1 /******************************************************************************
2 *
3 * Copyright 1999-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /******************************************************************************
20 *
21 * This file contains functions for the SMP L2Cap interface
22 *
23 ******************************************************************************/
24
25 #include "bt_target.h"
26
27 #include <string.h>
28 #include "btm_ble_api.h"
29 #include "l2c_api.h"
30
31 #include "smp_int.h"
32
33 static void smp_tx_complete_callback(uint16_t cid, uint16_t num_pkt);
34
35 static void smp_connect_callback(uint16_t channel, const RawAddress& bd_addr,
36 bool connected, uint16_t reason,
37 tBT_TRANSPORT transport);
38 static void smp_data_received(uint16_t channel, const RawAddress& bd_addr,
39 BT_HDR* p_buf);
40
41 static void smp_br_connect_callback(uint16_t channel, const RawAddress& bd_addr,
42 bool connected, uint16_t reason,
43 tBT_TRANSPORT transport);
44 static void smp_br_data_received(uint16_t channel, const RawAddress& bd_addr,
45 BT_HDR* p_buf);
46
47 /*******************************************************************************
48 *
49 * Function smp_l2cap_if_init
50 *
51 * Description This function is called during the SMP task startup
52 * to register interface functions with L2CAP.
53 *
54 ******************************************************************************/
smp_l2cap_if_init(void)55 void smp_l2cap_if_init(void) {
56 tL2CAP_FIXED_CHNL_REG fixed_reg;
57 SMP_TRACE_EVENT("SMDBG l2c %s", __func__);
58 fixed_reg.fixed_chnl_opts.mode = L2CAP_FCR_BASIC_MODE;
59 fixed_reg.fixed_chnl_opts.max_transmit = 0;
60 fixed_reg.fixed_chnl_opts.rtrans_tout = 0;
61 fixed_reg.fixed_chnl_opts.mon_tout = 0;
62 fixed_reg.fixed_chnl_opts.mps = 0;
63 fixed_reg.fixed_chnl_opts.tx_win_sz = 0;
64
65 fixed_reg.pL2CA_FixedConn_Cb = smp_connect_callback;
66 fixed_reg.pL2CA_FixedData_Cb = smp_data_received;
67 fixed_reg.pL2CA_FixedTxComplete_Cb = smp_tx_complete_callback;
68
69 fixed_reg.pL2CA_FixedCong_Cb =
70 NULL; /* do not handle congestion on this channel */
71 fixed_reg.default_idle_tout =
72 60; /* set 60 seconds timeout, 0xffff default idle timeout */
73
74 L2CA_RegisterFixedChannel(L2CAP_SMP_CID, &fixed_reg);
75
76 fixed_reg.pL2CA_FixedConn_Cb = smp_br_connect_callback;
77 fixed_reg.pL2CA_FixedData_Cb = smp_br_data_received;
78
79 L2CA_RegisterFixedChannel(L2CAP_SMP_BR_CID, &fixed_reg);
80 }
81
82 /*******************************************************************************
83 *
84 * Function smp_connect_callback
85 *
86 * Description This callback function is called by L2CAP to indicate that
87 * SMP channel is
88 * connected (conn = true)/disconnected (conn = false).
89 *
90 ******************************************************************************/
smp_connect_callback(uint16_t channel,const RawAddress & bd_addr,bool connected,uint16_t reason,tBT_TRANSPORT transport)91 static void smp_connect_callback(uint16_t channel, const RawAddress& bd_addr,
92 bool connected, uint16_t reason,
93 tBT_TRANSPORT transport) {
94 tSMP_CB* p_cb = &smp_cb;
95 tSMP_INT_DATA int_data;
96
97 SMP_TRACE_EVENT("%s: SMDBG l2c: bd_addr=%s, p_cb->pairing_bda=%s", __func__,
98 bd_addr.ToString().c_str(),
99 p_cb->pairing_bda.ToString().c_str());
100
101 if (transport == BT_TRANSPORT_BR_EDR || bd_addr.IsEmpty()) return;
102
103 if (bd_addr == p_cb->pairing_bda) {
104 VLOG(2) << __func__ << " for pairing BDA: " << bd_addr
105 << " Event: " << ((connected) ? "connected" : "disconnected");
106
107 if (connected) {
108 if (!p_cb->connect_initialized) {
109 p_cb->connect_initialized = true;
110 /* initiating connection established */
111 p_cb->role = L2CA_GetBleConnRole(bd_addr);
112
113 /* initialize local i/r key to be default keys */
114 p_cb->local_r_key = p_cb->local_i_key = SMP_SEC_DEFAULT_KEY;
115 p_cb->loc_auth_req = p_cb->peer_auth_req = SMP_DEFAULT_AUTH_REQ;
116 p_cb->cb_evt = SMP_IO_CAP_REQ_EVT;
117 smp_sm_event(p_cb, SMP_L2CAP_CONN_EVT, NULL);
118 }
119 } else {
120 int_data.reason = reason;
121 /* Disconnected while doing security */
122 smp_sm_event(p_cb, SMP_L2CAP_DISCONN_EVT, &int_data);
123 }
124 }
125 }
126
127 /*******************************************************************************
128 *
129 * Function smp_data_received
130 *
131 * Description This function is called when data is received from L2CAP on
132 * SMP channel.
133 *
134 *
135 * Returns void
136 *
137 ******************************************************************************/
smp_data_received(uint16_t channel,const RawAddress & bd_addr,BT_HDR * p_buf)138 static void smp_data_received(uint16_t channel, const RawAddress& bd_addr,
139 BT_HDR* p_buf) {
140 tSMP_CB* p_cb = &smp_cb;
141 uint8_t* p = (uint8_t*)(p_buf + 1) + p_buf->offset;
142 uint8_t cmd;
143
144 STREAM_TO_UINT8(cmd, p);
145
146 SMP_TRACE_EVENT("%s: SMDBG l2c, cmd=0x%x", __func__, cmd);
147
148 /* sanity check */
149 if ((SMP_OPCODE_MAX < cmd) || (SMP_OPCODE_MIN > cmd)) {
150 SMP_TRACE_WARNING("Ignore received command with RESERVED code 0x%02x", cmd);
151 osi_free(p_buf);
152 return;
153 }
154
155 /* reject the pairing request if there is an on-going SMP pairing */
156 if (SMP_OPCODE_PAIRING_REQ == cmd || SMP_OPCODE_SEC_REQ == cmd) {
157 if ((p_cb->state == SMP_STATE_IDLE) &&
158 (p_cb->br_state == SMP_BR_STATE_IDLE) &&
159 !(p_cb->flags & SMP_PAIR_FLAGS_WE_STARTED_DD)) {
160 p_cb->role = L2CA_GetBleConnRole(bd_addr);
161 p_cb->pairing_bda = bd_addr;
162 } else if (bd_addr != p_cb->pairing_bda) {
163 osi_free(p_buf);
164 smp_reject_unexpected_pairing_command(bd_addr);
165 return;
166 }
167 /* else, out of state pairing request/security request received, passed into
168 * SM */
169 }
170
171 if (bd_addr == p_cb->pairing_bda) {
172 alarm_set_on_mloop(p_cb->smp_rsp_timer_ent, SMP_WAIT_FOR_RSP_TIMEOUT_MS,
173 smp_rsp_timeout, NULL);
174
175 if (cmd == SMP_OPCODE_CONFIRM) {
176 SMP_TRACE_DEBUG(
177 "in %s cmd = 0x%02x, peer_auth_req = 0x%02x,"
178 "loc_auth_req = 0x%02x",
179 __func__, cmd, p_cb->peer_auth_req, p_cb->loc_auth_req);
180
181 if ((p_cb->peer_auth_req & SMP_SC_SUPPORT_BIT) &&
182 (p_cb->loc_auth_req & SMP_SC_SUPPORT_BIT)) {
183 cmd = SMP_OPCODE_PAIR_COMMITM;
184 }
185 }
186
187 p_cb->rcvd_cmd_code = cmd;
188 p_cb->rcvd_cmd_len = (uint8_t)p_buf->len;
189 tSMP_INT_DATA smp_int_data;
190 smp_int_data.p_data = p;
191 smp_sm_event(p_cb, cmd, &smp_int_data);
192 }
193
194 osi_free(p_buf);
195 }
196
197 /*******************************************************************************
198 *
199 * Function smp_tx_complete_callback
200 *
201 * Description SMP channel tx complete callback
202 *
203 ******************************************************************************/
smp_tx_complete_callback(uint16_t cid,uint16_t num_pkt)204 static void smp_tx_complete_callback(uint16_t cid, uint16_t num_pkt) {
205 tSMP_CB* p_cb = &smp_cb;
206
207 if (p_cb->total_tx_unacked >= num_pkt)
208 p_cb->total_tx_unacked -= num_pkt;
209 else
210 SMP_TRACE_ERROR("Unexpected %s: num_pkt = %d", __func__, num_pkt);
211
212 if (p_cb->total_tx_unacked == 0 && p_cb->wait_for_authorization_complete) {
213 tSMP_INT_DATA smp_int_data;
214 smp_int_data.status = SMP_SUCCESS;
215 if (cid == L2CAP_SMP_CID) {
216 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
217 } else {
218 smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &smp_int_data);
219 }
220 }
221 }
222
223 /*******************************************************************************
224 *
225 * Function smp_br_connect_callback
226 *
227 * Description This callback function is called by L2CAP to indicate that
228 * SMP BR channel is
229 * connected (conn = true)/disconnected (conn = false).
230 *
231 ******************************************************************************/
smp_br_connect_callback(uint16_t channel,const RawAddress & bd_addr,bool connected,uint16_t reason,tBT_TRANSPORT transport)232 static void smp_br_connect_callback(uint16_t channel, const RawAddress& bd_addr,
233 bool connected, uint16_t reason,
234 tBT_TRANSPORT transport) {
235 tSMP_CB* p_cb = &smp_cb;
236 tSMP_INT_DATA int_data;
237
238 SMP_TRACE_EVENT("%s", __func__);
239
240 if (transport != BT_TRANSPORT_BR_EDR) {
241 SMP_TRACE_WARNING("%s is called on unexpected transport %d", __func__,
242 transport);
243 return;
244 }
245
246 VLOG(1) << __func__ << " for pairing BDA: " << bd_addr
247 << ", pairing_bda:" << p_cb->pairing_bda
248 << " Event: " << ((connected) ? "connected" : "disconnected");
249
250 if (bd_addr != p_cb->pairing_bda) return;
251
252 if (connected) {
253 if (!p_cb->connect_initialized) {
254 p_cb->connect_initialized = true;
255 /* initialize local i/r key to be default keys */
256 p_cb->local_r_key = p_cb->local_i_key = SMP_BR_SEC_DEFAULT_KEY;
257 p_cb->loc_auth_req = p_cb->peer_auth_req = 0;
258 p_cb->cb_evt = SMP_BR_KEYS_REQ_EVT;
259 smp_br_state_machine_event(p_cb, SMP_BR_L2CAP_CONN_EVT, NULL);
260 }
261 } else {
262 int_data.reason = reason;
263 /* Disconnected while doing security */
264 smp_br_state_machine_event(p_cb, SMP_BR_L2CAP_DISCONN_EVT, &int_data);
265 }
266 }
267
268 /*******************************************************************************
269 *
270 * Function smp_br_data_received
271 *
272 * Description This function is called when data is received from L2CAP on
273 * SMP BR channel.
274 *
275 * Returns void
276 *
277 ******************************************************************************/
smp_br_data_received(uint16_t channel,const RawAddress & bd_addr,BT_HDR * p_buf)278 static void smp_br_data_received(uint16_t channel, const RawAddress& bd_addr,
279 BT_HDR* p_buf) {
280 tSMP_CB* p_cb = &smp_cb;
281 uint8_t* p = (uint8_t*)(p_buf + 1) + p_buf->offset;
282 uint8_t cmd;
283 SMP_TRACE_EVENT("SMDBG l2c %s", __func__);
284
285 STREAM_TO_UINT8(cmd, p);
286
287 /* sanity check */
288 if ((SMP_OPCODE_MAX < cmd) || (SMP_OPCODE_MIN > cmd)) {
289 SMP_TRACE_WARNING("Ignore received command with RESERVED code 0x%02x", cmd);
290 osi_free(p_buf);
291 return;
292 }
293
294 /* reject the pairing request if there is an on-going SMP pairing */
295 if (SMP_OPCODE_PAIRING_REQ == cmd) {
296 if ((p_cb->state == SMP_STATE_IDLE) &&
297 (p_cb->br_state == SMP_BR_STATE_IDLE)) {
298 p_cb->role = HCI_ROLE_SLAVE;
299 p_cb->smp_over_br = true;
300 p_cb->pairing_bda = bd_addr;
301 } else if (bd_addr != p_cb->pairing_bda) {
302 osi_free(p_buf);
303 smp_reject_unexpected_pairing_command(bd_addr);
304 return;
305 }
306 /* else, out of state pairing request received, passed into State Machine */
307 }
308
309 if (bd_addr == p_cb->pairing_bda) {
310 alarm_set_on_mloop(p_cb->smp_rsp_timer_ent, SMP_WAIT_FOR_RSP_TIMEOUT_MS,
311 smp_rsp_timeout, NULL);
312
313 p_cb->rcvd_cmd_code = cmd;
314 p_cb->rcvd_cmd_len = (uint8_t)p_buf->len;
315 tSMP_INT_DATA smp_int_data;
316 smp_int_data.p_data = p;
317 smp_br_state_machine_event(p_cb, cmd, &smp_int_data);
318 }
319
320 osi_free(p_buf);
321 }
322