_id, tx_phy, rx_phy, gatt_status);
+  if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+    for (auto& [i, p_reg] : gatt_cb.cl_rcb_map) {
+      if (p_reg->in_use && p_reg->app_cb.p_phy_update_cb) {
+        uint16_t conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
+        (*p_reg->app_cb.p_phy_update_cb)(p_reg->gatt_if, conn_id, tx_phy, rx_phy, gatt_status);
+      }
+    }
+  } else {
+    for (int i = 0; i < GATT_MAX_APPS; i++) {
+      tGATT_REG* p_reg = &gatt_cb.cl_rcb[i];
+      if (p_reg->in_use && p_reg->app_cb.p_phy_update_cb) {
+        uint16_t conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
+        (*p_reg->app_cb.p_phy_update_cb)(p_reg->gatt_if, conn_id, tx_phy, rx_phy, gatt_status);
+      }
     }
   }
 }
@@ -649,12 +670,22 @@ void gatt_notify_conn_update(const RawAddress& remote, uint16_t interval, uint16
     return;
   }
 
-  for (int i = 0; i < GATT_MAX_APPS; i++) {
-    tGATT_REG* p_reg = &gatt_cb.cl_rcb[i];
-    if (p_reg->in_use && p_reg->app_cb.p_conn_update_cb) {
-      uint16_t conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
-      (*p_reg->app_cb.p_conn_update_cb)(p_reg->gatt_if, conn_id, interval, latency, timeout,
-                                        static_cast<tGATT_STATUS>(status));
+  if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+    for (auto& [i, p_reg] : gatt_cb.cl_rcb_map) {
+      if (p_reg->in_use && p_reg->app_cb.p_conn_update_cb) {
+        uint16_t conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
+        (*p_reg->app_cb.p_conn_update_cb)(p_reg->gatt_if, conn_id, interval, latency, timeout,
+                                          static_cast<tGATT_STATUS>(status));
+      }
+    }
+  } else {
+    for (int i = 0; i < GATT_MAX_APPS; i++) {
+      tGATT_REG* p_reg = &gatt_cb.cl_rcb[i];
+      if (p_reg->in_use && p_reg->app_cb.p_conn_update_cb) {
+        uint16_t conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
+        (*p_reg->app_cb.p_conn_update_cb)(p_reg->gatt_if, conn_id, interval, latency, timeout,
+                                          static_cast<tGATT_STATUS>(status));
+      }
     }
   }
 }
@@ -672,12 +703,22 @@ void gatt_notify_subrate_change(uint16_t handle, uint16_t subrate_factor, uint16
     return;
   }
 
-  for (int i = 0; i < GATT_MAX_APPS; i++) {
-    tGATT_REG* p_reg = &gatt_cb.cl_rcb[i];
-    if (p_reg->in_use && p_reg->app_cb.p_subrate_chg_cb) {
-      uint16_t conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
-      (*p_reg->app_cb.p_subrate_chg_cb)(p_reg->gatt_if, conn_id, subrate_factor, latency, cont_num,
-                                        timeout, static_cast<tGATT_STATUS>(status));
+  if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+    for (auto& [i, p_reg] : gatt_cb.cl_rcb_map) {
+      if (p_reg->in_use && p_reg->app_cb.p_subrate_chg_cb) {
+        uint16_t conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
+        (*p_reg->app_cb.p_subrate_chg_cb)(p_reg->gatt_if, conn_id, subrate_factor, latency,
+                                          cont_num, timeout, static_cast<tGATT_STATUS>(status));
+      }
+    }
+  } else {
+    for (int i = 0; i < GATT_MAX_APPS; i++) {
+      tGATT_REG* p_reg = &gatt_cb.cl_rcb[i];
+      if (p_reg->in_use && p_reg->app_cb.p_subrate_chg_cb) {
+        uint16_t conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
+        (*p_reg->app_cb.p_subrate_chg_cb)(p_reg->gatt_if, conn_id, subrate_factor, latency,
+                                          cont_num, timeout, static_cast<tGATT_STATUS>(status));
+      }
     }
   }
 }
@@ -927,28 +968,56 @@ static void gatt_send_conn_cback(tGATT_TCB* p_tcb) {
   }
 
   /* notifying all applications for the connection up event */
-  for (i = 0, p_reg = gatt_cb.cl_rcb; i < GATT_MAX_APPS; i++, p_reg++) {
-    if (!p_reg->in_use) {
-      continue;
-    }
 
-    if (apps.find(p_reg->gatt_if) != apps.end()) {
-      gatt_update_app_use_link_flag(p_reg->gatt_if, p_tcb, true, true);
-    }
+  if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+    for (auto& [i, p_reg] : gatt_cb.cl_rcb_map) {
+      if (!p_reg->in_use) {
+        continue;
+      }
 
-    if (com::android::bluetooth::flags::gatt_reconnect_on_bt_on_fix()) {
-      if (p_reg->direct_connect_request.count(p_tcb->peer_bda) > 0) {
+      if (apps.find(p_reg->gatt_if) != apps.end()) {
         gatt_update_app_use_link_flag(p_reg->gatt_if, p_tcb, true, true);
-        log::info("Removing device {} from the direct connect list of gatt_if {}", p_tcb->peer_bda,
-                  p_reg->gatt_if);
-        p_reg->direct_connect_request.erase(p_tcb->peer_bda);
+      }
+
+      if (com::android::bluetooth::flags::gatt_reconnect_on_bt_on_fix()) {
+        if (p_reg->direct_connect_request.count(p_tcb->peer_bda) > 0) {
+          gatt_update_app_use_link_flag(p_reg->gatt_if, p_tcb, true, true);
+          log::info("Removing device {} from the direct connect list of gatt_if {}",
+                    p_tcb->peer_bda, p_reg->gatt_if);
+          p_reg->direct_connect_request.erase(p_tcb->peer_bda);
+        }
+      }
+
+      if (p_reg->app_cb.p_conn_cb) {
+        conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
+        (*p_reg->app_cb.p_conn_cb)(p_reg->gatt_if, p_tcb->peer_bda, conn_id, kGattConnected,
+                                   GATT_CONN_OK, p_tcb->transport);
       }
     }
+  } else {
+    for (i = 0, p_reg = gatt_cb.cl_rcb; i < GATT_MAX_APPS; i++, p_reg++) {
+      if (!p_reg->in_use) {
+        continue;
+      }
 
-    if (p_reg->app_cb.p_conn_cb) {
-      conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
-      (*p_reg->app_cb.p_conn_cb)(p_reg->gatt_if, p_tcb->peer_bda, conn_id, kGattConnected,
-                                 GATT_CONN_OK, p_tcb->transport);
+      if (apps.find(p_reg->gatt_if) != apps.end()) {
+        gatt_update_app_use_link_flag(p_reg->gatt_if, p_tcb, true, true);
+      }
+
+      if (com::android::bluetooth::flags::gatt_reconnect_on_bt_on_fix()) {
+        if (p_reg->direct_connect_request.count(p_tcb->peer_bda) > 0) {
+          gatt_update_app_use_link_flag(p_reg->gatt_if, p_tcb, true, true);
+          log::info("Removing device {} from the direct connect list of gatt_if {}",
+                    p_tcb->peer_bda, p_reg->gatt_if);
+          p_reg->direct_connect_request.erase(p_tcb->peer_bda);
+        }
+      }
+
+      if (p_reg->app_cb.p_conn_cb) {
+        conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
+        (*p_reg->app_cb.p_conn_cb)(p_reg->gatt_if, p_tcb->peer_bda, conn_id, kGattConnected,
+                                   GATT_CONN_OK, p_tcb->transport);
+      }
     }
   }
 
diff --git a/system/stack/gatt/gatt_sr.cc b/system/stack/gatt/gatt_sr.cc
index 6506ec47fa..be1dab48b8 100644
--- a/system/stack/gatt/gatt_sr.cc
+++ b/system/stack/gatt/gatt_sr.cc
@@ -23,6 +23,7 @@
  ******************************************************************************/
 
 #include <bluetooth/log.h>
+#include <com_android_bluetooth_flags.h>
 #include <string.h>
 
 #include <algorithm>
@@ -865,12 +866,21 @@ static void gatts_process_mtu_req(tGATT_TCB& tcb, uint16_t cid, uint16_t len, ui
 
   tGATTS_DATA gatts_data;
   gatts_data.mtu = tcb.payload_size;
-  /* Notify all registered application with new MTU size. Us a transaction ID */
-  /* of 0, as no response is allowed from application */
-  for (int i = 0; i < GATT_MAX_APPS; i++) {
-    if (gatt_cb.cl_rcb[i].in_use) {
-      uint16_t conn_id = GATT_CREATE_CONN_ID(tcb.tcb_idx, gatt_cb.cl_rcb[i].gatt_if);
-      gatt_sr_send_req_callback(conn_id, 0, GATTS_REQ_TYPE_MTU, &gatts_data);
+  /* Notify all registered application with new MTU size. Use a transaction ID */
+  /* of 0, as no response is allowed from applications */
+  if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+    for (auto& [i, p_reg] : gatt_cb.cl_rcb_map) {
+      if (p_reg->in_use) {
+        uint16_t conn_id = GATT_CREATE_CONN_ID(tcb.tcb_idx, p_reg->gatt_if);
+        gatt_sr_send_req_callback(conn_id, 0, GATTS_REQ_TYPE_MTU, &gatts_data);
+      }
+    }
+  } else {
+    for (int i = 0; i < GATT_MAX_APPS; i++) {
+      if (gatt_cb.cl_rcb[i].in_use) {
+        uint16_t conn_id = GATT_CREATE_CONN_ID(tcb.tcb_idx, gatt_cb.cl_rcb[i].gatt_if);
+        gatt_sr_send_req_callback(conn_id, 0, GATTS_REQ_TYPE_MTU, &gatts_data);
+      }
     }
   }
 }
diff --git a/system/stack/gatt/gatt_utils.cc b/system/stack/gatt/gatt_utils.cc
index f974a6acfa..7ca93e3ed4 100644
--- a/system/stack/gatt/gatt_utils.cc
+++ b/system/stack/gatt/gatt_utils.cc
@@ -1034,14 +1034,22 @@ tGATT_REG* gatt_get_regcb(tGATT_IF gatt_if) {
   uint8_t ii = (uint8_t)gatt_if;
   tGATT_REG* p_reg = NULL;
 
-  if (ii < 1 || ii > GATT_MAX_APPS) {
-    log::warn("gatt_if out of range = {}", ii);
-    return NULL;
+  if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+    auto it = gatt_cb.cl_rcb_map.find(gatt_if);
+    if (it == gatt_cb.cl_rcb_map.end()) {
+      log::warn("unknown gatt_if = {}", ii);
+      return NULL;
+    }
+    p_reg = it->second.get();
+  } else {
+    // Index for cl_rcb is always 1 less than gatt_if.
+    if (ii < 1 || ii > GATT_MAX_APPS) {
+      log::warn("gatt_if out of range = {}", ii);
+      return NULL;
+    }
+    p_reg = &gatt_cb.cl_rcb[ii - 1];
   }
 
-  // Index for cl_rcb is always 1 less than gatt_if.
-  p_reg = &gatt_cb.cl_rcb[ii - 1];
-
   if (!p_reg->in_use) {
     log::warn("gatt_if found but not in use.");
     return NULL;
@@ -1749,20 +1757,39 @@ static void gatt_le_disconnect_complete_notify_user(const RawAddress& bda,
                                                     tBT_TRANSPORT transport) {
   tGATT_TCB* p_tcb = gatt_find_tcb_by_addr(bda, transport);
 
-  for (uint8_t i = 0; i < GATT_MAX_APPS; i++) {
-    tGATT_REG* p_reg = &gatt_cb.cl_rcb[i];
-    if (p_reg->in_use && p_reg->app_cb.p_conn_cb) {
-      uint16_t conn_id =
-              p_tcb ? GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if) : GATT_INVALID_CONN_ID;
-      (*p_reg->app_cb.p_conn_cb)(p_reg->gatt_if, bda, conn_id, kGattDisconnected, reason,
-                                 transport);
+  if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+    for (auto& [i, p_reg] : gatt_cb.cl_rcb_map) {
+      if (p_reg->in_use && p_reg->app_cb.p_conn_cb) {
+        uint16_t conn_id =
+                p_tcb ? GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if) : GATT_INVALID_CONN_ID;
+        (*p_reg->app_cb.p_conn_cb)(p_reg->gatt_if, bda, conn_id, kGattDisconnected, reason,
+                                   transport);
+      }
+
+      if (com::android::bluetooth::flags::gatt_reconnect_on_bt_on_fix()) {
+        if (p_reg->direct_connect_request.count(bda) > 0) {
+          log::info("Removing device {} from the direct connect list of gatt_if {}", bda,
+                    p_reg->gatt_if);
+          p_reg->direct_connect_request.erase(bda);
+        }
+      }
     }
+  } else {
+    for (uint8_t i = 0; i < GATT_MAX_APPS; i++) {
+      tGATT_REG* p_reg = &gatt_cb.cl_rcb[i];
+      if (p_reg->in_use && p_reg->app_cb.p_conn_cb) {
+        uint16_t conn_id =
+                p_tcb ? GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if) : GATT_INVALID_CONN_ID;
+        (*p_reg->app_cb.p_conn_cb)(p_reg->gatt_if, bda, conn_id, kGattDisconnected, reason,
+                                   transport);
+      }
 
-    if (com::android::bluetooth::flags::gatt_reconnect_on_bt_on_fix()) {
-      if (p_reg->direct_connect_request.count(bda) > 0) {
-        log::info("Removing device {} from the direct connect list of gatt_if {}", bda,
-                  p_reg->gatt_if);
-        p_reg->direct_connect_request.erase(bda);
+      if (com::android::bluetooth::flags::gatt_reconnect_on_bt_on_fix()) {
+        if (p_reg->direct_connect_request.count(bda) > 0) {
+          log::info("Removing device {} from the direct connect list of gatt_if {}", bda,
+                    p_reg->gatt_if);
+          p_reg->direct_connect_request.erase(bda);
+        }
       }
     }
   }