1 /******************************************************************************
2 *
3 * Copyright 2009-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /*******************************************************************************
20 *
21 * Filename: btif_dm.c
22 *
23 * Description: Contains Device Management (DM) related functionality
24 *
25 *
26 ******************************************************************************/
27
28 #define LOG_TAG "bt_btif_dm"
29
30 #include "btif_dm.h"
31
32 #include <base/bind.h>
33 #include <base/logging.h>
34 #include <signal.h>
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38 #include <sys/types.h>
39 #include <time.h>
40 #include <unistd.h>
41
42 #include <mutex>
43
44 #include <bluetooth/uuid.h>
45 #include <hardware/bluetooth.h>
46 #include <hardware/bt_hearing_aid.h>
47
48 #include "advertise_data_parser.h"
49 #include "bt_common.h"
50 #include "bta_gatt_api.h"
51 #include "btif_api.h"
52 #include "btif_av.h"
53 #include "btif_bqr.h"
54 #include "btif_config.h"
55 #include "btif_dm.h"
56 #include "btif_hd.h"
57 #include "btif_hf.h"
58 #include "btif_hh.h"
59 #include "btif_sdp.h"
60 #include "btif_storage.h"
61 #include "btif_util.h"
62 #include "btu.h"
63 #include "common/metrics.h"
64 #include "device/include/controller.h"
65 #include "device/include/interop.h"
66 #include "internal_include/stack_config.h"
67 #include "osi/include/allocator.h"
68 #include "osi/include/log.h"
69 #include "osi/include/osi.h"
70 #include "osi/include/properties.h"
71 #include "stack/btm/btm_int.h"
72 #include "stack_config.h"
73
74 using bluetooth::Uuid;
75 /******************************************************************************
76 * Constants & Macros
77 *****************************************************************************/
78
79 const Uuid UUID_HEARING_AID = Uuid::FromString("FDF0");
80
81 #define COD_MASK 0x07FF
82
83 #define COD_UNCLASSIFIED ((0x1F) << 8)
84 #define COD_HID_KEYBOARD 0x0540
85 #define COD_HID_POINTING 0x0580
86 #define COD_HID_COMBO 0x05C0
87 #define COD_HID_MAJOR 0x0500
88 #define COD_HID_MASK 0x0700
89 #define COD_AV_HEADSETS 0x0404
90 #define COD_AV_HANDSFREE 0x0408
91 #define COD_AV_HEADPHONES 0x0418
92 #define COD_AV_PORTABLE_AUDIO 0x041C
93 #define COD_AV_HIFI_AUDIO 0x0428
94
95 #define BTIF_DM_DEFAULT_INQ_MAX_RESULTS 0
96 #define BTIF_DM_DEFAULT_INQ_MAX_DURATION 10
97 #define BTIF_DM_MAX_SDP_ATTEMPTS_AFTER_PAIRING 2
98
99 #define NUM_TIMEOUT_RETRIES 5
100 #ifndef PROPERTY_PRODUCT_MODEL
101 #define PROPERTY_PRODUCT_MODEL "ro.product.model"
102 #endif
103 #define DEFAULT_LOCAL_NAME_MAX 31
104 #if (DEFAULT_LOCAL_NAME_MAX > BTM_MAX_LOC_BD_NAME_LEN)
105 #error "default btif local name size exceeds stack supported length"
106 #endif
107
108 #define ENCRYPTED_BREDR 2
109 #define ENCRYPTED_LE 4
110
111 typedef struct {
112 bt_bond_state_t state;
113 RawAddress static_bdaddr;
114 RawAddress bd_addr;
115 tBTM_BOND_TYPE bond_type;
116 uint8_t pin_code_len;
117 uint8_t is_ssp;
118 uint8_t auth_req;
119 uint8_t io_cap;
120 uint8_t autopair_attempts;
121 uint8_t timeout_retries;
122 uint8_t is_local_initiated;
123 uint8_t sdp_attempts;
124 bool is_le_only;
125 bool is_le_nc; /* LE Numeric comparison */
126 btif_dm_ble_cb_t ble;
127 } btif_dm_pairing_cb_t;
128
129 // TODO(jpawlowski): unify ?
130 // btif_dm_local_key_id_t == tBTM_BLE_LOCAL_ID_KEYS == tBTA_BLE_LOCAL_ID_KEYS
131 typedef struct {
132 Octet16 ir;
133 Octet16 irk;
134 Octet16 dhk;
135 } btif_dm_local_key_id_t;
136
137 typedef struct {
138 bool is_er_rcvd;
139 Octet16 er;
140 bool is_id_keys_rcvd;
141 btif_dm_local_key_id_t id_keys; /* ID kyes */
142
143 } btif_dm_local_key_cb_t;
144
145 typedef struct {
146 RawAddress bd_addr;
147 BD_NAME bd_name;
148 } btif_dm_remote_name_t;
149
150 /* this structure holds optional OOB data for remote device */
151 typedef struct {
152 RawAddress bdaddr; /* peer bdaddr */
153 bt_out_of_band_data_t oob_data;
154 } btif_dm_oob_cb_t;
155
156 typedef struct {
157 RawAddress bdaddr;
158 uint8_t transport; /* 0=Unknown, 1=BR/EDR, 2=LE */
159 } btif_dm_create_bond_cb_t;
160
161 typedef struct {
162 uint8_t status;
163 uint8_t ctrl_state;
164 uint64_t tx_time;
165 uint64_t rx_time;
166 uint64_t idle_time;
167 uint64_t energy_used;
168 } btif_activity_energy_info_cb_t;
169
170 typedef struct { unsigned int manufact_id; } skip_sdp_entry_t;
171
172 typedef enum {
173 BTIF_DM_FUNC_CREATE_BOND,
174 BTIF_DM_FUNC_CANCEL_BOND,
175 BTIF_DM_FUNC_REMOVE_BOND,
176 BTIF_DM_FUNC_BOND_STATE_CHANGED,
177 } bt_bond_function_t;
178
179 typedef struct {
180 RawAddress bd_addr;
181 bt_bond_function_t function;
182 bt_bond_state_t state;
183 struct timespec timestamp;
184 } btif_bond_event_t;
185
186 #define BTA_SERVICE_ID_TO_SERVICE_MASK(id) (1 << (id))
187
188 #define MAX_BTIF_BOND_EVENT_ENTRIES 15
189
190 static skip_sdp_entry_t sdp_blacklist[] = {{76}}; // Apple Mouse and Keyboard
191
192 /* This flag will be true if HCI_Inquiry is in progress */
193 static bool btif_dm_inquiry_in_progress = false;
194
195 /*******************************************************************************
196 * Static variables
197 ******************************************************************************/
198 static char btif_default_local_name[DEFAULT_LOCAL_NAME_MAX + 1] = {'\0'};
199 static uid_set_t* uid_set = NULL;
200
201 /* A circular array to keep track of the most recent bond events */
202 static btif_bond_event_t btif_dm_bond_events[MAX_BTIF_BOND_EVENT_ENTRIES + 1];
203
204 static std::mutex bond_event_lock;
205
206 /* |btif_num_bond_events| keeps track of the total number of events and can be
207 greater than |MAX_BTIF_BOND_EVENT_ENTRIES| */
208 static size_t btif_num_bond_events = 0;
209 static size_t btif_events_start_index = 0;
210 static size_t btif_events_end_index = 0;
211
212 /******************************************************************************
213 * Static functions
214 *****************************************************************************/
215 static btif_dm_pairing_cb_t pairing_cb;
216 static btif_dm_oob_cb_t oob_cb;
217 static void btif_dm_generic_evt(uint16_t event, char* p_param);
218 static void btif_dm_cb_create_bond(const RawAddress& bd_addr,
219 tBTA_TRANSPORT transport);
220 static void btif_dm_cb_hid_remote_name(tBTM_REMOTE_DEV_NAME* p_remote_name);
221 static void btif_update_remote_properties(const RawAddress& bd_addr,
222 BD_NAME bd_name, DEV_CLASS dev_class,
223 tBT_DEVICE_TYPE dev_type);
224 static btif_dm_local_key_cb_t ble_local_key_cb;
225 static void btif_dm_ble_key_notif_evt(tBTA_DM_SP_KEY_NOTIF* p_ssp_key_notif);
226 static void btif_dm_ble_auth_cmpl_evt(tBTA_DM_AUTH_CMPL* p_auth_cmpl);
227 static void btif_dm_ble_passkey_req_evt(tBTA_DM_PIN_REQ* p_pin_req);
228 static void btif_dm_ble_key_nc_req_evt(tBTA_DM_SP_KEY_NOTIF* p_notif_req);
229 static void btif_dm_ble_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type);
230 static void btif_dm_ble_sc_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type);
231
232 static void bte_scan_filt_param_cfg_evt(uint8_t action_type, uint8_t avbl_space,
233 uint8_t ref_value, uint8_t status);
234
235 static char* btif_get_default_local_name();
236
237 static void btif_stats_add_bond_event(const RawAddress& bd_addr,
238 bt_bond_function_t function,
239 bt_bond_state_t state);
240
241 /******************************************************************************
242 * Externs
243 *****************************************************************************/
244 extern bt_status_t btif_av_execute_service(bool b_enable);
245 extern bt_status_t btif_av_sink_execute_service(bool b_enable);
246 extern bt_status_t btif_hh_execute_service(bool b_enable);
247 extern bt_status_t btif_hf_client_execute_service(bool b_enable);
248 extern bt_status_t btif_sdp_execute_service(bool b_enable);
249 extern int btif_hh_connect(const RawAddress* bd_addr);
250 extern bt_status_t btif_hd_execute_service(bool b_enable);
251 extern bluetooth::hearing_aid::HearingAidInterface*
252 btif_hearing_aid_get_interface();
253
254 /******************************************************************************
255 * Functions
256 *****************************************************************************/
257
is_empty_128bit(uint8_t * data)258 static bool is_empty_128bit(uint8_t* data) {
259 static const uint8_t zero[16] = {0};
260 return !memcmp(zero, data, sizeof(zero));
261 }
262
is_bonding_or_sdp()263 static bool is_bonding_or_sdp() {
264 return pairing_cb.state == BT_BOND_STATE_BONDING ||
265 (pairing_cb.state == BT_BOND_STATE_BONDED && pairing_cb.sdp_attempts);
266 }
267
btif_dm_data_copy(uint16_t event,char * dst,char * src)268 static void btif_dm_data_copy(uint16_t event, char* dst, char* src) {
269 tBTA_DM_SEC* dst_dm_sec = (tBTA_DM_SEC*)dst;
270 tBTA_DM_SEC* src_dm_sec = (tBTA_DM_SEC*)src;
271
272 if (!src_dm_sec) return;
273
274 CHECK(dst_dm_sec);
275 maybe_non_aligned_memcpy(dst_dm_sec, src_dm_sec, sizeof(*src_dm_sec));
276
277 if (event == BTA_DM_BLE_KEY_EVT) {
278 dst_dm_sec->ble_key.p_key_value =
279 (tBTM_LE_KEY_VALUE*)osi_malloc(sizeof(tBTM_LE_KEY_VALUE));
280 CHECK(src_dm_sec->ble_key.p_key_value);
281 memcpy(dst_dm_sec->ble_key.p_key_value, src_dm_sec->ble_key.p_key_value,
282 sizeof(tBTM_LE_KEY_VALUE));
283 }
284 }
285
btif_dm_data_free(uint16_t event,tBTA_DM_SEC * dm_sec)286 static void btif_dm_data_free(uint16_t event, tBTA_DM_SEC* dm_sec) {
287 if (event == BTA_DM_BLE_KEY_EVT)
288 osi_free_and_reset((void**)&dm_sec->ble_key.p_key_value);
289 }
290
btif_dm_init(uid_set_t * set)291 void btif_dm_init(uid_set_t* set) { uid_set = set; }
292
btif_dm_cleanup(void)293 void btif_dm_cleanup(void) {
294 if (uid_set) {
295 uid_set_destroy(uid_set);
296 uid_set = NULL;
297 }
298 }
299
btif_in_execute_service_request(tBTA_SERVICE_ID service_id,bool b_enable)300 bt_status_t btif_in_execute_service_request(tBTA_SERVICE_ID service_id,
301 bool b_enable) {
302 BTIF_TRACE_DEBUG("%s service_id: %d", __func__, service_id);
303 /* Check the service_ID and invoke the profile's BT state changed API */
304 switch (service_id) {
305 case BTA_HFP_SERVICE_ID:
306 case BTA_HSP_SERVICE_ID: {
307 bluetooth::headset::ExecuteService(b_enable);
308 } break;
309 case BTA_A2DP_SOURCE_SERVICE_ID: {
310 btif_av_source_execute_service(b_enable);
311 } break;
312 case BTA_A2DP_SINK_SERVICE_ID: {
313 btif_av_sink_execute_service(b_enable);
314 } break;
315 case BTA_HID_SERVICE_ID: {
316 btif_hh_execute_service(b_enable);
317 } break;
318 case BTA_HFP_HS_SERVICE_ID: {
319 btif_hf_client_execute_service(b_enable);
320 } break;
321 case BTA_SDP_SERVICE_ID: {
322 btif_sdp_execute_service(b_enable);
323 } break;
324 case BTA_HIDD_SERVICE_ID: {
325 btif_hd_execute_service(b_enable);
326 } break;
327 default:
328 BTIF_TRACE_ERROR("%s: Unknown service %d being %s", __func__, service_id,
329 (b_enable) ? "enabled" : "disabled");
330 return BT_STATUS_FAIL;
331 }
332 return BT_STATUS_SUCCESS;
333 }
334
335 /*******************************************************************************
336 *
337 * Function check_eir_remote_name
338 *
339 * Description Check if remote name is in the EIR data
340 *
341 * Returns true if remote name found
342 * Populate p_remote_name, if provided and remote name found
343 *
344 ******************************************************************************/
check_eir_remote_name(tBTA_DM_SEARCH * p_search_data,uint8_t * p_remote_name,uint8_t * p_remote_name_len)345 static bool check_eir_remote_name(tBTA_DM_SEARCH* p_search_data,
346 uint8_t* p_remote_name,
347 uint8_t* p_remote_name_len) {
348 const uint8_t* p_eir_remote_name = NULL;
349 uint8_t remote_name_len = 0;
350
351 /* Check EIR for remote name and services */
352 if (p_search_data->inq_res.p_eir) {
353 p_eir_remote_name = AdvertiseDataParser::GetFieldByType(
354 p_search_data->inq_res.p_eir, p_search_data->inq_res.eir_len,
355 BTM_EIR_COMPLETE_LOCAL_NAME_TYPE, &remote_name_len);
356 if (!p_eir_remote_name) {
357 p_eir_remote_name = AdvertiseDataParser::GetFieldByType(
358 p_search_data->inq_res.p_eir, p_search_data->inq_res.eir_len,
359 BTM_EIR_SHORTENED_LOCAL_NAME_TYPE, &remote_name_len);
360 }
361
362 if (p_eir_remote_name) {
363 if (remote_name_len > BD_NAME_LEN) remote_name_len = BD_NAME_LEN;
364
365 if (p_remote_name && p_remote_name_len) {
366 memcpy(p_remote_name, p_eir_remote_name, remote_name_len);
367 *(p_remote_name + remote_name_len) = 0;
368 *p_remote_name_len = remote_name_len;
369 }
370
371 return true;
372 }
373 }
374
375 return false;
376 }
377
378 /*******************************************************************************
379 *
380 * Function check_cached_remote_name
381 *
382 * Description Check if remote name is in the NVRAM cache
383 *
384 * Returns true if remote name found
385 * Populate p_remote_name, if provided and remote name found
386 *
387 ******************************************************************************/
check_cached_remote_name(tBTA_DM_SEARCH * p_search_data,uint8_t * p_remote_name,uint8_t * p_remote_name_len)388 static bool check_cached_remote_name(tBTA_DM_SEARCH* p_search_data,
389 uint8_t* p_remote_name,
390 uint8_t* p_remote_name_len) {
391 bt_bdname_t bdname;
392 bt_property_t prop_name;
393
394 /* check if we already have it in our btif_storage cache */
395
396 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_BDNAME,
397 sizeof(bt_bdname_t), &bdname);
398 if (btif_storage_get_remote_device_property(
399 &p_search_data->inq_res.bd_addr, &prop_name) == BT_STATUS_SUCCESS) {
400 if (p_remote_name && p_remote_name_len) {
401 strcpy((char*)p_remote_name, (char*)bdname.name);
402 *p_remote_name_len = strlen((char*)p_remote_name);
403 }
404 return true;
405 }
406
407 return false;
408 }
409
get_cod(const RawAddress * remote_bdaddr)410 static uint32_t get_cod(const RawAddress* remote_bdaddr) {
411 uint32_t remote_cod;
412 bt_property_t prop_name;
413
414 /* check if we already have it in our btif_storage cache */
415 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_CLASS_OF_DEVICE,
416 sizeof(uint32_t), &remote_cod);
417 if (btif_storage_get_remote_device_property(
418 (RawAddress*)remote_bdaddr, &prop_name) == BT_STATUS_SUCCESS) {
419 LOG_INFO(LOG_TAG, "%s remote_cod = 0x%08x", __func__, remote_cod);
420 return remote_cod & COD_MASK;
421 }
422
423 return 0;
424 }
425
check_cod(const RawAddress * remote_bdaddr,uint32_t cod)426 bool check_cod(const RawAddress* remote_bdaddr, uint32_t cod) {
427 return get_cod(remote_bdaddr) == cod;
428 }
429
check_cod_hid(const RawAddress * remote_bdaddr)430 bool check_cod_hid(const RawAddress* remote_bdaddr) {
431 return (get_cod(remote_bdaddr) & COD_HID_MASK) == COD_HID_MAJOR;
432 }
433
check_hid_le(const RawAddress * remote_bdaddr)434 bool check_hid_le(const RawAddress* remote_bdaddr) {
435 uint32_t remote_dev_type;
436 bt_property_t prop_name;
437
438 /* check if we already have it in our btif_storage cache */
439 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_TYPE_OF_DEVICE,
440 sizeof(uint32_t), &remote_dev_type);
441 if (btif_storage_get_remote_device_property(
442 (RawAddress*)remote_bdaddr, &prop_name) == BT_STATUS_SUCCESS) {
443 if (remote_dev_type == BT_DEVICE_DEVTYPE_BLE) {
444 if (btif_config_exist(remote_bdaddr->ToString().c_str(), "HidAppId"))
445 return true;
446 }
447 }
448 return false;
449 }
450
451 /*****************************************************************************
452 *
453 * Function check_sdp_bl
454 *
455 * Description Checks if a given device is blacklisted to skip sdp
456 *
457 * Parameters skip_sdp_entry
458 *
459 * Returns true if the device is present in blacklist, else false
460 *
461 ******************************************************************************/
check_sdp_bl(const RawAddress * remote_bdaddr)462 bool check_sdp_bl(const RawAddress* remote_bdaddr) {
463 uint16_t manufacturer = 0;
464 uint8_t lmp_ver = 0;
465 uint16_t lmp_subver = 0;
466 bt_property_t prop_name;
467 bt_remote_version_t info;
468
469 if (remote_bdaddr == NULL) return false;
470
471 /* fetch additional info about remote device used in iop query */
472 BTM_ReadRemoteVersion(*remote_bdaddr, &lmp_ver, &manufacturer, &lmp_subver);
473
474 /* if not available yet, try fetching from config database */
475 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_REMOTE_VERSION_INFO,
476 sizeof(bt_remote_version_t), &info);
477
478 if (btif_storage_get_remote_device_property(remote_bdaddr, &prop_name) !=
479 BT_STATUS_SUCCESS) {
480 return false;
481 }
482 manufacturer = info.manufacturer;
483
484 for (unsigned int i = 0; i < ARRAY_SIZE(sdp_blacklist); i++) {
485 if (manufacturer == sdp_blacklist[i].manufact_id) return true;
486 }
487 return false;
488 }
489
bond_state_changed(bt_status_t status,const RawAddress & bd_addr,bt_bond_state_t state)490 static void bond_state_changed(bt_status_t status, const RawAddress& bd_addr,
491 bt_bond_state_t state) {
492 btif_stats_add_bond_event(bd_addr, BTIF_DM_FUNC_BOND_STATE_CHANGED, state);
493
494 if ((pairing_cb.state == state) && (state == BT_BOND_STATE_BONDING)) {
495 // Cross key pairing so send callback for static address
496 if (!pairing_cb.static_bdaddr.IsEmpty()) {
497 auto tmp = bd_addr;
498 HAL_CBACK(bt_hal_cbacks, bond_state_changed_cb, status, &tmp, state);
499 }
500 return;
501 }
502
503 if (pairing_cb.bond_type == BOND_TYPE_TEMPORARY) state = BT_BOND_STATE_NONE;
504
505 BTIF_TRACE_DEBUG("%s: state=%d, prev_state=%d, sdp_attempts = %d", __func__,
506 state, pairing_cb.state, pairing_cb.sdp_attempts);
507
508 auto tmp = bd_addr;
509 HAL_CBACK(bt_hal_cbacks, bond_state_changed_cb, status, &tmp, state);
510
511 int dev_type;
512 if (!btif_get_device_type(bd_addr, &dev_type)) {
513 dev_type = BT_DEVICE_TYPE_BREDR;
514 }
515
516 if (state == BT_BOND_STATE_BONDING ||
517 (state == BT_BOND_STATE_BONDED && pairing_cb.sdp_attempts > 0)) {
518 // Save state for the device is bonding or SDP.
519 pairing_cb.state = state;
520 pairing_cb.bd_addr = bd_addr;
521 } else {
522 pairing_cb = {};
523 }
524 }
525
526 /* store remote version in bt config to always have access
527 to it post pairing*/
btif_update_remote_version_property(RawAddress * p_bd)528 static void btif_update_remote_version_property(RawAddress* p_bd) {
529 bt_property_t property;
530 uint8_t lmp_ver = 0;
531 uint16_t lmp_subver = 0;
532 uint16_t mfct_set = 0;
533 tBTM_STATUS btm_status;
534 bt_remote_version_t info;
535 bt_status_t status;
536
537 btm_status = BTM_ReadRemoteVersion(*p_bd, &lmp_ver, &mfct_set, &lmp_subver);
538
539 LOG_DEBUG(LOG_TAG, "remote version info [%s]: %x, %x, %x",
540 p_bd->ToString().c_str(), lmp_ver, mfct_set, lmp_subver);
541
542 if (btm_status == BTM_SUCCESS) {
543 // Always update cache to ensure we have availability whenever BTM API is
544 // not populated
545 info.manufacturer = mfct_set;
546 info.sub_ver = lmp_subver;
547 info.version = lmp_ver;
548 BTIF_STORAGE_FILL_PROPERTY(&property, BT_PROPERTY_REMOTE_VERSION_INFO,
549 sizeof(bt_remote_version_t), &info);
550 status = btif_storage_set_remote_device_property(p_bd, &property);
551 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote version",
552 status);
553 }
554 }
555
btif_update_remote_properties(const RawAddress & bdaddr,BD_NAME bd_name,DEV_CLASS dev_class,tBT_DEVICE_TYPE device_type)556 static void btif_update_remote_properties(const RawAddress& bdaddr,
557 BD_NAME bd_name, DEV_CLASS dev_class,
558 tBT_DEVICE_TYPE device_type) {
559 int num_properties = 0;
560 bt_property_t properties[3];
561 bt_status_t status;
562 uint32_t cod;
563 bt_device_type_t dev_type;
564
565 memset(properties, 0, sizeof(properties));
566
567 /* remote name */
568 if (strlen((const char*)bd_name)) {
569 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties], BT_PROPERTY_BDNAME,
570 strlen((char*)bd_name), bd_name);
571 status = btif_storage_set_remote_device_property(
572 &bdaddr, &properties[num_properties]);
573 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device name",
574 status);
575 num_properties++;
576 }
577
578 /* class of device */
579 cod = devclass2uint(dev_class);
580 BTIF_TRACE_DEBUG("%s cod is 0x%06x", __func__, cod);
581 if (cod == 0) {
582 /* Try to retrieve cod from storage */
583 BTIF_TRACE_DEBUG("%s cod is 0, checking cod from storage", __func__);
584 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
585 BT_PROPERTY_CLASS_OF_DEVICE, sizeof(cod), &cod);
586 status = btif_storage_get_remote_device_property(
587 &bdaddr, &properties[num_properties]);
588 BTIF_TRACE_DEBUG("%s cod retrieved from storage is 0x%06x", __func__, cod);
589 if (cod == 0) {
590 BTIF_TRACE_DEBUG("%s cod is again 0, set as unclassified", __func__);
591 cod = COD_UNCLASSIFIED;
592 }
593 }
594
595 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
596 BT_PROPERTY_CLASS_OF_DEVICE, sizeof(cod), &cod);
597 status = btif_storage_set_remote_device_property(&bdaddr,
598 &properties[num_properties]);
599 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device class",
600 status);
601 num_properties++;
602
603 /* device type */
604 bt_property_t prop_name;
605 uint8_t remote_dev_type;
606 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_TYPE_OF_DEVICE,
607 sizeof(uint8_t), &remote_dev_type);
608 if (btif_storage_get_remote_device_property(&bdaddr, &prop_name) ==
609 BT_STATUS_SUCCESS)
610 dev_type = (bt_device_type_t)(remote_dev_type | device_type);
611 else
612 dev_type = (bt_device_type_t)device_type;
613
614 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
615 BT_PROPERTY_TYPE_OF_DEVICE, sizeof(dev_type),
616 &dev_type);
617 status = btif_storage_set_remote_device_property(&bdaddr,
618 &properties[num_properties]);
619 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device type",
620 status);
621 num_properties++;
622
623 auto tmp = bdaddr;
624 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, status, &tmp,
625 num_properties, properties);
626 }
627
628 /*******************************************************************************
629 *
630 * Function btif_dm_cb_hid_remote_name
631 *
632 * Description Remote name callback for HID device. Called in btif context
633 * Special handling for HID devices
634 *
635 * Returns void
636 *
637 ******************************************************************************/
btif_dm_cb_hid_remote_name(tBTM_REMOTE_DEV_NAME * p_remote_name)638 static void btif_dm_cb_hid_remote_name(tBTM_REMOTE_DEV_NAME* p_remote_name) {
639 BTIF_TRACE_DEBUG("%s: status=%d pairing_cb.state=%d", __func__,
640 p_remote_name->status, pairing_cb.state);
641 if (pairing_cb.state == BT_BOND_STATE_BONDING) {
642 if (p_remote_name->status == BTM_SUCCESS) {
643 bond_state_changed(BT_STATUS_SUCCESS, pairing_cb.bd_addr,
644 BT_BOND_STATE_BONDED);
645 } else
646 bond_state_changed(BT_STATUS_FAIL, pairing_cb.bd_addr,
647 BT_BOND_STATE_NONE);
648 }
649 }
650
651 /*******************************************************************************
652 *
653 * Function btif_dm_cb_create_bond
654 *
655 * Description Create bond initiated from the BTIF thread context
656 * Special handling for HID devices
657 *
658 * Returns void
659 *
660 ******************************************************************************/
btif_dm_cb_create_bond(const RawAddress & bd_addr,tBTA_TRANSPORT transport)661 static void btif_dm_cb_create_bond(const RawAddress& bd_addr,
662 tBTA_TRANSPORT transport) {
663 bool is_hid = check_cod(&bd_addr, COD_HID_POINTING);
664 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
665
666 int device_type;
667 int addr_type;
668 std::string addrstr = bd_addr.ToString();
669 const char* bdstr = addrstr.c_str();
670 if (transport == BT_TRANSPORT_LE) {
671 if (!btif_config_get_int(bdstr, "DevType", &device_type)) {
672 btif_config_set_int(bdstr, "DevType", BT_DEVICE_TYPE_BLE);
673 }
674 if (btif_storage_get_remote_addr_type(&bd_addr, &addr_type) !=
675 BT_STATUS_SUCCESS) {
676 // Try to read address type. OOB pairing might have set it earlier, but
677 // didn't store it, it defaults to BLE_ADDR_PUBLIC
678 uint8_t tmp_dev_type;
679 uint8_t tmp_addr_type;
680 BTM_ReadDevInfo(bd_addr, &tmp_dev_type, &tmp_addr_type);
681 addr_type = tmp_addr_type;
682
683 btif_storage_set_remote_addr_type(&bd_addr, addr_type);
684 }
685 }
686 if ((btif_config_get_int(bdstr, "DevType", &device_type) &&
687 (btif_storage_get_remote_addr_type(&bd_addr, &addr_type) ==
688 BT_STATUS_SUCCESS) &&
689 (device_type & BT_DEVICE_TYPE_BLE) == BT_DEVICE_TYPE_BLE) ||
690 (transport == BT_TRANSPORT_LE)) {
691 BTA_DmAddBleDevice(bd_addr, addr_type, device_type);
692 }
693
694 if (is_hid && (device_type & BT_DEVICE_TYPE_BLE) == 0) {
695 bt_status_t status;
696 status = (bt_status_t)btif_hh_connect(&bd_addr);
697 if (status != BT_STATUS_SUCCESS)
698 bond_state_changed(status, bd_addr, BT_BOND_STATE_NONE);
699 } else {
700 BTA_DmBondByTransport(bd_addr, transport);
701 }
702 /* Track originator of bond creation */
703 pairing_cb.is_local_initiated = true;
704 }
705
706 /*******************************************************************************
707 *
708 * Function btif_dm_cb_remove_bond
709 *
710 * Description remove bond initiated from the BTIF thread context
711 * Special handling for HID devices
712 *
713 * Returns void
714 *
715 ******************************************************************************/
btif_dm_cb_remove_bond(const RawAddress * bd_addr)716 void btif_dm_cb_remove_bond(const RawAddress* bd_addr) {
717 /*special handling for HID devices */
718 /* VUP needs to be sent if its a HID Device. The HID HOST module will check if
719 there
720 is a valid hid connection with this bd_addr. If yes VUP will be issued.*/
721 #if (BTA_HH_INCLUDED == TRUE)
722 if (btif_hh_virtual_unplug(bd_addr) != BT_STATUS_SUCCESS)
723 #endif
724 {
725 BTIF_TRACE_DEBUG("%s: Removing HH device", __func__);
726 BTA_DmRemoveDevice(*bd_addr);
727 }
728 }
729
730 /*******************************************************************************
731 *
732 * Function btif_dm_get_connection_state
733 *
734 * Description Returns whether the remote device is currently connected
735 * and whether encryption is active for the connection
736 *
737 * Returns 0 if not connected; 1 if connected and > 1 if connection is
738 * encrypted
739 *
740 ******************************************************************************/
btif_dm_get_connection_state(const RawAddress * bd_addr)741 uint16_t btif_dm_get_connection_state(const RawAddress* bd_addr) {
742 uint16_t rc = BTA_DmGetConnectionState(*bd_addr);
743
744 if (rc != 0) {
745 uint8_t flags = 0;
746
747 BTM_GetSecurityFlagsByTransport(*bd_addr, &flags, BT_TRANSPORT_BR_EDR);
748 BTIF_TRACE_DEBUG("%s: security flags (BR/EDR)=0x%02x", __func__, flags);
749 if (flags & BTM_SEC_FLAG_ENCRYPTED) rc |= ENCRYPTED_BREDR;
750
751 BTM_GetSecurityFlagsByTransport(*bd_addr, &flags, BT_TRANSPORT_LE);
752 BTIF_TRACE_DEBUG("%s: security flags (LE)=0x%02x", __func__, flags);
753 if (flags & BTM_SEC_FLAG_ENCRYPTED) rc |= ENCRYPTED_LE;
754 }
755
756 return rc;
757 }
758
759 /*******************************************************************************
760 *
761 * Function search_devices_copy_cb
762 *
763 * Description Deep copy callback for search devices event
764 *
765 * Returns void
766 *
767 ******************************************************************************/
search_devices_copy_cb(uint16_t event,char * p_dest,char * p_src)768 static void search_devices_copy_cb(uint16_t event, char* p_dest, char* p_src) {
769 tBTA_DM_SEARCH* p_dest_data = (tBTA_DM_SEARCH*)p_dest;
770 tBTA_DM_SEARCH* p_src_data = (tBTA_DM_SEARCH*)p_src;
771
772 if (!p_src) return;
773
774 BTIF_TRACE_DEBUG("%s: event=%s", __func__, dump_dm_search_event(event));
775 maybe_non_aligned_memcpy(p_dest_data, p_src_data, sizeof(*p_src_data));
776 switch (event) {
777 case BTA_DM_INQ_RES_EVT: {
778 if (p_src_data->inq_res.p_eir) {
779 p_dest_data->inq_res.p_eir =
780 (uint8_t*)(p_dest + sizeof(tBTA_DM_SEARCH));
781 memcpy(p_dest_data->inq_res.p_eir, p_src_data->inq_res.p_eir,
782 p_src_data->inq_res.eir_len);
783 p_dest_data->inq_res.eir_len = p_src_data->inq_res.eir_len;
784 }
785 } break;
786
787 case BTA_DM_DISC_RES_EVT: {
788 if (p_src_data->disc_res.raw_data_size &&
789 p_src_data->disc_res.p_raw_data) {
790 p_dest_data->disc_res.p_raw_data =
791 (uint8_t*)(p_dest + sizeof(tBTA_DM_SEARCH));
792 memcpy(p_dest_data->disc_res.p_raw_data,
793 p_src_data->disc_res.p_raw_data,
794 p_src_data->disc_res.raw_data_size);
795 }
796 } break;
797 }
798 }
799
search_services_copy_cb(uint16_t event,char * p_dest,char * p_src)800 static void search_services_copy_cb(uint16_t event, char* p_dest, char* p_src) {
801 tBTA_DM_SEARCH* p_dest_data = (tBTA_DM_SEARCH*)p_dest;
802 tBTA_DM_SEARCH* p_src_data = (tBTA_DM_SEARCH*)p_src;
803
804 if (!p_src) return;
805 maybe_non_aligned_memcpy(p_dest_data, p_src_data, sizeof(*p_src_data));
806 switch (event) {
807 case BTA_DM_DISC_RES_EVT: {
808 if (p_src_data->disc_res.result == BTA_SUCCESS) {
809 if (p_src_data->disc_res.num_uuids > 0) {
810 p_dest_data->disc_res.p_uuid_list =
811 (Uuid*)(p_dest + sizeof(tBTA_DM_SEARCH));
812 memcpy(p_dest_data->disc_res.p_uuid_list,
813 p_src_data->disc_res.p_uuid_list,
814 p_src_data->disc_res.num_uuids * sizeof(Uuid));
815 osi_free_and_reset((void**)&p_src_data->disc_res.p_uuid_list);
816 }
817 osi_free_and_reset((void**)&p_src_data->disc_res.p_raw_data);
818 }
819 } break;
820 }
821 }
822 /******************************************************************************
823 *
824 * BTIF DM callback events
825 *
826 ****************************************************************************/
827
828 /*******************************************************************************
829 *
830 * Function btif_dm_pin_req_evt
831 *
832 * Description Executes pin request event in btif context
833 *
834 * Returns void
835 *
836 ******************************************************************************/
btif_dm_pin_req_evt(tBTA_DM_PIN_REQ * p_pin_req)837 static void btif_dm_pin_req_evt(tBTA_DM_PIN_REQ* p_pin_req) {
838 bt_bdname_t bd_name;
839 uint32_t cod;
840 bt_pin_code_t pin_code;
841 int dev_type;
842
843 /* Remote properties update */
844 if (!btif_get_device_type(p_pin_req->bd_addr, &dev_type)) {
845 dev_type = BT_DEVICE_TYPE_BREDR;
846 }
847 btif_update_remote_properties(p_pin_req->bd_addr, p_pin_req->bd_name,
848 p_pin_req->dev_class,
849 (tBT_DEVICE_TYPE)dev_type);
850
851 const RawAddress& bd_addr = p_pin_req->bd_addr;
852 memcpy(bd_name.name, p_pin_req->bd_name, BD_NAME_LEN);
853
854 if (pairing_cb.state == BT_BOND_STATE_BONDING &&
855 bd_addr != pairing_cb.bd_addr) {
856 BTIF_TRACE_WARNING("%s(): already in bonding state, reject request",
857 __FUNCTION__);
858 btif_dm_pin_reply(&bd_addr, 0, 0, NULL);
859 return;
860 }
861
862 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
863
864 cod = devclass2uint(p_pin_req->dev_class);
865
866 if (cod == 0) {
867 BTIF_TRACE_DEBUG("%s cod is 0, set as unclassified", __func__);
868 cod = COD_UNCLASSIFIED;
869 }
870
871 /* check for auto pair possiblity only if bond was initiated by local device
872 */
873 if (pairing_cb.is_local_initiated && !p_pin_req->min_16_digit) {
874 if (check_cod(&bd_addr, COD_AV_HEADSETS) ||
875 check_cod(&bd_addr, COD_AV_HEADPHONES) ||
876 check_cod(&bd_addr, COD_AV_PORTABLE_AUDIO) ||
877 check_cod(&bd_addr, COD_AV_HIFI_AUDIO) ||
878 check_cod(&bd_addr, COD_HID_POINTING)) {
879 /* Check if this device can be auto paired */
880 if (!interop_match_addr(INTEROP_DISABLE_AUTO_PAIRING, &bd_addr) &&
881 !interop_match_name(INTEROP_DISABLE_AUTO_PAIRING,
882 (const char*)bd_name.name) &&
883 (pairing_cb.autopair_attempts == 0)) {
884 BTIF_TRACE_DEBUG("%s() Attempting auto pair", __func__);
885 pin_code.pin[0] = 0x30;
886 pin_code.pin[1] = 0x30;
887 pin_code.pin[2] = 0x30;
888 pin_code.pin[3] = 0x30;
889
890 pairing_cb.autopair_attempts++;
891 BTA_DmPinReply(bd_addr, true, 4, pin_code.pin);
892 return;
893 }
894 } else if (check_cod(&bd_addr, COD_HID_KEYBOARD) ||
895 check_cod(&bd_addr, COD_HID_COMBO)) {
896 if ((interop_match_addr(INTEROP_KEYBOARD_REQUIRES_FIXED_PIN, &bd_addr) ==
897 true) &&
898 (pairing_cb.autopair_attempts == 0)) {
899 BTIF_TRACE_DEBUG("%s() Attempting auto pair", __func__);
900 pin_code.pin[0] = 0x30;
901 pin_code.pin[1] = 0x30;
902 pin_code.pin[2] = 0x30;
903 pin_code.pin[3] = 0x30;
904
905 pairing_cb.autopair_attempts++;
906 BTA_DmPinReply(bd_addr, true, 4, pin_code.pin);
907 return;
908 }
909 }
910 }
911 // TODO: make cback accept const and get rid of tmp!
912 auto tmp = bd_addr;
913 HAL_CBACK(bt_hal_cbacks, pin_request_cb, &tmp, &bd_name, cod,
914 p_pin_req->min_16_digit);
915 }
916
917 /*******************************************************************************
918 *
919 * Function btif_dm_ssp_cfm_req_evt
920 *
921 * Description Executes SSP confirm request event in btif context
922 *
923 * Returns void
924 *
925 ******************************************************************************/
btif_dm_ssp_cfm_req_evt(tBTA_DM_SP_CFM_REQ * p_ssp_cfm_req)926 static void btif_dm_ssp_cfm_req_evt(tBTA_DM_SP_CFM_REQ* p_ssp_cfm_req) {
927 bt_bdname_t bd_name;
928 uint32_t cod;
929 bool is_incoming = !(pairing_cb.state == BT_BOND_STATE_BONDING);
930 int dev_type;
931
932 BTIF_TRACE_DEBUG("%s", __func__);
933
934 /* Remote properties update */
935 if (!btif_get_device_type(p_ssp_cfm_req->bd_addr, &dev_type)) {
936 dev_type = BT_DEVICE_TYPE_BREDR;
937 }
938 btif_update_remote_properties(p_ssp_cfm_req->bd_addr, p_ssp_cfm_req->bd_name,
939 p_ssp_cfm_req->dev_class,
940 (tBT_DEVICE_TYPE)dev_type);
941
942 RawAddress bd_addr = p_ssp_cfm_req->bd_addr;
943 memcpy(bd_name.name, p_ssp_cfm_req->bd_name, BD_NAME_LEN);
944
945 if (pairing_cb.state == BT_BOND_STATE_BONDING &&
946 bd_addr != pairing_cb.bd_addr) {
947 BTIF_TRACE_WARNING("%s(): already in bonding state, reject request",
948 __FUNCTION__);
949 btif_dm_ssp_reply(&bd_addr, BT_SSP_VARIANT_PASSKEY_CONFIRMATION, 0, 0);
950 return;
951 }
952
953 /* Set the pairing_cb based on the local & remote authentication requirements
954 */
955 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
956
957 BTIF_TRACE_EVENT("%s: just_works:%d, loc_auth_req=%d, rmt_auth_req=%d",
958 __func__, p_ssp_cfm_req->just_works,
959 p_ssp_cfm_req->loc_auth_req, p_ssp_cfm_req->rmt_auth_req);
960
961 /* if just_works and bonding bit is not set treat this as temporary */
962 if (p_ssp_cfm_req->just_works &&
963 !(p_ssp_cfm_req->loc_auth_req & BTM_AUTH_BONDS) &&
964 !(p_ssp_cfm_req->rmt_auth_req & BTM_AUTH_BONDS) &&
965 !(check_cod((RawAddress*)&p_ssp_cfm_req->bd_addr, COD_HID_POINTING)))
966 pairing_cb.bond_type = BOND_TYPE_TEMPORARY;
967 else
968 pairing_cb.bond_type = BOND_TYPE_PERSISTENT;
969
970 btm_set_bond_type_dev(p_ssp_cfm_req->bd_addr, pairing_cb.bond_type);
971
972 pairing_cb.is_ssp = true;
973
974 /* If JustWorks auto-accept */
975 if (p_ssp_cfm_req->just_works) {
976 /* Pairing consent for JustWorks NOT needed if:
977 * 1. Incoming temporary pairing is detected
978 */
979 if (is_incoming && pairing_cb.bond_type == BOND_TYPE_TEMPORARY) {
980 BTIF_TRACE_EVENT(
981 "%s: Auto-accept JustWorks pairing for temporary incoming", __func__);
982 btif_dm_ssp_reply(&bd_addr, BT_SSP_VARIANT_CONSENT, true, 0);
983 return;
984 }
985 }
986
987 cod = devclass2uint(p_ssp_cfm_req->dev_class);
988
989 if (cod == 0) {
990 LOG_DEBUG(LOG_TAG, "%s cod is 0, set as unclassified", __func__);
991 cod = COD_UNCLASSIFIED;
992 }
993
994 pairing_cb.sdp_attempts = 0;
995 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
996 (p_ssp_cfm_req->just_works ? BT_SSP_VARIANT_CONSENT
997 : BT_SSP_VARIANT_PASSKEY_CONFIRMATION),
998 p_ssp_cfm_req->num_val);
999 }
1000
btif_dm_ssp_key_notif_evt(tBTA_DM_SP_KEY_NOTIF * p_ssp_key_notif)1001 static void btif_dm_ssp_key_notif_evt(tBTA_DM_SP_KEY_NOTIF* p_ssp_key_notif) {
1002 bt_bdname_t bd_name;
1003 uint32_t cod;
1004 int dev_type;
1005
1006 BTIF_TRACE_DEBUG("%s", __func__);
1007
1008 /* Remote properties update */
1009 if (!btif_get_device_type(p_ssp_key_notif->bd_addr, &dev_type)) {
1010 dev_type = BT_DEVICE_TYPE_BREDR;
1011 }
1012 btif_update_remote_properties(
1013 p_ssp_key_notif->bd_addr, p_ssp_key_notif->bd_name,
1014 p_ssp_key_notif->dev_class, (tBT_DEVICE_TYPE)dev_type);
1015
1016 RawAddress bd_addr = p_ssp_key_notif->bd_addr;
1017 memcpy(bd_name.name, p_ssp_key_notif->bd_name, BD_NAME_LEN);
1018
1019 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
1020 pairing_cb.is_ssp = true;
1021 cod = devclass2uint(p_ssp_key_notif->dev_class);
1022
1023 if (cod == 0) {
1024 LOG_DEBUG(LOG_TAG, "%s cod is 0, set as unclassified", __func__);
1025 cod = COD_UNCLASSIFIED;
1026 }
1027
1028 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
1029 BT_SSP_VARIANT_PASSKEY_NOTIFICATION, p_ssp_key_notif->passkey);
1030 }
1031 /*******************************************************************************
1032 *
1033 * Function btif_dm_auth_cmpl_evt
1034 *
1035 * Description Executes authentication complete event in btif context
1036 *
1037 * Returns void
1038 *
1039 ******************************************************************************/
btif_dm_auth_cmpl_evt(tBTA_DM_AUTH_CMPL * p_auth_cmpl)1040 static void btif_dm_auth_cmpl_evt(tBTA_DM_AUTH_CMPL* p_auth_cmpl) {
1041 /* Save link key, if not temporary */
1042 bt_status_t status = BT_STATUS_FAIL;
1043 bt_bond_state_t state = BT_BOND_STATE_NONE;
1044 bool skip_sdp = false;
1045
1046 BTIF_TRACE_DEBUG("%s: bond state=%d, success=%d, key_present=%d", __func__,
1047 pairing_cb.state, p_auth_cmpl->success,
1048 p_auth_cmpl->key_present);
1049
1050 RawAddress bd_addr = p_auth_cmpl->bd_addr;
1051 if ((p_auth_cmpl->success) && (p_auth_cmpl->key_present)) {
1052 if ((p_auth_cmpl->key_type < HCI_LKEY_TYPE_DEBUG_COMB) ||
1053 (p_auth_cmpl->key_type == HCI_LKEY_TYPE_AUTH_COMB) ||
1054 (p_auth_cmpl->key_type == HCI_LKEY_TYPE_CHANGED_COMB) ||
1055 (p_auth_cmpl->key_type == HCI_LKEY_TYPE_AUTH_COMB_P_256) ||
1056 pairing_cb.bond_type == BOND_TYPE_PERSISTENT) {
1057 bt_status_t ret;
1058 BTIF_TRACE_DEBUG("%s: Storing link key. key_type=0x%x, bond_type=%d",
1059 __func__, p_auth_cmpl->key_type, pairing_cb.bond_type);
1060 ret = btif_storage_add_bonded_device(&bd_addr, p_auth_cmpl->key,
1061 p_auth_cmpl->key_type,
1062 pairing_cb.pin_code_len);
1063 ASSERTC(ret == BT_STATUS_SUCCESS, "storing link key failed", ret);
1064 } else {
1065 BTIF_TRACE_DEBUG(
1066 "%s: Temporary key. Not storing. key_type=0x%x, bond_type=%d",
1067 __func__, p_auth_cmpl->key_type, pairing_cb.bond_type);
1068 if (pairing_cb.bond_type == BOND_TYPE_TEMPORARY) {
1069 BTIF_TRACE_DEBUG("%s: sending BT_BOND_STATE_NONE for Temp pairing",
1070 __func__);
1071 btif_storage_remove_bonded_device(&bd_addr);
1072 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_NONE);
1073 return;
1074 }
1075 }
1076 }
1077
1078 if (p_auth_cmpl->success) {
1079 // We could have received a new link key without going through the pairing
1080 // flow. If so, we don't want to perform SDP or any other operations on the
1081 // authenticated device. Also, make sure that the link key is not derived
1082 // from secure LTK, because we will need to perform SDP in case of link key
1083 // derivation to allow bond state change notification for the BR/EDR
1084 // transport so that the subsequent BR/EDR connections to the remote can use
1085 // the derived link key.
1086 if (p_auth_cmpl->bd_addr != pairing_cb.bd_addr &&
1087 (!pairing_cb.ble.is_penc_key_rcvd)) {
1088 LOG(INFO) << __func__
1089 << " skipping SDP since we did not initiate pairing to "
1090 << p_auth_cmpl->bd_addr;
1091 return;
1092 }
1093
1094 btif_storage_set_remote_addr_type(&bd_addr, p_auth_cmpl->addr_type);
1095 btif_update_remote_properties(p_auth_cmpl->bd_addr, p_auth_cmpl->bd_name,
1096 NULL, p_auth_cmpl->dev_type);
1097 pairing_cb.timeout_retries = 0;
1098 status = BT_STATUS_SUCCESS;
1099 state = BT_BOND_STATE_BONDED;
1100 bd_addr = p_auth_cmpl->bd_addr;
1101
1102 if (check_sdp_bl(&bd_addr) && check_cod_hid(&bd_addr)) {
1103 LOG_WARN(LOG_TAG, "%s:skip SDP", __func__);
1104 skip_sdp = true;
1105 }
1106 if (!pairing_cb.is_local_initiated && skip_sdp) {
1107 bond_state_changed(status, bd_addr, state);
1108
1109 LOG_WARN(LOG_TAG, "%s: Incoming HID Connection", __func__);
1110 bt_property_t prop;
1111 RawAddress bd_addr;
1112 Uuid uuid = Uuid::From16Bit(UUID_SERVCLASS_HUMAN_INTERFACE);
1113
1114 prop.type = BT_PROPERTY_UUIDS;
1115 prop.val = &uuid;
1116 prop.len = Uuid::kNumBytes128;
1117
1118 /* Send the event to the BTIF */
1119 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1120 &bd_addr, 1, &prop);
1121 } else {
1122 bool is_crosskey = false;
1123 /* If bonded due to cross-key, save the static address too*/
1124 if (pairing_cb.state == BT_BOND_STATE_BONDING &&
1125 p_auth_cmpl->bd_addr != pairing_cb.bd_addr) {
1126 BTIF_TRACE_DEBUG(
1127 "%s: bonding initiated due to cross key, adding static address",
1128 __func__);
1129 pairing_cb.static_bdaddr = bd_addr;
1130 is_crosskey = true;
1131 }
1132 if (!is_crosskey ||
1133 !(stack_config_get_interface()->get_pts_crosskey_sdp_disable())) {
1134 // Ensure inquiry is stopped before attempting service discovery
1135 btif_dm_cancel_discovery();
1136
1137 /* Trigger SDP on the device */
1138 pairing_cb.sdp_attempts = 1;
1139
1140 if (is_crosskey) {
1141 // If bonding occurred due to cross-key pairing, send bonding callback
1142 // for static address now
1143 LOG_INFO(LOG_TAG,
1144 "%s: send bonding state update for static address %s",
1145 __func__, bd_addr.ToString().c_str());
1146 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
1147 }
1148 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDED);
1149
1150 btif_dm_get_remote_services(bd_addr);
1151 }
1152 }
1153 // Do not call bond_state_changed_cb yet. Wait until remote service
1154 // discovery is complete
1155 } else {
1156 // Map the HCI fail reason to bt status
1157 switch (p_auth_cmpl->fail_reason) {
1158 case HCI_ERR_PAGE_TIMEOUT:
1159 case HCI_ERR_LMP_RESPONSE_TIMEOUT:
1160 if (interop_match_addr(INTEROP_AUTO_RETRY_PAIRING, &bd_addr) &&
1161 pairing_cb.timeout_retries) {
1162 BTIF_TRACE_WARNING("%s() - Pairing timeout; retrying (%d) ...",
1163 __func__, pairing_cb.timeout_retries);
1164 --pairing_cb.timeout_retries;
1165 btif_dm_cb_create_bond(bd_addr, BTA_TRANSPORT_UNKNOWN);
1166 return;
1167 }
1168 FALLTHROUGH_INTENDED; /* FALLTHROUGH */
1169 case HCI_ERR_CONNECTION_TOUT:
1170 status = BT_STATUS_RMT_DEV_DOWN;
1171 break;
1172
1173 case HCI_ERR_PAIRING_NOT_ALLOWED:
1174 btif_storage_remove_bonded_device(&bd_addr);
1175 status = BT_STATUS_AUTH_REJECTED;
1176 break;
1177
1178 /* map the auth failure codes, so we can retry pairing if necessary */
1179 case HCI_ERR_AUTH_FAILURE:
1180 case HCI_ERR_KEY_MISSING:
1181 btif_storage_remove_bonded_device(&bd_addr);
1182 case HCI_ERR_HOST_REJECT_SECURITY:
1183 case HCI_ERR_ENCRY_MODE_NOT_ACCEPTABLE:
1184 case HCI_ERR_UNIT_KEY_USED:
1185 case HCI_ERR_PAIRING_WITH_UNIT_KEY_NOT_SUPPORTED:
1186 case HCI_ERR_INSUFFCIENT_SECURITY:
1187 case HCI_ERR_PEER_USER:
1188 case HCI_ERR_UNSPECIFIED:
1189 BTIF_TRACE_DEBUG(" %s() Authentication fail reason %d", __func__,
1190 p_auth_cmpl->fail_reason);
1191 if (pairing_cb.autopair_attempts == 1) {
1192 /* Create the Bond once again */
1193 BTIF_TRACE_WARNING("%s() auto pair failed. Reinitiate Bond",
1194 __func__);
1195 btif_dm_cb_create_bond(bd_addr, BTA_TRANSPORT_UNKNOWN);
1196 return;
1197 } else {
1198 /* if autopair attempts are more than 1, or not attempted */
1199 status = BT_STATUS_AUTH_FAILURE;
1200 }
1201 break;
1202
1203 default:
1204 status = BT_STATUS_FAIL;
1205 }
1206 /* Special Handling for HID Devices */
1207 if (check_cod(&bd_addr, COD_HID_POINTING)) {
1208 /* Remove Device as bonded in nvram as authentication failed */
1209 BTIF_TRACE_DEBUG("%s(): removing hid pointing device from nvram",
1210 __func__);
1211 btif_storage_remove_bonded_device(&bd_addr);
1212 }
1213 bond_state_changed(status, bd_addr, state);
1214 }
1215 }
1216
1217 /******************************************************************************
1218 *
1219 * Function btif_dm_search_devices_evt
1220 *
1221 * Description Executes search devices callback events in btif context
1222 *
1223 * Returns void
1224 *
1225 *****************************************************************************/
btif_dm_search_devices_evt(uint16_t event,char * p_param)1226 static void btif_dm_search_devices_evt(uint16_t event, char* p_param) {
1227 tBTA_DM_SEARCH* p_search_data;
1228 BTIF_TRACE_EVENT("%s event=%s", __func__, dump_dm_search_event(event));
1229
1230 switch (event) {
1231 case BTA_DM_DISC_RES_EVT: {
1232 p_search_data = (tBTA_DM_SEARCH*)p_param;
1233 /* Remote name update */
1234 if (strlen((const char*)p_search_data->disc_res.bd_name)) {
1235 bt_property_t properties[1];
1236 bt_status_t status;
1237
1238 properties[0].type = BT_PROPERTY_BDNAME;
1239 properties[0].val = p_search_data->disc_res.bd_name;
1240 properties[0].len = strlen((char*)p_search_data->disc_res.bd_name);
1241 RawAddress& bdaddr = p_search_data->disc_res.bd_addr;
1242
1243 status =
1244 btif_storage_set_remote_device_property(&bdaddr, &properties[0]);
1245 ASSERTC(status == BT_STATUS_SUCCESS,
1246 "failed to save remote device property", status);
1247 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, status, &bdaddr,
1248 1, properties);
1249 }
1250 /* TODO: Services? */
1251 } break;
1252
1253 case BTA_DM_INQ_RES_EVT: {
1254 /* inquiry result */
1255 bt_bdname_t bdname;
1256 uint8_t remote_name_len;
1257 tBTA_SERVICE_MASK services = 0;
1258
1259 p_search_data = (tBTA_DM_SEARCH*)p_param;
1260 RawAddress& bdaddr = p_search_data->inq_res.bd_addr;
1261
1262 BTIF_TRACE_DEBUG("%s() %s device_type = 0x%x\n", __func__,
1263 bdaddr.ToString().c_str(),
1264 p_search_data->inq_res.device_type);
1265 bdname.name[0] = 0;
1266
1267 if (!check_eir_remote_name(p_search_data, bdname.name, &remote_name_len))
1268 check_cached_remote_name(p_search_data, bdname.name, &remote_name_len);
1269
1270 /* Check EIR for remote name and services */
1271 if (p_search_data->inq_res.p_eir) {
1272 BTA_GetEirService(p_search_data->inq_res.p_eir,
1273 p_search_data->inq_res.eir_len, &services);
1274 BTIF_TRACE_DEBUG("%s()EIR BTA services = %08X", __func__,
1275 (uint32_t)services);
1276 /* TODO: Get the service list and check to see which uuids we got and
1277 * send it back to the client. */
1278 }
1279
1280 {
1281 bt_property_t properties[5];
1282 bt_device_type_t dev_type;
1283 uint32_t num_properties = 0;
1284 bt_status_t status;
1285 int addr_type = 0;
1286
1287 memset(properties, 0, sizeof(properties));
1288 /* RawAddress */
1289 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1290 BT_PROPERTY_BDADDR, sizeof(bdaddr), &bdaddr);
1291 num_properties++;
1292 /* BD_NAME */
1293 /* Don't send BDNAME if it is empty */
1294 if (bdname.name[0]) {
1295 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1296 BT_PROPERTY_BDNAME,
1297 strlen((char*)bdname.name), &bdname);
1298 num_properties++;
1299 }
1300
1301 /* DEV_CLASS */
1302 uint32_t cod = devclass2uint(p_search_data->inq_res.dev_class);
1303 BTIF_TRACE_DEBUG("%s cod is 0x%06x", __func__, cod);
1304 if (cod != 0) {
1305 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1306 BT_PROPERTY_CLASS_OF_DEVICE, sizeof(cod),
1307 &cod);
1308 num_properties++;
1309 }
1310
1311 /* DEV_TYPE */
1312 /* FixMe: Assumption is that bluetooth.h and BTE enums match */
1313
1314 /* Verify if the device is dual mode in NVRAM */
1315 int stored_device_type = 0;
1316 if (btif_get_device_type(bdaddr, &stored_device_type) &&
1317 ((stored_device_type != BT_DEVICE_TYPE_BREDR &&
1318 p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BREDR) ||
1319 (stored_device_type != BT_DEVICE_TYPE_BLE &&
1320 p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BLE))) {
1321 dev_type = (bt_device_type_t)BT_DEVICE_TYPE_DUMO;
1322 } else {
1323 dev_type = (bt_device_type_t)p_search_data->inq_res.device_type;
1324 }
1325
1326 if (p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BLE)
1327 addr_type = p_search_data->inq_res.ble_addr_type;
1328 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1329 BT_PROPERTY_TYPE_OF_DEVICE, sizeof(dev_type),
1330 &dev_type);
1331 num_properties++;
1332 /* RSSI */
1333 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1334 BT_PROPERTY_REMOTE_RSSI, sizeof(int8_t),
1335 &(p_search_data->inq_res.rssi));
1336 num_properties++;
1337
1338 status =
1339 btif_storage_add_remote_device(&bdaddr, num_properties, properties);
1340 ASSERTC(status == BT_STATUS_SUCCESS,
1341 "failed to save remote device (inquiry)", status);
1342 status = btif_storage_set_remote_addr_type(&bdaddr, addr_type);
1343 ASSERTC(status == BT_STATUS_SUCCESS,
1344 "failed to save remote addr type (inquiry)", status);
1345 /* Callback to notify upper layer of device */
1346 HAL_CBACK(bt_hal_cbacks, device_found_cb, num_properties, properties);
1347 }
1348 } break;
1349
1350 case BTA_DM_INQ_CMPL_EVT: {
1351 do_in_main_thread(
1352 FROM_HERE,
1353 base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_DELETE, 0,
1354 nullptr, base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
1355 } break;
1356 case BTA_DM_DISC_CMPL_EVT: {
1357 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1358 BT_DISCOVERY_STOPPED);
1359 } break;
1360 case BTA_DM_SEARCH_CANCEL_CMPL_EVT: {
1361 /* if inquiry is not in progress and we get a cancel event, then
1362 * it means we are done with inquiry, but remote_name fetches are in
1363 * progress
1364 *
1365 * if inquiry is in progress, then we don't want to act on this
1366 * cancel_cmpl_evt
1367 * but instead wait for the cancel_cmpl_evt via the Busy Level
1368 *
1369 */
1370 if (!btif_dm_inquiry_in_progress) {
1371 btgatt_filt_param_setup_t adv_filt_param;
1372 memset(&adv_filt_param, 0, sizeof(btgatt_filt_param_setup_t));
1373 do_in_main_thread(
1374 FROM_HERE,
1375 base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_DELETE, 0,
1376 nullptr, base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
1377 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1378 BT_DISCOVERY_STOPPED);
1379 }
1380 } break;
1381 }
1382 }
1383
1384 /*******************************************************************************
1385 *
1386 * Function btif_dm_search_services_evt
1387 *
1388 * Description Executes search services event in btif context
1389 *
1390 * Returns void
1391 *
1392 ******************************************************************************/
btif_dm_search_services_evt(uint16_t event,char * p_param)1393 static void btif_dm_search_services_evt(uint16_t event, char* p_param) {
1394 tBTA_DM_SEARCH* p_data = (tBTA_DM_SEARCH*)p_param;
1395
1396 BTIF_TRACE_EVENT("%s: event = %d", __func__, event);
1397 switch (event) {
1398 case BTA_DM_DISC_RES_EVT: {
1399 bt_property_t prop;
1400 uint32_t i = 0;
1401 bt_status_t ret;
1402
1403 RawAddress& bd_addr = p_data->disc_res.bd_addr;
1404
1405 BTIF_TRACE_DEBUG("%s:(result=0x%x, services 0x%x)", __func__,
1406 p_data->disc_res.result, p_data->disc_res.services);
1407 if (p_data->disc_res.result != BTA_SUCCESS &&
1408 pairing_cb.state == BT_BOND_STATE_BONDED &&
1409 pairing_cb.sdp_attempts < BTIF_DM_MAX_SDP_ATTEMPTS_AFTER_PAIRING) {
1410 if (pairing_cb.sdp_attempts) {
1411 BTIF_TRACE_WARNING("%s: SDP failed after bonding re-attempting",
1412 __func__);
1413 pairing_cb.sdp_attempts++;
1414 btif_dm_get_remote_services(bd_addr);
1415 } else {
1416 BTIF_TRACE_WARNING("%s: SDP triggered by someone failed when bonding",
1417 __func__);
1418 }
1419 return;
1420 }
1421 prop.type = BT_PROPERTY_UUIDS;
1422 prop.len = 0;
1423 if ((p_data->disc_res.result == BTA_SUCCESS) &&
1424 (p_data->disc_res.num_uuids > 0)) {
1425 prop.val = p_data->disc_res.p_uuid_list;
1426 prop.len = p_data->disc_res.num_uuids * Uuid::kNumBytes128;
1427 for (i = 0; i < p_data->disc_res.num_uuids; i++) {
1428 std::string temp = ((p_data->disc_res.p_uuid_list + i))->ToString();
1429 LOG_INFO(LOG_TAG, "%s index:%d uuid:%s", __func__, i, temp.c_str());
1430 }
1431 }
1432
1433 /* onUuidChanged requires getBondedDevices to be populated.
1434 ** bond_state_changed needs to be sent prior to remote_device_property
1435 */
1436 if (pairing_cb.state == BT_BOND_STATE_BONDED && pairing_cb.sdp_attempts &&
1437 (p_data->disc_res.bd_addr == pairing_cb.bd_addr ||
1438 p_data->disc_res.bd_addr == pairing_cb.static_bdaddr)) {
1439 LOG_INFO(LOG_TAG, "%s: SDP search done for %s", __func__,
1440 bd_addr.ToString().c_str());
1441 pairing_cb.sdp_attempts = 0;
1442
1443 // Both SDP and bonding are done, clear pairing control block in case
1444 // it is not already cleared
1445 pairing_cb = {};
1446
1447 // Send one empty UUID to Java to unblock pairing intent when SDP failed
1448 // or no UUID is discovered
1449 if (p_data->disc_res.result != BTA_SUCCESS ||
1450 p_data->disc_res.num_uuids == 0) {
1451 LOG_INFO(LOG_TAG,
1452 "%s: SDP failed, send empty UUID to unblock bonding %s",
1453 __func__, bd_addr.ToString().c_str());
1454 bt_property_t prop;
1455 Uuid uuid = {};
1456
1457 prop.type = BT_PROPERTY_UUIDS;
1458 prop.val = &uuid;
1459 prop.len = Uuid::kNumBytes128;
1460
1461 /* Send the event to the BTIF */
1462 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb,
1463 BT_STATUS_SUCCESS, &bd_addr, 1, &prop);
1464 break;
1465 }
1466 }
1467
1468 if (p_data->disc_res.num_uuids != 0) {
1469 /* Also write this to the NVRAM */
1470 ret = btif_storage_set_remote_device_property(&bd_addr, &prop);
1471 ASSERTC(ret == BT_STATUS_SUCCESS, "storing remote services failed",
1472 ret);
1473 /* Send the event to the BTIF */
1474 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1475 &bd_addr, 1, &prop);
1476 }
1477 } break;
1478
1479 case BTA_DM_DISC_CMPL_EVT:
1480 /* fixme */
1481 break;
1482
1483 case BTA_DM_SEARCH_CANCEL_CMPL_EVT:
1484 /* no-op */
1485 break;
1486
1487 case BTA_DM_DISC_BLE_RES_EVT: {
1488 BTIF_TRACE_DEBUG("%s: service %s", __func__,
1489 p_data->disc_ble_res.service.ToString().c_str());
1490 int num_properties = 0;
1491 if (p_data->disc_ble_res.service.As16Bit() == UUID_SERVCLASS_LE_HID ||
1492 p_data->disc_ble_res.service == UUID_HEARING_AID) {
1493 BTIF_TRACE_DEBUG("%s: Found HOGP or HEARING AID UUID", __func__);
1494 bt_property_t prop[2];
1495 bt_status_t ret;
1496
1497 const auto& arr = p_data->disc_ble_res.service.To128BitBE();
1498
1499 RawAddress& bd_addr = p_data->disc_ble_res.bd_addr;
1500 prop[0].type = BT_PROPERTY_UUIDS;
1501 prop[0].val = (void*)arr.data();
1502 prop[0].len = Uuid::kNumBytes128;
1503
1504 /* Also write this to the NVRAM */
1505 ret = btif_storage_set_remote_device_property(&bd_addr, &prop[0]);
1506 ASSERTC(ret == BT_STATUS_SUCCESS, "storing remote services failed",
1507 ret);
1508 num_properties++;
1509
1510 /* Remote name update */
1511 if (strnlen((const char*)p_data->disc_ble_res.bd_name, BD_NAME_LEN)) {
1512 prop[1].type = BT_PROPERTY_BDNAME;
1513 prop[1].val = p_data->disc_ble_res.bd_name;
1514 prop[1].len =
1515 strnlen((char*)p_data->disc_ble_res.bd_name, BD_NAME_LEN);
1516
1517 ret = btif_storage_set_remote_device_property(&bd_addr, &prop[1]);
1518 ASSERTC(ret == BT_STATUS_SUCCESS,
1519 "failed to save remote device property", ret);
1520 num_properties++;
1521 }
1522
1523 /* Send the event to the BTIF */
1524 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1525 &bd_addr, num_properties, prop);
1526 }
1527 } break;
1528
1529 default: { ASSERTC(0, "unhandled search services event", event); } break;
1530 }
1531 }
1532
1533 /*******************************************************************************
1534 *
1535 * Function btif_dm_remote_service_record_evt
1536 *
1537 * Description Executes search service record event in btif context
1538 *
1539 * Returns void
1540 *
1541 ******************************************************************************/
btif_dm_remote_service_record_evt(uint16_t event,char * p_param)1542 static void btif_dm_remote_service_record_evt(uint16_t event, char* p_param) {
1543 tBTA_DM_SEARCH* p_data = (tBTA_DM_SEARCH*)p_param;
1544
1545 BTIF_TRACE_EVENT("%s: event = %d", __func__, event);
1546 switch (event) {
1547 case BTA_DM_DISC_RES_EVT: {
1548 bt_service_record_t rec;
1549 bt_property_t prop;
1550
1551 memset(&rec, 0, sizeof(bt_service_record_t));
1552 RawAddress& bd_addr = p_data->disc_res.bd_addr;
1553
1554 BTIF_TRACE_DEBUG("%s:(result=0x%x, services 0x%x)", __func__,
1555 p_data->disc_res.result, p_data->disc_res.services);
1556 prop.type = BT_PROPERTY_SERVICE_RECORD;
1557 prop.val = (void*)&rec;
1558 prop.len = sizeof(rec);
1559
1560 /* disc_res.result is overloaded with SCN. Cannot check result */
1561 p_data->disc_res.services &= ~BTA_USER_SERVICE_MASK;
1562 /* TODO: Get the UUID as well */
1563 rec.channel = p_data->disc_res.result - 3;
1564 /* TODO: Need to get the service name using p_raw_data */
1565 rec.name[0] = 0;
1566
1567 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1568 &bd_addr, 1, &prop);
1569 } break;
1570
1571 default: {
1572 ASSERTC(0, "unhandled remote service record event", event);
1573 } break;
1574 }
1575 }
1576
1577 /*******************************************************************************
1578 *
1579 * Function btif_dm_upstreams_cback
1580 *
1581 * Description Executes UPSTREAMS events in btif context
1582 *
1583 * Returns void
1584 *
1585 ******************************************************************************/
btif_dm_upstreams_evt(uint16_t event,char * p_param)1586 static void btif_dm_upstreams_evt(uint16_t event, char* p_param) {
1587 tBTA_DM_SEC* p_data = (tBTA_DM_SEC*)p_param;
1588 tBTA_SERVICE_MASK service_mask;
1589 uint32_t i;
1590 RawAddress bd_addr;
1591
1592 BTIF_TRACE_EVENT("%s: ev: %s", __func__, dump_dm_event(event));
1593
1594 switch (event) {
1595 case BTA_DM_ENABLE_EVT: {
1596 BD_NAME bdname;
1597 bt_status_t status;
1598 bt_property_t prop;
1599 prop.type = BT_PROPERTY_BDNAME;
1600 prop.len = BD_NAME_LEN;
1601 prop.val = (void*)bdname;
1602
1603 status = btif_storage_get_adapter_property(&prop);
1604 if (status == BT_STATUS_SUCCESS) {
1605 /* A name exists in the storage. Make this the device name */
1606 BTA_DmSetDeviceName((char*)prop.val);
1607 } else {
1608 /* Storage does not have a name yet.
1609 * Use the default name and write it to the chip
1610 */
1611 BTA_DmSetDeviceName(btif_get_default_local_name());
1612 }
1613
1614 /* Enable local privacy */
1615 BTA_DmBleConfigLocalPrivacy(BLE_LOCAL_PRIVACY_ENABLED);
1616
1617 /* for each of the enabled services in the mask, trigger the profile
1618 * enable */
1619 service_mask = btif_get_enabled_services_mask();
1620 for (i = 0; i <= BTA_MAX_SERVICE_ID; i++) {
1621 if (service_mask &
1622 (tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(i))) {
1623 btif_in_execute_service_request(i, true);
1624 }
1625 }
1626 /* clear control blocks */
1627 memset(&pairing_cb, 0, sizeof(btif_dm_pairing_cb_t));
1628 pairing_cb.bond_type = BOND_TYPE_PERSISTENT;
1629
1630 /* This function will also trigger the adapter_properties_cb
1631 ** and bonded_devices_info_cb
1632 */
1633 btif_storage_load_bonded_devices();
1634 bluetooth::bqr::EnableBtQualityReport(true);
1635 btif_enable_bluetooth_evt(p_data->enable.status);
1636 } break;
1637
1638 case BTA_DM_DISABLE_EVT:
1639 /* for each of the enabled services in the mask, trigger the profile
1640 * disable */
1641 service_mask = btif_get_enabled_services_mask();
1642 for (i = 0; i <= BTA_MAX_SERVICE_ID; i++) {
1643 if (service_mask &
1644 (tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(i))) {
1645 btif_in_execute_service_request(i, false);
1646 }
1647 }
1648 bluetooth::bqr::EnableBtQualityReport(false);
1649 btif_disable_bluetooth_evt();
1650 break;
1651
1652 case BTA_DM_PIN_REQ_EVT:
1653 btif_dm_pin_req_evt(&p_data->pin_req);
1654 break;
1655
1656 case BTA_DM_AUTH_CMPL_EVT:
1657 btif_dm_auth_cmpl_evt(&p_data->auth_cmpl);
1658 break;
1659
1660 case BTA_DM_BOND_CANCEL_CMPL_EVT:
1661 if (is_bonding_or_sdp()) {
1662 bd_addr = pairing_cb.bd_addr;
1663 btm_set_bond_type_dev(pairing_cb.bd_addr, BOND_TYPE_UNKNOWN);
1664 bond_state_changed((bt_status_t)p_data->bond_cancel_cmpl.result,
1665 bd_addr, BT_BOND_STATE_NONE);
1666 }
1667 break;
1668
1669 case BTA_DM_SP_CFM_REQ_EVT:
1670 btif_dm_ssp_cfm_req_evt(&p_data->cfm_req);
1671 break;
1672 case BTA_DM_SP_KEY_NOTIF_EVT:
1673 btif_dm_ssp_key_notif_evt(&p_data->key_notif);
1674 break;
1675
1676 case BTA_DM_DEV_UNPAIRED_EVT:
1677 bd_addr = p_data->link_down.bd_addr;
1678 btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
1679
1680 /*special handling for HID devices */
1681 #if (defined(BTA_HH_INCLUDED) && (BTA_HH_INCLUDED == TRUE))
1682 btif_hh_remove_device(bd_addr);
1683 #endif
1684 #if (defined(BTA_HD_INCLUDED) && (BTA_HD_INCLUDED == TRUE))
1685 btif_hd_remove_device(bd_addr);
1686 #endif
1687 btif_hearing_aid_get_interface()->RemoveDevice(bd_addr);
1688 btif_storage_remove_bonded_device(&bd_addr);
1689 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_NONE);
1690 break;
1691
1692 case BTA_DM_BUSY_LEVEL_EVT: {
1693 if (p_data->busy_level.level_flags & BTM_BL_INQUIRY_PAGING_MASK) {
1694 if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_STARTED) {
1695 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1696 BT_DISCOVERY_STARTED);
1697 btif_dm_inquiry_in_progress = true;
1698 } else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_CANCELLED) {
1699 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1700 BT_DISCOVERY_STOPPED);
1701 btif_dm_inquiry_in_progress = false;
1702 } else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_COMPLETE) {
1703 btif_dm_inquiry_in_progress = false;
1704 }
1705 }
1706 } break;
1707
1708 case BTA_DM_LINK_UP_EVT:
1709 bd_addr = p_data->link_up.bd_addr;
1710 BTIF_TRACE_DEBUG("BTA_DM_LINK_UP_EVT. Sending BT_ACL_STATE_CONNECTED");
1711
1712 btif_update_remote_version_property(&bd_addr);
1713
1714 HAL_CBACK(bt_hal_cbacks, acl_state_changed_cb, BT_STATUS_SUCCESS,
1715 &bd_addr, BT_ACL_STATE_CONNECTED);
1716 break;
1717
1718 case BTA_DM_LINK_DOWN_EVT:
1719 bd_addr = p_data->link_down.bd_addr;
1720 btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
1721 btif_av_acl_disconnected(bd_addr);
1722 BTIF_TRACE_DEBUG(
1723 "BTA_DM_LINK_DOWN_EVT. Sending BT_ACL_STATE_DISCONNECTED");
1724 HAL_CBACK(bt_hal_cbacks, acl_state_changed_cb, BT_STATUS_SUCCESS,
1725 &bd_addr, BT_ACL_STATE_DISCONNECTED);
1726 break;
1727
1728 case BTA_DM_HW_ERROR_EVT:
1729 BTIF_TRACE_ERROR("Received H/W Error. ");
1730 /* Flush storage data */
1731 btif_config_flush();
1732 usleep(100000); /* 100milliseconds */
1733 /* Killing the process to force a restart as part of fault tolerance */
1734 kill(getpid(), SIGKILL);
1735 break;
1736
1737 case BTA_DM_BLE_KEY_EVT:
1738 BTIF_TRACE_DEBUG("BTA_DM_BLE_KEY_EVT key_type=0x%02x ",
1739 p_data->ble_key.key_type);
1740
1741 /* If this pairing is by-product of local initiated GATT client Read or
1742 Write,
1743 BTA would not have sent BTA_DM_BLE_SEC_REQ_EVT event and Bond state would
1744 not
1745 have setup properly. Setup pairing_cb and notify App about Bonding state
1746 now*/
1747 if (pairing_cb.state != BT_BOND_STATE_BONDING) {
1748 BTIF_TRACE_DEBUG(
1749 "Bond state not sent to App so far.Notify the app now");
1750 bond_state_changed(BT_STATUS_SUCCESS, p_data->ble_key.bd_addr,
1751 BT_BOND_STATE_BONDING);
1752 } else if (pairing_cb.bd_addr != p_data->ble_key.bd_addr) {
1753 BTIF_TRACE_ERROR("BD mismatch discard BLE key_type=%d ",
1754 p_data->ble_key.key_type);
1755 break;
1756 }
1757
1758 switch (p_data->ble_key.key_type) {
1759 case BTA_LE_KEY_PENC:
1760 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_PENC");
1761 pairing_cb.ble.is_penc_key_rcvd = true;
1762 pairing_cb.ble.penc_key = p_data->ble_key.p_key_value->penc_key;
1763 break;
1764
1765 case BTA_LE_KEY_PID:
1766 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_PID");
1767 pairing_cb.ble.is_pid_key_rcvd = true;
1768 pairing_cb.ble.pid_key = p_data->ble_key.p_key_value->pid_key;
1769 break;
1770
1771 case BTA_LE_KEY_PCSRK:
1772 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_PCSRK");
1773 pairing_cb.ble.is_pcsrk_key_rcvd = true;
1774 pairing_cb.ble.pcsrk_key = p_data->ble_key.p_key_value->pcsrk_key;
1775 break;
1776
1777 case BTA_LE_KEY_LENC:
1778 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_LENC");
1779 pairing_cb.ble.is_lenc_key_rcvd = true;
1780 pairing_cb.ble.lenc_key = p_data->ble_key.p_key_value->lenc_key;
1781 break;
1782
1783 case BTA_LE_KEY_LCSRK:
1784 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_LCSRK");
1785 pairing_cb.ble.is_lcsrk_key_rcvd = true;
1786 pairing_cb.ble.lcsrk_key = p_data->ble_key.p_key_value->lcsrk_key;
1787 break;
1788
1789 case BTA_LE_KEY_LID:
1790 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_LID");
1791 pairing_cb.ble.is_lidk_key_rcvd = true;
1792 break;
1793
1794 default:
1795 BTIF_TRACE_ERROR("unknown BLE key type (0x%02x)",
1796 p_data->ble_key.key_type);
1797 break;
1798 }
1799 break;
1800 case BTA_DM_BLE_SEC_REQ_EVT:
1801 BTIF_TRACE_DEBUG("BTA_DM_BLE_SEC_REQ_EVT. ");
1802 btif_dm_ble_sec_req_evt(&p_data->ble_req);
1803 break;
1804 case BTA_DM_BLE_PASSKEY_NOTIF_EVT:
1805 BTIF_TRACE_DEBUG("BTA_DM_BLE_PASSKEY_NOTIF_EVT. ");
1806 btif_dm_ble_key_notif_evt(&p_data->key_notif);
1807 break;
1808 case BTA_DM_BLE_PASSKEY_REQ_EVT:
1809 BTIF_TRACE_DEBUG("BTA_DM_BLE_PASSKEY_REQ_EVT. ");
1810 btif_dm_ble_passkey_req_evt(&p_data->pin_req);
1811 break;
1812 case BTA_DM_BLE_NC_REQ_EVT:
1813 BTIF_TRACE_DEBUG("BTA_DM_BLE_PASSKEY_REQ_EVT. ");
1814 btif_dm_ble_key_nc_req_evt(&p_data->key_notif);
1815 break;
1816 case BTA_DM_BLE_OOB_REQ_EVT:
1817 BTIF_TRACE_DEBUG("BTA_DM_BLE_OOB_REQ_EVT. ");
1818 btif_dm_ble_oob_req_evt(&p_data->rmt_oob);
1819 break;
1820 case BTA_DM_BLE_SC_OOB_REQ_EVT:
1821 BTIF_TRACE_DEBUG("BTA_DM_BLE_SC_OOB_REQ_EVT. ");
1822 btif_dm_ble_sc_oob_req_evt(&p_data->rmt_oob);
1823 break;
1824 case BTA_DM_BLE_LOCAL_IR_EVT:
1825 BTIF_TRACE_DEBUG("BTA_DM_BLE_LOCAL_IR_EVT. ");
1826 ble_local_key_cb.is_id_keys_rcvd = true;
1827 ble_local_key_cb.id_keys.irk = p_data->ble_id_keys.irk;
1828 ble_local_key_cb.id_keys.ir = p_data->ble_id_keys.ir;
1829 ble_local_key_cb.id_keys.dhk = p_data->ble_id_keys.dhk;
1830 btif_storage_add_ble_local_key(ble_local_key_cb.id_keys.irk,
1831 BTIF_DM_LE_LOCAL_KEY_IRK);
1832 btif_storage_add_ble_local_key(ble_local_key_cb.id_keys.ir,
1833 BTIF_DM_LE_LOCAL_KEY_IR);
1834 btif_storage_add_ble_local_key(ble_local_key_cb.id_keys.dhk,
1835 BTIF_DM_LE_LOCAL_KEY_DHK);
1836 break;
1837 case BTA_DM_BLE_LOCAL_ER_EVT:
1838 BTIF_TRACE_DEBUG("BTA_DM_BLE_LOCAL_ER_EVT. ");
1839 ble_local_key_cb.is_er_rcvd = true;
1840 ble_local_key_cb.er = p_data->ble_er;
1841 btif_storage_add_ble_local_key(ble_local_key_cb.er,
1842 BTIF_DM_LE_LOCAL_KEY_ER);
1843 break;
1844
1845 case BTA_DM_BLE_AUTH_CMPL_EVT:
1846 BTIF_TRACE_DEBUG("BTA_DM_BLE_AUTH_CMPL_EVT. ");
1847 btif_dm_ble_auth_cmpl_evt(&p_data->auth_cmpl);
1848 break;
1849
1850 case BTA_DM_LE_FEATURES_READ: {
1851 tBTM_BLE_VSC_CB cmn_vsc_cb;
1852 bt_local_le_features_t local_le_features;
1853 char buf[512];
1854 bt_property_t prop;
1855 prop.type = BT_PROPERTY_LOCAL_LE_FEATURES;
1856 prop.val = (void*)buf;
1857 prop.len = sizeof(buf);
1858
1859 /* LE features are not stored in storage. Should be retrived from stack */
1860 BTM_BleGetVendorCapabilities(&cmn_vsc_cb);
1861 local_le_features.local_privacy_enabled = BTM_BleLocalPrivacyEnabled();
1862
1863 prop.len = sizeof(bt_local_le_features_t);
1864 if (cmn_vsc_cb.filter_support == 1)
1865 local_le_features.max_adv_filter_supported = cmn_vsc_cb.max_filter;
1866 else
1867 local_le_features.max_adv_filter_supported = 0;
1868 local_le_features.max_adv_instance = cmn_vsc_cb.adv_inst_max;
1869 local_le_features.max_irk_list_size = cmn_vsc_cb.max_irk_list_sz;
1870 local_le_features.rpa_offload_supported = cmn_vsc_cb.rpa_offloading;
1871 local_le_features.activity_energy_info_supported =
1872 cmn_vsc_cb.energy_support;
1873 local_le_features.scan_result_storage_size =
1874 cmn_vsc_cb.tot_scan_results_strg;
1875 local_le_features.version_supported = cmn_vsc_cb.version_supported;
1876 local_le_features.total_trackable_advertisers =
1877 cmn_vsc_cb.total_trackable_advertisers;
1878
1879 local_le_features.extended_scan_support =
1880 cmn_vsc_cb.extended_scan_support > 0;
1881 local_le_features.debug_logging_supported =
1882 cmn_vsc_cb.debug_logging_supported > 0;
1883
1884 const controller_t* controller = controller_get_interface();
1885
1886 local_le_features.le_2m_phy_supported = controller->supports_ble_2m_phy();
1887 local_le_features.le_coded_phy_supported =
1888 controller->supports_ble_coded_phy();
1889 local_le_features.le_extended_advertising_supported =
1890 controller->supports_ble_extended_advertising();
1891 local_le_features.le_periodic_advertising_supported =
1892 controller->supports_ble_periodic_advertising();
1893 local_le_features.le_maximum_advertising_data_length =
1894 controller->get_ble_maxium_advertising_data_length();
1895
1896 memcpy(prop.val, &local_le_features, prop.len);
1897 HAL_CBACK(bt_hal_cbacks, adapter_properties_cb, BT_STATUS_SUCCESS, 1,
1898 &prop);
1899 break;
1900 }
1901
1902 case BTA_DM_ENER_INFO_READ: {
1903 btif_activity_energy_info_cb_t* p_ener_data =
1904 (btif_activity_energy_info_cb_t*)p_param;
1905 bt_activity_energy_info energy_info;
1906 energy_info.status = p_ener_data->status;
1907 energy_info.ctrl_state = p_ener_data->ctrl_state;
1908 energy_info.rx_time = p_ener_data->rx_time;
1909 energy_info.tx_time = p_ener_data->tx_time;
1910 energy_info.idle_time = p_ener_data->idle_time;
1911 energy_info.energy_used = p_ener_data->energy_used;
1912
1913 bt_uid_traffic_t* data = uid_set_read_and_clear(uid_set);
1914 HAL_CBACK(bt_hal_cbacks, energy_info_cb, &energy_info, data);
1915 osi_free(data);
1916 break;
1917 }
1918
1919 case BTA_DM_AUTHORIZE_EVT:
1920 case BTA_DM_SIG_STRENGTH_EVT:
1921 case BTA_DM_SP_RMT_OOB_EVT:
1922 case BTA_DM_SP_KEYPRESS_EVT:
1923 case BTA_DM_ROLE_CHG_EVT:
1924
1925 default:
1926 BTIF_TRACE_WARNING("%s: unhandled event (%d)", __func__, event);
1927 break;
1928 }
1929
1930 btif_dm_data_free(event, p_data);
1931 }
1932
1933 /*******************************************************************************
1934 *
1935 * Function btif_dm_generic_evt
1936 *
1937 * Description Executes non-BTA upstream events in BTIF context
1938 *
1939 * Returns void
1940 *
1941 ******************************************************************************/
btif_dm_generic_evt(uint16_t event,char * p_param)1942 static void btif_dm_generic_evt(uint16_t event, char* p_param) {
1943 BTIF_TRACE_EVENT("%s: event=%d", __func__, event);
1944 switch (event) {
1945 case BTIF_DM_CB_DISCOVERY_STARTED: {
1946 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1947 BT_DISCOVERY_STARTED);
1948 } break;
1949
1950 case BTIF_DM_CB_CREATE_BOND: {
1951 pairing_cb.timeout_retries = NUM_TIMEOUT_RETRIES;
1952 btif_dm_create_bond_cb_t* create_bond_cb =
1953 (btif_dm_create_bond_cb_t*)p_param;
1954 btif_dm_cb_create_bond(create_bond_cb->bdaddr, create_bond_cb->transport);
1955 } break;
1956
1957 case BTIF_DM_CB_REMOVE_BOND: {
1958 btif_dm_cb_remove_bond((RawAddress*)p_param);
1959 } break;
1960
1961 case BTIF_DM_CB_HID_REMOTE_NAME: {
1962 btif_dm_cb_hid_remote_name((tBTM_REMOTE_DEV_NAME*)p_param);
1963 } break;
1964
1965 case BTIF_DM_CB_BOND_STATE_BONDING: {
1966 bond_state_changed(BT_STATUS_SUCCESS, *((RawAddress*)p_param),
1967 BT_BOND_STATE_BONDING);
1968 } break;
1969 case BTIF_DM_CB_LE_TX_TEST:
1970 case BTIF_DM_CB_LE_RX_TEST: {
1971 uint8_t status;
1972 STREAM_TO_UINT8(status, p_param);
1973 HAL_CBACK(bt_hal_cbacks, le_test_mode_cb,
1974 (status == 0) ? BT_STATUS_SUCCESS : BT_STATUS_FAIL, 0);
1975 } break;
1976 case BTIF_DM_CB_LE_TEST_END: {
1977 uint8_t status;
1978 uint16_t count = 0;
1979 STREAM_TO_UINT8(status, p_param);
1980 if (status == 0) STREAM_TO_UINT16(count, p_param);
1981 HAL_CBACK(bt_hal_cbacks, le_test_mode_cb,
1982 (status == 0) ? BT_STATUS_SUCCESS : BT_STATUS_FAIL, count);
1983 } break;
1984 default: {
1985 BTIF_TRACE_WARNING("%s : Unknown event 0x%x", __func__, event);
1986 } break;
1987 }
1988 }
1989
1990 /*******************************************************************************
1991 *
1992 * Function bte_dm_evt
1993 *
1994 * Description Switches context from BTE to BTIF for all DM events
1995 *
1996 * Returns void
1997 *
1998 ******************************************************************************/
1999
bte_dm_evt(tBTA_DM_SEC_EVT event,tBTA_DM_SEC * p_data)2000 void bte_dm_evt(tBTA_DM_SEC_EVT event, tBTA_DM_SEC* p_data) {
2001 /* switch context to btif task context (copy full union size for convenience)
2002 */
2003 bt_status_t status = btif_transfer_context(
2004 btif_dm_upstreams_evt, (uint16_t)event, (char*)p_data,
2005 sizeof(tBTA_DM_SEC), btif_dm_data_copy);
2006
2007 /* catch any failed context transfers */
2008 ASSERTC(status == BT_STATUS_SUCCESS, "context transfer failed", status);
2009 }
2010
2011 /*******************************************************************************
2012 *
2013 * Function bte_search_devices_evt
2014 *
2015 * Description Switches context from BTE to BTIF for DM search events
2016 *
2017 * Returns void
2018 *
2019 ******************************************************************************/
bte_search_devices_evt(tBTA_DM_SEARCH_EVT event,tBTA_DM_SEARCH * p_data)2020 static void bte_search_devices_evt(tBTA_DM_SEARCH_EVT event,
2021 tBTA_DM_SEARCH* p_data) {
2022 uint16_t param_len = 0;
2023
2024 if (p_data) param_len += sizeof(tBTA_DM_SEARCH);
2025 /* Allocate buffer to hold the pointers (deep copy). The pointers will point
2026 * to the end of the tBTA_DM_SEARCH */
2027 switch (event) {
2028 case BTA_DM_INQ_RES_EVT: {
2029 if (p_data->inq_res.p_eir) param_len += p_data->inq_res.eir_len;
2030 } break;
2031
2032 case BTA_DM_DISC_RES_EVT: {
2033 if (p_data->disc_res.raw_data_size && p_data->disc_res.p_raw_data)
2034 param_len += p_data->disc_res.raw_data_size;
2035 } break;
2036 }
2037 BTIF_TRACE_DEBUG("%s event=%s param_len=%d", __func__,
2038 dump_dm_search_event(event), param_len);
2039
2040 /* if remote name is available in EIR, set teh flag so that stack doesnt
2041 * trigger RNR */
2042 if (event == BTA_DM_INQ_RES_EVT)
2043 p_data->inq_res.remt_name_not_required =
2044 check_eir_remote_name(p_data, NULL, NULL);
2045
2046 btif_transfer_context(
2047 btif_dm_search_devices_evt, (uint16_t)event, (char*)p_data, param_len,
2048 (param_len > sizeof(tBTA_DM_SEARCH)) ? search_devices_copy_cb : NULL);
2049 }
2050
2051 /*******************************************************************************
2052 *
2053 * Function bte_dm_search_services_evt
2054 *
2055 * Description Switches context from BTE to BTIF for DM search services
2056 * event
2057 *
2058 * Returns void
2059 *
2060 ******************************************************************************/
bte_dm_search_services_evt(tBTA_DM_SEARCH_EVT event,tBTA_DM_SEARCH * p_data)2061 static void bte_dm_search_services_evt(tBTA_DM_SEARCH_EVT event,
2062 tBTA_DM_SEARCH* p_data) {
2063 uint16_t param_len = 0;
2064 if (p_data) param_len += sizeof(tBTA_DM_SEARCH);
2065 switch (event) {
2066 case BTA_DM_DISC_RES_EVT: {
2067 if ((p_data->disc_res.result == BTA_SUCCESS) &&
2068 (p_data->disc_res.num_uuids > 0)) {
2069 param_len += (p_data->disc_res.num_uuids * Uuid::kNumBytes128);
2070 }
2071 } break;
2072 }
2073 /* TODO: The only other member that needs a deep copy is the p_raw_data. But
2074 * not sure
2075 * if raw_data is needed. */
2076 btif_transfer_context(
2077 btif_dm_search_services_evt, event, (char*)p_data, param_len,
2078 (param_len > sizeof(tBTA_DM_SEARCH)) ? search_services_copy_cb : NULL);
2079 }
2080
2081 /*******************************************************************************
2082 *
2083 * Function bte_dm_remote_service_record_evt
2084 *
2085 * Description Switches context from BTE to BTIF for DM search service
2086 * record event
2087 *
2088 * Returns void
2089 *
2090 ******************************************************************************/
bte_dm_remote_service_record_evt(tBTA_DM_SEARCH_EVT event,tBTA_DM_SEARCH * p_data)2091 static void bte_dm_remote_service_record_evt(tBTA_DM_SEARCH_EVT event,
2092 tBTA_DM_SEARCH* p_data) {
2093 /* TODO: The only member that needs a deep copy is the p_raw_data. But not
2094 * sure yet if this is needed. */
2095 btif_transfer_context(btif_dm_remote_service_record_evt, event, (char*)p_data,
2096 sizeof(tBTA_DM_SEARCH), NULL);
2097 }
2098
2099 /*******************************************************************************
2100 *
2101 * Function bta_energy_info_cb
2102 *
2103 * Description Switches context from BTE to BTIF for DM energy info event
2104 *
2105 * Returns void
2106 *
2107 ******************************************************************************/
bta_energy_info_cb(tBTA_DM_BLE_TX_TIME_MS tx_time,tBTA_DM_BLE_RX_TIME_MS rx_time,tBTA_DM_BLE_IDLE_TIME_MS idle_time,tBTA_DM_BLE_ENERGY_USED energy_used,tBTA_DM_CONTRL_STATE ctrl_state,tBTA_STATUS status)2108 static void bta_energy_info_cb(tBTA_DM_BLE_TX_TIME_MS tx_time,
2109 tBTA_DM_BLE_RX_TIME_MS rx_time,
2110 tBTA_DM_BLE_IDLE_TIME_MS idle_time,
2111 tBTA_DM_BLE_ENERGY_USED energy_used,
2112 tBTA_DM_CONTRL_STATE ctrl_state,
2113 tBTA_STATUS status) {
2114 BTIF_TRACE_DEBUG(
2115 "energy_info_cb-Status:%d,state=%d,tx_t=%ld, rx_t=%ld, "
2116 "idle_time=%ld,used=%ld",
2117 status, ctrl_state, tx_time, rx_time, idle_time, energy_used);
2118
2119 btif_activity_energy_info_cb_t btif_cb;
2120 btif_cb.status = status;
2121 btif_cb.ctrl_state = ctrl_state;
2122 btif_cb.tx_time = (uint64_t)tx_time;
2123 btif_cb.rx_time = (uint64_t)rx_time;
2124 btif_cb.idle_time = (uint64_t)idle_time;
2125 btif_cb.energy_used = (uint64_t)energy_used;
2126 btif_transfer_context(btif_dm_upstreams_evt, BTA_DM_ENER_INFO_READ,
2127 (char*)&btif_cb, sizeof(btif_activity_energy_info_cb_t),
2128 NULL);
2129 }
2130
2131 /* Scan filter param config event */
bte_scan_filt_param_cfg_evt(uint8_t ref_value,uint8_t avbl_space,uint8_t action_type,uint8_t status)2132 static void bte_scan_filt_param_cfg_evt(uint8_t ref_value, uint8_t avbl_space,
2133 uint8_t action_type, uint8_t status) {
2134 /* This event occurs on calling BTA_DmBleCfgFilterCondition internally,
2135 ** and that is why there is no HAL callback
2136 */
2137 if (BTA_SUCCESS != status) {
2138 BTIF_TRACE_ERROR("%s, %d", __func__, status);
2139 } else {
2140 BTIF_TRACE_DEBUG("%s", __func__);
2141 }
2142 }
2143
2144 /*****************************************************************************
2145 *
2146 * btif api functions (no context switch)
2147 *
2148 ****************************************************************************/
2149
2150 /*******************************************************************************
2151 *
2152 * Function btif_dm_start_discovery
2153 *
2154 * Description Start device discovery/inquiry
2155 *
2156 * Returns bt_status_t
2157 *
2158 ******************************************************************************/
btif_dm_start_discovery(void)2159 bt_status_t btif_dm_start_discovery(void) {
2160 tBTA_DM_INQ inq_params;
2161 tBTA_SERVICE_MASK services = 0;
2162
2163 BTIF_TRACE_EVENT("%s", __func__);
2164
2165 /* Cleanup anything remaining on index 0 */
2166 do_in_main_thread(
2167 FROM_HERE,
2168 base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_DELETE, 0,
2169 nullptr, base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
2170
2171 auto adv_filt_param = std::make_unique<btgatt_filt_param_setup_t>();
2172 /* Add an allow-all filter on index 0*/
2173 adv_filt_param->dely_mode = IMMEDIATE_DELY_MODE;
2174 adv_filt_param->feat_seln = ALLOW_ALL_FILTER;
2175 adv_filt_param->filt_logic_type = BTA_DM_BLE_PF_FILT_LOGIC_OR;
2176 adv_filt_param->list_logic_type = BTA_DM_BLE_PF_LIST_LOGIC_OR;
2177 adv_filt_param->rssi_low_thres = LOWEST_RSSI_VALUE;
2178 adv_filt_param->rssi_high_thres = LOWEST_RSSI_VALUE;
2179 do_in_main_thread(
2180 FROM_HERE, base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_ADD,
2181 0, base::Passed(&adv_filt_param),
2182 base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
2183
2184 /* TODO: Do we need to handle multiple inquiries at the same time? */
2185
2186 /* Set inquiry params and call API */
2187 inq_params.mode = BTA_DM_GENERAL_INQUIRY | BTA_BLE_GENERAL_INQUIRY;
2188 inq_params.duration = BTIF_DM_DEFAULT_INQ_MAX_DURATION;
2189
2190 inq_params.max_resps = BTIF_DM_DEFAULT_INQ_MAX_RESULTS;
2191 inq_params.report_dup = true;
2192
2193 inq_params.filter_type = BTA_DM_INQ_CLR;
2194 /* TODO: Filter device by BDA needs to be implemented here */
2195
2196 /* Will be enabled to true once inquiry busy level has been received */
2197 btif_dm_inquiry_in_progress = false;
2198 /* find nearby devices */
2199 BTA_DmSearch(&inq_params, services, bte_search_devices_evt);
2200
2201 return BT_STATUS_SUCCESS;
2202 }
2203
2204 /*******************************************************************************
2205 *
2206 * Function btif_dm_cancel_discovery
2207 *
2208 * Description Cancels search
2209 *
2210 * Returns bt_status_t
2211 *
2212 ******************************************************************************/
btif_dm_cancel_discovery(void)2213 bt_status_t btif_dm_cancel_discovery(void) {
2214 BTIF_TRACE_EVENT("%s", __func__);
2215 BTA_DmSearchCancel();
2216 return BT_STATUS_SUCCESS;
2217 }
2218
2219 /*******************************************************************************
2220 *
2221 * Function btif_dm_create_bond
2222 *
2223 * Description Initiate bonding with the specified device
2224 *
2225 * Returns bt_status_t
2226 *
2227 ******************************************************************************/
btif_dm_create_bond(const RawAddress * bd_addr,int transport)2228 bt_status_t btif_dm_create_bond(const RawAddress* bd_addr, int transport) {
2229 btif_dm_create_bond_cb_t create_bond_cb;
2230 create_bond_cb.transport = transport;
2231 create_bond_cb.bdaddr = *bd_addr;
2232
2233 BTIF_TRACE_EVENT("%s: bd_addr=%s, transport=%d", __func__,
2234 bd_addr->ToString().c_str(), transport);
2235 if (pairing_cb.state != BT_BOND_STATE_NONE) return BT_STATUS_BUSY;
2236
2237 btif_stats_add_bond_event(*bd_addr, BTIF_DM_FUNC_CREATE_BOND,
2238 pairing_cb.state);
2239
2240 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_CREATE_BOND,
2241 (char*)&create_bond_cb,
2242 sizeof(btif_dm_create_bond_cb_t), NULL);
2243
2244 return BT_STATUS_SUCCESS;
2245 }
2246
2247 /*******************************************************************************
2248 *
2249 * Function btif_dm_create_bond_out_of_band
2250 *
2251 * Description Initiate bonding with the specified device using out of band
2252 * data
2253 *
2254 * Returns bt_status_t
2255 *
2256 ******************************************************************************/
btif_dm_create_bond_out_of_band(const RawAddress * bd_addr,int transport,const bt_out_of_band_data_t * oob_data)2257 bt_status_t btif_dm_create_bond_out_of_band(
2258 const RawAddress* bd_addr, int transport,
2259 const bt_out_of_band_data_t* oob_data) {
2260 oob_cb.bdaddr = *bd_addr;
2261 memcpy(&oob_cb.oob_data, oob_data, sizeof(bt_out_of_band_data_t));
2262
2263 uint8_t empty[] = {0, 0, 0, 0, 0, 0, 0};
2264 // If LE Bluetooth Device Address is provided, use provided address type
2265 // value.
2266 if (memcmp(oob_data->le_bt_dev_addr, empty, 7) != 0) {
2267 /* byte no 7 is address type in LE Bluetooth Address OOB data */
2268 uint8_t address_type = oob_data->le_bt_dev_addr[6];
2269 if (address_type == BLE_ADDR_PUBLIC || address_type == BLE_ADDR_RANDOM) {
2270 // bd_addr->address is already reversed, so use it instead of
2271 // oob_data->le_bt_dev_addr
2272 BTM_SecAddBleDevice(*bd_addr, NULL, BT_DEVICE_TYPE_BLE, address_type);
2273 }
2274 }
2275
2276 BTIF_TRACE_EVENT("%s: bd_addr=%s, transport=%d", __func__,
2277 bd_addr->ToString().c_str(), transport);
2278 return btif_dm_create_bond(bd_addr, transport);
2279 }
2280
2281 /*******************************************************************************
2282 *
2283 * Function btif_dm_cancel_bond
2284 *
2285 * Description Initiate bonding with the specified device
2286 *
2287 * Returns bt_status_t
2288 *
2289 ******************************************************************************/
2290
btif_dm_cancel_bond(const RawAddress * bd_addr)2291 bt_status_t btif_dm_cancel_bond(const RawAddress* bd_addr) {
2292 BTIF_TRACE_EVENT("%s: bd_addr=%s", __func__, bd_addr->ToString().c_str());
2293
2294 btif_stats_add_bond_event(*bd_addr, BTIF_DM_FUNC_CANCEL_BOND,
2295 pairing_cb.state);
2296
2297 /* TODO:
2298 ** 1. Restore scan modes
2299 ** 2. special handling for HID devices
2300 */
2301 if (is_bonding_or_sdp()) {
2302 if (pairing_cb.is_ssp) {
2303 if (pairing_cb.is_le_only) {
2304 BTA_DmBleSecurityGrant(*bd_addr, BTA_DM_SEC_PAIR_NOT_SPT);
2305 } else {
2306 BTA_DmConfirm(*bd_addr, false);
2307 BTA_DmBondCancel(*bd_addr);
2308 btif_storage_remove_bonded_device(bd_addr);
2309 }
2310 } else {
2311 if (pairing_cb.is_le_only) {
2312 BTA_DmBondCancel(*bd_addr);
2313 } else {
2314 BTA_DmPinReply(*bd_addr, false, 0, NULL);
2315 }
2316 /* Cancel bonding, in case it is in ACL connection setup state */
2317 BTA_DmBondCancel(*bd_addr);
2318 }
2319 }
2320
2321 return BT_STATUS_SUCCESS;
2322 }
2323
2324 /*******************************************************************************
2325 *
2326 * Function btif_dm_hh_open_failed
2327 *
2328 * Description informs the upper layers if the HH have failed during
2329 * bonding
2330 *
2331 * Returns none
2332 *
2333 ******************************************************************************/
2334
btif_dm_hh_open_failed(RawAddress * bdaddr)2335 void btif_dm_hh_open_failed(RawAddress* bdaddr) {
2336 if (pairing_cb.state == BT_BOND_STATE_BONDING &&
2337 *bdaddr == pairing_cb.bd_addr) {
2338 bond_state_changed(BT_STATUS_FAIL, *bdaddr, BT_BOND_STATE_NONE);
2339 }
2340 }
2341
2342 /*******************************************************************************
2343 *
2344 * Function btif_dm_remove_bond
2345 *
2346 * Description Removes bonding with the specified device
2347 *
2348 * Returns bt_status_t
2349 *
2350 ******************************************************************************/
2351
btif_dm_remove_bond(const RawAddress * bd_addr)2352 bt_status_t btif_dm_remove_bond(const RawAddress* bd_addr) {
2353 BTIF_TRACE_EVENT("%s: bd_addr=%s", __func__, bd_addr->ToString().c_str());
2354
2355 btif_stats_add_bond_event(*bd_addr, BTIF_DM_FUNC_REMOVE_BOND,
2356 pairing_cb.state);
2357
2358 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_REMOVE_BOND,
2359 (char*)bd_addr, sizeof(RawAddress), NULL);
2360
2361 return BT_STATUS_SUCCESS;
2362 }
2363
2364 /*******************************************************************************
2365 *
2366 * Function btif_dm_pin_reply
2367 *
2368 * Description BT legacy pairing - PIN code reply
2369 *
2370 * Returns bt_status_t
2371 *
2372 ******************************************************************************/
2373
btif_dm_pin_reply(const RawAddress * bd_addr,uint8_t accept,uint8_t pin_len,bt_pin_code_t * pin_code)2374 bt_status_t btif_dm_pin_reply(const RawAddress* bd_addr, uint8_t accept,
2375 uint8_t pin_len, bt_pin_code_t* pin_code) {
2376 BTIF_TRACE_EVENT("%s: accept=%d", __func__, accept);
2377 if (pin_code == NULL || pin_len > PIN_CODE_LEN) return BT_STATUS_FAIL;
2378 if (pairing_cb.is_le_only) {
2379 int i;
2380 uint32_t passkey = 0;
2381 int multi[] = {100000, 10000, 1000, 100, 10, 1};
2382 for (i = 0; i < 6; i++) {
2383 passkey += (multi[i] * (pin_code->pin[i] - '0'));
2384 }
2385 BTIF_TRACE_DEBUG("btif_dm_pin_reply: passkey: %d", passkey);
2386 BTA_DmBlePasskeyReply(*bd_addr, accept, passkey);
2387
2388 } else {
2389 BTA_DmPinReply(*bd_addr, accept, pin_len, pin_code->pin);
2390 if (accept) pairing_cb.pin_code_len = pin_len;
2391 }
2392 return BT_STATUS_SUCCESS;
2393 }
2394
2395 /*******************************************************************************
2396 *
2397 * Function btif_dm_ssp_reply
2398 *
2399 * Description BT SSP Reply - Just Works, Numeric Comparison & Passkey
2400 * Entry
2401 *
2402 * Returns bt_status_t
2403 *
2404 ******************************************************************************/
btif_dm_ssp_reply(const RawAddress * bd_addr,bt_ssp_variant_t variant,uint8_t accept,UNUSED_ATTR uint32_t passkey)2405 bt_status_t btif_dm_ssp_reply(const RawAddress* bd_addr,
2406 bt_ssp_variant_t variant, uint8_t accept,
2407 UNUSED_ATTR uint32_t passkey) {
2408 if (variant == BT_SSP_VARIANT_PASSKEY_ENTRY) {
2409 /* This is not implemented in the stack.
2410 * For devices with display, this is not needed
2411 */
2412 BTIF_TRACE_WARNING("%s: Not implemented", __func__);
2413 return BT_STATUS_FAIL;
2414 }
2415 /* BT_SSP_VARIANT_CONSENT & BT_SSP_VARIANT_PASSKEY_CONFIRMATION supported */
2416 BTIF_TRACE_EVENT("%s: accept=%d", __func__, accept);
2417 if (pairing_cb.is_le_only) {
2418 if (pairing_cb.is_le_nc) {
2419 BTA_DmBleConfirmReply(*bd_addr, accept);
2420 } else {
2421 if (accept)
2422 BTA_DmBleSecurityGrant(*bd_addr, BTA_DM_SEC_GRANTED);
2423 else
2424 BTA_DmBleSecurityGrant(*bd_addr, BTA_DM_SEC_PAIR_NOT_SPT);
2425 }
2426 } else {
2427 BTA_DmConfirm(*bd_addr, accept);
2428 }
2429 return BT_STATUS_SUCCESS;
2430 }
2431
2432 /*******************************************************************************
2433 *
2434 * Function btif_dm_get_adapter_property
2435 *
2436 * Description Queries the BTA for the adapter property
2437 *
2438 * Returns bt_status_t
2439 *
2440 ******************************************************************************/
btif_dm_get_adapter_property(bt_property_t * prop)2441 bt_status_t btif_dm_get_adapter_property(bt_property_t* prop) {
2442 BTIF_TRACE_EVENT("%s: type=0x%x", __func__, prop->type);
2443 switch (prop->type) {
2444 case BT_PROPERTY_BDNAME: {
2445 bt_bdname_t* bd_name = (bt_bdname_t*)prop->val;
2446 strncpy((char*)bd_name->name, (char*)btif_get_default_local_name(),
2447 sizeof(bd_name->name) - 1);
2448 bd_name->name[sizeof(bd_name->name) - 1] = 0;
2449 prop->len = strlen((char*)bd_name->name);
2450 } break;
2451
2452 case BT_PROPERTY_ADAPTER_SCAN_MODE: {
2453 /* if the storage does not have it. Most likely app never set it. Default
2454 * is NONE */
2455 bt_scan_mode_t* mode = (bt_scan_mode_t*)prop->val;
2456 *mode = BT_SCAN_MODE_NONE;
2457 prop->len = sizeof(bt_scan_mode_t);
2458 } break;
2459
2460 case BT_PROPERTY_ADAPTER_DISCOVERY_TIMEOUT: {
2461 uint32_t* tmt = (uint32_t*)prop->val;
2462 *tmt = 120; /* default to 120s, if not found in NV */
2463 prop->len = sizeof(uint32_t);
2464 } break;
2465
2466 case BT_PROPERTY_CLASS_OF_DEVICE: {
2467 DEV_CLASS dev_class = BTA_DM_COD;
2468 memcpy(prop->val, dev_class, sizeof(DEV_CLASS));
2469 prop->len = sizeof(DEV_CLASS);
2470 } break;
2471
2472 // While fetching IO_CAP* values for the local device, we maintain backward
2473 // compatibility by using the value from #define macros BTM_LOCAL_IO_CAPS,
2474 // BTM_LOCAL_IO_CAPS_BLE if the values have never been explicitly set.
2475
2476 case BT_PROPERTY_LOCAL_IO_CAPS: {
2477 *(bt_io_cap_t*)prop->val = (bt_io_cap_t)BTM_LOCAL_IO_CAPS;
2478 prop->len = sizeof(bt_io_cap_t);
2479 } break;
2480
2481 case BT_PROPERTY_LOCAL_IO_CAPS_BLE: {
2482 *(bt_io_cap_t*)prop->val = (bt_io_cap_t)BTM_LOCAL_IO_CAPS_BLE;
2483 prop->len = sizeof(bt_io_cap_t);
2484 } break;
2485
2486 default:
2487 prop->len = 0;
2488 return BT_STATUS_FAIL;
2489 }
2490 return BT_STATUS_SUCCESS;
2491 }
2492
2493 /*******************************************************************************
2494 *
2495 * Function btif_dm_get_remote_services
2496 *
2497 * Description Start SDP to get remote services
2498 *
2499 * Returns bt_status_t
2500 *
2501 ******************************************************************************/
btif_dm_get_remote_services(const RawAddress & remote_addr)2502 bt_status_t btif_dm_get_remote_services(const RawAddress& remote_addr) {
2503 BTIF_TRACE_EVENT("%s: bd_addr=%s", __func__, remote_addr.ToString().c_str());
2504
2505 BTA_DmDiscover(remote_addr, BTA_ALL_SERVICE_MASK, bte_dm_search_services_evt,
2506 true);
2507
2508 return BT_STATUS_SUCCESS;
2509 }
2510
2511 /*******************************************************************************
2512 *
2513 * Function btif_dm_get_remote_services_by_transport
2514 *
2515 * Description Start SDP to get remote services by transport
2516 *
2517 * Returns bt_status_t
2518 *
2519 ******************************************************************************/
btif_dm_get_remote_services_by_transport(RawAddress * remote_addr,const int transport)2520 bt_status_t btif_dm_get_remote_services_by_transport(RawAddress* remote_addr,
2521 const int transport) {
2522 BTIF_TRACE_EVENT("%s: transport=%d, remote_addr=%s", __func__, transport,
2523 remote_addr->ToString().c_str());
2524
2525 /* Set the mask extension */
2526 tBTA_SERVICE_MASK_EXT mask_ext;
2527 mask_ext.num_uuid = 0;
2528 mask_ext.p_uuid = NULL;
2529 mask_ext.srvc_mask = BTA_ALL_SERVICE_MASK;
2530
2531 BTA_DmDiscoverByTransport(*remote_addr, &mask_ext, bte_dm_search_services_evt,
2532 true, transport);
2533
2534 return BT_STATUS_SUCCESS;
2535 }
2536
2537 /*******************************************************************************
2538 *
2539 * Function btif_dm_get_remote_service_record
2540 *
2541 * Description Start SDP to get remote service record
2542 *
2543 *
2544 * Returns bt_status_t
2545 ******************************************************************************/
btif_dm_get_remote_service_record(const RawAddress & remote_addr,const Uuid & uuid)2546 bt_status_t btif_dm_get_remote_service_record(const RawAddress& remote_addr,
2547 const Uuid& uuid) {
2548 BTIF_TRACE_EVENT("%s: bd_addr=%s", __func__, remote_addr.ToString().c_str());
2549 BTA_DmDiscoverUUID(remote_addr, uuid, bte_dm_remote_service_record_evt, true);
2550
2551 return BT_STATUS_SUCCESS;
2552 }
2553
btif_dm_execute_service_request(uint16_t event,char * p_param)2554 void btif_dm_execute_service_request(uint16_t event, char* p_param) {
2555 bool b_enable = false;
2556 bt_status_t status;
2557 if (event == BTIF_DM_ENABLE_SERVICE) {
2558 b_enable = true;
2559 }
2560 status =
2561 btif_in_execute_service_request(*((tBTA_SERVICE_ID*)p_param), b_enable);
2562 if (status == BT_STATUS_SUCCESS) {
2563 bt_property_t property;
2564 Uuid local_uuids[BT_MAX_NUM_UUIDS];
2565
2566 /* Now send the UUID_PROPERTY_CHANGED event to the upper layer */
2567 BTIF_STORAGE_FILL_PROPERTY(&property, BT_PROPERTY_UUIDS,
2568 sizeof(local_uuids), local_uuids);
2569 btif_storage_get_adapter_property(&property);
2570 HAL_CBACK(bt_hal_cbacks, adapter_properties_cb, BT_STATUS_SUCCESS, 1,
2571 &property);
2572 }
2573 return;
2574 }
2575
btif_dm_proc_io_req(UNUSED_ATTR const RawAddress & bd_addr,UNUSED_ATTR tBTA_IO_CAP * p_io_cap,UNUSED_ATTR tBTA_OOB_DATA * p_oob_data,tBTA_AUTH_REQ * p_auth_req,bool is_orig)2576 void btif_dm_proc_io_req(UNUSED_ATTR const RawAddress& bd_addr,
2577 UNUSED_ATTR tBTA_IO_CAP* p_io_cap,
2578 UNUSED_ATTR tBTA_OOB_DATA* p_oob_data,
2579 tBTA_AUTH_REQ* p_auth_req, bool is_orig) {
2580 uint8_t yes_no_bit = BTA_AUTH_SP_YES & *p_auth_req;
2581 /* if local initiated:
2582 ** 1. set DD + MITM
2583 ** if remote initiated:
2584 ** 1. Copy over the auth_req from peer's io_rsp
2585 ** 2. Set the MITM if peer has it set or if peer has DisplayYesNo
2586 *(iPhone)
2587 ** as a fallback set MITM+GB if peer had MITM set
2588 */
2589
2590 BTIF_TRACE_DEBUG("+%s: p_auth_req=%d", __func__, *p_auth_req);
2591 if (pairing_cb.is_local_initiated) {
2592 /* if initing/responding to a dedicated bonding, use dedicate bonding bit */
2593 *p_auth_req = BTA_AUTH_DD_BOND | BTA_AUTH_SP_YES;
2594 } else if (!is_orig) {
2595 /* peer initiated paring. They probably know what they want.
2596 ** Copy the mitm from peer device.
2597 */
2598 BTIF_TRACE_DEBUG("%s: setting p_auth_req to peer's: %d", __func__,
2599 pairing_cb.auth_req);
2600 *p_auth_req = (pairing_cb.auth_req & BTA_AUTH_BONDS);
2601
2602 /* copy over the MITM bit as well. In addition if the peer has DisplayYesNo,
2603 * force MITM */
2604 if ((yes_no_bit) || (pairing_cb.io_cap & BTM_IO_CAP_IO))
2605 *p_auth_req |= BTA_AUTH_SP_YES;
2606 } else if (yes_no_bit) {
2607 /* set the general bonding bit for stored device */
2608 *p_auth_req = BTA_AUTH_GEN_BOND | yes_no_bit;
2609 }
2610 BTIF_TRACE_DEBUG("-%s: p_auth_req=%d", __func__, *p_auth_req);
2611 }
2612
btif_dm_proc_io_rsp(UNUSED_ATTR const RawAddress & bd_addr,tBTA_IO_CAP io_cap,UNUSED_ATTR tBTA_OOB_DATA oob_data,tBTA_AUTH_REQ auth_req)2613 void btif_dm_proc_io_rsp(UNUSED_ATTR const RawAddress& bd_addr,
2614 tBTA_IO_CAP io_cap, UNUSED_ATTR tBTA_OOB_DATA oob_data,
2615 tBTA_AUTH_REQ auth_req) {
2616 if (auth_req & BTA_AUTH_BONDS) {
2617 BTIF_TRACE_DEBUG("%s auth_req:%d", __func__, auth_req);
2618 pairing_cb.auth_req = auth_req;
2619 pairing_cb.io_cap = io_cap;
2620 }
2621 }
2622
btif_dm_set_oob_for_io_req(tBTA_OOB_DATA * p_has_oob_data)2623 void btif_dm_set_oob_for_io_req(tBTA_OOB_DATA* p_has_oob_data) {
2624 if (is_empty_128bit(oob_cb.oob_data.c192)) {
2625 *p_has_oob_data = false;
2626 } else {
2627 *p_has_oob_data = true;
2628 }
2629 BTIF_TRACE_DEBUG("%s: *p_has_oob_data=%d", __func__, *p_has_oob_data);
2630 }
2631
btif_dm_set_oob_for_le_io_req(const RawAddress & bd_addr,tBTA_OOB_DATA * p_has_oob_data,tBTA_LE_AUTH_REQ * p_auth_req)2632 void btif_dm_set_oob_for_le_io_req(const RawAddress& bd_addr,
2633 tBTA_OOB_DATA* p_has_oob_data,
2634 tBTA_LE_AUTH_REQ* p_auth_req) {
2635 if (!is_empty_128bit(oob_cb.oob_data.le_sc_c) &&
2636 !is_empty_128bit(oob_cb.oob_data.le_sc_r)) {
2637 /* We have LE SC OOB data */
2638
2639 /* make sure OOB data is for this particular device */
2640 if (bd_addr == oob_cb.bdaddr) {
2641 *p_auth_req = ((*p_auth_req) | BTM_LE_AUTH_REQ_SC_ONLY);
2642 *p_has_oob_data = true;
2643 } else {
2644 *p_has_oob_data = false;
2645 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
2646 __func__);
2647 }
2648 } else if (!is_empty_128bit(oob_cb.oob_data.sm_tk)) {
2649 /* We have security manager TK */
2650
2651 /* make sure OOB data is for this particular device */
2652 if (bd_addr == oob_cb.bdaddr) {
2653 // When using OOB with TK, SC Secure Connections bit must be disabled.
2654 tBTA_LE_AUTH_REQ mask = ~BTM_LE_AUTH_REQ_SC_ONLY;
2655 *p_auth_req = ((*p_auth_req) & mask);
2656
2657 *p_has_oob_data = true;
2658 } else {
2659 *p_has_oob_data = false;
2660 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
2661 __func__);
2662 }
2663 } else {
2664 *p_has_oob_data = false;
2665 }
2666 BTIF_TRACE_DEBUG("%s *p_has_oob_data=%d", __func__, *p_has_oob_data);
2667 }
2668
2669 #ifdef BTIF_DM_OOB_TEST
btif_dm_load_local_oob(void)2670 void btif_dm_load_local_oob(void) {
2671 char prop_oob[PROPERTY_VALUE_MAX];
2672 osi_property_get("service.brcm.bt.oob", prop_oob, "3");
2673 BTIF_TRACE_DEBUG("%s: prop_oob = %s", __func__, prop_oob);
2674 if (prop_oob[0] != '3') {
2675 if (is_empty_128bit(oob_cb.oob_data.c192)) {
2676 BTIF_TRACE_DEBUG("%s: read OOB, call BTA_DmLocalOob()", __func__);
2677 BTA_DmLocalOob();
2678 }
2679 }
2680 }
2681
btif_dm_proc_loc_oob(bool valid,const Octet16 & c,const Octet16 & r)2682 void btif_dm_proc_loc_oob(bool valid, const Octet16& c, const Octet16& r) {
2683 FILE* fp;
2684 const char* path_a = "/data/misc/bluedroid/LOCAL/a.key";
2685 const char* path_b = "/data/misc/bluedroid/LOCAL/b.key";
2686 const char* path = NULL;
2687 char prop_oob[PROPERTY_VALUE_MAX];
2688 BTIF_TRACE_DEBUG("%s: valid=%d", __func__, valid);
2689 if (is_empty_128bit(oob_cb.oob_data.c192) && valid) {
2690 BTIF_TRACE_DEBUG("save local OOB data in memory");
2691 memcpy(oob_cb.oob_data.c192, c.data(), OCTET16_LEN);
2692 memcpy(oob_cb.oob_data.r192, r.data(), OCTET16_LEN);
2693 osi_property_get("service.brcm.bt.oob", prop_oob, "3");
2694 BTIF_TRACE_DEBUG("%s: prop_oob = %s", __func__, prop_oob);
2695 if (prop_oob[0] == '1')
2696 path = path_a;
2697 else if (prop_oob[0] == '2')
2698 path = path_b;
2699 if (path) {
2700 fp = fopen(path, "wb+");
2701 if (fp == NULL) {
2702 BTIF_TRACE_DEBUG("%s: failed to save local OOB data to %s", __func__,
2703 path);
2704 } else {
2705 BTIF_TRACE_DEBUG("%s: save local OOB data into file %s", __func__,
2706 path);
2707 fwrite(c.data(), 1, OCTET16_LEN, fp);
2708 fwrite(r.data(), 1, OCTET16_LEN, fp);
2709 fclose(fp);
2710 }
2711 }
2712 }
2713 }
2714
2715 /*******************************************************************************
2716 *
2717 * Function btif_dm_get_smp_config
2718 *
2719 * Description Retrieve the SMP pairing options from the bt_stack.conf
2720 * file. To provide specific pairing options for the host
2721 * add a node with label "SmpOptions" to the config file
2722 * and assign it a comma separated list of 5 values in the
2723 * format: auth, io, ikey, rkey, ksize, oob
2724 * eg: PTS_SmpOptions=0xD,0x4,0xf,0xf,0x10
2725 *
2726 * Parameters: tBTE_APPL_CFG*: pointer to struct defining pairing options
2727 *
2728 * Returns true if the options were successfully read, else false
2729 *
2730 ******************************************************************************/
btif_dm_get_smp_config(tBTE_APPL_CFG * p_cfg)2731 bool btif_dm_get_smp_config(tBTE_APPL_CFG* p_cfg) {
2732 const std::string* recv = stack_config_get_interface()->get_pts_smp_options();
2733 if (!recv) {
2734 BTIF_TRACE_DEBUG("%s: SMP options not found in configuration", __func__);
2735 return false;
2736 }
2737
2738 char conf[64];
2739 char* pch;
2740 char* endptr;
2741
2742 strncpy(conf, recv->c_str(), 64);
2743 conf[63] = 0; // null terminate
2744
2745 pch = strtok(conf, ",");
2746 if (pch != NULL)
2747 p_cfg->ble_auth_req = (uint8_t)strtoul(pch, &endptr, 16);
2748 else
2749 return false;
2750
2751 pch = strtok(NULL, ",");
2752 if (pch != NULL)
2753 p_cfg->ble_io_cap = (uint8_t)strtoul(pch, &endptr, 16);
2754 else
2755 return false;
2756
2757 pch = strtok(NULL, ",");
2758 if (pch != NULL)
2759 p_cfg->ble_init_key = (uint8_t)strtoul(pch, &endptr, 16);
2760 else
2761 return false;
2762
2763 pch = strtok(NULL, ",");
2764 if (pch != NULL)
2765 p_cfg->ble_resp_key = (uint8_t)strtoul(pch, &endptr, 16);
2766 else
2767 return false;
2768
2769 pch = strtok(NULL, ",");
2770 if (pch != NULL)
2771 p_cfg->ble_max_key_size = (uint8_t)strtoul(pch, &endptr, 16);
2772 else
2773 return false;
2774
2775 return true;
2776 }
2777
btif_dm_proc_rmt_oob(const RawAddress & bd_addr,Octet16 * p_c,Octet16 * p_r)2778 bool btif_dm_proc_rmt_oob(const RawAddress& bd_addr, Octet16* p_c,
2779 Octet16* p_r) {
2780 const char* path_a = "/data/misc/bluedroid/LOCAL/a.key";
2781 const char* path_b = "/data/misc/bluedroid/LOCAL/b.key";
2782 const char* path = NULL;
2783 char prop_oob[PROPERTY_VALUE_MAX];
2784 osi_property_get("service.brcm.bt.oob", prop_oob, "3");
2785 BTIF_TRACE_DEBUG("%s: prop_oob = %s", __func__, prop_oob);
2786 if (prop_oob[0] == '1')
2787 path = path_b;
2788 else if (prop_oob[0] == '2')
2789 path = path_a;
2790 if (!path) {
2791 BTIF_TRACE_DEBUG("%s: can't open path!", __func__);
2792 return false;
2793 }
2794
2795 FILE* fp = fopen(path, "rb");
2796 if (fp == NULL) {
2797 BTIF_TRACE_DEBUG("%s: failed to read OOB keys from %s", __func__, path);
2798 return false;
2799 }
2800
2801 BTIF_TRACE_DEBUG("%s: read OOB data from %s", __func__, path);
2802 fread(p_c->data(), 1, OCTET16_LEN, fp);
2803 fread(p_r->data(), 1, OCTET16_LEN, fp);
2804 fclose(fp);
2805
2806 RawAddress bt_bd_addr = bd_addr;
2807 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_BOND_STATE_BONDING,
2808 (char*)&bt_bd_addr, sizeof(RawAddress), NULL);
2809 return true;
2810 }
2811 #endif /* BTIF_DM_OOB_TEST */
2812
btif_dm_ble_key_notif_evt(tBTA_DM_SP_KEY_NOTIF * p_ssp_key_notif)2813 static void btif_dm_ble_key_notif_evt(tBTA_DM_SP_KEY_NOTIF* p_ssp_key_notif) {
2814 RawAddress bd_addr;
2815 bt_bdname_t bd_name;
2816 uint32_t cod;
2817 int dev_type;
2818
2819 BTIF_TRACE_DEBUG("%s", __func__);
2820
2821 /* Remote name update */
2822 if (!btif_get_device_type(p_ssp_key_notif->bd_addr, &dev_type)) {
2823 dev_type = BT_DEVICE_TYPE_BLE;
2824 }
2825 btif_dm_update_ble_remote_properties(p_ssp_key_notif->bd_addr,
2826 p_ssp_key_notif->bd_name,
2827 (tBT_DEVICE_TYPE)dev_type);
2828 bd_addr = p_ssp_key_notif->bd_addr;
2829 memcpy(bd_name.name, p_ssp_key_notif->bd_name, BD_NAME_LEN);
2830
2831 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
2832 pairing_cb.is_ssp = false;
2833 cod = COD_UNCLASSIFIED;
2834
2835 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
2836 BT_SSP_VARIANT_PASSKEY_NOTIFICATION, p_ssp_key_notif->passkey);
2837 }
2838
2839 /*******************************************************************************
2840 *
2841 * Function btif_dm_ble_auth_cmpl_evt
2842 *
2843 * Description Executes authentication complete event in btif context
2844 *
2845 * Returns void
2846 *
2847 ******************************************************************************/
btif_dm_ble_auth_cmpl_evt(tBTA_DM_AUTH_CMPL * p_auth_cmpl)2848 static void btif_dm_ble_auth_cmpl_evt(tBTA_DM_AUTH_CMPL* p_auth_cmpl) {
2849 /* Save link key, if not temporary */
2850 bt_status_t status = BT_STATUS_FAIL;
2851 bt_bond_state_t state = BT_BOND_STATE_NONE;
2852
2853 RawAddress bd_addr = p_auth_cmpl->bd_addr;
2854
2855 /* Clear OOB data */
2856 memset(&oob_cb, 0, sizeof(oob_cb));
2857
2858 if ((p_auth_cmpl->success) && (p_auth_cmpl->key_present)) {
2859 /* store keys */
2860 }
2861 if (p_auth_cmpl->success) {
2862 status = BT_STATUS_SUCCESS;
2863 state = BT_BOND_STATE_BONDED;
2864 int addr_type;
2865 RawAddress bdaddr = p_auth_cmpl->bd_addr;
2866 if (btif_storage_get_remote_addr_type(&bdaddr, &addr_type) !=
2867 BT_STATUS_SUCCESS)
2868 btif_storage_set_remote_addr_type(&bdaddr, p_auth_cmpl->addr_type);
2869
2870 /* Test for temporary bonding */
2871 if (btm_get_bond_type_dev(p_auth_cmpl->bd_addr) == BOND_TYPE_TEMPORARY) {
2872 BTIF_TRACE_DEBUG("%s: sending BT_BOND_STATE_NONE for Temp pairing",
2873 __func__);
2874 btif_storage_remove_bonded_device(&bdaddr);
2875 state = BT_BOND_STATE_NONE;
2876 } else {
2877 btif_dm_save_ble_bonding_keys(bdaddr);
2878 btif_dm_get_remote_services_by_transport(&bd_addr, GATT_TRANSPORT_LE);
2879 }
2880 } else {
2881 /*Map the HCI fail reason to bt status */
2882 switch (p_auth_cmpl->fail_reason) {
2883 case BTA_DM_AUTH_SMP_PAIR_AUTH_FAIL:
2884 case BTA_DM_AUTH_SMP_CONFIRM_VALUE_FAIL:
2885 case BTA_DM_AUTH_SMP_UNKNOWN_ERR:
2886 btif_dm_remove_ble_bonding_keys();
2887 status = BT_STATUS_AUTH_FAILURE;
2888 break;
2889
2890 case BTA_DM_AUTH_SMP_CONN_TOUT: {
2891 if (btm_sec_is_a_bonded_dev(bd_addr)) {
2892 LOG(INFO) << __func__ << " Bonded device addr=" << bd_addr
2893 << " timed out - will not remove the keys";
2894 // Don't send state change to upper layers - otherwise Java think we
2895 // unbonded, and will disconnect HID profile.
2896 return;
2897 }
2898
2899 btif_dm_remove_ble_bonding_keys();
2900 status = BT_STATUS_AUTH_FAILURE;
2901 break;
2902 }
2903 case BTA_DM_AUTH_SMP_PAIR_NOT_SUPPORT:
2904 status = BT_STATUS_AUTH_REJECTED;
2905 break;
2906 default:
2907 btif_dm_remove_ble_bonding_keys();
2908 status = BT_STATUS_FAIL;
2909 break;
2910 }
2911 }
2912 if (state == BT_BOND_STATE_BONDED && bd_addr != pairing_cb.static_bdaddr) {
2913 // Report RPA bonding state to Java in crosskey paring
2914 bond_state_changed(status, bd_addr, BT_BOND_STATE_BONDING);
2915 }
2916 bond_state_changed(status, bd_addr, state);
2917 }
2918
btif_dm_load_ble_local_keys(void)2919 void btif_dm_load_ble_local_keys(void) {
2920 memset(&ble_local_key_cb, 0, sizeof(btif_dm_local_key_cb_t));
2921
2922 if (btif_storage_get_ble_local_key(
2923 BTIF_DM_LE_LOCAL_KEY_ER, &ble_local_key_cb.er) == BT_STATUS_SUCCESS) {
2924 ble_local_key_cb.is_er_rcvd = true;
2925 BTIF_TRACE_DEBUG("%s BLE ER key loaded", __func__);
2926 }
2927
2928 if ((btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_IR,
2929 &ble_local_key_cb.id_keys.ir) ==
2930 BT_STATUS_SUCCESS) &&
2931 (btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_IRK,
2932 &ble_local_key_cb.id_keys.irk) ==
2933 BT_STATUS_SUCCESS) &&
2934 (btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_DHK,
2935 &ble_local_key_cb.id_keys.dhk) ==
2936 BT_STATUS_SUCCESS)) {
2937 ble_local_key_cb.is_id_keys_rcvd = true;
2938 BTIF_TRACE_DEBUG("%s BLE ID keys loaded", __func__);
2939 }
2940 }
btif_dm_get_ble_local_keys(tBTA_DM_BLE_LOCAL_KEY_MASK * p_key_mask,Octet16 * p_er,tBTA_BLE_LOCAL_ID_KEYS * p_id_keys)2941 void btif_dm_get_ble_local_keys(tBTA_DM_BLE_LOCAL_KEY_MASK* p_key_mask,
2942 Octet16* p_er,
2943 tBTA_BLE_LOCAL_ID_KEYS* p_id_keys) {
2944 if (ble_local_key_cb.is_er_rcvd) {
2945 *p_er = ble_local_key_cb.er;
2946 *p_key_mask |= BTA_BLE_LOCAL_KEY_TYPE_ER;
2947 }
2948
2949 if (ble_local_key_cb.is_id_keys_rcvd) {
2950 p_id_keys->ir = ble_local_key_cb.id_keys.ir;
2951 p_id_keys->irk = ble_local_key_cb.id_keys.irk;
2952 p_id_keys->dhk = ble_local_key_cb.id_keys.dhk;
2953 *p_key_mask |= BTA_BLE_LOCAL_KEY_TYPE_ID;
2954 }
2955 BTIF_TRACE_DEBUG("%s *p_key_mask=0x%02x", __func__, *p_key_mask);
2956 }
2957
btif_dm_save_ble_bonding_keys(RawAddress & bd_addr)2958 void btif_dm_save_ble_bonding_keys(RawAddress& bd_addr) {
2959 BTIF_TRACE_DEBUG("%s", __func__);
2960
2961 if (pairing_cb.ble.is_penc_key_rcvd) {
2962 btif_storage_add_ble_bonding_key(
2963 &bd_addr, (uint8_t*)&pairing_cb.ble.penc_key, BTIF_DM_LE_KEY_PENC,
2964 sizeof(tBTM_LE_PENC_KEYS));
2965 }
2966
2967 if (pairing_cb.ble.is_pid_key_rcvd) {
2968 btif_storage_add_ble_bonding_key(
2969 &bd_addr, (uint8_t*)&pairing_cb.ble.pid_key, BTIF_DM_LE_KEY_PID,
2970 sizeof(tBTM_LE_PID_KEYS));
2971 }
2972
2973 if (pairing_cb.ble.is_pcsrk_key_rcvd) {
2974 btif_storage_add_ble_bonding_key(
2975 &bd_addr, (uint8_t*)&pairing_cb.ble.pcsrk_key, BTIF_DM_LE_KEY_PCSRK,
2976 sizeof(tBTM_LE_PCSRK_KEYS));
2977 }
2978
2979 if (pairing_cb.ble.is_lenc_key_rcvd) {
2980 btif_storage_add_ble_bonding_key(
2981 &bd_addr, (uint8_t*)&pairing_cb.ble.lenc_key, BTIF_DM_LE_KEY_LENC,
2982 sizeof(tBTM_LE_LENC_KEYS));
2983 }
2984
2985 if (pairing_cb.ble.is_lcsrk_key_rcvd) {
2986 btif_storage_add_ble_bonding_key(
2987 &bd_addr, (uint8_t*)&pairing_cb.ble.lcsrk_key, BTIF_DM_LE_KEY_LCSRK,
2988 sizeof(tBTM_LE_LCSRK_KEYS));
2989 }
2990
2991 if (pairing_cb.ble.is_lidk_key_rcvd) {
2992 btif_storage_add_ble_bonding_key(&bd_addr, NULL, BTIF_DM_LE_KEY_LID, 0);
2993 }
2994 }
2995
btif_dm_remove_ble_bonding_keys(void)2996 void btif_dm_remove_ble_bonding_keys(void) {
2997 BTIF_TRACE_DEBUG("%s", __func__);
2998
2999 RawAddress bd_addr = pairing_cb.bd_addr;
3000 btif_storage_remove_ble_bonding_keys(&bd_addr);
3001 }
3002
3003 /*******************************************************************************
3004 *
3005 * Function btif_dm_ble_sec_req_evt
3006 *
3007 * Description Eprocess security request event in btif context
3008 *
3009 * Returns void
3010 *
3011 ******************************************************************************/
btif_dm_ble_sec_req_evt(tBTA_DM_BLE_SEC_REQ * p_ble_req)3012 void btif_dm_ble_sec_req_evt(tBTA_DM_BLE_SEC_REQ* p_ble_req) {
3013 bt_bdname_t bd_name;
3014 uint32_t cod;
3015 int dev_type;
3016
3017 BTIF_TRACE_DEBUG("%s", __func__);
3018
3019 if (pairing_cb.state == BT_BOND_STATE_BONDING) {
3020 BTIF_TRACE_DEBUG("%s Discard security request", __func__);
3021 return;
3022 }
3023
3024 /* Remote name update */
3025 if (!btif_get_device_type(p_ble_req->bd_addr, &dev_type)) {
3026 dev_type = BT_DEVICE_TYPE_BLE;
3027 }
3028 btif_dm_update_ble_remote_properties(p_ble_req->bd_addr, p_ble_req->bd_name,
3029 (tBT_DEVICE_TYPE)dev_type);
3030
3031 RawAddress bd_addr = p_ble_req->bd_addr;
3032 memcpy(bd_name.name, p_ble_req->bd_name, BD_NAME_LEN);
3033
3034 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
3035
3036 pairing_cb.bond_type = BOND_TYPE_PERSISTENT;
3037 pairing_cb.is_le_only = true;
3038 pairing_cb.is_le_nc = false;
3039 pairing_cb.is_ssp = true;
3040 btm_set_bond_type_dev(p_ble_req->bd_addr, pairing_cb.bond_type);
3041
3042 cod = COD_UNCLASSIFIED;
3043
3044 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
3045 BT_SSP_VARIANT_CONSENT, 0);
3046 }
3047
3048 /*******************************************************************************
3049 *
3050 * Function btif_dm_ble_passkey_req_evt
3051 *
3052 * Description Executes pin request event in btif context
3053 *
3054 * Returns void
3055 *
3056 ******************************************************************************/
btif_dm_ble_passkey_req_evt(tBTA_DM_PIN_REQ * p_pin_req)3057 static void btif_dm_ble_passkey_req_evt(tBTA_DM_PIN_REQ* p_pin_req) {
3058 bt_bdname_t bd_name;
3059 uint32_t cod;
3060 int dev_type;
3061
3062 /* Remote name update */
3063 if (!btif_get_device_type(p_pin_req->bd_addr, &dev_type)) {
3064 dev_type = BT_DEVICE_TYPE_BLE;
3065 }
3066 btif_dm_update_ble_remote_properties(p_pin_req->bd_addr, p_pin_req->bd_name,
3067 (tBT_DEVICE_TYPE)dev_type);
3068
3069 RawAddress bd_addr = p_pin_req->bd_addr;
3070 memcpy(bd_name.name, p_pin_req->bd_name, BD_NAME_LEN);
3071
3072 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
3073 pairing_cb.is_le_only = true;
3074
3075 cod = COD_UNCLASSIFIED;
3076
3077 HAL_CBACK(bt_hal_cbacks, pin_request_cb, &bd_addr, &bd_name, cod, false);
3078 }
btif_dm_ble_key_nc_req_evt(tBTA_DM_SP_KEY_NOTIF * p_notif_req)3079 static void btif_dm_ble_key_nc_req_evt(tBTA_DM_SP_KEY_NOTIF* p_notif_req) {
3080 /* TODO implement key notification for numeric comparison */
3081 BTIF_TRACE_DEBUG("%s", __func__);
3082
3083 /* Remote name update */
3084 btif_update_remote_properties(p_notif_req->bd_addr, p_notif_req->bd_name,
3085 NULL, BT_DEVICE_TYPE_BLE);
3086
3087 RawAddress bd_addr = p_notif_req->bd_addr;
3088
3089 bt_bdname_t bd_name;
3090 memcpy(bd_name.name, p_notif_req->bd_name, BD_NAME_LEN);
3091
3092 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
3093 pairing_cb.is_ssp = false;
3094 pairing_cb.is_le_only = true;
3095 pairing_cb.is_le_nc = true;
3096
3097 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, COD_UNCLASSIFIED,
3098 BT_SSP_VARIANT_PASSKEY_CONFIRMATION, p_notif_req->passkey);
3099 }
3100
btif_dm_ble_oob_req_evt(tBTA_DM_SP_RMT_OOB * req_oob_type)3101 static void btif_dm_ble_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type) {
3102 BTIF_TRACE_DEBUG("%s", __func__);
3103
3104 RawAddress bd_addr = req_oob_type->bd_addr;
3105 /* We already checked if OOB data is present in
3106 * btif_dm_set_oob_for_le_io_req, but check here again. If it's not present
3107 * do nothing, pairing will timeout.
3108 */
3109 if (is_empty_128bit(oob_cb.oob_data.sm_tk)) {
3110 return;
3111 }
3112
3113 /* make sure OOB data is for this particular device */
3114 if (req_oob_type->bd_addr != oob_cb.bdaddr) {
3115 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
3116 __func__);
3117 return;
3118 }
3119
3120 /* Remote name update */
3121 btif_update_remote_properties(req_oob_type->bd_addr, req_oob_type->bd_name,
3122 NULL, BT_DEVICE_TYPE_BLE);
3123
3124 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
3125 pairing_cb.is_ssp = false;
3126 pairing_cb.is_le_only = true;
3127 pairing_cb.is_le_nc = false;
3128
3129 BTM_BleOobDataReply(req_oob_type->bd_addr, 0, 16, oob_cb.oob_data.sm_tk);
3130 }
3131
btif_dm_ble_sc_oob_req_evt(tBTA_DM_SP_RMT_OOB * req_oob_type)3132 static void btif_dm_ble_sc_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type) {
3133 BTIF_TRACE_DEBUG("%s", __func__);
3134
3135 RawAddress bd_addr = req_oob_type->bd_addr;
3136
3137 /* We already checked if OOB data is present in
3138 * btif_dm_set_oob_for_le_io_req, but check here again. If it's not present
3139 * do nothing, pairing will timeout.
3140 */
3141 if (is_empty_128bit(oob_cb.oob_data.le_sc_c) &&
3142 is_empty_128bit(oob_cb.oob_data.le_sc_r)) {
3143 BTIF_TRACE_WARNING("%s: LE SC OOB data is empty", __func__);
3144 return;
3145 }
3146
3147 /* make sure OOB data is for this particular device */
3148 if (req_oob_type->bd_addr != oob_cb.bdaddr) {
3149 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
3150 __func__);
3151 return;
3152 }
3153
3154 /* Remote name update */
3155 btif_update_remote_properties(req_oob_type->bd_addr, req_oob_type->bd_name,
3156 NULL, BT_DEVICE_TYPE_BLE);
3157
3158 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
3159 pairing_cb.is_ssp = false;
3160 pairing_cb.is_le_only =
3161 true; // TODO: we can derive classic pairing from this one
3162 pairing_cb.is_le_nc = false;
3163
3164 BTM_BleSecureConnectionOobDataReply(
3165 req_oob_type->bd_addr, oob_cb.oob_data.le_sc_c, oob_cb.oob_data.le_sc_r);
3166 }
3167
btif_dm_update_ble_remote_properties(const RawAddress & bd_addr,BD_NAME bd_name,tBT_DEVICE_TYPE dev_type)3168 void btif_dm_update_ble_remote_properties(const RawAddress& bd_addr,
3169 BD_NAME bd_name,
3170 tBT_DEVICE_TYPE dev_type) {
3171 btif_update_remote_properties(bd_addr, bd_name, NULL, dev_type);
3172 }
3173
btif_dm_ble_tx_test_cback(void * p)3174 static void btif_dm_ble_tx_test_cback(void* p) {
3175 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_LE_TX_TEST, (char*)p, 1,
3176 NULL);
3177 }
3178
btif_dm_ble_rx_test_cback(void * p)3179 static void btif_dm_ble_rx_test_cback(void* p) {
3180 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_LE_RX_TEST, (char*)p, 1,
3181 NULL);
3182 }
3183
btif_dm_ble_test_end_cback(void * p)3184 static void btif_dm_ble_test_end_cback(void* p) {
3185 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_LE_TEST_END, (char*)p,
3186 3, NULL);
3187 }
3188 /*******************************************************************************
3189 *
3190 * Function btif_le_test_mode
3191 *
3192 * Description Sends a HCI BLE Test command to the Controller
3193 *
3194 * Returns BT_STATUS_SUCCESS on success
3195 *
3196 ******************************************************************************/
btif_le_test_mode(uint16_t opcode,uint8_t * buf,uint8_t len)3197 bt_status_t btif_le_test_mode(uint16_t opcode, uint8_t* buf, uint8_t len) {
3198 switch (opcode) {
3199 case HCI_BLE_TRANSMITTER_TEST:
3200 if (len != 3) return BT_STATUS_PARM_INVALID;
3201 BTM_BleTransmitterTest(buf[0], buf[1], buf[2], btif_dm_ble_tx_test_cback);
3202 break;
3203 case HCI_BLE_RECEIVER_TEST:
3204 if (len != 1) return BT_STATUS_PARM_INVALID;
3205 BTM_BleReceiverTest(buf[0], btif_dm_ble_rx_test_cback);
3206 break;
3207 case HCI_BLE_TEST_END:
3208 BTM_BleTestEnd(btif_dm_ble_test_end_cback);
3209 break;
3210 default:
3211 BTIF_TRACE_ERROR("%s: Unknown LE Test Mode Command 0x%x", __func__,
3212 opcode);
3213 return BT_STATUS_UNSUPPORTED;
3214 }
3215 return BT_STATUS_SUCCESS;
3216 }
3217
btif_dm_on_disable()3218 void btif_dm_on_disable() {
3219 /* cancel any pending pairing requests */
3220 if (is_bonding_or_sdp()) {
3221 BTIF_TRACE_DEBUG("%s: Cancel pending pairing request", __func__);
3222 btif_dm_cancel_bond(&pairing_cb.bd_addr);
3223 }
3224 }
3225
3226 /*******************************************************************************
3227 *
3228 * Function btif_dm_read_energy_info
3229 *
3230 * Description Reads the energy info from controller
3231 *
3232 * Returns void
3233 *
3234 ******************************************************************************/
btif_dm_read_energy_info()3235 void btif_dm_read_energy_info() { BTA_DmBleGetEnergyInfo(bta_energy_info_cb); }
3236
btif_get_default_local_name()3237 static char* btif_get_default_local_name() {
3238 if (btif_default_local_name[0] == '\0') {
3239 int max_len = sizeof(btif_default_local_name) - 1;
3240 if (BTM_DEF_LOCAL_NAME[0] != '\0') {
3241 strncpy(btif_default_local_name, BTM_DEF_LOCAL_NAME, max_len);
3242 } else {
3243 char prop_model[PROPERTY_VALUE_MAX];
3244 osi_property_get(PROPERTY_PRODUCT_MODEL, prop_model, "");
3245 strncpy(btif_default_local_name, prop_model, max_len);
3246 }
3247 btif_default_local_name[max_len] = '\0';
3248 }
3249 return btif_default_local_name;
3250 }
3251
btif_stats_add_bond_event(const RawAddress & bd_addr,bt_bond_function_t function,bt_bond_state_t state)3252 static void btif_stats_add_bond_event(const RawAddress& bd_addr,
3253 bt_bond_function_t function,
3254 bt_bond_state_t state) {
3255 std::unique_lock<std::mutex> lock(bond_event_lock);
3256
3257 btif_bond_event_t* event = &btif_dm_bond_events[btif_events_end_index];
3258 event->bd_addr = bd_addr;
3259 event->function = function;
3260 event->state = state;
3261 clock_gettime(CLOCK_REALTIME, &event->timestamp);
3262
3263 btif_num_bond_events++;
3264 btif_events_end_index =
3265 (btif_events_end_index + 1) % (MAX_BTIF_BOND_EVENT_ENTRIES + 1);
3266 if (btif_events_end_index == btif_events_start_index) {
3267 btif_events_start_index =
3268 (btif_events_start_index + 1) % (MAX_BTIF_BOND_EVENT_ENTRIES + 1);
3269 }
3270
3271 int type;
3272 btif_get_device_type(bd_addr, &type);
3273
3274 bluetooth::common::device_type_t device_type;
3275 switch (type) {
3276 case BT_DEVICE_TYPE_BREDR:
3277 device_type = bluetooth::common::DEVICE_TYPE_BREDR;
3278 break;
3279 case BT_DEVICE_TYPE_BLE:
3280 device_type = bluetooth::common::DEVICE_TYPE_LE;
3281 break;
3282 case BT_DEVICE_TYPE_DUMO:
3283 device_type = bluetooth::common::DEVICE_TYPE_DUMO;
3284 break;
3285 default:
3286 device_type = bluetooth::common::DEVICE_TYPE_UNKNOWN;
3287 break;
3288 }
3289
3290 uint32_t cod = get_cod(&bd_addr);
3291 uint64_t ts =
3292 event->timestamp.tv_sec * 1000 + event->timestamp.tv_nsec / 1000000;
3293 bluetooth::common::BluetoothMetricsLogger::GetInstance()->LogPairEvent(
3294 0, ts, cod, device_type);
3295 }
3296
btif_debug_bond_event_dump(int fd)3297 void btif_debug_bond_event_dump(int fd) {
3298 std::unique_lock<std::mutex> lock(bond_event_lock);
3299 dprintf(fd, "\nBond Events: \n");
3300 dprintf(fd, " Total Number of events: %zu\n", btif_num_bond_events);
3301 if (btif_num_bond_events > 0)
3302 dprintf(fd,
3303 " Time address Function State\n");
3304
3305 for (size_t i = btif_events_start_index; i != btif_events_end_index;
3306 i = (i + 1) % (MAX_BTIF_BOND_EVENT_ENTRIES + 1)) {
3307 btif_bond_event_t* event = &btif_dm_bond_events[i];
3308
3309 char eventtime[20];
3310 char temptime[20];
3311 struct tm* tstamp = localtime(&event->timestamp.tv_sec);
3312 strftime(temptime, sizeof(temptime), "%H:%M:%S", tstamp);
3313 snprintf(eventtime, sizeof(eventtime), "%s.%03ld", temptime,
3314 event->timestamp.tv_nsec / 1000000);
3315
3316 const char* func_name;
3317 switch (event->function) {
3318 case BTIF_DM_FUNC_CREATE_BOND:
3319 func_name = "btif_dm_create_bond";
3320 break;
3321 case BTIF_DM_FUNC_REMOVE_BOND:
3322 func_name = "btif_dm_remove_bond";
3323 break;
3324 case BTIF_DM_FUNC_BOND_STATE_CHANGED:
3325 func_name = "bond_state_changed ";
3326 break;
3327 default:
3328 func_name = "Invalid value ";
3329 break;
3330 }
3331
3332 const char* bond_state;
3333 switch (event->state) {
3334 case BT_BOND_STATE_NONE:
3335 bond_state = "BOND_STATE_NONE";
3336 break;
3337 case BT_BOND_STATE_BONDING:
3338 bond_state = "BOND_STATE_BONDING";
3339 break;
3340 case BT_BOND_STATE_BONDED:
3341 bond_state = "BOND_STATE_BONDED";
3342 break;
3343 default:
3344 bond_state = "Invalid bond state";
3345 break;
3346 }
3347
3348 dprintf(fd, " %s %s %s %s\n", eventtime,
3349 event->bd_addr.ToString().c_str(), func_name, bond_state);
3350 }
3351 }
3352