1 /******************************************************************************
2 *
3 * Copyright (C) 2009-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /*******************************************************************************
20 *
21 * Filename: btif_dm.c
22 *
23 * Description: Contains Device Management (DM) related functionality
24 *
25 *
26 ******************************************************************************/
27
28 #define LOG_TAG "bt_btif_dm"
29
30 #include "btif_dm.h"
31
32 #include <base/bind.h>
33 #include <base/logging.h>
34 #include <signal.h>
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38 #include <sys/types.h>
39 #include <time.h>
40 #include <unistd.h>
41
42 #include <mutex>
43
44 #include <hardware/bluetooth.h>
45
46 #include "advertise_data_parser.h"
47 #include "bdaddr.h"
48 #include "bt_common.h"
49 #include "bta_closure_api.h"
50 #include "bta_gatt_api.h"
51 #include "btif_api.h"
52 #include "btif_config.h"
53 #include "btif_dm.h"
54 #include "btif_hd.h"
55 #include "btif_hh.h"
56 #include "btif_sdp.h"
57 #include "btif_storage.h"
58 #include "btif_util.h"
59 #include "btu.h"
60 #include "device/include/controller.h"
61 #include "device/include/interop.h"
62 #include "include/stack_config.h"
63 #include "osi/include/allocator.h"
64 #include "osi/include/log.h"
65 #include "osi/include/metrics.h"
66 #include "osi/include/osi.h"
67 #include "osi/include/properties.h"
68 #include "stack/btm/btm_int.h"
69 #include "stack_config.h"
70
71 /******************************************************************************
72 * Constants & Macros
73 *****************************************************************************/
74
75 #define COD_MASK 0x07FF
76
77 #define COD_UNCLASSIFIED ((0x1F) << 8)
78 #define COD_HID_KEYBOARD 0x0540
79 #define COD_HID_POINTING 0x0580
80 #define COD_HID_COMBO 0x05C0
81 #define COD_HID_MAJOR 0x0500
82 #define COD_HID_MASK 0x0700
83 #define COD_AV_HEADSETS 0x0404
84 #define COD_AV_HANDSFREE 0x0408
85 #define COD_AV_HEADPHONES 0x0418
86 #define COD_AV_PORTABLE_AUDIO 0x041C
87 #define COD_AV_HIFI_AUDIO 0x0428
88
89 #define BTIF_DM_DEFAULT_INQ_MAX_RESULTS 0
90 #define BTIF_DM_DEFAULT_INQ_MAX_DURATION 10
91 #define BTIF_DM_MAX_SDP_ATTEMPTS_AFTER_PAIRING 2
92
93 #define NUM_TIMEOUT_RETRIES 5
94
95 #define PROPERTY_PRODUCT_MODEL "ro.product.model"
96 #define DEFAULT_LOCAL_NAME_MAX 31
97 #if (DEFAULT_LOCAL_NAME_MAX > BTM_MAX_LOC_BD_NAME_LEN)
98 #error "default btif local name size exceeds stack supported length"
99 #endif
100
101 #if (BTA_HOST_INTERLEAVE_SEARCH == TRUE)
102 #define BTIF_DM_INTERLEAVE_DURATION_BR_ONE 2
103 #define BTIF_DM_INTERLEAVE_DURATION_LE_ONE 2
104 #define BTIF_DM_INTERLEAVE_DURATION_BR_TWO 3
105 #define BTIF_DM_INTERLEAVE_DURATION_LE_TWO 4
106 #endif
107
108 #define ENCRYPTED_BREDR 2
109 #define ENCRYPTED_LE 4
110
111 typedef struct {
112 bt_bond_state_t state;
113 bt_bdaddr_t static_bdaddr;
114 BD_ADDR bd_addr;
115 tBTM_BOND_TYPE bond_type;
116 uint8_t pin_code_len;
117 uint8_t is_ssp;
118 uint8_t auth_req;
119 uint8_t io_cap;
120 uint8_t autopair_attempts;
121 uint8_t timeout_retries;
122 uint8_t is_local_initiated;
123 uint8_t sdp_attempts;
124 bool is_le_only;
125 bool is_le_nc; /* LE Numeric comparison */
126 btif_dm_ble_cb_t ble;
127 } btif_dm_pairing_cb_t;
128
129 typedef struct {
130 uint8_t ir[BT_OCTET16_LEN];
131 uint8_t irk[BT_OCTET16_LEN];
132 uint8_t dhk[BT_OCTET16_LEN];
133 } btif_dm_local_key_id_t;
134
135 typedef struct {
136 bool is_er_rcvd;
137 uint8_t er[BT_OCTET16_LEN];
138 bool is_id_keys_rcvd;
139 btif_dm_local_key_id_t id_keys; /* ID kyes */
140
141 } btif_dm_local_key_cb_t;
142
143 typedef struct {
144 BD_ADDR bd_addr;
145 BD_NAME bd_name;
146 } btif_dm_remote_name_t;
147
148 /* this structure holds optional OOB data for remote device */
149 typedef struct {
150 BD_ADDR bdaddr; /* peer bdaddr */
151 bt_out_of_band_data_t oob_data;
152 } btif_dm_oob_cb_t;
153
154 typedef struct {
155 bt_bdaddr_t bdaddr;
156 uint8_t transport; /* 0=Unknown, 1=BR/EDR, 2=LE */
157 } btif_dm_create_bond_cb_t;
158
159 typedef struct {
160 uint8_t status;
161 uint8_t ctrl_state;
162 uint64_t tx_time;
163 uint64_t rx_time;
164 uint64_t idle_time;
165 uint64_t energy_used;
166 } btif_activity_energy_info_cb_t;
167
168 typedef struct { unsigned int manufact_id; } skip_sdp_entry_t;
169
170 typedef enum {
171 BTIF_DM_FUNC_CREATE_BOND,
172 BTIF_DM_FUNC_CANCEL_BOND,
173 BTIF_DM_FUNC_REMOVE_BOND,
174 BTIF_DM_FUNC_BOND_STATE_CHANGED,
175 } bt_bond_function_t;
176
177 typedef struct {
178 bt_bdaddr_t bd_addr;
179 bt_bond_function_t function;
180 bt_bond_state_t state;
181 struct timespec timestamp;
182 } btif_bond_event_t;
183
184 #define BTA_SERVICE_ID_TO_SERVICE_MASK(id) (1 << (id))
185
186 #define UUID_HUMAN_INTERFACE_DEVICE "00001124-0000-1000-8000-00805f9b34fb"
187
188 #define MAX_BTIF_BOND_EVENT_ENTRIES 15
189
190 static skip_sdp_entry_t sdp_blacklist[] = {{76}}; // Apple Mouse and Keyboard
191
192 /* This flag will be true if HCI_Inquiry is in progress */
193 static bool btif_dm_inquiry_in_progress = false;
194
195 /*******************************************************************************
196 * Static variables
197 ******************************************************************************/
198 static char btif_default_local_name[DEFAULT_LOCAL_NAME_MAX + 1] = {'\0'};
199 static uid_set_t* uid_set = NULL;
200
201 /* A circular array to keep track of the most recent bond events */
202 static btif_bond_event_t btif_dm_bond_events[MAX_BTIF_BOND_EVENT_ENTRIES + 1];
203
204 static std::mutex bond_event_lock;
205
206 /* |btif_num_bond_events| keeps track of the total number of events and can be
207 greater than |MAX_BTIF_BOND_EVENT_ENTRIES| */
208 static size_t btif_num_bond_events = 0;
209 static size_t btif_events_start_index = 0;
210 static size_t btif_events_end_index = 0;
211
212 /******************************************************************************
213 * Static functions
214 *****************************************************************************/
215 static btif_dm_pairing_cb_t pairing_cb;
216 static btif_dm_oob_cb_t oob_cb;
217 static void btif_dm_generic_evt(uint16_t event, char* p_param);
218 static void btif_dm_cb_create_bond(bt_bdaddr_t* bd_addr,
219 tBTA_TRANSPORT transport);
220 static void btif_dm_cb_hid_remote_name(tBTM_REMOTE_DEV_NAME* p_remote_name);
221 static void btif_update_remote_properties(BD_ADDR bd_addr, BD_NAME bd_name,
222 DEV_CLASS dev_class,
223 tBT_DEVICE_TYPE dev_type);
224 static btif_dm_local_key_cb_t ble_local_key_cb;
225 static void btif_dm_ble_key_notif_evt(tBTA_DM_SP_KEY_NOTIF* p_ssp_key_notif);
226 static void btif_dm_ble_auth_cmpl_evt(tBTA_DM_AUTH_CMPL* p_auth_cmpl);
227 static void btif_dm_ble_passkey_req_evt(tBTA_DM_PIN_REQ* p_pin_req);
228 static void btif_dm_ble_key_nc_req_evt(tBTA_DM_SP_KEY_NOTIF* p_notif_req);
229 static void btif_dm_ble_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type);
230 static void btif_dm_ble_sc_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type);
231
232 static void bte_scan_filt_param_cfg_evt(uint8_t action_type, uint8_t avbl_space,
233 uint8_t ref_value, uint8_t status);
234
235 static char* btif_get_default_local_name();
236
237 static void btif_stats_add_bond_event(const bt_bdaddr_t* bd_addr,
238 bt_bond_function_t function,
239 bt_bond_state_t state);
240
241 /******************************************************************************
242 * Externs
243 *****************************************************************************/
244 extern bt_status_t btif_hf_execute_service(bool b_enable);
245 extern bt_status_t btif_av_execute_service(bool b_enable);
246 extern bt_status_t btif_av_sink_execute_service(bool b_enable);
247 extern bt_status_t btif_hh_execute_service(bool b_enable);
248 extern bt_status_t btif_hf_client_execute_service(bool b_enable);
249 extern bt_status_t btif_sdp_execute_service(bool b_enable);
250 extern int btif_hh_connect(bt_bdaddr_t* bd_addr);
251 extern void bta_gatt_convert_uuid16_to_uuid128(uint8_t uuid_128[LEN_UUID_128],
252 uint16_t uuid_16);
253 extern void btif_av_move_idle(bt_bdaddr_t bd_addr);
254 extern bt_status_t btif_hd_execute_service(bool b_enable);
255
256 /******************************************************************************
257 * Functions
258 *****************************************************************************/
259
is_empty_128bit(uint8_t * data)260 static bool is_empty_128bit(uint8_t* data) {
261 static const uint8_t zero[16] = {0};
262 return !memcmp(zero, data, sizeof(zero));
263 }
264
btif_dm_data_copy(uint16_t event,char * dst,char * src)265 static void btif_dm_data_copy(uint16_t event, char* dst, char* src) {
266 tBTA_DM_SEC* dst_dm_sec = (tBTA_DM_SEC*)dst;
267 tBTA_DM_SEC* src_dm_sec = (tBTA_DM_SEC*)src;
268
269 if (!src_dm_sec) return;
270
271 CHECK(dst_dm_sec);
272 maybe_non_aligned_memcpy(dst_dm_sec, src_dm_sec, sizeof(*src_dm_sec));
273
274 if (event == BTA_DM_BLE_KEY_EVT) {
275 dst_dm_sec->ble_key.p_key_value =
276 (tBTM_LE_KEY_VALUE*)osi_malloc(sizeof(tBTM_LE_KEY_VALUE));
277 CHECK(src_dm_sec->ble_key.p_key_value);
278 memcpy(dst_dm_sec->ble_key.p_key_value, src_dm_sec->ble_key.p_key_value,
279 sizeof(tBTM_LE_KEY_VALUE));
280 }
281 }
282
btif_dm_data_free(uint16_t event,tBTA_DM_SEC * dm_sec)283 static void btif_dm_data_free(uint16_t event, tBTA_DM_SEC* dm_sec) {
284 if (event == BTA_DM_BLE_KEY_EVT)
285 osi_free_and_reset((void**)&dm_sec->ble_key.p_key_value);
286 }
287
btif_dm_init(uid_set_t * set)288 void btif_dm_init(uid_set_t* set) { uid_set = set; }
289
btif_dm_cleanup(void)290 void btif_dm_cleanup(void) {
291 if (uid_set) {
292 uid_set_destroy(uid_set);
293 uid_set = NULL;
294 }
295 }
296
btif_in_execute_service_request(tBTA_SERVICE_ID service_id,bool b_enable)297 bt_status_t btif_in_execute_service_request(tBTA_SERVICE_ID service_id,
298 bool b_enable) {
299 BTIF_TRACE_DEBUG("%s service_id: %d", __func__, service_id);
300 /* Check the service_ID and invoke the profile's BT state changed API */
301 switch (service_id) {
302 case BTA_HFP_SERVICE_ID:
303 case BTA_HSP_SERVICE_ID: {
304 btif_hf_execute_service(b_enable);
305 } break;
306 case BTA_A2DP_SOURCE_SERVICE_ID: {
307 btif_av_execute_service(b_enable);
308 } break;
309 case BTA_A2DP_SINK_SERVICE_ID: {
310 btif_av_sink_execute_service(b_enable);
311 } break;
312 case BTA_HID_SERVICE_ID: {
313 btif_hh_execute_service(b_enable);
314 } break;
315 case BTA_HFP_HS_SERVICE_ID: {
316 btif_hf_client_execute_service(b_enable);
317 } break;
318 case BTA_SDP_SERVICE_ID: {
319 btif_sdp_execute_service(b_enable);
320 } break;
321 case BTA_HIDD_SERVICE_ID: {
322 btif_hd_execute_service(b_enable);
323 } break;
324 default:
325 BTIF_TRACE_ERROR("%s: Unknown service %d being %s", __func__, service_id,
326 (b_enable) ? "enabled" : "disabled");
327 return BT_STATUS_FAIL;
328 }
329 return BT_STATUS_SUCCESS;
330 }
331
332 /*******************************************************************************
333 *
334 * Function check_eir_remote_name
335 *
336 * Description Check if remote name is in the EIR data
337 *
338 * Returns true if remote name found
339 * Populate p_remote_name, if provided and remote name found
340 *
341 ******************************************************************************/
check_eir_remote_name(tBTA_DM_SEARCH * p_search_data,uint8_t * p_remote_name,uint8_t * p_remote_name_len)342 static bool check_eir_remote_name(tBTA_DM_SEARCH* p_search_data,
343 uint8_t* p_remote_name,
344 uint8_t* p_remote_name_len) {
345 const uint8_t* p_eir_remote_name = NULL;
346 uint8_t remote_name_len = 0;
347
348 /* Check EIR for remote name and services */
349 if (p_search_data->inq_res.p_eir) {
350 p_eir_remote_name = AdvertiseDataParser::GetFieldByType(
351 p_search_data->inq_res.p_eir, p_search_data->inq_res.eir_len,
352 BTM_EIR_COMPLETE_LOCAL_NAME_TYPE, &remote_name_len);
353 if (!p_eir_remote_name) {
354 p_eir_remote_name = AdvertiseDataParser::GetFieldByType(
355 p_search_data->inq_res.p_eir, p_search_data->inq_res.eir_len,
356 BTM_EIR_SHORTENED_LOCAL_NAME_TYPE, &remote_name_len);
357 }
358
359 if (p_eir_remote_name) {
360 if (remote_name_len > BD_NAME_LEN) remote_name_len = BD_NAME_LEN;
361
362 if (p_remote_name && p_remote_name_len) {
363 memcpy(p_remote_name, p_eir_remote_name, remote_name_len);
364 *(p_remote_name + remote_name_len) = 0;
365 *p_remote_name_len = remote_name_len;
366 }
367
368 return true;
369 }
370 }
371
372 return false;
373 }
374
375 /*******************************************************************************
376 *
377 * Function check_cached_remote_name
378 *
379 * Description Check if remote name is in the NVRAM cache
380 *
381 * Returns true if remote name found
382 * Populate p_remote_name, if provided and remote name found
383 *
384 ******************************************************************************/
check_cached_remote_name(tBTA_DM_SEARCH * p_search_data,uint8_t * p_remote_name,uint8_t * p_remote_name_len)385 static bool check_cached_remote_name(tBTA_DM_SEARCH* p_search_data,
386 uint8_t* p_remote_name,
387 uint8_t* p_remote_name_len) {
388 bt_bdname_t bdname;
389 bt_bdaddr_t remote_bdaddr;
390 bt_property_t prop_name;
391
392 /* check if we already have it in our btif_storage cache */
393 bdcpy(remote_bdaddr.address, p_search_data->inq_res.bd_addr);
394 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_BDNAME,
395 sizeof(bt_bdname_t), &bdname);
396 if (btif_storage_get_remote_device_property(&remote_bdaddr, &prop_name) ==
397 BT_STATUS_SUCCESS) {
398 if (p_remote_name && p_remote_name_len) {
399 strcpy((char*)p_remote_name, (char*)bdname.name);
400 *p_remote_name_len = strlen((char*)p_remote_name);
401 }
402 return true;
403 }
404
405 return false;
406 }
407
get_cod(const bt_bdaddr_t * remote_bdaddr)408 static uint32_t get_cod(const bt_bdaddr_t* remote_bdaddr) {
409 uint32_t remote_cod;
410 bt_property_t prop_name;
411
412 /* check if we already have it in our btif_storage cache */
413 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_CLASS_OF_DEVICE,
414 sizeof(uint32_t), &remote_cod);
415 if (btif_storage_get_remote_device_property(
416 (bt_bdaddr_t*)remote_bdaddr, &prop_name) == BT_STATUS_SUCCESS) {
417 LOG_INFO(LOG_TAG, "%s remote_cod = 0x%08x", __func__, remote_cod);
418 return remote_cod & COD_MASK;
419 }
420
421 return 0;
422 }
423
check_cod(const bt_bdaddr_t * remote_bdaddr,uint32_t cod)424 bool check_cod(const bt_bdaddr_t* remote_bdaddr, uint32_t cod) {
425 return get_cod(remote_bdaddr) == cod;
426 }
427
check_cod_hid(const bt_bdaddr_t * remote_bdaddr)428 bool check_cod_hid(const bt_bdaddr_t* remote_bdaddr) {
429 return (get_cod(remote_bdaddr) & COD_HID_MASK) == COD_HID_MAJOR;
430 }
431
check_hid_le(const bt_bdaddr_t * remote_bdaddr)432 bool check_hid_le(const bt_bdaddr_t* remote_bdaddr) {
433 uint32_t remote_dev_type;
434 bt_property_t prop_name;
435
436 /* check if we already have it in our btif_storage cache */
437 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_TYPE_OF_DEVICE,
438 sizeof(uint32_t), &remote_dev_type);
439 if (btif_storage_get_remote_device_property(
440 (bt_bdaddr_t*)remote_bdaddr, &prop_name) == BT_STATUS_SUCCESS) {
441 if (remote_dev_type == BT_DEVICE_DEVTYPE_BLE) {
442 bdstr_t bdstr;
443 bdaddr_to_string(remote_bdaddr, bdstr, sizeof(bdstr));
444 if (btif_config_exist(bdstr, "HidAppId")) return true;
445 }
446 }
447 return false;
448 }
449
450 /*****************************************************************************
451 *
452 * Function check_sdp_bl
453 *
454 * Description Checks if a given device is blacklisted to skip sdp
455 *
456 * Parameters skip_sdp_entry
457 *
458 * Returns true if the device is present in blacklist, else false
459 *
460 ******************************************************************************/
check_sdp_bl(const bt_bdaddr_t * remote_bdaddr)461 bool check_sdp_bl(const bt_bdaddr_t* remote_bdaddr) {
462 uint16_t manufacturer = 0;
463 uint8_t lmp_ver = 0;
464 uint16_t lmp_subver = 0;
465 bt_property_t prop_name;
466 bt_remote_version_t info;
467
468 if (remote_bdaddr == NULL) return false;
469
470 /* fetch additional info about remote device used in iop query */
471 BTM_ReadRemoteVersion(*(BD_ADDR*)remote_bdaddr, &lmp_ver, &manufacturer,
472 &lmp_subver);
473
474 /* if not available yet, try fetching from config database */
475 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_REMOTE_VERSION_INFO,
476 sizeof(bt_remote_version_t), &info);
477
478 if (btif_storage_get_remote_device_property(
479 (bt_bdaddr_t*)remote_bdaddr, &prop_name) != BT_STATUS_SUCCESS) {
480 return false;
481 }
482 manufacturer = info.manufacturer;
483
484 for (unsigned int i = 0; i < ARRAY_SIZE(sdp_blacklist); i++) {
485 if (manufacturer == sdp_blacklist[i].manufact_id) return true;
486 }
487 return false;
488 }
489
bond_state_changed(bt_status_t status,bt_bdaddr_t * bd_addr,bt_bond_state_t state)490 static void bond_state_changed(bt_status_t status, bt_bdaddr_t* bd_addr,
491 bt_bond_state_t state) {
492 btif_stats_add_bond_event(bd_addr, BTIF_DM_FUNC_BOND_STATE_CHANGED, state);
493
494 // Send bonding state only once - based on outgoing/incoming we may receive
495 // duplicates
496 if ((pairing_cb.state == state) && (state == BT_BOND_STATE_BONDING)) {
497 // Cross key pairing so send callback for static address
498 if (!bdaddr_is_empty(&pairing_cb.static_bdaddr)) {
499 HAL_CBACK(bt_hal_cbacks, bond_state_changed_cb, status, bd_addr, state);
500 }
501 return;
502 }
503
504 if (pairing_cb.bond_type == BOND_TYPE_TEMPORARY) state = BT_BOND_STATE_NONE;
505
506 BTIF_TRACE_DEBUG("%s: state=%d, prev_state=%d, sdp_attempts = %d", __func__,
507 state, pairing_cb.state, pairing_cb.sdp_attempts);
508
509 HAL_CBACK(bt_hal_cbacks, bond_state_changed_cb, status, bd_addr, state);
510
511 if (state == BT_BOND_STATE_BONDING) {
512 pairing_cb.state = state;
513 bdcpy(pairing_cb.bd_addr, bd_addr->address);
514 } else {
515 if (!pairing_cb.sdp_attempts)
516 memset(&pairing_cb, 0, sizeof(pairing_cb));
517 else
518 BTIF_TRACE_DEBUG("%s: BR-EDR service discovery active", __func__);
519 }
520 }
521
522 /* store remote version in bt config to always have access
523 to it post pairing*/
btif_update_remote_version_property(bt_bdaddr_t * p_bd)524 static void btif_update_remote_version_property(bt_bdaddr_t* p_bd) {
525 bt_property_t property;
526 uint8_t lmp_ver = 0;
527 uint16_t lmp_subver = 0;
528 uint16_t mfct_set = 0;
529 tBTM_STATUS btm_status;
530 bt_remote_version_t info;
531 bt_status_t status;
532 bdstr_t bdstr;
533
534 btm_status =
535 BTM_ReadRemoteVersion(*(BD_ADDR*)p_bd, &lmp_ver, &mfct_set, &lmp_subver);
536
537 LOG_DEBUG(LOG_TAG, "remote version info [%s]: %x, %x, %x",
538 bdaddr_to_string(p_bd, bdstr, sizeof(bdstr)), lmp_ver, mfct_set,
539 lmp_subver);
540
541 if (btm_status == BTM_SUCCESS) {
542 // Always update cache to ensure we have availability whenever BTM API is
543 // not populated
544 info.manufacturer = mfct_set;
545 info.sub_ver = lmp_subver;
546 info.version = lmp_ver;
547 BTIF_STORAGE_FILL_PROPERTY(&property, BT_PROPERTY_REMOTE_VERSION_INFO,
548 sizeof(bt_remote_version_t), &info);
549 status = btif_storage_set_remote_device_property(p_bd, &property);
550 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote version",
551 status);
552 }
553 }
554
btif_update_remote_properties(BD_ADDR bd_addr,BD_NAME bd_name,DEV_CLASS dev_class,tBT_DEVICE_TYPE device_type)555 static void btif_update_remote_properties(BD_ADDR bd_addr, BD_NAME bd_name,
556 DEV_CLASS dev_class,
557 tBT_DEVICE_TYPE device_type) {
558 int num_properties = 0;
559 bt_property_t properties[3];
560 bt_bdaddr_t bdaddr;
561 bt_status_t status;
562 uint32_t cod;
563 bt_device_type_t dev_type;
564
565 memset(properties, 0, sizeof(properties));
566 bdcpy(bdaddr.address, bd_addr);
567
568 /* remote name */
569 if (strlen((const char*)bd_name)) {
570 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties], BT_PROPERTY_BDNAME,
571 strlen((char*)bd_name), bd_name);
572 status = btif_storage_set_remote_device_property(
573 &bdaddr, &properties[num_properties]);
574 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device name",
575 status);
576 num_properties++;
577 }
578
579 /* class of device */
580 cod = devclass2uint(dev_class);
581 BTIF_TRACE_DEBUG("%s cod is 0x%06x", __func__, cod);
582 if (cod == 0) {
583 /* Try to retrieve cod from storage */
584 BTIF_TRACE_DEBUG("%s cod is 0, checking cod from storage", __func__);
585 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
586 BT_PROPERTY_CLASS_OF_DEVICE, sizeof(cod), &cod);
587 status = btif_storage_get_remote_device_property(
588 &bdaddr, &properties[num_properties]);
589 BTIF_TRACE_DEBUG("%s cod retrieved from storage is 0x%06x", __func__, cod);
590 if (cod == 0) {
591 BTIF_TRACE_DEBUG("%s cod is again 0, set as unclassified", __func__);
592 cod = COD_UNCLASSIFIED;
593 }
594 }
595
596 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
597 BT_PROPERTY_CLASS_OF_DEVICE, sizeof(cod), &cod);
598 status = btif_storage_set_remote_device_property(&bdaddr,
599 &properties[num_properties]);
600 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device class",
601 status);
602 num_properties++;
603
604 /* device type */
605 bt_property_t prop_name;
606 uint8_t remote_dev_type;
607 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_TYPE_OF_DEVICE,
608 sizeof(uint8_t), &remote_dev_type);
609 if (btif_storage_get_remote_device_property(&bdaddr, &prop_name) ==
610 BT_STATUS_SUCCESS)
611 dev_type = (bt_device_type_t)(remote_dev_type | device_type);
612 else
613 dev_type = (bt_device_type_t)device_type;
614
615 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
616 BT_PROPERTY_TYPE_OF_DEVICE, sizeof(dev_type),
617 &dev_type);
618 status = btif_storage_set_remote_device_property(&bdaddr,
619 &properties[num_properties]);
620 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device type",
621 status);
622 num_properties++;
623
624 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, status, &bdaddr,
625 num_properties, properties);
626 }
627
628 /*******************************************************************************
629 *
630 * Function btif_dm_cb_hid_remote_name
631 *
632 * Description Remote name callback for HID device. Called in btif context
633 * Special handling for HID devices
634 *
635 * Returns void
636 *
637 ******************************************************************************/
btif_dm_cb_hid_remote_name(tBTM_REMOTE_DEV_NAME * p_remote_name)638 static void btif_dm_cb_hid_remote_name(tBTM_REMOTE_DEV_NAME* p_remote_name) {
639 BTIF_TRACE_DEBUG("%s: status=%d pairing_cb.state=%d", __func__,
640 p_remote_name->status, pairing_cb.state);
641 if (pairing_cb.state == BT_BOND_STATE_BONDING) {
642 bt_bdaddr_t remote_bd;
643
644 bdcpy(remote_bd.address, pairing_cb.bd_addr);
645
646 if (p_remote_name->status == BTM_SUCCESS) {
647 bond_state_changed(BT_STATUS_SUCCESS, &remote_bd, BT_BOND_STATE_BONDED);
648 } else
649 bond_state_changed(BT_STATUS_FAIL, &remote_bd, BT_BOND_STATE_NONE);
650 }
651 }
652
653 /*******************************************************************************
654 *
655 * Function btif_dm_cb_create_bond
656 *
657 * Description Create bond initiated from the BTIF thread context
658 * Special handling for HID devices
659 *
660 * Returns void
661 *
662 ******************************************************************************/
btif_dm_cb_create_bond(bt_bdaddr_t * bd_addr,tBTA_TRANSPORT transport)663 static void btif_dm_cb_create_bond(bt_bdaddr_t* bd_addr,
664 tBTA_TRANSPORT transport) {
665 bool is_hid = check_cod(bd_addr, COD_HID_POINTING);
666 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
667
668 int device_type;
669 int addr_type;
670 bdstr_t bdstr;
671 bdaddr_to_string(bd_addr, bdstr, sizeof(bdstr));
672 if (transport == BT_TRANSPORT_LE) {
673 if (!btif_config_get_int((char const*)&bdstr, "DevType", &device_type)) {
674 btif_config_set_int(bdstr, "DevType", BT_DEVICE_TYPE_BLE);
675 }
676 if (btif_storage_get_remote_addr_type(bd_addr, &addr_type) !=
677 BT_STATUS_SUCCESS) {
678 // Try to read address type. OOB pairing might have set it earlier, but
679 // didn't store it, it defaults to BLE_ADDR_PUBLIC
680 uint8_t tmp_dev_type;
681 uint8_t tmp_addr_type;
682 BTM_ReadDevInfo(bd_addr->address, &tmp_dev_type, &tmp_addr_type);
683 addr_type = tmp_addr_type;
684
685 btif_storage_set_remote_addr_type(bd_addr, addr_type);
686 }
687 }
688 if ((btif_config_get_int((char const*)&bdstr, "DevType", &device_type) &&
689 (btif_storage_get_remote_addr_type(bd_addr, &addr_type) ==
690 BT_STATUS_SUCCESS) &&
691 (device_type & BT_DEVICE_TYPE_BLE) == BT_DEVICE_TYPE_BLE) ||
692 (transport == BT_TRANSPORT_LE)) {
693 BTA_DmAddBleDevice(bd_addr->address, addr_type, device_type);
694 }
695
696 if (is_hid && (device_type & BT_DEVICE_TYPE_BLE) == 0) {
697 bt_status_t status;
698 status = (bt_status_t)btif_hh_connect(bd_addr);
699 if (status != BT_STATUS_SUCCESS)
700 bond_state_changed(status, bd_addr, BT_BOND_STATE_NONE);
701 } else {
702 BTA_DmBondByTransport((uint8_t*)bd_addr->address, transport);
703 }
704 /* Track originator of bond creation */
705 pairing_cb.is_local_initiated = true;
706 }
707
708 /*******************************************************************************
709 *
710 * Function btif_dm_cb_remove_bond
711 *
712 * Description remove bond initiated from the BTIF thread context
713 * Special handling for HID devices
714 *
715 * Returns void
716 *
717 ******************************************************************************/
btif_dm_cb_remove_bond(bt_bdaddr_t * bd_addr)718 void btif_dm_cb_remove_bond(bt_bdaddr_t* bd_addr) {
719 /*special handling for HID devices */
720 /* VUP needs to be sent if its a HID Device. The HID HOST module will check if
721 there
722 is a valid hid connection with this bd_addr. If yes VUP will be issued.*/
723 #if (BTA_HH_INCLUDED == TRUE)
724 if (btif_hh_virtual_unplug(bd_addr) != BT_STATUS_SUCCESS)
725 #endif
726 {
727 BTIF_TRACE_DEBUG("%s: Removing HH device", __func__);
728 BTA_DmRemoveDevice((uint8_t*)bd_addr->address);
729 }
730 }
731
732 /*******************************************************************************
733 *
734 * Function btif_dm_get_connection_state
735 *
736 * Description Returns whether the remote device is currently connected
737 * and whether encryption is active for the connection
738 *
739 * Returns 0 if not connected; 1 if connected and > 1 if connection is
740 * encrypted
741 *
742 ******************************************************************************/
btif_dm_get_connection_state(const bt_bdaddr_t * bd_addr)743 uint16_t btif_dm_get_connection_state(const bt_bdaddr_t* bd_addr) {
744 uint8_t* bda = (uint8_t*)bd_addr->address;
745 uint16_t rc = BTA_DmGetConnectionState(bda);
746
747 if (rc != 0) {
748 uint8_t flags = 0;
749
750 BTM_GetSecurityFlagsByTransport(bda, &flags, BT_TRANSPORT_BR_EDR);
751 BTIF_TRACE_DEBUG("%s: security flags (BR/EDR)=0x%02x", __func__, flags);
752 if (flags & BTM_SEC_FLAG_ENCRYPTED) rc |= ENCRYPTED_BREDR;
753
754 BTM_GetSecurityFlagsByTransport(bda, &flags, BT_TRANSPORT_LE);
755 BTIF_TRACE_DEBUG("%s: security flags (LE)=0x%02x", __func__, flags);
756 if (flags & BTM_SEC_FLAG_ENCRYPTED) rc |= ENCRYPTED_LE;
757 }
758
759 return rc;
760 }
761
762 /*******************************************************************************
763 *
764 * Function search_devices_copy_cb
765 *
766 * Description Deep copy callback for search devices event
767 *
768 * Returns void
769 *
770 ******************************************************************************/
search_devices_copy_cb(uint16_t event,char * p_dest,char * p_src)771 static void search_devices_copy_cb(uint16_t event, char* p_dest, char* p_src) {
772 tBTA_DM_SEARCH* p_dest_data = (tBTA_DM_SEARCH*)p_dest;
773 tBTA_DM_SEARCH* p_src_data = (tBTA_DM_SEARCH*)p_src;
774
775 if (!p_src) return;
776
777 BTIF_TRACE_DEBUG("%s: event=%s", __func__, dump_dm_search_event(event));
778 maybe_non_aligned_memcpy(p_dest_data, p_src_data, sizeof(*p_src_data));
779 switch (event) {
780 case BTA_DM_INQ_RES_EVT: {
781 if (p_src_data->inq_res.p_eir) {
782 p_dest_data->inq_res.p_eir =
783 (uint8_t*)(p_dest + sizeof(tBTA_DM_SEARCH));
784 memcpy(p_dest_data->inq_res.p_eir, p_src_data->inq_res.p_eir,
785 p_src_data->inq_res.eir_len);
786 p_dest_data->inq_res.eir_len = p_src_data->inq_res.eir_len;
787 }
788 } break;
789
790 case BTA_DM_DISC_RES_EVT: {
791 if (p_src_data->disc_res.raw_data_size &&
792 p_src_data->disc_res.p_raw_data) {
793 p_dest_data->disc_res.p_raw_data =
794 (uint8_t*)(p_dest + sizeof(tBTA_DM_SEARCH));
795 memcpy(p_dest_data->disc_res.p_raw_data,
796 p_src_data->disc_res.p_raw_data,
797 p_src_data->disc_res.raw_data_size);
798 }
799 } break;
800 }
801 }
802
search_services_copy_cb(uint16_t event,char * p_dest,char * p_src)803 static void search_services_copy_cb(uint16_t event, char* p_dest, char* p_src) {
804 tBTA_DM_SEARCH* p_dest_data = (tBTA_DM_SEARCH*)p_dest;
805 tBTA_DM_SEARCH* p_src_data = (tBTA_DM_SEARCH*)p_src;
806
807 if (!p_src) return;
808 maybe_non_aligned_memcpy(p_dest_data, p_src_data, sizeof(*p_src_data));
809 switch (event) {
810 case BTA_DM_DISC_RES_EVT: {
811 if (p_src_data->disc_res.result == BTA_SUCCESS) {
812 if (p_src_data->disc_res.num_uuids > 0) {
813 p_dest_data->disc_res.p_uuid_list =
814 (uint8_t*)(p_dest + sizeof(tBTA_DM_SEARCH));
815 memcpy(p_dest_data->disc_res.p_uuid_list,
816 p_src_data->disc_res.p_uuid_list,
817 p_src_data->disc_res.num_uuids * MAX_UUID_SIZE);
818 osi_free_and_reset((void**)&p_src_data->disc_res.p_uuid_list);
819 }
820 osi_free_and_reset((void**)&p_src_data->disc_res.p_raw_data);
821 }
822 } break;
823 }
824 }
825 /******************************************************************************
826 *
827 * BTIF DM callback events
828 *
829 ****************************************************************************/
830
831 /*******************************************************************************
832 *
833 * Function btif_dm_pin_req_evt
834 *
835 * Description Executes pin request event in btif context
836 *
837 * Returns void
838 *
839 ******************************************************************************/
btif_dm_pin_req_evt(tBTA_DM_PIN_REQ * p_pin_req)840 static void btif_dm_pin_req_evt(tBTA_DM_PIN_REQ* p_pin_req) {
841 bt_bdaddr_t bd_addr;
842 bt_bdname_t bd_name;
843 uint32_t cod;
844 bt_pin_code_t pin_code;
845 int dev_type;
846
847 /* Remote properties update */
848 if (!btif_get_device_type(p_pin_req->bd_addr, &dev_type)) {
849 dev_type = BT_DEVICE_TYPE_BREDR;
850 }
851 btif_update_remote_properties(p_pin_req->bd_addr, p_pin_req->bd_name,
852 p_pin_req->dev_class,
853 (tBT_DEVICE_TYPE)dev_type);
854
855 bdcpy(bd_addr.address, p_pin_req->bd_addr);
856 memcpy(bd_name.name, p_pin_req->bd_name, BD_NAME_LEN);
857
858 bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
859
860 cod = devclass2uint(p_pin_req->dev_class);
861
862 if (cod == 0) {
863 BTIF_TRACE_DEBUG("%s cod is 0, set as unclassified", __func__);
864 cod = COD_UNCLASSIFIED;
865 }
866
867 /* check for auto pair possiblity only if bond was initiated by local device
868 */
869 if (pairing_cb.is_local_initiated && (p_pin_req->min_16_digit == false)) {
870 if (check_cod(&bd_addr, COD_AV_HEADSETS) ||
871 check_cod(&bd_addr, COD_AV_HEADPHONES) ||
872 check_cod(&bd_addr, COD_AV_PORTABLE_AUDIO) ||
873 check_cod(&bd_addr, COD_AV_HIFI_AUDIO) ||
874 check_cod(&bd_addr, COD_HID_POINTING)) {
875 /* Check if this device can be auto paired */
876 if (!interop_match_addr(INTEROP_DISABLE_AUTO_PAIRING, &bd_addr) &&
877 !interop_match_name(INTEROP_DISABLE_AUTO_PAIRING,
878 (const char*)bd_name.name) &&
879 (pairing_cb.autopair_attempts == 0)) {
880 BTIF_TRACE_DEBUG("%s() Attempting auto pair", __func__);
881 pin_code.pin[0] = 0x30;
882 pin_code.pin[1] = 0x30;
883 pin_code.pin[2] = 0x30;
884 pin_code.pin[3] = 0x30;
885
886 pairing_cb.autopair_attempts++;
887 BTA_DmPinReply((uint8_t*)bd_addr.address, true, 4, pin_code.pin);
888 return;
889 }
890 } else if (check_cod(&bd_addr, COD_HID_KEYBOARD) ||
891 check_cod(&bd_addr, COD_HID_COMBO)) {
892 if ((interop_match_addr(INTEROP_KEYBOARD_REQUIRES_FIXED_PIN, &bd_addr) ==
893 true) &&
894 (pairing_cb.autopair_attempts == 0)) {
895 BTIF_TRACE_DEBUG("%s() Attempting auto pair", __func__);
896 pin_code.pin[0] = 0x30;
897 pin_code.pin[1] = 0x30;
898 pin_code.pin[2] = 0x30;
899 pin_code.pin[3] = 0x30;
900
901 pairing_cb.autopair_attempts++;
902 BTA_DmPinReply((uint8_t*)bd_addr.address, true, 4, pin_code.pin);
903 return;
904 }
905 }
906 }
907 HAL_CBACK(bt_hal_cbacks, pin_request_cb, &bd_addr, &bd_name, cod,
908 p_pin_req->min_16_digit);
909 }
910
911 /*******************************************************************************
912 *
913 * Function btif_dm_ssp_cfm_req_evt
914 *
915 * Description Executes SSP confirm request event in btif context
916 *
917 * Returns void
918 *
919 ******************************************************************************/
btif_dm_ssp_cfm_req_evt(tBTA_DM_SP_CFM_REQ * p_ssp_cfm_req)920 static void btif_dm_ssp_cfm_req_evt(tBTA_DM_SP_CFM_REQ* p_ssp_cfm_req) {
921 bt_bdaddr_t bd_addr;
922 bt_bdname_t bd_name;
923 uint32_t cod;
924 bool is_incoming = !(pairing_cb.state == BT_BOND_STATE_BONDING);
925 int dev_type;
926
927 BTIF_TRACE_DEBUG("%s", __func__);
928
929 /* Remote properties update */
930 if (!btif_get_device_type(p_ssp_cfm_req->bd_addr, &dev_type)) {
931 dev_type = BT_DEVICE_TYPE_BREDR;
932 }
933 btif_update_remote_properties(p_ssp_cfm_req->bd_addr, p_ssp_cfm_req->bd_name,
934 p_ssp_cfm_req->dev_class,
935 (tBT_DEVICE_TYPE)dev_type);
936
937 bdcpy(bd_addr.address, p_ssp_cfm_req->bd_addr);
938 memcpy(bd_name.name, p_ssp_cfm_req->bd_name, BD_NAME_LEN);
939
940 /* Set the pairing_cb based on the local & remote authentication requirements
941 */
942 bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
943
944 /* if just_works and bonding bit is not set treat this as temporary */
945 if (p_ssp_cfm_req->just_works &&
946 !(p_ssp_cfm_req->loc_auth_req & BTM_AUTH_BONDS) &&
947 !(p_ssp_cfm_req->rmt_auth_req & BTM_AUTH_BONDS) &&
948 !(check_cod((bt_bdaddr_t*)&p_ssp_cfm_req->bd_addr, COD_HID_POINTING)))
949 pairing_cb.bond_type = BOND_TYPE_TEMPORARY;
950 else
951 pairing_cb.bond_type = BOND_TYPE_PERSISTENT;
952
953 btm_set_bond_type_dev(p_ssp_cfm_req->bd_addr, pairing_cb.bond_type);
954
955 pairing_cb.is_ssp = true;
956
957 /* If JustWorks auto-accept */
958 if (p_ssp_cfm_req->just_works) {
959 /* Pairing consent for JustWorks needed if:
960 * 1. Incoming (non-temporary) pairing is detected AND
961 * 2. local IO capabilities are DisplayYesNo AND
962 * 3. remote IO capabiltiies are DisplayOnly or NoInputNoOutput;
963 */
964 if (is_incoming && pairing_cb.bond_type != BOND_TYPE_TEMPORARY &&
965 ((p_ssp_cfm_req->loc_io_caps == HCI_IO_CAP_DISPLAY_YESNO) &&
966 (p_ssp_cfm_req->rmt_io_caps == HCI_IO_CAP_DISPLAY_ONLY ||
967 p_ssp_cfm_req->rmt_io_caps == HCI_IO_CAP_NO_IO))) {
968 BTIF_TRACE_EVENT(
969 "%s: User consent needed for incoming pairing request. loc_io_caps: "
970 "%d, rmt_io_caps: %d",
971 __func__, p_ssp_cfm_req->loc_io_caps, p_ssp_cfm_req->rmt_io_caps);
972 } else {
973 BTIF_TRACE_EVENT("%s: Auto-accept JustWorks pairing", __func__);
974 btif_dm_ssp_reply(&bd_addr, BT_SSP_VARIANT_CONSENT, true, 0);
975 return;
976 }
977 }
978
979 cod = devclass2uint(p_ssp_cfm_req->dev_class);
980
981 if (cod == 0) {
982 LOG_DEBUG(LOG_TAG, "%s cod is 0, set as unclassified", __func__);
983 cod = COD_UNCLASSIFIED;
984 }
985
986 pairing_cb.sdp_attempts = 0;
987 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
988 (p_ssp_cfm_req->just_works ? BT_SSP_VARIANT_CONSENT
989 : BT_SSP_VARIANT_PASSKEY_CONFIRMATION),
990 p_ssp_cfm_req->num_val);
991 }
992
btif_dm_ssp_key_notif_evt(tBTA_DM_SP_KEY_NOTIF * p_ssp_key_notif)993 static void btif_dm_ssp_key_notif_evt(tBTA_DM_SP_KEY_NOTIF* p_ssp_key_notif) {
994 bt_bdaddr_t bd_addr;
995 bt_bdname_t bd_name;
996 uint32_t cod;
997 int dev_type;
998
999 BTIF_TRACE_DEBUG("%s", __func__);
1000
1001 /* Remote properties update */
1002 if (!btif_get_device_type(p_ssp_key_notif->bd_addr, &dev_type)) {
1003 dev_type = BT_DEVICE_TYPE_BREDR;
1004 }
1005 btif_update_remote_properties(
1006 p_ssp_key_notif->bd_addr, p_ssp_key_notif->bd_name,
1007 p_ssp_key_notif->dev_class, (tBT_DEVICE_TYPE)dev_type);
1008
1009 bdcpy(bd_addr.address, p_ssp_key_notif->bd_addr);
1010 memcpy(bd_name.name, p_ssp_key_notif->bd_name, BD_NAME_LEN);
1011
1012 bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
1013 pairing_cb.is_ssp = true;
1014 cod = devclass2uint(p_ssp_key_notif->dev_class);
1015
1016 if (cod == 0) {
1017 LOG_DEBUG(LOG_TAG, "%s cod is 0, set as unclassified", __func__);
1018 cod = COD_UNCLASSIFIED;
1019 }
1020
1021 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
1022 BT_SSP_VARIANT_PASSKEY_NOTIFICATION, p_ssp_key_notif->passkey);
1023 }
1024 /*******************************************************************************
1025 *
1026 * Function btif_dm_auth_cmpl_evt
1027 *
1028 * Description Executes authentication complete event in btif context
1029 *
1030 * Returns void
1031 *
1032 ******************************************************************************/
btif_dm_auth_cmpl_evt(tBTA_DM_AUTH_CMPL * p_auth_cmpl)1033 static void btif_dm_auth_cmpl_evt(tBTA_DM_AUTH_CMPL* p_auth_cmpl) {
1034 /* Save link key, if not temporary */
1035 bt_bdaddr_t bd_addr;
1036 bt_status_t status = BT_STATUS_FAIL;
1037 bt_bond_state_t state = BT_BOND_STATE_NONE;
1038 bool skip_sdp = false;
1039
1040 BTIF_TRACE_DEBUG("%s: bond state=%d", __func__, pairing_cb.state);
1041
1042 bdcpy(bd_addr.address, p_auth_cmpl->bd_addr);
1043 if ((p_auth_cmpl->success == true) && (p_auth_cmpl->key_present)) {
1044 if ((p_auth_cmpl->key_type < HCI_LKEY_TYPE_DEBUG_COMB) ||
1045 (p_auth_cmpl->key_type == HCI_LKEY_TYPE_AUTH_COMB) ||
1046 (p_auth_cmpl->key_type == HCI_LKEY_TYPE_CHANGED_COMB) ||
1047 (p_auth_cmpl->key_type == HCI_LKEY_TYPE_AUTH_COMB_P_256) ||
1048 pairing_cb.bond_type == BOND_TYPE_PERSISTENT) {
1049 bt_status_t ret;
1050 BTIF_TRACE_DEBUG("%s: Storing link key. key_type=0x%x, bond_type=%d",
1051 __func__, p_auth_cmpl->key_type, pairing_cb.bond_type);
1052 ret = btif_storage_add_bonded_device(&bd_addr, p_auth_cmpl->key,
1053 p_auth_cmpl->key_type,
1054 pairing_cb.pin_code_len);
1055 ASSERTC(ret == BT_STATUS_SUCCESS, "storing link key failed", ret);
1056 } else {
1057 BTIF_TRACE_DEBUG(
1058 "%s: Temporary key. Not storing. key_type=0x%x, bond_type=%d",
1059 __func__, p_auth_cmpl->key_type, pairing_cb.bond_type);
1060 if (pairing_cb.bond_type == BOND_TYPE_TEMPORARY) {
1061 BTIF_TRACE_DEBUG("%s: sending BT_BOND_STATE_NONE for Temp pairing",
1062 __func__);
1063 btif_storage_remove_bonded_device(&bd_addr);
1064 bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_NONE);
1065 return;
1066 }
1067 }
1068 }
1069
1070 // We could have received a new link key without going through the pairing
1071 // flow. If so, we don't want to perform SDP or any other operations on the
1072 // authenticated device. Also, make sure that the link key is not derived from
1073 // secure LTK, because we will need to perform SDP in case of link key
1074 // derivation to allow bond state change notification for the BR/EDR transport
1075 // so that the subsequent BR/EDR connections to the remote can use the derived
1076 // link key.
1077 if ((bdcmp(p_auth_cmpl->bd_addr, pairing_cb.bd_addr) != 0) &&
1078 (!pairing_cb.ble.is_penc_key_rcvd)) {
1079 char address[32];
1080 bt_bdaddr_t bt_bdaddr;
1081
1082 memcpy(bt_bdaddr.address, p_auth_cmpl->bd_addr, sizeof(bt_bdaddr.address));
1083 bdaddr_to_string(&bt_bdaddr, address, sizeof(address));
1084 LOG_INFO(LOG_TAG,
1085 "%s skipping SDP since we did not initiate pairing to %s.",
1086 __func__, address);
1087 return;
1088 }
1089
1090 // Skip SDP for certain HID Devices
1091 if (p_auth_cmpl->success) {
1092 btif_storage_set_remote_addr_type(&bd_addr, p_auth_cmpl->addr_type);
1093 btif_update_remote_properties(p_auth_cmpl->bd_addr, p_auth_cmpl->bd_name,
1094 NULL, p_auth_cmpl->dev_type);
1095 pairing_cb.timeout_retries = 0;
1096 status = BT_STATUS_SUCCESS;
1097 state = BT_BOND_STATE_BONDED;
1098 bdcpy(bd_addr.address, p_auth_cmpl->bd_addr);
1099
1100 if (check_sdp_bl(&bd_addr) && check_cod_hid(&bd_addr)) {
1101 LOG_WARN(LOG_TAG, "%s:skip SDP", __func__);
1102 skip_sdp = true;
1103 }
1104 if (!pairing_cb.is_local_initiated && skip_sdp) {
1105 bond_state_changed(status, &bd_addr, state);
1106
1107 LOG_WARN(LOG_TAG, "%s: Incoming HID Connection", __func__);
1108 bt_property_t prop;
1109 bt_bdaddr_t bd_addr;
1110 bt_uuid_t uuid;
1111 char uuid_str[128] = UUID_HUMAN_INTERFACE_DEVICE;
1112
1113 string_to_uuid(uuid_str, &uuid);
1114
1115 prop.type = BT_PROPERTY_UUIDS;
1116 prop.val = uuid.uu;
1117 prop.len = MAX_UUID_SIZE;
1118
1119 /* Send the event to the BTIF */
1120 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1121 &bd_addr, 1, &prop);
1122 } else {
1123 bool is_crosskey = false;
1124 /* If bonded due to cross-key, save the static address too*/
1125 if (pairing_cb.state == BT_BOND_STATE_BONDING &&
1126 (bdcmp(p_auth_cmpl->bd_addr, pairing_cb.bd_addr) != 0)) {
1127 BTIF_TRACE_DEBUG(
1128 "%s: bonding initiated due to cross key, adding static address",
1129 __func__);
1130 bdcpy(pairing_cb.static_bdaddr.address, p_auth_cmpl->bd_addr);
1131 is_crosskey = true;
1132 }
1133 if (!is_crosskey ||
1134 !(stack_config_get_interface()->get_pts_crosskey_sdp_disable())) {
1135 // Ensure inquiry is stopped before attempting service discovery
1136 btif_dm_cancel_discovery();
1137
1138 /* Trigger SDP on the device */
1139 pairing_cb.sdp_attempts = 1;
1140 btif_dm_get_remote_services(&bd_addr);
1141 }
1142 }
1143 // Do not call bond_state_changed_cb yet. Wait until remote service
1144 // discovery is complete
1145 } else {
1146 // Map the HCI fail reason to bt status
1147 switch (p_auth_cmpl->fail_reason) {
1148 case HCI_ERR_PAGE_TIMEOUT:
1149 case HCI_ERR_LMP_RESPONSE_TIMEOUT:
1150 if (interop_match_addr(INTEROP_AUTO_RETRY_PAIRING, &bd_addr) &&
1151 pairing_cb.timeout_retries) {
1152 BTIF_TRACE_WARNING("%s() - Pairing timeout; retrying (%d) ...",
1153 __func__, pairing_cb.timeout_retries);
1154 --pairing_cb.timeout_retries;
1155 btif_dm_cb_create_bond(&bd_addr, BTA_TRANSPORT_UNKNOWN);
1156 return;
1157 }
1158 /* Fall-through */
1159 case HCI_ERR_CONNECTION_TOUT:
1160 status = BT_STATUS_RMT_DEV_DOWN;
1161 break;
1162
1163 case HCI_ERR_PAIRING_NOT_ALLOWED:
1164 btif_storage_remove_bonded_device(&bd_addr);
1165 status = BT_STATUS_AUTH_REJECTED;
1166 break;
1167
1168 /* map the auth failure codes, so we can retry pairing if necessary */
1169 case HCI_ERR_AUTH_FAILURE:
1170 case HCI_ERR_KEY_MISSING:
1171 btif_storage_remove_bonded_device(&bd_addr);
1172 case HCI_ERR_HOST_REJECT_SECURITY:
1173 case HCI_ERR_ENCRY_MODE_NOT_ACCEPTABLE:
1174 case HCI_ERR_UNIT_KEY_USED:
1175 case HCI_ERR_PAIRING_WITH_UNIT_KEY_NOT_SUPPORTED:
1176 case HCI_ERR_INSUFFCIENT_SECURITY:
1177 case HCI_ERR_PEER_USER:
1178 case HCI_ERR_UNSPECIFIED:
1179 BTIF_TRACE_DEBUG(" %s() Authentication fail reason %d", __func__,
1180 p_auth_cmpl->fail_reason);
1181 if (pairing_cb.autopair_attempts == 1) {
1182 /* Create the Bond once again */
1183 BTIF_TRACE_WARNING("%s() auto pair failed. Reinitiate Bond",
1184 __func__);
1185 btif_dm_cb_create_bond(&bd_addr, BTA_TRANSPORT_UNKNOWN);
1186 return;
1187 } else {
1188 /* if autopair attempts are more than 1, or not attempted */
1189 status = BT_STATUS_AUTH_FAILURE;
1190 }
1191 break;
1192
1193 default:
1194 status = BT_STATUS_FAIL;
1195 }
1196 /* Special Handling for HID Devices */
1197 if (check_cod(&bd_addr, COD_HID_POINTING)) {
1198 /* Remove Device as bonded in nvram as authentication failed */
1199 BTIF_TRACE_DEBUG("%s(): removing hid pointing device from nvram",
1200 __func__);
1201 btif_storage_remove_bonded_device(&bd_addr);
1202 }
1203 bond_state_changed(status, &bd_addr, state);
1204 }
1205 }
1206
1207 /******************************************************************************
1208 *
1209 * Function btif_dm_search_devices_evt
1210 *
1211 * Description Executes search devices callback events in btif context
1212 *
1213 * Returns void
1214 *
1215 *****************************************************************************/
btif_dm_search_devices_evt(uint16_t event,char * p_param)1216 static void btif_dm_search_devices_evt(uint16_t event, char* p_param) {
1217 tBTA_DM_SEARCH* p_search_data;
1218 BTIF_TRACE_EVENT("%s event=%s", __func__, dump_dm_search_event(event));
1219
1220 switch (event) {
1221 case BTA_DM_DISC_RES_EVT: {
1222 p_search_data = (tBTA_DM_SEARCH*)p_param;
1223 /* Remote name update */
1224 if (strlen((const char*)p_search_data->disc_res.bd_name)) {
1225 bt_property_t properties[1];
1226 bt_bdaddr_t bdaddr;
1227 bt_status_t status;
1228
1229 properties[0].type = BT_PROPERTY_BDNAME;
1230 properties[0].val = p_search_data->disc_res.bd_name;
1231 properties[0].len = strlen((char*)p_search_data->disc_res.bd_name);
1232 bdcpy(bdaddr.address, p_search_data->disc_res.bd_addr);
1233
1234 status =
1235 btif_storage_set_remote_device_property(&bdaddr, &properties[0]);
1236 ASSERTC(status == BT_STATUS_SUCCESS,
1237 "failed to save remote device property", status);
1238 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, status, &bdaddr,
1239 1, properties);
1240 }
1241 /* TODO: Services? */
1242 } break;
1243
1244 case BTA_DM_INQ_RES_EVT: {
1245 /* inquiry result */
1246 bt_bdname_t bdname;
1247 bt_bdaddr_t bdaddr;
1248 uint8_t remote_name_len;
1249 tBTA_SERVICE_MASK services = 0;
1250 bdstr_t bdstr;
1251
1252 p_search_data = (tBTA_DM_SEARCH*)p_param;
1253 bdcpy(bdaddr.address, p_search_data->inq_res.bd_addr);
1254
1255 BTIF_TRACE_DEBUG("%s() %s device_type = 0x%x\n", __func__,
1256 bdaddr_to_string(&bdaddr, bdstr, sizeof(bdstr)),
1257 p_search_data->inq_res.device_type);
1258 bdname.name[0] = 0;
1259
1260 if (!check_eir_remote_name(p_search_data, bdname.name, &remote_name_len))
1261 check_cached_remote_name(p_search_data, bdname.name, &remote_name_len);
1262
1263 /* Check EIR for remote name and services */
1264 if (p_search_data->inq_res.p_eir) {
1265 BTA_GetEirService(p_search_data->inq_res.p_eir,
1266 p_search_data->inq_res.eir_len, &services);
1267 BTIF_TRACE_DEBUG("%s()EIR BTA services = %08X", __func__,
1268 (uint32_t)services);
1269 /* TODO: Get the service list and check to see which uuids we got and
1270 * send it back to the client. */
1271 }
1272
1273 {
1274 bt_property_t properties[5];
1275 bt_device_type_t dev_type;
1276 uint32_t num_properties = 0;
1277 bt_status_t status;
1278 int addr_type = 0;
1279
1280 memset(properties, 0, sizeof(properties));
1281 /* BD_ADDR */
1282 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1283 BT_PROPERTY_BDADDR, sizeof(bdaddr), &bdaddr);
1284 num_properties++;
1285 /* BD_NAME */
1286 /* Don't send BDNAME if it is empty */
1287 if (bdname.name[0]) {
1288 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1289 BT_PROPERTY_BDNAME,
1290 strlen((char*)bdname.name), &bdname);
1291 num_properties++;
1292 }
1293
1294 /* DEV_CLASS */
1295 uint32_t cod = devclass2uint(p_search_data->inq_res.dev_class);
1296 BTIF_TRACE_DEBUG("%s cod is 0x%06x", __func__, cod);
1297 if (cod != 0) {
1298 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1299 BT_PROPERTY_CLASS_OF_DEVICE, sizeof(cod),
1300 &cod);
1301 num_properties++;
1302 }
1303
1304 /* DEV_TYPE */
1305 /* FixMe: Assumption is that bluetooth.h and BTE enums match */
1306
1307 /* Verify if the device is dual mode in NVRAM */
1308 int stored_device_type = 0;
1309 if (btif_get_device_type(bdaddr.address, &stored_device_type) &&
1310 ((stored_device_type != BT_DEVICE_TYPE_BREDR &&
1311 p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BREDR) ||
1312 (stored_device_type != BT_DEVICE_TYPE_BLE &&
1313 p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BLE))) {
1314 dev_type = (bt_device_type_t)BT_DEVICE_TYPE_DUMO;
1315 } else {
1316 dev_type = (bt_device_type_t)p_search_data->inq_res.device_type;
1317 }
1318
1319 if (p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BLE)
1320 addr_type = p_search_data->inq_res.ble_addr_type;
1321 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1322 BT_PROPERTY_TYPE_OF_DEVICE, sizeof(dev_type),
1323 &dev_type);
1324 num_properties++;
1325 /* RSSI */
1326 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1327 BT_PROPERTY_REMOTE_RSSI, sizeof(int8_t),
1328 &(p_search_data->inq_res.rssi));
1329 num_properties++;
1330
1331 status =
1332 btif_storage_add_remote_device(&bdaddr, num_properties, properties);
1333 ASSERTC(status == BT_STATUS_SUCCESS,
1334 "failed to save remote device (inquiry)", status);
1335 status = btif_storage_set_remote_addr_type(&bdaddr, addr_type);
1336 ASSERTC(status == BT_STATUS_SUCCESS,
1337 "failed to save remote addr type (inquiry)", status);
1338 /* Callback to notify upper layer of device */
1339 HAL_CBACK(bt_hal_cbacks, device_found_cb, num_properties, properties);
1340 }
1341 } break;
1342
1343 case BTA_DM_INQ_CMPL_EVT: {
1344 do_in_bta_thread(
1345 FROM_HERE,
1346 base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_DELETE, 0,
1347 nullptr, base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
1348 } break;
1349 case BTA_DM_DISC_CMPL_EVT: {
1350 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1351 BT_DISCOVERY_STOPPED);
1352 } break;
1353 case BTA_DM_SEARCH_CANCEL_CMPL_EVT: {
1354 /* if inquiry is not in progress and we get a cancel event, then
1355 * it means we are done with inquiry, but remote_name fetches are in
1356 * progress
1357 *
1358 * if inquiry is in progress, then we don't want to act on this
1359 * cancel_cmpl_evt
1360 * but instead wait for the cancel_cmpl_evt via the Busy Level
1361 *
1362 */
1363 if (btif_dm_inquiry_in_progress == false) {
1364 btgatt_filt_param_setup_t adv_filt_param;
1365 memset(&adv_filt_param, 0, sizeof(btgatt_filt_param_setup_t));
1366 do_in_bta_thread(
1367 FROM_HERE,
1368 base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_DELETE, 0,
1369 nullptr, base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
1370 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1371 BT_DISCOVERY_STOPPED);
1372 }
1373 } break;
1374 }
1375 }
1376
1377 /*******************************************************************************
1378 *
1379 * Function btif_dm_search_services_evt
1380 *
1381 * Description Executes search services event in btif context
1382 *
1383 * Returns void
1384 *
1385 ******************************************************************************/
btif_dm_search_services_evt(uint16_t event,char * p_param)1386 static void btif_dm_search_services_evt(uint16_t event, char* p_param) {
1387 tBTA_DM_SEARCH* p_data = (tBTA_DM_SEARCH*)p_param;
1388
1389 BTIF_TRACE_EVENT("%s: event = %d", __func__, event);
1390 switch (event) {
1391 case BTA_DM_DISC_RES_EVT: {
1392 bt_property_t prop;
1393 uint32_t i = 0;
1394 bt_bdaddr_t bd_addr;
1395 bt_status_t ret;
1396
1397 bdcpy(bd_addr.address, p_data->disc_res.bd_addr);
1398
1399 BTIF_TRACE_DEBUG("%s:(result=0x%x, services 0x%x)", __func__,
1400 p_data->disc_res.result, p_data->disc_res.services);
1401 if ((p_data->disc_res.result != BTA_SUCCESS) &&
1402 (pairing_cb.state == BT_BOND_STATE_BONDING) &&
1403 (pairing_cb.sdp_attempts < BTIF_DM_MAX_SDP_ATTEMPTS_AFTER_PAIRING)) {
1404 BTIF_TRACE_WARNING("%s:SDP failed after bonding re-attempting",
1405 __func__);
1406 pairing_cb.sdp_attempts++;
1407 btif_dm_get_remote_services(&bd_addr);
1408 return;
1409 }
1410 prop.type = BT_PROPERTY_UUIDS;
1411 prop.len = 0;
1412 if ((p_data->disc_res.result == BTA_SUCCESS) &&
1413 (p_data->disc_res.num_uuids > 0)) {
1414 prop.val = p_data->disc_res.p_uuid_list;
1415 prop.len = p_data->disc_res.num_uuids * MAX_UUID_SIZE;
1416 for (i = 0; i < p_data->disc_res.num_uuids; i++) {
1417 char temp[256];
1418 uuid_to_string_legacy(
1419 (bt_uuid_t*)(p_data->disc_res.p_uuid_list + (i * MAX_UUID_SIZE)),
1420 temp, sizeof(temp));
1421 LOG_INFO(LOG_TAG, "%s index:%d uuid:%s", __func__, i, temp);
1422 }
1423 }
1424
1425 /* onUuidChanged requires getBondedDevices to be populated.
1426 ** bond_state_changed needs to be sent prior to remote_device_property
1427 */
1428 if ((pairing_cb.state == BT_BOND_STATE_BONDING) &&
1429 ((bdcmp(p_data->disc_res.bd_addr, pairing_cb.bd_addr) == 0) ||
1430 (bdcmp(p_data->disc_res.bd_addr, pairing_cb.static_bdaddr.address) ==
1431 0)) &&
1432 pairing_cb.sdp_attempts > 0) {
1433 BTIF_TRACE_DEBUG(
1434 "%s Remote Service SDP done. Call bond_state_changed_cb BONDED",
1435 __func__);
1436 pairing_cb.sdp_attempts = 0;
1437
1438 // If bonding occured due to cross-key pairing, send bonding callback
1439 // for static address now
1440 if (bdcmp(p_data->disc_res.bd_addr, pairing_cb.static_bdaddr.address) ==
1441 0)
1442 bond_state_changed(BT_STATUS_SUCCESS, &bd_addr,
1443 BT_BOND_STATE_BONDING);
1444
1445 bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDED);
1446 }
1447
1448 if (p_data->disc_res.num_uuids != 0) {
1449 /* Also write this to the NVRAM */
1450 ret = btif_storage_set_remote_device_property(&bd_addr, &prop);
1451 ASSERTC(ret == BT_STATUS_SUCCESS, "storing remote services failed",
1452 ret);
1453 /* Send the event to the BTIF */
1454 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1455 &bd_addr, 1, &prop);
1456 }
1457 } break;
1458
1459 case BTA_DM_DISC_CMPL_EVT:
1460 /* fixme */
1461 break;
1462
1463 case BTA_DM_SEARCH_CANCEL_CMPL_EVT:
1464 /* no-op */
1465 break;
1466
1467 case BTA_DM_DISC_BLE_RES_EVT: {
1468 BTIF_TRACE_DEBUG("%s:, services 0x%x)", __func__,
1469 p_data->disc_ble_res.service.uu.uuid16);
1470 bt_uuid_t uuid;
1471 int i = 0;
1472 int j = 15;
1473 int num_properties = 0;
1474 if (p_data->disc_ble_res.service.uu.uuid16 == UUID_SERVCLASS_LE_HID) {
1475 BTIF_TRACE_DEBUG("%s: Found HOGP UUID", __func__);
1476 bt_property_t prop[2];
1477 bt_bdaddr_t bd_addr;
1478 char temp[256];
1479 bt_status_t ret;
1480
1481 bta_gatt_convert_uuid16_to_uuid128(
1482 uuid.uu, p_data->disc_ble_res.service.uu.uuid16);
1483
1484 while (i < j) {
1485 unsigned char c = uuid.uu[j];
1486 uuid.uu[j] = uuid.uu[i];
1487 uuid.uu[i] = c;
1488 i++;
1489 j--;
1490 }
1491
1492 uuid_to_string_legacy(&uuid, temp, sizeof(temp));
1493 LOG_INFO(LOG_TAG, "%s uuid:%s", __func__, temp);
1494
1495 bdcpy(bd_addr.address, p_data->disc_ble_res.bd_addr);
1496 prop[0].type = BT_PROPERTY_UUIDS;
1497 prop[0].val = uuid.uu;
1498 prop[0].len = MAX_UUID_SIZE;
1499
1500 /* Also write this to the NVRAM */
1501 ret = btif_storage_set_remote_device_property(&bd_addr, &prop[0]);
1502 ASSERTC(ret == BT_STATUS_SUCCESS, "storing remote services failed",
1503 ret);
1504 num_properties++;
1505
1506 /* Remote name update */
1507 if (strnlen((const char*)p_data->disc_ble_res.bd_name, BD_NAME_LEN)) {
1508 prop[1].type = BT_PROPERTY_BDNAME;
1509 prop[1].val = p_data->disc_ble_res.bd_name;
1510 prop[1].len =
1511 strnlen((char*)p_data->disc_ble_res.bd_name, BD_NAME_LEN);
1512
1513 ret = btif_storage_set_remote_device_property(&bd_addr, &prop[1]);
1514 ASSERTC(ret == BT_STATUS_SUCCESS,
1515 "failed to save remote device property", ret);
1516 num_properties++;
1517 }
1518
1519 /* Send the event to the BTIF */
1520 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1521 &bd_addr, num_properties, prop);
1522 }
1523 } break;
1524
1525 default: { ASSERTC(0, "unhandled search services event", event); } break;
1526 }
1527 }
1528
1529 /*******************************************************************************
1530 *
1531 * Function btif_dm_remote_service_record_evt
1532 *
1533 * Description Executes search service record event in btif context
1534 *
1535 * Returns void
1536 *
1537 ******************************************************************************/
btif_dm_remote_service_record_evt(uint16_t event,char * p_param)1538 static void btif_dm_remote_service_record_evt(uint16_t event, char* p_param) {
1539 tBTA_DM_SEARCH* p_data = (tBTA_DM_SEARCH*)p_param;
1540
1541 BTIF_TRACE_EVENT("%s: event = %d", __func__, event);
1542 switch (event) {
1543 case BTA_DM_DISC_RES_EVT: {
1544 bt_service_record_t rec;
1545 bt_property_t prop;
1546 bt_bdaddr_t bd_addr;
1547
1548 memset(&rec, 0, sizeof(bt_service_record_t));
1549 bdcpy(bd_addr.address, p_data->disc_res.bd_addr);
1550
1551 BTIF_TRACE_DEBUG("%s:(result=0x%x, services 0x%x)", __func__,
1552 p_data->disc_res.result, p_data->disc_res.services);
1553 prop.type = BT_PROPERTY_SERVICE_RECORD;
1554 prop.val = (void*)&rec;
1555 prop.len = sizeof(rec);
1556
1557 /* disc_res.result is overloaded with SCN. Cannot check result */
1558 p_data->disc_res.services &= ~BTA_USER_SERVICE_MASK;
1559 /* TODO: Get the UUID as well */
1560 rec.channel = p_data->disc_res.result - 3;
1561 /* TODO: Need to get the service name using p_raw_data */
1562 rec.name[0] = 0;
1563
1564 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1565 &bd_addr, 1, &prop);
1566 } break;
1567
1568 default: {
1569 ASSERTC(0, "unhandled remote service record event", event);
1570 } break;
1571 }
1572 }
1573
1574 /*******************************************************************************
1575 *
1576 * Function btif_dm_upstreams_cback
1577 *
1578 * Description Executes UPSTREAMS events in btif context
1579 *
1580 * Returns void
1581 *
1582 ******************************************************************************/
btif_dm_upstreams_evt(uint16_t event,char * p_param)1583 static void btif_dm_upstreams_evt(uint16_t event, char* p_param) {
1584 tBTA_DM_SEC* p_data = (tBTA_DM_SEC*)p_param;
1585 tBTA_SERVICE_MASK service_mask;
1586 uint32_t i;
1587 bt_bdaddr_t bd_addr;
1588
1589 BTIF_TRACE_EVENT("%s: ev: %s", __func__, dump_dm_event(event));
1590
1591 switch (event) {
1592 case BTA_DM_ENABLE_EVT: {
1593 BD_NAME bdname;
1594 bt_status_t status;
1595 bt_property_t prop;
1596 prop.type = BT_PROPERTY_BDNAME;
1597 prop.len = BD_NAME_LEN;
1598 prop.val = (void*)bdname;
1599
1600 status = btif_storage_get_adapter_property(&prop);
1601 if (status == BT_STATUS_SUCCESS) {
1602 /* A name exists in the storage. Make this the device name */
1603 BTA_DmSetDeviceName((char*)prop.val);
1604 } else {
1605 /* Storage does not have a name yet.
1606 * Use the default name and write it to the chip
1607 */
1608 BTA_DmSetDeviceName(btif_get_default_local_name());
1609 }
1610
1611 /* Enable local privacy */
1612 BTA_DmBleConfigLocalPrivacy(BLE_LOCAL_PRIVACY_ENABLED);
1613
1614 /* for each of the enabled services in the mask, trigger the profile
1615 * enable */
1616 service_mask = btif_get_enabled_services_mask();
1617 for (i = 0; i <= BTA_MAX_SERVICE_ID; i++) {
1618 if (service_mask &
1619 (tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(i))) {
1620 btif_in_execute_service_request(i, true);
1621 }
1622 }
1623 /* clear control blocks */
1624 memset(&pairing_cb, 0, sizeof(btif_dm_pairing_cb_t));
1625 pairing_cb.bond_type = BOND_TYPE_PERSISTENT;
1626
1627 /* This function will also trigger the adapter_properties_cb
1628 ** and bonded_devices_info_cb
1629 */
1630 btif_storage_load_bonded_devices();
1631
1632 btif_enable_bluetooth_evt(p_data->enable.status);
1633 } break;
1634
1635 case BTA_DM_DISABLE_EVT:
1636 /* for each of the enabled services in the mask, trigger the profile
1637 * disable */
1638 service_mask = btif_get_enabled_services_mask();
1639 for (i = 0; i <= BTA_MAX_SERVICE_ID; i++) {
1640 if (service_mask &
1641 (tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(i))) {
1642 btif_in_execute_service_request(i, false);
1643 }
1644 }
1645 btif_disable_bluetooth_evt();
1646 break;
1647
1648 case BTA_DM_PIN_REQ_EVT:
1649 btif_dm_pin_req_evt(&p_data->pin_req);
1650 break;
1651
1652 case BTA_DM_AUTH_CMPL_EVT:
1653 btif_dm_auth_cmpl_evt(&p_data->auth_cmpl);
1654 break;
1655
1656 case BTA_DM_BOND_CANCEL_CMPL_EVT:
1657 if (pairing_cb.state == BT_BOND_STATE_BONDING) {
1658 bdcpy(bd_addr.address, pairing_cb.bd_addr);
1659 btm_set_bond_type_dev(pairing_cb.bd_addr, BOND_TYPE_UNKNOWN);
1660 bond_state_changed((bt_status_t)p_data->bond_cancel_cmpl.result,
1661 &bd_addr, BT_BOND_STATE_NONE);
1662 }
1663 break;
1664
1665 case BTA_DM_SP_CFM_REQ_EVT:
1666 btif_dm_ssp_cfm_req_evt(&p_data->cfm_req);
1667 break;
1668 case BTA_DM_SP_KEY_NOTIF_EVT:
1669 btif_dm_ssp_key_notif_evt(&p_data->key_notif);
1670 break;
1671
1672 case BTA_DM_DEV_UNPAIRED_EVT:
1673 bdcpy(bd_addr.address, p_data->link_down.bd_addr);
1674 btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
1675
1676 /*special handling for HID devices */
1677 #if (defined(BTA_HH_INCLUDED) && (BTA_HH_INCLUDED == true))
1678 btif_hh_remove_device(bd_addr);
1679 #endif
1680 #if (defined(BTA_HD_INCLUDED) && (BTA_HD_INCLUDED == TRUE))
1681 btif_hd_remove_device(bd_addr);
1682 #endif
1683 btif_storage_remove_bonded_device(&bd_addr);
1684 bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_NONE);
1685 break;
1686
1687 case BTA_DM_BUSY_LEVEL_EVT: {
1688 if (p_data->busy_level.level_flags & BTM_BL_INQUIRY_PAGING_MASK) {
1689 if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_STARTED) {
1690 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1691 BT_DISCOVERY_STARTED);
1692 btif_dm_inquiry_in_progress = true;
1693 } else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_CANCELLED) {
1694 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1695 BT_DISCOVERY_STOPPED);
1696 btif_dm_inquiry_in_progress = false;
1697 } else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_COMPLETE) {
1698 btif_dm_inquiry_in_progress = false;
1699 }
1700 }
1701 } break;
1702
1703 case BTA_DM_LINK_UP_EVT:
1704 bdcpy(bd_addr.address, p_data->link_up.bd_addr);
1705 BTIF_TRACE_DEBUG("BTA_DM_LINK_UP_EVT. Sending BT_ACL_STATE_CONNECTED");
1706
1707 btif_update_remote_version_property(&bd_addr);
1708
1709 HAL_CBACK(bt_hal_cbacks, acl_state_changed_cb, BT_STATUS_SUCCESS,
1710 &bd_addr, BT_ACL_STATE_CONNECTED);
1711 break;
1712
1713 case BTA_DM_LINK_DOWN_EVT:
1714 bdcpy(bd_addr.address, p_data->link_down.bd_addr);
1715 btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
1716 btif_av_move_idle(bd_addr);
1717 BTIF_TRACE_DEBUG(
1718 "BTA_DM_LINK_DOWN_EVT. Sending BT_ACL_STATE_DISCONNECTED");
1719 HAL_CBACK(bt_hal_cbacks, acl_state_changed_cb, BT_STATUS_SUCCESS,
1720 &bd_addr, BT_ACL_STATE_DISCONNECTED);
1721 break;
1722
1723 case BTA_DM_HW_ERROR_EVT:
1724 BTIF_TRACE_ERROR("Received H/W Error. ");
1725 /* Flush storage data */
1726 btif_config_flush();
1727 usleep(100000); /* 100milliseconds */
1728 /* Killing the process to force a restart as part of fault tolerance */
1729 kill(getpid(), SIGKILL);
1730 break;
1731
1732 case BTA_DM_BLE_KEY_EVT:
1733 BTIF_TRACE_DEBUG("BTA_DM_BLE_KEY_EVT key_type=0x%02x ",
1734 p_data->ble_key.key_type);
1735
1736 /* If this pairing is by-product of local initiated GATT client Read or
1737 Write,
1738 BTA would not have sent BTA_DM_BLE_SEC_REQ_EVT event and Bond state would
1739 not
1740 have setup properly. Setup pairing_cb and notify App about Bonding state
1741 now*/
1742 if (pairing_cb.state != BT_BOND_STATE_BONDING) {
1743 BTIF_TRACE_DEBUG(
1744 "Bond state not sent to App so far.Notify the app now");
1745 bond_state_changed(BT_STATUS_SUCCESS,
1746 (bt_bdaddr_t*)p_data->ble_key.bd_addr,
1747 BT_BOND_STATE_BONDING);
1748 } else if (memcmp(pairing_cb.bd_addr, p_data->ble_key.bd_addr,
1749 BD_ADDR_LEN) != 0) {
1750 BTIF_TRACE_ERROR("BD mismatch discard BLE key_type=%d ",
1751 p_data->ble_key.key_type);
1752 break;
1753 }
1754
1755 switch (p_data->ble_key.key_type) {
1756 case BTA_LE_KEY_PENC:
1757 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_PENC");
1758 pairing_cb.ble.is_penc_key_rcvd = true;
1759 pairing_cb.ble.penc_key = p_data->ble_key.p_key_value->penc_key;
1760 break;
1761
1762 case BTA_LE_KEY_PID:
1763 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_PID");
1764 pairing_cb.ble.is_pid_key_rcvd = true;
1765 pairing_cb.ble.pid_key = p_data->ble_key.p_key_value->pid_key;
1766 break;
1767
1768 case BTA_LE_KEY_PCSRK:
1769 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_PCSRK");
1770 pairing_cb.ble.is_pcsrk_key_rcvd = true;
1771 pairing_cb.ble.pcsrk_key = p_data->ble_key.p_key_value->pcsrk_key;
1772 break;
1773
1774 case BTA_LE_KEY_LENC:
1775 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_LENC");
1776 pairing_cb.ble.is_lenc_key_rcvd = true;
1777 pairing_cb.ble.lenc_key = p_data->ble_key.p_key_value->lenc_key;
1778 break;
1779
1780 case BTA_LE_KEY_LCSRK:
1781 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_LCSRK");
1782 pairing_cb.ble.is_lcsrk_key_rcvd = true;
1783 pairing_cb.ble.lcsrk_key = p_data->ble_key.p_key_value->lcsrk_key;
1784 break;
1785
1786 case BTA_LE_KEY_LID:
1787 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_LID");
1788 pairing_cb.ble.is_lidk_key_rcvd = true;
1789 break;
1790
1791 default:
1792 BTIF_TRACE_ERROR("unknown BLE key type (0x%02x)",
1793 p_data->ble_key.key_type);
1794 break;
1795 }
1796 break;
1797 case BTA_DM_BLE_SEC_REQ_EVT:
1798 BTIF_TRACE_DEBUG("BTA_DM_BLE_SEC_REQ_EVT. ");
1799 btif_dm_ble_sec_req_evt(&p_data->ble_req);
1800 break;
1801 case BTA_DM_BLE_PASSKEY_NOTIF_EVT:
1802 BTIF_TRACE_DEBUG("BTA_DM_BLE_PASSKEY_NOTIF_EVT. ");
1803 btif_dm_ble_key_notif_evt(&p_data->key_notif);
1804 break;
1805 case BTA_DM_BLE_PASSKEY_REQ_EVT:
1806 BTIF_TRACE_DEBUG("BTA_DM_BLE_PASSKEY_REQ_EVT. ");
1807 btif_dm_ble_passkey_req_evt(&p_data->pin_req);
1808 break;
1809 case BTA_DM_BLE_NC_REQ_EVT:
1810 BTIF_TRACE_DEBUG("BTA_DM_BLE_PASSKEY_REQ_EVT. ");
1811 btif_dm_ble_key_nc_req_evt(&p_data->key_notif);
1812 break;
1813 case BTA_DM_BLE_OOB_REQ_EVT:
1814 BTIF_TRACE_DEBUG("BTA_DM_BLE_OOB_REQ_EVT. ");
1815 btif_dm_ble_oob_req_evt(&p_data->rmt_oob);
1816 break;
1817 case BTA_DM_BLE_SC_OOB_REQ_EVT:
1818 BTIF_TRACE_DEBUG("BTA_DM_BLE_SC_OOB_REQ_EVT. ");
1819 btif_dm_ble_sc_oob_req_evt(&p_data->rmt_oob);
1820 break;
1821 case BTA_DM_BLE_LOCAL_IR_EVT:
1822 BTIF_TRACE_DEBUG("BTA_DM_BLE_LOCAL_IR_EVT. ");
1823 ble_local_key_cb.is_id_keys_rcvd = true;
1824 memcpy(&ble_local_key_cb.id_keys.irk[0], &p_data->ble_id_keys.irk[0],
1825 sizeof(BT_OCTET16));
1826 memcpy(&ble_local_key_cb.id_keys.ir[0], &p_data->ble_id_keys.ir[0],
1827 sizeof(BT_OCTET16));
1828 memcpy(&ble_local_key_cb.id_keys.dhk[0], &p_data->ble_id_keys.dhk[0],
1829 sizeof(BT_OCTET16));
1830 btif_storage_add_ble_local_key((char*)&ble_local_key_cb.id_keys.irk[0],
1831 BTIF_DM_LE_LOCAL_KEY_IRK, BT_OCTET16_LEN);
1832 btif_storage_add_ble_local_key((char*)&ble_local_key_cb.id_keys.ir[0],
1833 BTIF_DM_LE_LOCAL_KEY_IR, BT_OCTET16_LEN);
1834 btif_storage_add_ble_local_key((char*)&ble_local_key_cb.id_keys.dhk[0],
1835 BTIF_DM_LE_LOCAL_KEY_DHK, BT_OCTET16_LEN);
1836 break;
1837 case BTA_DM_BLE_LOCAL_ER_EVT:
1838 BTIF_TRACE_DEBUG("BTA_DM_BLE_LOCAL_ER_EVT. ");
1839 ble_local_key_cb.is_er_rcvd = true;
1840 memcpy(&ble_local_key_cb.er[0], &p_data->ble_er[0], sizeof(BT_OCTET16));
1841 btif_storage_add_ble_local_key((char*)&ble_local_key_cb.er[0],
1842 BTIF_DM_LE_LOCAL_KEY_ER, BT_OCTET16_LEN);
1843 break;
1844
1845 case BTA_DM_BLE_AUTH_CMPL_EVT:
1846 BTIF_TRACE_DEBUG("BTA_DM_BLE_AUTH_CMPL_EVT. ");
1847 btif_dm_ble_auth_cmpl_evt(&p_data->auth_cmpl);
1848 break;
1849
1850 case BTA_DM_LE_FEATURES_READ: {
1851 tBTM_BLE_VSC_CB cmn_vsc_cb;
1852 bt_local_le_features_t local_le_features;
1853 char buf[512];
1854 bt_property_t prop;
1855 prop.type = BT_PROPERTY_LOCAL_LE_FEATURES;
1856 prop.val = (void*)buf;
1857 prop.len = sizeof(buf);
1858
1859 /* LE features are not stored in storage. Should be retrived from stack */
1860 BTM_BleGetVendorCapabilities(&cmn_vsc_cb);
1861 local_le_features.local_privacy_enabled = BTM_BleLocalPrivacyEnabled();
1862
1863 prop.len = sizeof(bt_local_le_features_t);
1864 if (cmn_vsc_cb.filter_support == 1)
1865 local_le_features.max_adv_filter_supported = cmn_vsc_cb.max_filter;
1866 else
1867 local_le_features.max_adv_filter_supported = 0;
1868 local_le_features.max_adv_instance = cmn_vsc_cb.adv_inst_max;
1869 local_le_features.max_irk_list_size = cmn_vsc_cb.max_irk_list_sz;
1870 local_le_features.rpa_offload_supported = cmn_vsc_cb.rpa_offloading;
1871 local_le_features.activity_energy_info_supported =
1872 cmn_vsc_cb.energy_support;
1873 local_le_features.scan_result_storage_size =
1874 cmn_vsc_cb.tot_scan_results_strg;
1875 local_le_features.version_supported = cmn_vsc_cb.version_supported;
1876 local_le_features.total_trackable_advertisers =
1877 cmn_vsc_cb.total_trackable_advertisers;
1878
1879 local_le_features.extended_scan_support =
1880 cmn_vsc_cb.extended_scan_support > 0;
1881 local_le_features.debug_logging_supported =
1882 cmn_vsc_cb.debug_logging_supported > 0;
1883
1884 const controller_t* controller = controller_get_interface();
1885
1886 local_le_features.le_2m_phy_supported = controller->supports_ble_2m_phy();
1887 local_le_features.le_coded_phy_supported =
1888 controller->supports_ble_coded_phy();
1889 local_le_features.le_extended_advertising_supported =
1890 controller->supports_ble_extended_advertising();
1891 local_le_features.le_periodic_advertising_supported =
1892 controller->supports_ble_periodic_advertising();
1893 local_le_features.le_maximum_advertising_data_length =
1894 controller->get_ble_maxium_advertising_data_length();
1895
1896 memcpy(prop.val, &local_le_features, prop.len);
1897 HAL_CBACK(bt_hal_cbacks, adapter_properties_cb, BT_STATUS_SUCCESS, 1,
1898 &prop);
1899 break;
1900 }
1901
1902 case BTA_DM_ENER_INFO_READ: {
1903 btif_activity_energy_info_cb_t* p_ener_data =
1904 (btif_activity_energy_info_cb_t*)p_param;
1905 bt_activity_energy_info energy_info;
1906 energy_info.status = p_ener_data->status;
1907 energy_info.ctrl_state = p_ener_data->ctrl_state;
1908 energy_info.rx_time = p_ener_data->rx_time;
1909 energy_info.tx_time = p_ener_data->tx_time;
1910 energy_info.idle_time = p_ener_data->idle_time;
1911 energy_info.energy_used = p_ener_data->energy_used;
1912
1913 bt_uid_traffic_t* data = uid_set_read_and_clear(uid_set);
1914 HAL_CBACK(bt_hal_cbacks, energy_info_cb, &energy_info, data);
1915 osi_free(data);
1916 break;
1917 }
1918
1919 case BTA_DM_AUTHORIZE_EVT:
1920 case BTA_DM_SIG_STRENGTH_EVT:
1921 case BTA_DM_SP_RMT_OOB_EVT:
1922 case BTA_DM_SP_KEYPRESS_EVT:
1923 case BTA_DM_ROLE_CHG_EVT:
1924
1925 default:
1926 BTIF_TRACE_WARNING("btif_dm_cback : unhandled event (%d)", event);
1927 break;
1928 }
1929
1930 btif_dm_data_free(event, p_data);
1931 }
1932
1933 /*******************************************************************************
1934 *
1935 * Function btif_dm_generic_evt
1936 *
1937 * Description Executes non-BTA upstream events in BTIF context
1938 *
1939 * Returns void
1940 *
1941 ******************************************************************************/
btif_dm_generic_evt(uint16_t event,char * p_param)1942 static void btif_dm_generic_evt(uint16_t event, char* p_param) {
1943 BTIF_TRACE_EVENT("%s: event=%d", __func__, event);
1944 switch (event) {
1945 case BTIF_DM_CB_DISCOVERY_STARTED: {
1946 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1947 BT_DISCOVERY_STARTED);
1948 } break;
1949
1950 case BTIF_DM_CB_CREATE_BOND: {
1951 pairing_cb.timeout_retries = NUM_TIMEOUT_RETRIES;
1952 btif_dm_create_bond_cb_t* create_bond_cb =
1953 (btif_dm_create_bond_cb_t*)p_param;
1954 btif_dm_cb_create_bond(&create_bond_cb->bdaddr,
1955 create_bond_cb->transport);
1956 } break;
1957
1958 case BTIF_DM_CB_REMOVE_BOND: {
1959 btif_dm_cb_remove_bond((bt_bdaddr_t*)p_param);
1960 } break;
1961
1962 case BTIF_DM_CB_HID_REMOTE_NAME: {
1963 btif_dm_cb_hid_remote_name((tBTM_REMOTE_DEV_NAME*)p_param);
1964 } break;
1965
1966 case BTIF_DM_CB_BOND_STATE_BONDING: {
1967 bond_state_changed(BT_STATUS_SUCCESS, (bt_bdaddr_t*)p_param,
1968 BT_BOND_STATE_BONDING);
1969 } break;
1970 case BTIF_DM_CB_LE_TX_TEST:
1971 case BTIF_DM_CB_LE_RX_TEST: {
1972 uint8_t status;
1973 STREAM_TO_UINT8(status, p_param);
1974 HAL_CBACK(bt_hal_cbacks, le_test_mode_cb,
1975 (status == 0) ? BT_STATUS_SUCCESS : BT_STATUS_FAIL, 0);
1976 } break;
1977 case BTIF_DM_CB_LE_TEST_END: {
1978 uint8_t status;
1979 uint16_t count = 0;
1980 STREAM_TO_UINT8(status, p_param);
1981 if (status == 0) STREAM_TO_UINT16(count, p_param);
1982 HAL_CBACK(bt_hal_cbacks, le_test_mode_cb,
1983 (status == 0) ? BT_STATUS_SUCCESS : BT_STATUS_FAIL, count);
1984 } break;
1985 default: {
1986 BTIF_TRACE_WARNING("%s : Unknown event 0x%x", __func__, event);
1987 } break;
1988 }
1989 }
1990
1991 /*******************************************************************************
1992 *
1993 * Function bte_dm_evt
1994 *
1995 * Description Switches context from BTE to BTIF for all DM events
1996 *
1997 * Returns void
1998 *
1999 ******************************************************************************/
2000
bte_dm_evt(tBTA_DM_SEC_EVT event,tBTA_DM_SEC * p_data)2001 void bte_dm_evt(tBTA_DM_SEC_EVT event, tBTA_DM_SEC* p_data) {
2002 /* switch context to btif task context (copy full union size for convenience)
2003 */
2004 bt_status_t status = btif_transfer_context(
2005 btif_dm_upstreams_evt, (uint16_t)event, (char*)p_data,
2006 sizeof(tBTA_DM_SEC), btif_dm_data_copy);
2007
2008 /* catch any failed context transfers */
2009 ASSERTC(status == BT_STATUS_SUCCESS, "context transfer failed", status);
2010 }
2011
2012 /*******************************************************************************
2013 *
2014 * Function bte_search_devices_evt
2015 *
2016 * Description Switches context from BTE to BTIF for DM search events
2017 *
2018 * Returns void
2019 *
2020 ******************************************************************************/
bte_search_devices_evt(tBTA_DM_SEARCH_EVT event,tBTA_DM_SEARCH * p_data)2021 static void bte_search_devices_evt(tBTA_DM_SEARCH_EVT event,
2022 tBTA_DM_SEARCH* p_data) {
2023 uint16_t param_len = 0;
2024
2025 if (p_data) param_len += sizeof(tBTA_DM_SEARCH);
2026 /* Allocate buffer to hold the pointers (deep copy). The pointers will point
2027 * to the end of the tBTA_DM_SEARCH */
2028 switch (event) {
2029 case BTA_DM_INQ_RES_EVT: {
2030 if (p_data->inq_res.p_eir) param_len += HCI_EXT_INQ_RESPONSE_LEN;
2031 } break;
2032
2033 case BTA_DM_DISC_RES_EVT: {
2034 if (p_data->disc_res.raw_data_size && p_data->disc_res.p_raw_data)
2035 param_len += p_data->disc_res.raw_data_size;
2036 } break;
2037 }
2038 BTIF_TRACE_DEBUG("%s event=%s param_len=%d", __func__,
2039 dump_dm_search_event(event), param_len);
2040
2041 /* if remote name is available in EIR, set teh flag so that stack doesnt
2042 * trigger RNR */
2043 if (event == BTA_DM_INQ_RES_EVT)
2044 p_data->inq_res.remt_name_not_required =
2045 check_eir_remote_name(p_data, NULL, NULL);
2046
2047 btif_transfer_context(
2048 btif_dm_search_devices_evt, (uint16_t)event, (char*)p_data, param_len,
2049 (param_len > sizeof(tBTA_DM_SEARCH)) ? search_devices_copy_cb : NULL);
2050 }
2051
2052 /*******************************************************************************
2053 *
2054 * Function bte_dm_search_services_evt
2055 *
2056 * Description Switches context from BTE to BTIF for DM search services
2057 * event
2058 *
2059 * Returns void
2060 *
2061 ******************************************************************************/
bte_dm_search_services_evt(tBTA_DM_SEARCH_EVT event,tBTA_DM_SEARCH * p_data)2062 static void bte_dm_search_services_evt(tBTA_DM_SEARCH_EVT event,
2063 tBTA_DM_SEARCH* p_data) {
2064 uint16_t param_len = 0;
2065 if (p_data) param_len += sizeof(tBTA_DM_SEARCH);
2066 switch (event) {
2067 case BTA_DM_DISC_RES_EVT: {
2068 if ((p_data->disc_res.result == BTA_SUCCESS) &&
2069 (p_data->disc_res.num_uuids > 0)) {
2070 param_len += (p_data->disc_res.num_uuids * MAX_UUID_SIZE);
2071 }
2072 } break;
2073 }
2074 /* TODO: The only other member that needs a deep copy is the p_raw_data. But
2075 * not sure
2076 * if raw_data is needed. */
2077 btif_transfer_context(
2078 btif_dm_search_services_evt, event, (char*)p_data, param_len,
2079 (param_len > sizeof(tBTA_DM_SEARCH)) ? search_services_copy_cb : NULL);
2080 }
2081
2082 /*******************************************************************************
2083 *
2084 * Function bte_dm_remote_service_record_evt
2085 *
2086 * Description Switches context from BTE to BTIF for DM search service
2087 * record event
2088 *
2089 * Returns void
2090 *
2091 ******************************************************************************/
bte_dm_remote_service_record_evt(tBTA_DM_SEARCH_EVT event,tBTA_DM_SEARCH * p_data)2092 static void bte_dm_remote_service_record_evt(tBTA_DM_SEARCH_EVT event,
2093 tBTA_DM_SEARCH* p_data) {
2094 /* TODO: The only member that needs a deep copy is the p_raw_data. But not
2095 * sure yet if this is needed. */
2096 btif_transfer_context(btif_dm_remote_service_record_evt, event, (char*)p_data,
2097 sizeof(tBTA_DM_SEARCH), NULL);
2098 }
2099
2100 /*******************************************************************************
2101 *
2102 * Function bta_energy_info_cb
2103 *
2104 * Description Switches context from BTE to BTIF for DM energy info event
2105 *
2106 * Returns void
2107 *
2108 ******************************************************************************/
bta_energy_info_cb(tBTA_DM_BLE_TX_TIME_MS tx_time,tBTA_DM_BLE_RX_TIME_MS rx_time,tBTA_DM_BLE_IDLE_TIME_MS idle_time,tBTA_DM_BLE_ENERGY_USED energy_used,tBTA_DM_CONTRL_STATE ctrl_state,tBTA_STATUS status)2109 static void bta_energy_info_cb(tBTA_DM_BLE_TX_TIME_MS tx_time,
2110 tBTA_DM_BLE_RX_TIME_MS rx_time,
2111 tBTA_DM_BLE_IDLE_TIME_MS idle_time,
2112 tBTA_DM_BLE_ENERGY_USED energy_used,
2113 tBTA_DM_CONTRL_STATE ctrl_state,
2114 tBTA_STATUS status) {
2115 BTIF_TRACE_DEBUG(
2116 "energy_info_cb-Status:%d,state=%d,tx_t=%ld, rx_t=%ld, "
2117 "idle_time=%ld,used=%ld",
2118 status, ctrl_state, tx_time, rx_time, idle_time, energy_used);
2119
2120 btif_activity_energy_info_cb_t btif_cb;
2121 btif_cb.status = status;
2122 btif_cb.ctrl_state = ctrl_state;
2123 btif_cb.tx_time = (uint64_t)tx_time;
2124 btif_cb.rx_time = (uint64_t)rx_time;
2125 btif_cb.idle_time = (uint64_t)idle_time;
2126 btif_cb.energy_used = (uint64_t)energy_used;
2127 btif_transfer_context(btif_dm_upstreams_evt, BTA_DM_ENER_INFO_READ,
2128 (char*)&btif_cb, sizeof(btif_activity_energy_info_cb_t),
2129 NULL);
2130 }
2131
2132 /* Scan filter param config event */
bte_scan_filt_param_cfg_evt(uint8_t ref_value,uint8_t avbl_space,uint8_t action_type,uint8_t status)2133 static void bte_scan_filt_param_cfg_evt(uint8_t ref_value, uint8_t avbl_space,
2134 uint8_t action_type, uint8_t status) {
2135 /* This event occurs on calling BTA_DmBleCfgFilterCondition internally,
2136 ** and that is why there is no HAL callback
2137 */
2138 if (BTA_SUCCESS != status) {
2139 BTIF_TRACE_ERROR("%s, %d", __func__, status);
2140 } else {
2141 BTIF_TRACE_DEBUG("%s", __func__);
2142 }
2143 }
2144
2145 /*****************************************************************************
2146 *
2147 * btif api functions (no context switch)
2148 *
2149 ****************************************************************************/
2150
2151 /*******************************************************************************
2152 *
2153 * Function btif_dm_start_discovery
2154 *
2155 * Description Start device discovery/inquiry
2156 *
2157 * Returns bt_status_t
2158 *
2159 ******************************************************************************/
btif_dm_start_discovery(void)2160 bt_status_t btif_dm_start_discovery(void) {
2161 tBTA_DM_INQ inq_params;
2162 tBTA_SERVICE_MASK services = 0;
2163
2164 BTIF_TRACE_EVENT("%s", __func__);
2165
2166 /* Cleanup anything remaining on index 0 */
2167 do_in_bta_thread(
2168 FROM_HERE,
2169 base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_DELETE, 0,
2170 nullptr, base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
2171
2172 auto adv_filt_param = std::make_unique<btgatt_filt_param_setup_t>();
2173 /* Add an allow-all filter on index 0*/
2174 adv_filt_param->dely_mode = IMMEDIATE_DELY_MODE;
2175 adv_filt_param->feat_seln = ALLOW_ALL_FILTER;
2176 adv_filt_param->filt_logic_type = BTA_DM_BLE_PF_FILT_LOGIC_OR;
2177 adv_filt_param->list_logic_type = BTA_DM_BLE_PF_LIST_LOGIC_OR;
2178 adv_filt_param->rssi_low_thres = LOWEST_RSSI_VALUE;
2179 adv_filt_param->rssi_high_thres = LOWEST_RSSI_VALUE;
2180 do_in_bta_thread(
2181 FROM_HERE, base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_ADD,
2182 0, base::Passed(&adv_filt_param),
2183 base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
2184
2185 /* TODO: Do we need to handle multiple inquiries at the same time? */
2186
2187 /* Set inquiry params and call API */
2188 inq_params.mode = BTA_DM_GENERAL_INQUIRY | BTA_BLE_GENERAL_INQUIRY;
2189 #if (BTA_HOST_INTERLEAVE_SEARCH == TRUE)
2190 inq_params.intl_duration[0] = BTIF_DM_INTERLEAVE_DURATION_BR_ONE;
2191 inq_params.intl_duration[1] = BTIF_DM_INTERLEAVE_DURATION_LE_ONE;
2192 inq_params.intl_duration[2] = BTIF_DM_INTERLEAVE_DURATION_BR_TWO;
2193 inq_params.intl_duration[3] = BTIF_DM_INTERLEAVE_DURATION_LE_TWO;
2194 #endif
2195 inq_params.duration = BTIF_DM_DEFAULT_INQ_MAX_DURATION;
2196
2197 inq_params.max_resps = BTIF_DM_DEFAULT_INQ_MAX_RESULTS;
2198 inq_params.report_dup = true;
2199
2200 inq_params.filter_type = BTA_DM_INQ_CLR;
2201 /* TODO: Filter device by BDA needs to be implemented here */
2202
2203 /* Will be enabled to true once inquiry busy level has been received */
2204 btif_dm_inquiry_in_progress = false;
2205 /* find nearby devices */
2206 BTA_DmSearch(&inq_params, services, bte_search_devices_evt);
2207
2208 return BT_STATUS_SUCCESS;
2209 }
2210
2211 /*******************************************************************************
2212 *
2213 * Function btif_dm_cancel_discovery
2214 *
2215 * Description Cancels search
2216 *
2217 * Returns bt_status_t
2218 *
2219 ******************************************************************************/
btif_dm_cancel_discovery(void)2220 bt_status_t btif_dm_cancel_discovery(void) {
2221 BTIF_TRACE_EVENT("%s", __func__);
2222 BTA_DmSearchCancel();
2223 return BT_STATUS_SUCCESS;
2224 }
2225
2226 /*******************************************************************************
2227 *
2228 * Function btif_dm_create_bond
2229 *
2230 * Description Initiate bonding with the specified device
2231 *
2232 * Returns bt_status_t
2233 *
2234 ******************************************************************************/
btif_dm_create_bond(const bt_bdaddr_t * bd_addr,int transport)2235 bt_status_t btif_dm_create_bond(const bt_bdaddr_t* bd_addr, int transport) {
2236 btif_dm_create_bond_cb_t create_bond_cb;
2237 create_bond_cb.transport = transport;
2238 bdcpy(create_bond_cb.bdaddr.address, bd_addr->address);
2239
2240 bdstr_t bdstr;
2241 BTIF_TRACE_EVENT("%s: bd_addr=%s, transport=%d", __func__,
2242 bdaddr_to_string(bd_addr, bdstr, sizeof(bdstr)), transport);
2243 if (pairing_cb.state != BT_BOND_STATE_NONE) return BT_STATUS_BUSY;
2244
2245 btif_stats_add_bond_event(bd_addr, BTIF_DM_FUNC_CREATE_BOND,
2246 pairing_cb.state);
2247
2248 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_CREATE_BOND,
2249 (char*)&create_bond_cb,
2250 sizeof(btif_dm_create_bond_cb_t), NULL);
2251
2252 return BT_STATUS_SUCCESS;
2253 }
2254
2255 /*******************************************************************************
2256 *
2257 * Function btif_dm_create_bond_out_of_band
2258 *
2259 * Description Initiate bonding with the specified device using out of band
2260 * data
2261 *
2262 * Returns bt_status_t
2263 *
2264 ******************************************************************************/
btif_dm_create_bond_out_of_band(const bt_bdaddr_t * bd_addr,int transport,const bt_out_of_band_data_t * oob_data)2265 bt_status_t btif_dm_create_bond_out_of_band(
2266 const bt_bdaddr_t* bd_addr, int transport,
2267 const bt_out_of_band_data_t* oob_data) {
2268 bdcpy(oob_cb.bdaddr, bd_addr->address);
2269 memcpy(&oob_cb.oob_data, oob_data, sizeof(bt_out_of_band_data_t));
2270
2271 uint8_t empty[] = {0, 0, 0, 0, 0, 0, 0};
2272 // If LE Bluetooth Device Address is provided, use provided address type
2273 // value.
2274 if (memcmp(oob_data->le_bt_dev_addr, empty, 7) != 0) {
2275 /* byte no 7 is address type in LE Bluetooth Address OOB data */
2276 uint8_t address_type = oob_data->le_bt_dev_addr[6];
2277 if (address_type == BLE_ADDR_PUBLIC || address_type == BLE_ADDR_RANDOM) {
2278 // bd_addr->address is already reversed, so use it instead of
2279 // oob_data->le_bt_dev_addr
2280 BTM_SecAddBleDevice(bd_addr->address, NULL, BT_DEVICE_TYPE_BLE,
2281 address_type);
2282 }
2283 }
2284
2285 bdstr_t bdstr;
2286 BTIF_TRACE_EVENT("%s: bd_addr=%s, transport=%d", __func__,
2287 bdaddr_to_string(bd_addr, bdstr, sizeof(bdstr)), transport);
2288 return btif_dm_create_bond(bd_addr, transport);
2289 }
2290
2291 /*******************************************************************************
2292 *
2293 * Function btif_dm_cancel_bond
2294 *
2295 * Description Initiate bonding with the specified device
2296 *
2297 * Returns bt_status_t
2298 *
2299 ******************************************************************************/
2300
btif_dm_cancel_bond(const bt_bdaddr_t * bd_addr)2301 bt_status_t btif_dm_cancel_bond(const bt_bdaddr_t* bd_addr) {
2302 bdstr_t bdstr;
2303
2304 BTIF_TRACE_EVENT("%s: bd_addr=%s", __func__,
2305 bdaddr_to_string(bd_addr, bdstr, sizeof(bdstr)));
2306
2307 btif_stats_add_bond_event(bd_addr, BTIF_DM_FUNC_CANCEL_BOND,
2308 pairing_cb.state);
2309
2310 /* TODO:
2311 ** 1. Restore scan modes
2312 ** 2. special handling for HID devices
2313 */
2314 if (pairing_cb.state == BT_BOND_STATE_BONDING) {
2315 if (pairing_cb.is_ssp) {
2316 if (pairing_cb.is_le_only) {
2317 BTA_DmBleSecurityGrant((uint8_t*)bd_addr->address,
2318 BTA_DM_SEC_PAIR_NOT_SPT);
2319 } else {
2320 BTA_DmConfirm((uint8_t*)bd_addr->address, false);
2321 BTA_DmBondCancel((uint8_t*)bd_addr->address);
2322 btif_storage_remove_bonded_device((bt_bdaddr_t*)bd_addr);
2323 }
2324 } else {
2325 if (pairing_cb.is_le_only) {
2326 BTA_DmBondCancel((uint8_t*)bd_addr->address);
2327 } else {
2328 BTA_DmPinReply((uint8_t*)bd_addr->address, false, 0, NULL);
2329 }
2330 /* Cancel bonding, in case it is in ACL connection setup state */
2331 BTA_DmBondCancel((uint8_t*)bd_addr->address);
2332 }
2333 }
2334
2335 return BT_STATUS_SUCCESS;
2336 }
2337
2338 /*******************************************************************************
2339 *
2340 * Function btif_dm_hh_open_failed
2341 *
2342 * Description informs the upper layers if the HH have failed during
2343 * bonding
2344 *
2345 * Returns none
2346 *
2347 ******************************************************************************/
2348
btif_dm_hh_open_failed(bt_bdaddr_t * bdaddr)2349 void btif_dm_hh_open_failed(bt_bdaddr_t* bdaddr) {
2350 if (pairing_cb.state == BT_BOND_STATE_BONDING &&
2351 bdcmp(bdaddr->address, pairing_cb.bd_addr) == 0) {
2352 bond_state_changed(BT_STATUS_FAIL, bdaddr, BT_BOND_STATE_NONE);
2353 }
2354 }
2355
2356 /*******************************************************************************
2357 *
2358 * Function btif_dm_remove_bond
2359 *
2360 * Description Removes bonding with the specified device
2361 *
2362 * Returns bt_status_t
2363 *
2364 ******************************************************************************/
2365
btif_dm_remove_bond(const bt_bdaddr_t * bd_addr)2366 bt_status_t btif_dm_remove_bond(const bt_bdaddr_t* bd_addr) {
2367 bdstr_t bdstr;
2368
2369 BTIF_TRACE_EVENT("%s: bd_addr=%s", __func__,
2370 bdaddr_to_string(bd_addr, bdstr, sizeof(bdstr)));
2371
2372 btif_stats_add_bond_event(bd_addr, BTIF_DM_FUNC_REMOVE_BOND,
2373 pairing_cb.state);
2374
2375 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_REMOVE_BOND,
2376 (char*)bd_addr, sizeof(bt_bdaddr_t), NULL);
2377
2378 return BT_STATUS_SUCCESS;
2379 }
2380
2381 /*******************************************************************************
2382 *
2383 * Function btif_dm_pin_reply
2384 *
2385 * Description BT legacy pairing - PIN code reply
2386 *
2387 * Returns bt_status_t
2388 *
2389 ******************************************************************************/
2390
btif_dm_pin_reply(const bt_bdaddr_t * bd_addr,uint8_t accept,uint8_t pin_len,bt_pin_code_t * pin_code)2391 bt_status_t btif_dm_pin_reply(const bt_bdaddr_t* bd_addr, uint8_t accept,
2392 uint8_t pin_len, bt_pin_code_t* pin_code) {
2393 BTIF_TRACE_EVENT("%s: accept=%d", __func__, accept);
2394 if (pin_code == NULL || pin_len > PIN_CODE_LEN) return BT_STATUS_FAIL;
2395 if (pairing_cb.is_le_only) {
2396 int i;
2397 uint32_t passkey = 0;
2398 int multi[] = {100000, 10000, 1000, 100, 10, 1};
2399 BD_ADDR remote_bd_addr;
2400 bdcpy(remote_bd_addr, bd_addr->address);
2401 for (i = 0; i < 6; i++) {
2402 passkey += (multi[i] * (pin_code->pin[i] - '0'));
2403 }
2404 BTIF_TRACE_DEBUG("btif_dm_pin_reply: passkey: %d", passkey);
2405 BTA_DmBlePasskeyReply(remote_bd_addr, accept, passkey);
2406
2407 } else {
2408 BTA_DmPinReply((uint8_t*)bd_addr->address, accept, pin_len, pin_code->pin);
2409 if (accept) pairing_cb.pin_code_len = pin_len;
2410 }
2411 return BT_STATUS_SUCCESS;
2412 }
2413
2414 /*******************************************************************************
2415 *
2416 * Function btif_dm_ssp_reply
2417 *
2418 * Description BT SSP Reply - Just Works, Numeric Comparison & Passkey
2419 * Entry
2420 *
2421 * Returns bt_status_t
2422 *
2423 ******************************************************************************/
btif_dm_ssp_reply(const bt_bdaddr_t * bd_addr,bt_ssp_variant_t variant,uint8_t accept,UNUSED_ATTR uint32_t passkey)2424 bt_status_t btif_dm_ssp_reply(const bt_bdaddr_t* bd_addr,
2425 bt_ssp_variant_t variant, uint8_t accept,
2426 UNUSED_ATTR uint32_t passkey) {
2427 if (variant == BT_SSP_VARIANT_PASSKEY_ENTRY) {
2428 /* This is not implemented in the stack.
2429 * For devices with display, this is not needed
2430 */
2431 BTIF_TRACE_WARNING("%s: Not implemented", __func__);
2432 return BT_STATUS_FAIL;
2433 }
2434 /* BT_SSP_VARIANT_CONSENT & BT_SSP_VARIANT_PASSKEY_CONFIRMATION supported */
2435 BTIF_TRACE_EVENT("%s: accept=%d", __func__, accept);
2436 if (pairing_cb.is_le_only) {
2437 if (pairing_cb.is_le_nc) {
2438 BTA_DmBleConfirmReply((uint8_t*)bd_addr->address, accept);
2439 } else {
2440 if (accept)
2441 BTA_DmBleSecurityGrant((uint8_t*)bd_addr->address, BTA_DM_SEC_GRANTED);
2442 else
2443 BTA_DmBleSecurityGrant((uint8_t*)bd_addr->address,
2444 BTA_DM_SEC_PAIR_NOT_SPT);
2445 }
2446 } else {
2447 BTA_DmConfirm((uint8_t*)bd_addr->address, accept);
2448 }
2449 return BT_STATUS_SUCCESS;
2450 }
2451
2452 /*******************************************************************************
2453 *
2454 * Function btif_dm_get_adapter_property
2455 *
2456 * Description Queries the BTA for the adapter property
2457 *
2458 * Returns bt_status_t
2459 *
2460 ******************************************************************************/
btif_dm_get_adapter_property(bt_property_t * prop)2461 bt_status_t btif_dm_get_adapter_property(bt_property_t* prop) {
2462 BTIF_TRACE_EVENT("%s: type=0x%x", __func__, prop->type);
2463 switch (prop->type) {
2464 case BT_PROPERTY_BDNAME: {
2465 bt_bdname_t* bd_name = (bt_bdname_t*)prop->val;
2466 strncpy((char*)bd_name->name, (char*)btif_get_default_local_name(),
2467 sizeof(bd_name->name) - 1);
2468 bd_name->name[sizeof(bd_name->name) - 1] = 0;
2469 prop->len = strlen((char*)bd_name->name);
2470 } break;
2471
2472 case BT_PROPERTY_ADAPTER_SCAN_MODE: {
2473 /* if the storage does not have it. Most likely app never set it. Default
2474 * is NONE */
2475 bt_scan_mode_t* mode = (bt_scan_mode_t*)prop->val;
2476 *mode = BT_SCAN_MODE_NONE;
2477 prop->len = sizeof(bt_scan_mode_t);
2478 } break;
2479
2480 case BT_PROPERTY_ADAPTER_DISCOVERY_TIMEOUT: {
2481 uint32_t* tmt = (uint32_t*)prop->val;
2482 *tmt = 120; /* default to 120s, if not found in NV */
2483 prop->len = sizeof(uint32_t);
2484 } break;
2485
2486 default:
2487 prop->len = 0;
2488 return BT_STATUS_FAIL;
2489 }
2490 return BT_STATUS_SUCCESS;
2491 }
2492
2493 /*******************************************************************************
2494 *
2495 * Function btif_dm_get_remote_services
2496 *
2497 * Description Start SDP to get remote services
2498 *
2499 * Returns bt_status_t
2500 *
2501 ******************************************************************************/
btif_dm_get_remote_services(bt_bdaddr_t * remote_addr)2502 bt_status_t btif_dm_get_remote_services(bt_bdaddr_t* remote_addr) {
2503 bdstr_t bdstr;
2504
2505 BTIF_TRACE_EVENT("%s: remote_addr=%s", __func__,
2506 bdaddr_to_string(remote_addr, bdstr, sizeof(bdstr)));
2507
2508 BTA_DmDiscover(remote_addr->address, BTA_ALL_SERVICE_MASK,
2509 bte_dm_search_services_evt, true);
2510
2511 return BT_STATUS_SUCCESS;
2512 }
2513
2514 /*******************************************************************************
2515 *
2516 * Function btif_dm_get_remote_services_transport
2517 *
2518 * Description Start SDP to get remote services by transport
2519 *
2520 * Returns bt_status_t
2521 *
2522 ******************************************************************************/
btif_dm_get_remote_services_by_transport(bt_bdaddr_t * remote_addr,const int transport)2523 bt_status_t btif_dm_get_remote_services_by_transport(bt_bdaddr_t* remote_addr,
2524 const int transport) {
2525 BTIF_TRACE_EVENT("%s", __func__);
2526
2527 /* Set the mask extension */
2528 tBTA_SERVICE_MASK_EXT mask_ext;
2529 mask_ext.num_uuid = 0;
2530 mask_ext.p_uuid = NULL;
2531 mask_ext.srvc_mask = BTA_ALL_SERVICE_MASK;
2532
2533 BTA_DmDiscoverByTransport(remote_addr->address, &mask_ext,
2534 bte_dm_search_services_evt, true, transport);
2535
2536 return BT_STATUS_SUCCESS;
2537 }
2538
2539 /*******************************************************************************
2540 *
2541 * Function btif_dm_get_remote_service_record
2542 *
2543 * Description Start SDP to get remote service record
2544 *
2545 *
2546 * Returns bt_status_t
2547 ******************************************************************************/
btif_dm_get_remote_service_record(bt_bdaddr_t * remote_addr,bt_uuid_t * uuid)2548 bt_status_t btif_dm_get_remote_service_record(bt_bdaddr_t* remote_addr,
2549 bt_uuid_t* uuid) {
2550 tSDP_UUID sdp_uuid;
2551 bdstr_t bdstr;
2552
2553 BTIF_TRACE_EVENT("%s: remote_addr=%s", __func__,
2554 bdaddr_to_string(remote_addr, bdstr, sizeof(bdstr)));
2555
2556 sdp_uuid.len = MAX_UUID_SIZE;
2557 memcpy(sdp_uuid.uu.uuid128, uuid->uu, MAX_UUID_SIZE);
2558
2559 BTA_DmDiscoverUUID(remote_addr->address, &sdp_uuid,
2560 bte_dm_remote_service_record_evt, true);
2561
2562 return BT_STATUS_SUCCESS;
2563 }
2564
btif_dm_execute_service_request(uint16_t event,char * p_param)2565 void btif_dm_execute_service_request(uint16_t event, char* p_param) {
2566 bool b_enable = false;
2567 bt_status_t status;
2568 if (event == BTIF_DM_ENABLE_SERVICE) {
2569 b_enable = true;
2570 }
2571 status =
2572 btif_in_execute_service_request(*((tBTA_SERVICE_ID*)p_param), b_enable);
2573 if (status == BT_STATUS_SUCCESS) {
2574 bt_property_t property;
2575 bt_uuid_t local_uuids[BT_MAX_NUM_UUIDS];
2576
2577 /* Now send the UUID_PROPERTY_CHANGED event to the upper layer */
2578 BTIF_STORAGE_FILL_PROPERTY(&property, BT_PROPERTY_UUIDS,
2579 sizeof(local_uuids), local_uuids);
2580 btif_storage_get_adapter_property(&property);
2581 HAL_CBACK(bt_hal_cbacks, adapter_properties_cb, BT_STATUS_SUCCESS, 1,
2582 &property);
2583 }
2584 return;
2585 }
2586
btif_dm_proc_io_req(UNUSED_ATTR BD_ADDR bd_addr,UNUSED_ATTR tBTA_IO_CAP * p_io_cap,UNUSED_ATTR tBTA_OOB_DATA * p_oob_data,tBTA_AUTH_REQ * p_auth_req,bool is_orig)2587 void btif_dm_proc_io_req(UNUSED_ATTR BD_ADDR bd_addr,
2588 UNUSED_ATTR tBTA_IO_CAP* p_io_cap,
2589 UNUSED_ATTR tBTA_OOB_DATA* p_oob_data,
2590 tBTA_AUTH_REQ* p_auth_req, bool is_orig) {
2591 uint8_t yes_no_bit = BTA_AUTH_SP_YES & *p_auth_req;
2592 /* if local initiated:
2593 ** 1. set DD + MITM
2594 ** if remote initiated:
2595 ** 1. Copy over the auth_req from peer's io_rsp
2596 ** 2. Set the MITM if peer has it set or if peer has DisplayYesNo
2597 *(iPhone)
2598 ** as a fallback set MITM+GB if peer had MITM set
2599 */
2600
2601 BTIF_TRACE_DEBUG("+%s: p_auth_req=%d", __func__, *p_auth_req);
2602 if (pairing_cb.is_local_initiated) {
2603 /* if initing/responding to a dedicated bonding, use dedicate bonding bit */
2604 *p_auth_req = BTA_AUTH_DD_BOND | BTA_AUTH_SP_YES;
2605 } else if (!is_orig) {
2606 /* peer initiated paring. They probably know what they want.
2607 ** Copy the mitm from peer device.
2608 */
2609 BTIF_TRACE_DEBUG("%s: setting p_auth_req to peer's: %d", __func__,
2610 pairing_cb.auth_req);
2611 *p_auth_req = (pairing_cb.auth_req & BTA_AUTH_BONDS);
2612
2613 /* copy over the MITM bit as well. In addition if the peer has DisplayYesNo,
2614 * force MITM */
2615 if ((yes_no_bit) || (pairing_cb.io_cap & BTM_IO_CAP_IO))
2616 *p_auth_req |= BTA_AUTH_SP_YES;
2617 } else if (yes_no_bit) {
2618 /* set the general bonding bit for stored device */
2619 *p_auth_req = BTA_AUTH_GEN_BOND | yes_no_bit;
2620 }
2621 BTIF_TRACE_DEBUG("-%s: p_auth_req=%d", __func__, *p_auth_req);
2622 }
2623
btif_dm_proc_io_rsp(UNUSED_ATTR BD_ADDR bd_addr,tBTA_IO_CAP io_cap,UNUSED_ATTR tBTA_OOB_DATA oob_data,tBTA_AUTH_REQ auth_req)2624 void btif_dm_proc_io_rsp(UNUSED_ATTR BD_ADDR bd_addr, tBTA_IO_CAP io_cap,
2625 UNUSED_ATTR tBTA_OOB_DATA oob_data,
2626 tBTA_AUTH_REQ auth_req) {
2627 if (auth_req & BTA_AUTH_BONDS) {
2628 BTIF_TRACE_DEBUG("%s auth_req:%d", __func__, auth_req);
2629 pairing_cb.auth_req = auth_req;
2630 pairing_cb.io_cap = io_cap;
2631 }
2632 }
2633
btif_dm_set_oob_for_io_req(tBTA_OOB_DATA * p_has_oob_data)2634 void btif_dm_set_oob_for_io_req(tBTA_OOB_DATA* p_has_oob_data) {
2635 if (is_empty_128bit(oob_cb.oob_data.c192)) {
2636 *p_has_oob_data = false;
2637 } else {
2638 *p_has_oob_data = true;
2639 }
2640 BTIF_TRACE_DEBUG("%s: *p_has_oob_data=%d", __func__, *p_has_oob_data);
2641 }
2642
btif_dm_set_oob_for_le_io_req(BD_ADDR bd_addr,tBTA_OOB_DATA * p_has_oob_data,tBTA_LE_AUTH_REQ * p_auth_req)2643 void btif_dm_set_oob_for_le_io_req(BD_ADDR bd_addr,
2644 tBTA_OOB_DATA* p_has_oob_data,
2645 tBTA_LE_AUTH_REQ* p_auth_req) {
2646 if (!is_empty_128bit(oob_cb.oob_data.le_sc_c) &&
2647 !is_empty_128bit(oob_cb.oob_data.le_sc_r)) {
2648 /* We have LE SC OOB data */
2649
2650 /* make sure OOB data is for this particular device */
2651 if (memcmp(bd_addr, oob_cb.bdaddr, BD_ADDR_LEN) == 0) {
2652 *p_auth_req = ((*p_auth_req) | BTM_LE_AUTH_REQ_SC_ONLY);
2653 *p_has_oob_data = true;
2654 } else {
2655 *p_has_oob_data = false;
2656 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
2657 __func__);
2658 }
2659 } else if (!is_empty_128bit(oob_cb.oob_data.sm_tk)) {
2660 /* We have security manager TK */
2661
2662 /* make sure OOB data is for this particular device */
2663 if (memcmp(bd_addr, oob_cb.bdaddr, BD_ADDR_LEN) == 0) {
2664 // When using OOB with TK, SC Secure Connections bit must be disabled.
2665 tBTA_LE_AUTH_REQ mask = ~BTM_LE_AUTH_REQ_SC_ONLY;
2666 *p_auth_req = ((*p_auth_req) & mask);
2667
2668 *p_has_oob_data = true;
2669 } else {
2670 *p_has_oob_data = false;
2671 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
2672 __func__);
2673 }
2674 } else {
2675 *p_has_oob_data = false;
2676 }
2677 BTIF_TRACE_DEBUG("%s *p_has_oob_data=%d", __func__, *p_has_oob_data);
2678 }
2679
2680 #ifdef BTIF_DM_OOB_TEST
btif_dm_load_local_oob(void)2681 void btif_dm_load_local_oob(void) {
2682 char prop_oob[PROPERTY_VALUE_MAX];
2683 osi_property_get("service.brcm.bt.oob", prop_oob, "3");
2684 BTIF_TRACE_DEBUG("%s: prop_oob = %s", __func__, prop_oob);
2685 if (prop_oob[0] != '3') {
2686 if (is_empty_128bit(oob_cb.oob_data.c192)) {
2687 BTIF_TRACE_DEBUG("%s: read OOB, call BTA_DmLocalOob()", __func__);
2688 BTA_DmLocalOob();
2689 }
2690 }
2691 }
2692
btif_dm_proc_loc_oob(bool valid,BT_OCTET16 c,BT_OCTET16 r)2693 void btif_dm_proc_loc_oob(bool valid, BT_OCTET16 c, BT_OCTET16 r) {
2694 FILE* fp;
2695 const char* path_a = "/data/misc/bluedroid/LOCAL/a.key";
2696 const char* path_b = "/data/misc/bluedroid/LOCAL/b.key";
2697 const char* path = NULL;
2698 char prop_oob[PROPERTY_VALUE_MAX];
2699 BTIF_TRACE_DEBUG("%s: valid=%d", __func__, valid);
2700 if (is_empty_128bit(oob_cb.oob_data.c192) && valid) {
2701 BTIF_TRACE_DEBUG("save local OOB data in memory");
2702 memcpy(oob_cb.oob_data.c192, c, BT_OCTET16_LEN);
2703 memcpy(oob_cb.oob_data.r192, r, BT_OCTET16_LEN);
2704 osi_property_get("service.brcm.bt.oob", prop_oob, "3");
2705 BTIF_TRACE_DEBUG("%s: prop_oob = %s", __func__, prop_oob);
2706 if (prop_oob[0] == '1')
2707 path = path_a;
2708 else if (prop_oob[0] == '2')
2709 path = path_b;
2710 if (path) {
2711 fp = fopen(path, "wb+");
2712 if (fp == NULL) {
2713 BTIF_TRACE_DEBUG("%s: failed to save local OOB data to %s", __func__,
2714 path);
2715 } else {
2716 BTIF_TRACE_DEBUG("%s: save local OOB data into file %s", __func__,
2717 path);
2718 fwrite(c, 1, BT_OCTET16_LEN, fp);
2719 fwrite(r, 1, BT_OCTET16_LEN, fp);
2720 fclose(fp);
2721 }
2722 }
2723 }
2724 }
2725
2726 /*******************************************************************************
2727 *
2728 * Function btif_dm_get_smp_config
2729 *
2730 * Description Retrieve the SMP pairing options from the bt_stack.conf
2731 * file. To provide specific pairing options for the host
2732 * add a node with label "SmpOptions" to the config file
2733 * and assign it a comma separated list of 5 values in the
2734 * format: auth, io, ikey, rkey, ksize, oob
2735 * eg: PTS_SmpOptions=0xD,0x4,0xf,0xf,0x10
2736 *
2737 * Parameters: tBTE_APPL_CFG*: pointer to struct defining pairing options
2738 *
2739 * Returns true if the options were successfully read, else false
2740 *
2741 ******************************************************************************/
btif_dm_get_smp_config(tBTE_APPL_CFG * p_cfg)2742 bool btif_dm_get_smp_config(tBTE_APPL_CFG* p_cfg) {
2743 if (!stack_config_get_interface()->get_pts_smp_options()) {
2744 BTIF_TRACE_DEBUG("%s: SMP options not found in configuration", __func__);
2745 return false;
2746 }
2747
2748 char conf[64];
2749 const char* recv = stack_config_get_interface()->get_pts_smp_options();
2750 char* pch;
2751 char* endptr;
2752
2753 strncpy(conf, recv, 64);
2754 conf[63] = 0; // null terminate
2755
2756 pch = strtok(conf, ",");
2757 if (pch != NULL)
2758 p_cfg->ble_auth_req = (uint8_t)strtoul(pch, &endptr, 16);
2759 else
2760 return false;
2761
2762 pch = strtok(NULL, ",");
2763 if (pch != NULL)
2764 p_cfg->ble_io_cap = (uint8_t)strtoul(pch, &endptr, 16);
2765 else
2766 return false;
2767
2768 pch = strtok(NULL, ",");
2769 if (pch != NULL)
2770 p_cfg->ble_init_key = (uint8_t)strtoul(pch, &endptr, 16);
2771 else
2772 return false;
2773
2774 pch = strtok(NULL, ",");
2775 if (pch != NULL)
2776 p_cfg->ble_resp_key = (uint8_t)strtoul(pch, &endptr, 16);
2777 else
2778 return false;
2779
2780 pch = strtok(NULL, ",");
2781 if (pch != NULL)
2782 p_cfg->ble_max_key_size = (uint8_t)strtoul(pch, &endptr, 16);
2783 else
2784 return false;
2785
2786 return true;
2787 }
2788
btif_dm_proc_rmt_oob(BD_ADDR bd_addr,BT_OCTET16 p_c,BT_OCTET16 p_r)2789 bool btif_dm_proc_rmt_oob(BD_ADDR bd_addr, BT_OCTET16 p_c, BT_OCTET16 p_r) {
2790 char t[128];
2791 FILE* fp;
2792 const char* path_a = "/data/misc/bluedroid/LOCAL/a.key";
2793 const char* path_b = "/data/misc/bluedroid/LOCAL/b.key";
2794 const char* path = NULL;
2795 char prop_oob[PROPERTY_VALUE_MAX];
2796 bool result = false;
2797 bt_bdaddr_t bt_bd_addr;
2798 bdcpy(oob_cb.bdaddr, bd_addr);
2799 osi_property_get("service.brcm.bt.oob", prop_oob, "3");
2800 BTIF_TRACE_DEBUG("%s: prop_oob = %s", __func__, prop_oob);
2801 if (prop_oob[0] == '1')
2802 path = path_b;
2803 else if (prop_oob[0] == '2')
2804 path = path_a;
2805 if (path) {
2806 fp = fopen(path, "rb");
2807 if (fp == NULL) {
2808 BTIF_TRACE_DEBUG("%s: failed to read OOB keys from %s", __func__, path);
2809 return false;
2810 } else {
2811 BTIF_TRACE_DEBUG("%s: read OOB data from %s", __func__, path);
2812 fread(p_c, 1, BT_OCTET16_LEN, fp);
2813 fread(p_r, 1, BT_OCTET16_LEN, fp);
2814 fclose(fp);
2815 }
2816 BTIF_TRACE_DEBUG("----%s: true", __func__);
2817 snprintf(t, sizeof(t), "%02x:%02x:%02x:%02x:%02x:%02x", oob_cb.bdaddr[0],
2818 oob_cb.bdaddr[1], oob_cb.bdaddr[2], oob_cb.bdaddr[3],
2819 oob_cb.bdaddr[4], oob_cb.bdaddr[5]);
2820 BTIF_TRACE_DEBUG("----%s: peer_bdaddr = %s", __func__, t);
2821 snprintf(t, sizeof(t),
2822 "%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x "
2823 "%02x %02x %02x",
2824 p_c[0], p_c[1], p_c[2], p_c[3], p_c[4], p_c[5], p_c[6], p_c[7],
2825 p_c[8], p_c[9], p_c[10], p_c[11], p_c[12], p_c[13], p_c[14],
2826 p_c[15]);
2827 BTIF_TRACE_DEBUG("----%s: c = %s", __func__, t);
2828 snprintf(t, sizeof(t),
2829 "%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x "
2830 "%02x %02x %02x",
2831 p_r[0], p_r[1], p_r[2], p_r[3], p_r[4], p_r[5], p_r[6], p_r[7],
2832 p_r[8], p_r[9], p_r[10], p_r[11], p_r[12], p_r[13], p_r[14],
2833 p_r[15]);
2834 BTIF_TRACE_DEBUG("----%s: r = %s", __func__, t);
2835 bdcpy(bt_bd_addr.address, bd_addr);
2836 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_BOND_STATE_BONDING,
2837 (char*)&bt_bd_addr, sizeof(bt_bdaddr_t), NULL);
2838 result = true;
2839 }
2840 BTIF_TRACE_DEBUG("%s: result=%d", __func__, result);
2841 return result;
2842 }
2843 #endif /* BTIF_DM_OOB_TEST */
2844
btif_dm_ble_key_notif_evt(tBTA_DM_SP_KEY_NOTIF * p_ssp_key_notif)2845 static void btif_dm_ble_key_notif_evt(tBTA_DM_SP_KEY_NOTIF* p_ssp_key_notif) {
2846 bt_bdaddr_t bd_addr;
2847 bt_bdname_t bd_name;
2848 uint32_t cod;
2849 int dev_type;
2850
2851 BTIF_TRACE_DEBUG("%s", __func__);
2852
2853 /* Remote name update */
2854 if (!btif_get_device_type(p_ssp_key_notif->bd_addr, &dev_type)) {
2855 dev_type = BT_DEVICE_TYPE_BLE;
2856 }
2857 btif_dm_update_ble_remote_properties(p_ssp_key_notif->bd_addr,
2858 p_ssp_key_notif->bd_name,
2859 (tBT_DEVICE_TYPE)dev_type);
2860 bdcpy(bd_addr.address, p_ssp_key_notif->bd_addr);
2861 memcpy(bd_name.name, p_ssp_key_notif->bd_name, BD_NAME_LEN);
2862
2863 bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
2864 pairing_cb.is_ssp = false;
2865 cod = COD_UNCLASSIFIED;
2866
2867 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
2868 BT_SSP_VARIANT_PASSKEY_NOTIFICATION, p_ssp_key_notif->passkey);
2869 }
2870
2871 /*******************************************************************************
2872 *
2873 * Function btif_dm_ble_auth_cmpl_evt
2874 *
2875 * Description Executes authentication complete event in btif context
2876 *
2877 * Returns void
2878 *
2879 ******************************************************************************/
btif_dm_ble_auth_cmpl_evt(tBTA_DM_AUTH_CMPL * p_auth_cmpl)2880 static void btif_dm_ble_auth_cmpl_evt(tBTA_DM_AUTH_CMPL* p_auth_cmpl) {
2881 /* Save link key, if not temporary */
2882 bt_bdaddr_t bd_addr;
2883 bt_status_t status = BT_STATUS_FAIL;
2884 bt_bond_state_t state = BT_BOND_STATE_NONE;
2885
2886 bdcpy(bd_addr.address, p_auth_cmpl->bd_addr);
2887
2888 /* Clear OOB data */
2889 memset(&oob_cb, 0, sizeof(oob_cb));
2890
2891 if ((p_auth_cmpl->success == true) && (p_auth_cmpl->key_present)) {
2892 /* store keys */
2893 }
2894 if (p_auth_cmpl->success) {
2895 status = BT_STATUS_SUCCESS;
2896 state = BT_BOND_STATE_BONDED;
2897 int addr_type;
2898 bt_bdaddr_t bdaddr;
2899 bdcpy(bdaddr.address, p_auth_cmpl->bd_addr);
2900 if (btif_storage_get_remote_addr_type(&bdaddr, &addr_type) !=
2901 BT_STATUS_SUCCESS)
2902 btif_storage_set_remote_addr_type(&bdaddr, p_auth_cmpl->addr_type);
2903
2904 /* Test for temporary bonding */
2905 if (btm_get_bond_type_dev(p_auth_cmpl->bd_addr) == BOND_TYPE_TEMPORARY) {
2906 BTIF_TRACE_DEBUG("%s: sending BT_BOND_STATE_NONE for Temp pairing",
2907 __func__);
2908 btif_storage_remove_bonded_device(&bdaddr);
2909 state = BT_BOND_STATE_NONE;
2910 } else {
2911 btif_dm_save_ble_bonding_keys();
2912 BTA_GATTC_Refresh(bd_addr.address);
2913 btif_dm_get_remote_services_by_transport(&bd_addr, BTA_GATT_TRANSPORT_LE);
2914 }
2915 } else {
2916 /*Map the HCI fail reason to bt status */
2917 switch (p_auth_cmpl->fail_reason) {
2918 case BTA_DM_AUTH_SMP_PAIR_AUTH_FAIL:
2919 case BTA_DM_AUTH_SMP_CONFIRM_VALUE_FAIL:
2920 case BTA_DM_AUTH_SMP_UNKNOWN_ERR:
2921 case BTA_DM_AUTH_SMP_CONN_TOUT:
2922 btif_dm_remove_ble_bonding_keys();
2923 status = BT_STATUS_AUTH_FAILURE;
2924 break;
2925 case BTA_DM_AUTH_SMP_PAIR_NOT_SUPPORT:
2926 status = BT_STATUS_AUTH_REJECTED;
2927 break;
2928 default:
2929 btif_dm_remove_ble_bonding_keys();
2930 status = BT_STATUS_FAIL;
2931 break;
2932 }
2933 }
2934 bond_state_changed(status, &bd_addr, state);
2935 }
2936
btif_dm_load_ble_local_keys(void)2937 void btif_dm_load_ble_local_keys(void) {
2938 memset(&ble_local_key_cb, 0, sizeof(btif_dm_local_key_cb_t));
2939
2940 if (btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_ER,
2941 (char*)&ble_local_key_cb.er[0],
2942 BT_OCTET16_LEN) == BT_STATUS_SUCCESS) {
2943 ble_local_key_cb.is_er_rcvd = true;
2944 BTIF_TRACE_DEBUG("%s BLE ER key loaded", __func__);
2945 }
2946
2947 if ((btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_IR,
2948 (char*)&ble_local_key_cb.id_keys.ir[0],
2949 BT_OCTET16_LEN) == BT_STATUS_SUCCESS) &&
2950 (btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_IRK,
2951 (char*)&ble_local_key_cb.id_keys.irk[0],
2952 BT_OCTET16_LEN) == BT_STATUS_SUCCESS) &&
2953 (btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_DHK,
2954 (char*)&ble_local_key_cb.id_keys.dhk[0],
2955 BT_OCTET16_LEN) == BT_STATUS_SUCCESS)) {
2956 ble_local_key_cb.is_id_keys_rcvd = true;
2957 BTIF_TRACE_DEBUG("%s BLE ID keys loaded", __func__);
2958 }
2959 }
btif_dm_get_ble_local_keys(tBTA_DM_BLE_LOCAL_KEY_MASK * p_key_mask,BT_OCTET16 er,tBTA_BLE_LOCAL_ID_KEYS * p_id_keys)2960 void btif_dm_get_ble_local_keys(tBTA_DM_BLE_LOCAL_KEY_MASK* p_key_mask,
2961 BT_OCTET16 er,
2962 tBTA_BLE_LOCAL_ID_KEYS* p_id_keys) {
2963 if (ble_local_key_cb.is_er_rcvd) {
2964 memcpy(&er[0], &ble_local_key_cb.er[0], sizeof(BT_OCTET16));
2965 *p_key_mask |= BTA_BLE_LOCAL_KEY_TYPE_ER;
2966 }
2967
2968 if (ble_local_key_cb.is_id_keys_rcvd) {
2969 memcpy(&p_id_keys->ir[0], &ble_local_key_cb.id_keys.ir[0],
2970 sizeof(BT_OCTET16));
2971 memcpy(&p_id_keys->irk[0], &ble_local_key_cb.id_keys.irk[0],
2972 sizeof(BT_OCTET16));
2973 memcpy(&p_id_keys->dhk[0], &ble_local_key_cb.id_keys.dhk[0],
2974 sizeof(BT_OCTET16));
2975 *p_key_mask |= BTA_BLE_LOCAL_KEY_TYPE_ID;
2976 }
2977 BTIF_TRACE_DEBUG("%s *p_key_mask=0x%02x", __func__, *p_key_mask);
2978 }
2979
btif_dm_save_ble_bonding_keys(void)2980 void btif_dm_save_ble_bonding_keys(void) {
2981 bt_bdaddr_t bd_addr;
2982
2983 BTIF_TRACE_DEBUG("%s", __func__);
2984
2985 bdcpy(bd_addr.address, pairing_cb.bd_addr);
2986
2987 if (pairing_cb.ble.is_penc_key_rcvd) {
2988 btif_storage_add_ble_bonding_key(&bd_addr, (char*)&pairing_cb.ble.penc_key,
2989 BTIF_DM_LE_KEY_PENC,
2990 sizeof(tBTM_LE_PENC_KEYS));
2991 }
2992
2993 if (pairing_cb.ble.is_pid_key_rcvd) {
2994 btif_storage_add_ble_bonding_key(&bd_addr, (char*)&pairing_cb.ble.pid_key,
2995 BTIF_DM_LE_KEY_PID,
2996 sizeof(tBTM_LE_PID_KEYS));
2997 }
2998
2999 if (pairing_cb.ble.is_pcsrk_key_rcvd) {
3000 btif_storage_add_ble_bonding_key(&bd_addr, (char*)&pairing_cb.ble.pcsrk_key,
3001 BTIF_DM_LE_KEY_PCSRK,
3002 sizeof(tBTM_LE_PCSRK_KEYS));
3003 }
3004
3005 if (pairing_cb.ble.is_lenc_key_rcvd) {
3006 btif_storage_add_ble_bonding_key(&bd_addr, (char*)&pairing_cb.ble.lenc_key,
3007 BTIF_DM_LE_KEY_LENC,
3008 sizeof(tBTM_LE_LENC_KEYS));
3009 }
3010
3011 if (pairing_cb.ble.is_lcsrk_key_rcvd) {
3012 btif_storage_add_ble_bonding_key(&bd_addr, (char*)&pairing_cb.ble.lcsrk_key,
3013 BTIF_DM_LE_KEY_LCSRK,
3014 sizeof(tBTM_LE_LCSRK_KEYS));
3015 }
3016
3017 if (pairing_cb.ble.is_lidk_key_rcvd) {
3018 btif_storage_add_ble_bonding_key(&bd_addr, NULL, BTIF_DM_LE_KEY_LID, 0);
3019 }
3020 }
3021
btif_dm_remove_ble_bonding_keys(void)3022 void btif_dm_remove_ble_bonding_keys(void) {
3023 bt_bdaddr_t bd_addr;
3024
3025 BTIF_TRACE_DEBUG("%s", __func__);
3026
3027 bdcpy(bd_addr.address, pairing_cb.bd_addr);
3028 btif_storage_remove_ble_bonding_keys(&bd_addr);
3029 }
3030
3031 /*******************************************************************************
3032 *
3033 * Function btif_dm_ble_sec_req_evt
3034 *
3035 * Description Eprocess security request event in btif context
3036 *
3037 * Returns void
3038 *
3039 ******************************************************************************/
btif_dm_ble_sec_req_evt(tBTA_DM_BLE_SEC_REQ * p_ble_req)3040 void btif_dm_ble_sec_req_evt(tBTA_DM_BLE_SEC_REQ* p_ble_req) {
3041 bt_bdaddr_t bd_addr;
3042 bt_bdname_t bd_name;
3043 uint32_t cod;
3044 int dev_type;
3045
3046 BTIF_TRACE_DEBUG("%s", __func__);
3047
3048 if (pairing_cb.state == BT_BOND_STATE_BONDING) {
3049 BTIF_TRACE_DEBUG("%s Discard security request", __func__);
3050 return;
3051 }
3052
3053 /* Remote name update */
3054 if (!btif_get_device_type(p_ble_req->bd_addr, &dev_type)) {
3055 dev_type = BT_DEVICE_TYPE_BLE;
3056 }
3057 btif_dm_update_ble_remote_properties(p_ble_req->bd_addr, p_ble_req->bd_name,
3058 (tBT_DEVICE_TYPE)dev_type);
3059
3060 bdcpy(bd_addr.address, p_ble_req->bd_addr);
3061 memcpy(bd_name.name, p_ble_req->bd_name, BD_NAME_LEN);
3062
3063 bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
3064
3065 pairing_cb.bond_type = BOND_TYPE_PERSISTENT;
3066 pairing_cb.is_le_only = true;
3067 pairing_cb.is_le_nc = false;
3068 pairing_cb.is_ssp = true;
3069 btm_set_bond_type_dev(p_ble_req->bd_addr, pairing_cb.bond_type);
3070
3071 cod = COD_UNCLASSIFIED;
3072
3073 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
3074 BT_SSP_VARIANT_CONSENT, 0);
3075 }
3076
3077 /*******************************************************************************
3078 *
3079 * Function btif_dm_ble_passkey_req_evt
3080 *
3081 * Description Executes pin request event in btif context
3082 *
3083 * Returns void
3084 *
3085 ******************************************************************************/
btif_dm_ble_passkey_req_evt(tBTA_DM_PIN_REQ * p_pin_req)3086 static void btif_dm_ble_passkey_req_evt(tBTA_DM_PIN_REQ* p_pin_req) {
3087 bt_bdaddr_t bd_addr;
3088 bt_bdname_t bd_name;
3089 uint32_t cod;
3090 int dev_type;
3091
3092 /* Remote name update */
3093 if (!btif_get_device_type(p_pin_req->bd_addr, &dev_type)) {
3094 dev_type = BT_DEVICE_TYPE_BLE;
3095 }
3096 btif_dm_update_ble_remote_properties(p_pin_req->bd_addr, p_pin_req->bd_name,
3097 (tBT_DEVICE_TYPE)dev_type);
3098
3099 bdcpy(bd_addr.address, p_pin_req->bd_addr);
3100 memcpy(bd_name.name, p_pin_req->bd_name, BD_NAME_LEN);
3101
3102 bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
3103 pairing_cb.is_le_only = true;
3104
3105 cod = COD_UNCLASSIFIED;
3106
3107 HAL_CBACK(bt_hal_cbacks, pin_request_cb, &bd_addr, &bd_name, cod, false);
3108 }
btif_dm_ble_key_nc_req_evt(tBTA_DM_SP_KEY_NOTIF * p_notif_req)3109 static void btif_dm_ble_key_nc_req_evt(tBTA_DM_SP_KEY_NOTIF* p_notif_req) {
3110 /* TODO implement key notification for numeric comparison */
3111 BTIF_TRACE_DEBUG("%s", __func__);
3112
3113 /* Remote name update */
3114 btif_update_remote_properties(p_notif_req->bd_addr, p_notif_req->bd_name,
3115 NULL, BT_DEVICE_TYPE_BLE);
3116
3117 bt_bdaddr_t bd_addr;
3118 bdcpy(bd_addr.address, p_notif_req->bd_addr);
3119
3120 bt_bdname_t bd_name;
3121 memcpy(bd_name.name, p_notif_req->bd_name, BD_NAME_LEN);
3122
3123 bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
3124 pairing_cb.is_ssp = false;
3125 pairing_cb.is_le_only = true;
3126 pairing_cb.is_le_nc = true;
3127
3128 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, COD_UNCLASSIFIED,
3129 BT_SSP_VARIANT_PASSKEY_CONFIRMATION, p_notif_req->passkey);
3130 }
3131
btif_dm_ble_oob_req_evt(tBTA_DM_SP_RMT_OOB * req_oob_type)3132 static void btif_dm_ble_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type) {
3133 BTIF_TRACE_DEBUG("%s", __func__);
3134
3135 bt_bdaddr_t bd_addr;
3136 bdcpy(bd_addr.address, req_oob_type->bd_addr);
3137 /* We already checked if OOB data is present in
3138 * btif_dm_set_oob_for_le_io_req, but check here again. If it's not present
3139 * do nothing, pairing will timeout.
3140 */
3141 if (is_empty_128bit(oob_cb.oob_data.sm_tk)) {
3142 return;
3143 }
3144
3145 /* make sure OOB data is for this particular device */
3146 if (memcmp(req_oob_type->bd_addr, oob_cb.bdaddr, BD_ADDR_LEN) != 0) {
3147 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
3148 __func__);
3149 return;
3150 }
3151
3152 /* Remote name update */
3153 btif_update_remote_properties(req_oob_type->bd_addr, req_oob_type->bd_name,
3154 NULL, BT_DEVICE_TYPE_BLE);
3155
3156 bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
3157 pairing_cb.is_ssp = false;
3158 pairing_cb.is_le_only = true;
3159 pairing_cb.is_le_nc = false;
3160
3161 BTM_BleOobDataReply(req_oob_type->bd_addr, 0, 16, oob_cb.oob_data.sm_tk);
3162 }
3163
btif_dm_ble_sc_oob_req_evt(tBTA_DM_SP_RMT_OOB * req_oob_type)3164 static void btif_dm_ble_sc_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type) {
3165 BTIF_TRACE_DEBUG("%s", __func__);
3166
3167 bt_bdaddr_t bd_addr;
3168 bdcpy(bd_addr.address, req_oob_type->bd_addr);
3169
3170 /* We already checked if OOB data is present in
3171 * btif_dm_set_oob_for_le_io_req, but check here again. If it's not present
3172 * do nothing, pairing will timeout.
3173 */
3174 if (is_empty_128bit(oob_cb.oob_data.le_sc_c) &&
3175 is_empty_128bit(oob_cb.oob_data.le_sc_r)) {
3176 BTIF_TRACE_WARNING("%s: LE SC OOB data is empty", __func__);
3177 return;
3178 }
3179
3180 /* make sure OOB data is for this particular device */
3181 if (memcmp(req_oob_type->bd_addr, oob_cb.bdaddr, BD_ADDR_LEN) != 0) {
3182 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
3183 __func__);
3184 return;
3185 }
3186
3187 /* Remote name update */
3188 btif_update_remote_properties(req_oob_type->bd_addr, req_oob_type->bd_name,
3189 NULL, BT_DEVICE_TYPE_BLE);
3190
3191 bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
3192 pairing_cb.is_ssp = false;
3193 pairing_cb.is_le_only =
3194 true; // TODO: we can derive classic pairing from this one
3195 pairing_cb.is_le_nc = false;
3196
3197 BTM_BleSecureConnectionOobDataReply(
3198 req_oob_type->bd_addr, oob_cb.oob_data.le_sc_c, oob_cb.oob_data.le_sc_r);
3199 }
3200
btif_dm_update_ble_remote_properties(BD_ADDR bd_addr,BD_NAME bd_name,tBT_DEVICE_TYPE dev_type)3201 void btif_dm_update_ble_remote_properties(BD_ADDR bd_addr, BD_NAME bd_name,
3202 tBT_DEVICE_TYPE dev_type) {
3203 btif_update_remote_properties(bd_addr, bd_name, NULL, dev_type);
3204 }
3205
btif_dm_ble_tx_test_cback(void * p)3206 static void btif_dm_ble_tx_test_cback(void* p) {
3207 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_LE_TX_TEST, (char*)p, 1,
3208 NULL);
3209 }
3210
btif_dm_ble_rx_test_cback(void * p)3211 static void btif_dm_ble_rx_test_cback(void* p) {
3212 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_LE_RX_TEST, (char*)p, 1,
3213 NULL);
3214 }
3215
btif_dm_ble_test_end_cback(void * p)3216 static void btif_dm_ble_test_end_cback(void* p) {
3217 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_LE_TEST_END, (char*)p,
3218 3, NULL);
3219 }
3220 /*******************************************************************************
3221 *
3222 * Function btif_le_test_mode
3223 *
3224 * Description Sends a HCI BLE Test command to the Controller
3225 *
3226 * Returns BT_STATUS_SUCCESS on success
3227 *
3228 ******************************************************************************/
btif_le_test_mode(uint16_t opcode,uint8_t * buf,uint8_t len)3229 bt_status_t btif_le_test_mode(uint16_t opcode, uint8_t* buf, uint8_t len) {
3230 switch (opcode) {
3231 case HCI_BLE_TRANSMITTER_TEST:
3232 if (len != 3) return BT_STATUS_PARM_INVALID;
3233 BTM_BleTransmitterTest(buf[0], buf[1], buf[2], btif_dm_ble_tx_test_cback);
3234 break;
3235 case HCI_BLE_RECEIVER_TEST:
3236 if (len != 1) return BT_STATUS_PARM_INVALID;
3237 BTM_BleReceiverTest(buf[0], btif_dm_ble_rx_test_cback);
3238 break;
3239 case HCI_BLE_TEST_END:
3240 BTM_BleTestEnd((tBTM_CMPL_CB*)btif_dm_ble_test_end_cback);
3241 break;
3242 default:
3243 BTIF_TRACE_ERROR("%s: Unknown LE Test Mode Command 0x%x", __func__,
3244 opcode);
3245 return BT_STATUS_UNSUPPORTED;
3246 }
3247 return BT_STATUS_SUCCESS;
3248 }
3249
btif_dm_on_disable()3250 void btif_dm_on_disable() {
3251 /* cancel any pending pairing requests */
3252 if (pairing_cb.state == BT_BOND_STATE_BONDING) {
3253 bt_bdaddr_t bd_addr;
3254
3255 BTIF_TRACE_DEBUG("%s: Cancel pending pairing request", __func__);
3256 bdcpy(bd_addr.address, pairing_cb.bd_addr);
3257 btif_dm_cancel_bond(&bd_addr);
3258 }
3259 }
3260
3261 /*******************************************************************************
3262 *
3263 * Function btif_dm_read_energy_info
3264 *
3265 * Description Reads the energy info from controller
3266 *
3267 * Returns void
3268 *
3269 ******************************************************************************/
btif_dm_read_energy_info()3270 void btif_dm_read_energy_info() { BTA_DmBleGetEnergyInfo(bta_energy_info_cb); }
3271
btif_get_default_local_name()3272 static char* btif_get_default_local_name() {
3273 if (btif_default_local_name[0] == '\0') {
3274 int max_len = sizeof(btif_default_local_name) - 1;
3275 if (BTM_DEF_LOCAL_NAME[0] != '\0') {
3276 strncpy(btif_default_local_name, BTM_DEF_LOCAL_NAME, max_len);
3277 } else {
3278 char prop_model[PROPERTY_VALUE_MAX];
3279 osi_property_get(PROPERTY_PRODUCT_MODEL, prop_model, "");
3280 strncpy(btif_default_local_name, prop_model, max_len);
3281 }
3282 btif_default_local_name[max_len] = '\0';
3283 }
3284 return btif_default_local_name;
3285 }
3286
btif_stats_add_bond_event(const bt_bdaddr_t * bd_addr,bt_bond_function_t function,bt_bond_state_t state)3287 static void btif_stats_add_bond_event(const bt_bdaddr_t* bd_addr,
3288 bt_bond_function_t function,
3289 bt_bond_state_t state) {
3290 std::unique_lock<std::mutex> lock(bond_event_lock);
3291
3292 btif_bond_event_t* event = &btif_dm_bond_events[btif_events_end_index];
3293 memcpy(&event->bd_addr, bd_addr, sizeof(bt_bdaddr_t));
3294 event->function = function;
3295 event->state = state;
3296 clock_gettime(CLOCK_REALTIME, &event->timestamp);
3297
3298 btif_num_bond_events++;
3299 btif_events_end_index =
3300 (btif_events_end_index + 1) % (MAX_BTIF_BOND_EVENT_ENTRIES + 1);
3301 if (btif_events_end_index == btif_events_start_index) {
3302 btif_events_start_index =
3303 (btif_events_start_index + 1) % (MAX_BTIF_BOND_EVENT_ENTRIES + 1);
3304 }
3305
3306 int type;
3307 btif_get_device_type(bd_addr->address, &type);
3308
3309 system_bt_osi::device_type_t device_type;
3310 switch (type) {
3311 case BT_DEVICE_TYPE_BREDR:
3312 device_type = system_bt_osi::DEVICE_TYPE_BREDR;
3313 break;
3314 case BT_DEVICE_TYPE_BLE:
3315 device_type = system_bt_osi::DEVICE_TYPE_LE;
3316 break;
3317 case BT_DEVICE_TYPE_DUMO:
3318 device_type = system_bt_osi::DEVICE_TYPE_DUMO;
3319 break;
3320 default:
3321 device_type = system_bt_osi::DEVICE_TYPE_UNKNOWN;
3322 break;
3323 }
3324
3325 uint32_t cod = get_cod(bd_addr);
3326 uint64_t ts =
3327 event->timestamp.tv_sec * 1000 + event->timestamp.tv_nsec / 1000000;
3328 system_bt_osi::BluetoothMetricsLogger::GetInstance()->LogPairEvent(
3329 0, ts, cod, device_type);
3330 }
3331
btif_debug_bond_event_dump(int fd)3332 void btif_debug_bond_event_dump(int fd) {
3333 std::unique_lock<std::mutex> lock(bond_event_lock);
3334 dprintf(fd, "\nBond Events: \n");
3335 dprintf(fd, " Total Number of events: %zu\n", btif_num_bond_events);
3336 if (btif_num_bond_events > 0)
3337 dprintf(fd,
3338 " Time BD_ADDR Function State\n");
3339
3340 for (size_t i = btif_events_start_index; i != btif_events_end_index;
3341 i = (i + 1) % (MAX_BTIF_BOND_EVENT_ENTRIES + 1)) {
3342 btif_bond_event_t* event = &btif_dm_bond_events[i];
3343
3344 char eventtime[20];
3345 char temptime[20];
3346 struct tm* tstamp = localtime(&event->timestamp.tv_sec);
3347 strftime(temptime, sizeof(temptime), "%H:%M:%S", tstamp);
3348 snprintf(eventtime, sizeof(eventtime), "%s.%03ld", temptime,
3349 event->timestamp.tv_nsec / 1000000);
3350
3351 char bdaddr[18];
3352 bdaddr_to_string(&event->bd_addr, bdaddr, sizeof(bdaddr));
3353
3354 const char* func_name;
3355 switch (event->function) {
3356 case BTIF_DM_FUNC_CREATE_BOND:
3357 func_name = "btif_dm_create_bond";
3358 break;
3359 case BTIF_DM_FUNC_REMOVE_BOND:
3360 func_name = "btif_dm_remove_bond";
3361 break;
3362 case BTIF_DM_FUNC_BOND_STATE_CHANGED:
3363 func_name = "bond_state_changed ";
3364 break;
3365 default:
3366 func_name = "Invalid value ";
3367 break;
3368 }
3369
3370 const char* bond_state;
3371 switch (event->state) {
3372 case BT_BOND_STATE_NONE:
3373 bond_state = "BOND_STATE_NONE";
3374 break;
3375 case BT_BOND_STATE_BONDING:
3376 bond_state = "BOND_STATE_BONDING";
3377 break;
3378 case BT_BOND_STATE_BONDED:
3379 bond_state = "BOND_STATE_BONDED";
3380 break;
3381 default:
3382 bond_state = "Invalid bond state";
3383 break;
3384 }
3385 dprintf(fd, " %s %s %s %s\n", eventtime, bdaddr, func_name, bond_state);
3386 }
3387 }
3388