1 /******************************************************************************
2  *
3  *  Copyright 1999-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 #ifndef BTM_INT_TYPES_H
19 #define BTM_INT_TYPES_H
20 
21 #include <cstdint>
22 #include <memory>
23 #include <string>
24 
25 #include "gd/common/circular_buffer.h"
26 #include "osi/include/allocator.h"
27 #include "osi/include/fixed_queue.h"
28 #include "osi/include/list.h"
29 #include "stack/acl/acl.h"
30 #include "stack/btm/btm_ble_int_types.h"
31 #include "stack/btm/btm_sco.h"
32 #include "stack/btm/neighbor_inquiry.h"
33 #include "stack/btm/security_device_record.h"
34 #include "stack/include/btm_ble_api_types.h"
35 #include "stack/include/security_client_callbacks.h"
36 
37 #define BTM_MAX_SCN_ 31  // PORT_MAX_RFC_PORTS system/bt/stack/include/rfcdefs.h
38 
39 constexpr size_t kMaxLogSize = 255;
40 class TimestampedStringCircularBuffer
41     : public bluetooth::common::TimestampedCircularBuffer<std::string> {
42  public:
TimestampedStringCircularBuffer(size_t size)43   explicit TimestampedStringCircularBuffer(size_t size)
44       : bluetooth::common::TimestampedCircularBuffer<std::string>(size) {}
45 
Push(std::string s)46   void Push(std::string s) {
47     bluetooth::common::TimestampedCircularBuffer<std::string>::Push(
48         s.substr(0, kMaxLogSize));
49   }
50 
51   template <typename... Args>
Push(Args...args)52   void Push(Args... args) {
53     char buf[kMaxLogSize];
54     std::snprintf(buf, sizeof(buf), args...);
55     bluetooth::common::TimestampedCircularBuffer<std::string>::Push(
56         std::string(buf));
57   }
58 };
59 
60 /*
61  * Local device configuration
62  */
63 typedef struct {
64   tBTM_LOC_BD_NAME bd_name;  /* local Bluetooth device name */
65   bool pin_type;             /* true if PIN type is fixed */
66   uint8_t pin_code_len;      /* Bonding information */
67   PIN_CODE pin_code;         /* PIN CODE if pin type is fixed */
68 } tBTM_CFG;
69 
70 /* Pairing State */
71 enum {
72   BTM_PAIR_STATE_IDLE, /* Idle                                         */
73   BTM_PAIR_STATE_GET_REM_NAME, /* Getting the remote name (to check for SM4) */
74   BTM_PAIR_STATE_WAIT_PIN_REQ, /* Started authentication, waiting for PIN req
75                                   (PIN is pre-fetched) */
76   BTM_PAIR_STATE_WAIT_LOCAL_PIN,       /* Waiting for local PIN code */
77   BTM_PAIR_STATE_WAIT_NUMERIC_CONFIRM, /* Waiting user 'yes' to numeric
78                                           confirmation   */
79   BTM_PAIR_STATE_KEY_ENTRY, /* Key entry state (we are a keyboard)          */
80   BTM_PAIR_STATE_WAIT_LOCAL_OOB_RSP, /* Waiting for local response to peer OOB
81                                         data  */
82   BTM_PAIR_STATE_WAIT_LOCAL_IOCAPS, /* Waiting for local IO capabilities and OOB
83                                        data */
84   BTM_PAIR_STATE_INCOMING_SSP, /* Incoming SSP (got peer IO caps when idle) */
85   BTM_PAIR_STATE_WAIT_AUTH_COMPLETE, /* All done, waiting authentication
86                                         cpmplete    */
87   BTM_PAIR_STATE_WAIT_DISCONNECT     /* Waiting to disconnect the ACL */
88 };
89 typedef uint8_t tBTM_PAIRING_STATE;
90 
91 #define BTM_PAIR_FLAGS_WE_STARTED_DD \
92   0x01 /* We want to do dedicated bonding              */
93 #define BTM_PAIR_FLAGS_PEER_STARTED_DD \
94   0x02 /* Peer initiated dedicated bonding             */
95 #define BTM_PAIR_FLAGS_DISC_WHEN_DONE 0x04 /* Disconnect when done     */
96 #define BTM_PAIR_FLAGS_PIN_REQD \
97   0x08 /* set this bit when pin_callback is called     */
98 #define BTM_PAIR_FLAGS_PRE_FETCH_PIN \
99   0x10 /* set this bit when pre-fetch pin     */
100 #define BTM_PAIR_FLAGS_REJECTED_CONNECT \
101   0x20 /* set this bit when rejected incoming connection  */
102 #define BTM_PAIR_FLAGS_WE_CANCEL_DD \
103   0x40 /* set this bit when cancelling a bonding procedure */
104 #define BTM_PAIR_FLAGS_LE_ACTIVE \
105   0x80 /* use this bit when SMP pairing is active */
106 
107 typedef struct {
108   bool is_mux;
109   RawAddress bd_addr;
110   uint16_t psm;
111   bool is_orig;
112   tBTM_SEC_CALLBACK* p_callback;
113   void* p_ref_data;
114   uint16_t rfcomm_security_requirement;
115   tBT_TRANSPORT transport;
116   tBTM_BLE_SEC_ACT sec_act;
117 } tBTM_SEC_QUEUE_ENTRY;
118 
119 // Bluetooth Quality Report - Report receiver
120 typedef void(tBTM_BT_QUALITY_REPORT_RECEIVER)(uint8_t len, uint8_t* p_stream);
121 
122 /* Define a structure to hold all the BTM data
123 */
124 
125 #define BTM_STATE_BUFFER_SIZE 5 /* size of state buffer */
126 
127 /* Define the Device Management control structure
128  */
129 typedef struct tBTM_DEVCB {
130   tBTM_VS_EVT_CB* p_vend_spec_cb[BTM_MAX_VSE_CALLBACKS]; /* Register for vendor
131                                                             specific events  */
132 
133   tBTM_CMPL_CB*
134       p_stored_link_key_cmpl_cb; /* Read/Write/Delete stored link key    */
135 
136   alarm_t* read_local_name_timer; /* Read local name timer */
137   tBTM_CMPL_CB* p_rln_cmpl_cb;    /* Callback function to be called when  */
138                                   /* read local name function complete    */
139 
140   alarm_t* read_rssi_timer;     /* Read RSSI timer */
141   tBTM_CMPL_CB* p_rssi_cmpl_cb; /* Callback function to be called when  */
142                                 /* read RSSI function completes */
143 
144   alarm_t* read_failed_contact_counter_timer; /* Read Failed Contact Counter */
145                                               /* timer */
146   tBTM_CMPL_CB* p_failed_contact_counter_cmpl_cb; /* Callback function to be */
147   /* called when read Failed Contact Counter function completes */
148 
149   alarm_t*
150       read_automatic_flush_timeout_timer; /* Read Automatic Flush Timeout */
151                                           /* timer */
152   tBTM_CMPL_CB* p_automatic_flush_timeout_cmpl_cb; /* Callback function to be */
153   /* called when read Automatic Flush Timeout function completes */
154 
155   alarm_t* read_link_quality_timer;
156   tBTM_CMPL_CB* p_link_qual_cmpl_cb; /* Callback function to be called when  */
157                                      /* read link quality function completes */
158 
159   alarm_t* read_tx_power_timer;     /* Read tx power timer */
160   tBTM_CMPL_CB* p_tx_power_cmpl_cb; /* Callback function to be called       */
161 
162   DEV_CLASS dev_class; /* Local device class                   */
163 
164   tBTM_CMPL_CB*
165       p_le_test_cmd_cmpl_cb; /* Callback function to be called when
166                              LE test mode command has been sent successfully */
167 
168   RawAddress read_tx_pwr_addr; /* read TX power target address     */
169 
170   tBTM_BLE_LOCAL_ID_KEYS id_keys;   /* local BLE ID keys */
171   Octet16 ble_encryption_key_value; /* BLE encryption key */
172 
173 #if (BTM_BLE_CONFORMANCE_TESTING == TRUE)
174   bool no_disc_if_pair_fail;
175   bool enable_test_mac_val;
176   BT_OCTET8 test_mac;
177   bool enable_test_local_sign_cntr;
178   uint32_t test_local_sign_cntr;
179 #endif
180 
181   tBTM_IO_CAP loc_io_caps;    /* IO capability of the local device */
182   tBTM_AUTH_REQ loc_auth_req; /* the auth_req flag  */
183 
InittBTM_DEVCB184   void Init() {
185     read_local_name_timer = alarm_new("btm.read_local_name_timer");
186     read_rssi_timer = alarm_new("btm.read_rssi_timer");
187     read_failed_contact_counter_timer =
188         alarm_new("btm.read_failed_contact_counter_timer");
189     read_automatic_flush_timeout_timer =
190         alarm_new("btm.read_automatic_flush_timeout_timer");
191     read_link_quality_timer = alarm_new("btm.read_link_quality_timer");
192     read_tx_power_timer = alarm_new("btm.read_tx_power_timer");
193   }
194 
FreetBTM_DEVCB195   void Free() {
196     alarm_free(read_local_name_timer);
197     alarm_free(read_rssi_timer);
198     alarm_free(read_failed_contact_counter_timer);
199     alarm_free(read_automatic_flush_timeout_timer);
200     alarm_free(read_link_quality_timer);
201     alarm_free(read_tx_power_timer);
202   }
203 } tBTM_DEVCB;
204 
205 typedef struct tBTM_CB {
206   tBTM_CFG cfg; /* Device configuration */
207 
208   /*****************************************************
209   **      Device control
210   *****************************************************/
211   tBTM_DEVCB devcb;
212 
213   /*****************************************************
214   **      BLE Device controllers
215   *****************************************************/
216   tBTM_BLE_CB ble_ctr_cb;
217 
218  private:
219   friend void btm_ble_ltk_request_reply(const RawAddress& bda, bool use_stk,
220                                         const Octet16& stk);
221   friend tBTM_STATUS btm_ble_start_encrypt(const RawAddress& bda, bool use_stk,
222                                            Octet16* p_stk);
223   friend void btm_ble_ltk_request_reply(const RawAddress& bda, bool use_stk,
224                                         const Octet16& stk);
225   uint16_t enc_handle{0};
226 
227   friend void btm_ble_ltk_request(uint16_t handle, uint8_t rand[8],
228                                   uint16_t ediv);
229   BT_OCTET8 enc_rand; /* received rand value from LTK request*/
230 
231   uint16_t ediv{0}; /* received ediv value from LTK request */
232 
233   uint8_t key_size{0};
234 
235  public:
236   tBTM_BLE_VSC_CB cmn_ble_vsc_cb;
237 
238   /* Packet types supported by the local device */
239   uint16_t btm_sco_pkt_types_supported{0};
240 
241   /*****************************************************
242   **      Inquiry
243   *****************************************************/
244   tBTM_INQUIRY_VAR_ST btm_inq_vars;
245 
246   /*****************************************************
247   **      SCO Management
248   *****************************************************/
249   tSCO_CB sco_cb;
250 
251   /*****************************************************
252   **      Security Management
253   *****************************************************/
254   tBTM_APPL_INFO api;
255 
256 #define BTM_SEC_MAX_RMT_NAME_CALLBACKS 2
257   tBTM_RMT_NAME_CALLBACK* p_rmt_name_callback[BTM_SEC_MAX_RMT_NAME_CALLBACKS];
258 
259   tBTM_SEC_DEV_REC* p_collided_dev_rec{nullptr};
260   alarm_t* sec_collision_timer{nullptr};
261   uint64_t collision_start_time{0};
262   uint32_t dev_rec_count{0}; /* Counter used for device record timestamp */
263   uint8_t security_mode{0};
264   bool pairing_disabled{false};
265   bool security_mode_changed{false}; /* mode changed during bonding */
266   bool pin_type_changed{false};      /* pin type changed during bonding */
267   bool sec_req_pending{false};       /*   true if a request is pending */
268 
269   uint8_t pin_code_len{0};          /* for legacy devices */
270   PIN_CODE pin_code;                /* for legacy devices */
271   tBTM_PAIRING_STATE pairing_state{
272       BTM_PAIR_STATE_IDLE};         /* The current pairing state    */
273   uint8_t pairing_flags{0};         /* The current pairing flags    */
274   RawAddress pairing_bda;           /* The device currently pairing */
275   alarm_t* pairing_timer{nullptr};  /* Timer for pairing process    */
276   uint16_t disc_handle{0};          /* for legacy devices */
277   uint8_t disc_reason{0};           /* for legacy devices */
278   tBTM_SEC_SERV_REC sec_serv_rec[BTM_SEC_MAX_SERVICE_RECORDS];
279   list_t* sec_dev_rec{nullptr}; /* list of tBTM_SEC_DEV_REC */
280   tBTM_SEC_SERV_REC* p_out_serv{nullptr};
281   tBTM_MKEY_CALLBACK* mkey_cback{nullptr};
282 
283   RawAddress connecting_bda;
284   DEV_CLASS connecting_dc;
285   uint8_t trace_level;
286   bool is_paging{false};  /* true, if paging is in progess */
287   bool is_inquiry{false}; /* true, if inquiry is in progess */
288   fixed_queue_t* page_queue{nullptr};
289 
290   bool paging{false};
set_pagingtBTM_CB291   void set_paging() { paging = true; }
reset_pagingtBTM_CB292   void reset_paging() { paging = false; }
is_paging_activetBTM_CB293   bool is_paging_active() const {
294     return paging;
295   }  // TODO remove all this paging state
296 
297   fixed_queue_t* sec_pending_q{nullptr}; /* pending sequrity requests in
298                                             tBTM_SEC_QUEUE_ENTRY format */
299 
300   // BQR Receiver
301   tBTM_BT_QUALITY_REPORT_RECEIVER* p_bqr_report_receiver{nullptr};
302 
303 #define BTM_CODEC_TYPE_MAX_RECORDS 32
304   tBTM_BT_DYNAMIC_AUDIO_BUFFER_CB
305       dynamic_audio_buffer_cb[BTM_CODEC_TYPE_MAX_RECORDS];
306 
307   tACL_CB acl_cb_;
308 
309   std::shared_ptr<TimestampedStringCircularBuffer> history_{nullptr};
310 
InittBTM_CB311   void Init(uint8_t initial_security_mode) {
312     memset(&cfg, 0, sizeof(cfg));
313     memset(&devcb, 0, sizeof(devcb));
314     memset(&ble_ctr_cb, 0, sizeof(ble_ctr_cb));
315     memset(&enc_rand, 0, sizeof(enc_rand));
316     memset(&cmn_ble_vsc_cb, 0, sizeof(cmn_ble_vsc_cb));
317     memset(&btm_inq_vars, 0, sizeof(btm_inq_vars));
318     memset(&sco_cb, 0, sizeof(sco_cb));
319     memset(&api, 0, sizeof(api));
320     memset(p_rmt_name_callback, 0, sizeof(p_rmt_name_callback));
321     memset(&pin_code, 0, sizeof(pin_code));
322     memset(sec_serv_rec, 0, sizeof(sec_serv_rec));
323 
324     connecting_bda = RawAddress::kEmpty;
325     memset(&connecting_dc, 0, sizeof(connecting_dc));
326 
327     memset(&acl_cb_, 0, sizeof(acl_cb_));
328 
329     page_queue = fixed_queue_new(SIZE_MAX);
330     sec_pending_q = fixed_queue_new(SIZE_MAX);
331     sec_collision_timer = alarm_new("btm.sec_collision_timer");
332     pairing_timer = alarm_new("btm.pairing_timer");
333 
334 #if defined(BTM_INITIAL_TRACE_LEVEL)
335     trace_level = BTM_INITIAL_TRACE_LEVEL;
336 #else
337     trace_level = BT_TRACE_LEVEL_NONE; /* No traces */
338 #endif
339     security_mode = initial_security_mode;
340     pairing_bda = RawAddress::kAny;
341     sec_dev_rec = list_new(osi_free);
342 
343     /* Initialize BTM component structures */
344     btm_inq_vars.Init(); /* Inquiry Database and Structures */
345     acl_cb_ = {};
346     sco_cb.Init();       /* SCO Database and Structures (If included) */
347     devcb.Init();
348 
349     history_ = std::make_shared<TimestampedStringCircularBuffer>(40);
350     CHECK(history_ != nullptr);
351     history_->Push(std::string("Initialized btm history"));
352   }
353 
FreetBTM_CB354   void Free() {
355     history_.reset();
356 
357     devcb.Free();
358     btm_inq_vars.Free();
359 
360     fixed_queue_free(page_queue, nullptr);
361     page_queue = nullptr;
362 
363     fixed_queue_free(sec_pending_q, nullptr);
364     sec_pending_q = nullptr;
365 
366     list_free(sec_dev_rec);
367     sec_dev_rec = nullptr;
368 
369     alarm_free(sec_collision_timer);
370     sec_collision_timer = nullptr;
371 
372     alarm_free(pairing_timer);
373     pairing_timer = nullptr;
374   }
375 
376  private:
377   friend uint8_t BTM_AllocateSCN(void);
378   friend bool BTM_TryAllocateSCN(uint8_t scn);
379   friend bool BTM_FreeSCN(uint8_t scn);
380   uint8_t btm_scn[BTM_MAX_SCN_];
381 } tBTM_CB;
382 
383 /* security action for L2CAP COC channels */
384 #define BTM_SEC_OK 1
385 #define BTM_SEC_ENCRYPT 2         /* encrypt the link with current key */
386 #define BTM_SEC_ENCRYPT_NO_MITM 3 /* unauthenticated encryption or better */
387 #define BTM_SEC_ENCRYPT_MITM 4    /* authenticated encryption */
388 #define BTM_SEC_ENC_PENDING 5     /* wait for link encryption pending */
389 
390 typedef uint8_t tBTM_SEC_ACTION;
391 
392 #endif  // BTM_INT_TYPES_H
393