1 /******************************************************************************
2 *
3 * Copyright (C) 1999-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /******************************************************************************
20 *
21 * This file contains functions for BLE address management.
22 *
23 ******************************************************************************/
24
25 #include <string.h>
26
27 #include "bt_types.h"
28 #include "hcimsgs.h"
29 #include "btu.h"
30 #include "btm_int.h"
31 #include "btm_ble_int.h"
32 #include "gap_api.h"
33
34 #if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
35 #include "smp_api.h"
36 #define BTM_BLE_PRIVATE_ADDR_INT 900 /* 15 minutes minimum for
37 random address refreshing */
38
39 /*******************************************************************************
40 **
41 ** Function btm_gen_resolve_paddr_cmpl
42 **
43 ** Description This is callback functioin when resolvable private address
44 ** generation is complete.
45 **
46 ** Returns void
47 **
48 *******************************************************************************/
btm_gen_resolve_paddr_cmpl(tSMP_ENC * p)49 static void btm_gen_resolve_paddr_cmpl(tSMP_ENC *p)
50 {
51 tBTM_LE_RANDOM_CB *p_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
52 BTM_TRACE_EVENT0 ("btm_gen_resolve_paddr_cmpl");
53
54 if (p)
55 {
56 /* set hash to be LSB of rpAddress */
57 p_cb->private_addr[5] = p->param_buf[0];
58 p_cb->private_addr[4] = p->param_buf[1];
59 p_cb->private_addr[3] = p->param_buf[2];
60 /* set it to controller */
61 btsnd_hcic_ble_set_random_addr(p_cb->private_addr);
62
63 p_cb->own_addr_type = BLE_ADDR_RANDOM;
64
65 /* start a periodical timer to refresh random addr */
66 btu_stop_timer(&p_cb->raddr_timer_ent);
67 btu_start_timer (&p_cb->raddr_timer_ent, BTU_TTYPE_BLE_RANDOM_ADDR,
68 BTM_BLE_PRIVATE_ADDR_INT);
69
70 }
71 else
72 {
73 /* random address set failure */
74 BTM_TRACE_DEBUG0("set random address failed");
75 }
76 }
77 /*******************************************************************************
78 **
79 ** Function btm_gen_resolve_paddr_low
80 **
81 ** Description This function is called when random address has generate the
82 ** random number base for low 3 byte bd address.
83 **
84 ** Returns void
85 **
86 *******************************************************************************/
btm_gen_resolve_paddr_low(tBTM_RAND_ENC * p)87 static void btm_gen_resolve_paddr_low(tBTM_RAND_ENC *p)
88 {
89 #if (BLE_INCLUDED == TRUE && SMP_INCLUDED == TRUE)
90 tBTM_LE_RANDOM_CB *p_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
91 tSMP_ENC output;
92
93 BTM_TRACE_EVENT0 ("btm_gen_resolve_paddr_low");
94 if (p)
95 {
96 p->param_buf[2] &= (~BLE_RESOLVE_ADDR_MASK);
97 p->param_buf[2] |= BLE_RESOLVE_ADDR_MSB;
98
99 p_cb->private_addr[2] = p->param_buf[0];
100 p_cb->private_addr[1] = p->param_buf[1];
101 p_cb->private_addr[0] = p->param_buf[2];
102
103 /* encrypt with ur IRK */
104 if (!SMP_Encrypt(btm_cb.devcb.id_keys.irk, BT_OCTET16_LEN, p->param_buf, 3, &output))
105 {
106 btm_gen_resolve_paddr_cmpl(NULL);
107 }
108 else
109 {
110 btm_gen_resolve_paddr_cmpl(&output);
111 }
112 }
113 #endif
114 }
115 /*******************************************************************************
116 **
117 ** Function btm_gen_resolvable_private_addr
118 **
119 ** Description This function generate a resolvable private address.
120 **
121 ** Returns void
122 **
123 *******************************************************************************/
btm_gen_resolvable_private_addr(void)124 void btm_gen_resolvable_private_addr (void)
125 {
126 BTM_TRACE_EVENT0 ("btm_gen_resolvable_private_addr");
127 /* generate 3B rand as BD LSB, SRK with it, get BD MSB */
128 if (!btsnd_hcic_ble_rand((void *)btm_gen_resolve_paddr_low))
129 btm_gen_resolve_paddr_cmpl(NULL);
130 }
131 /*******************************************************************************
132 **
133 ** Function btm_gen_non_resolve_paddr_cmpl
134 **
135 ** Description This is the callback function when non-resolvable private
136 ** function is generated and write to controller.
137 **
138 ** Returns void
139 **
140 *******************************************************************************/
btm_gen_non_resolve_paddr_cmpl(tBTM_RAND_ENC * p)141 static void btm_gen_non_resolve_paddr_cmpl(tBTM_RAND_ENC *p)
142 {
143 tBTM_LE_RANDOM_CB *p_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
144 tBTM_BLE_ADDR_CBACK *p_cback = p_cb->p_generate_cback;
145 void *p_data = p_cb->p;
146 UINT8 *pp;
147 BD_ADDR static_random;
148
149 BTM_TRACE_EVENT0 ("btm_gen_non_resolve_paddr_cmpl");
150
151 p_cb->p_generate_cback = NULL;
152 if (p)
153 {
154
155 pp = p->param_buf;
156 STREAM_TO_BDADDR(static_random, pp);
157 /* mask off the 2 MSB */
158 static_random[0] &= BLE_STATIC_PRIVATE_MSB_MASK;
159
160 /* report complete */
161 if (p_cback)
162 (* p_cback)(static_random, p_data);
163 }
164 else
165 {
166 BTM_TRACE_DEBUG0("btm_gen_non_resolvable_private_addr failed");
167 if (p_cback)
168 (* p_cback)(NULL, p_data);
169 }
170 }
171 /*******************************************************************************
172 **
173 ** Function btm_gen_non_resolvable_private_addr
174 **
175 ** Description This function generate a non-resolvable private address.
176 **
177 **
178 ** Returns void
179 **
180 *******************************************************************************/
btm_gen_non_resolvable_private_addr(tBTM_BLE_ADDR_CBACK * p_cback,void * p)181 void btm_gen_non_resolvable_private_addr (tBTM_BLE_ADDR_CBACK *p_cback, void *p)
182 {
183 tBTM_LE_RANDOM_CB *p_mgnt_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
184
185 BTM_TRACE_EVENT0 ("btm_gen_non_resolvable_private_addr");
186
187 if (p_mgnt_cb->p_generate_cback != NULL)
188 return;
189
190 p_mgnt_cb->p_generate_cback = p_cback;
191 p_mgnt_cb->p = p;
192 if (!btsnd_hcic_ble_rand((void *)btm_gen_non_resolve_paddr_cmpl))
193 {
194 btm_gen_non_resolve_paddr_cmpl(NULL);
195 }
196
197 }
198 #if SMP_INCLUDED == TRUE
199 /*******************************************************************************
200 ** Utility functions for Random address resolving
201 *******************************************************************************/
202 /*******************************************************************************
203 **
204 ** Function btm_ble_resolve_address_cmpl
205 **
206 ** Description This function sends the random address resolving complete
207 ** callback.
208 **
209 ** Returns None.
210 **
211 *******************************************************************************/
btm_ble_resolve_address_cmpl(void)212 static void btm_ble_resolve_address_cmpl(void)
213 {
214 tBTM_LE_RANDOM_CB *p_mgnt_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
215 tBTM_SEC_DEV_REC *p_dev_rec = NULL;
216
217 BTM_TRACE_EVENT1 ("btm_ble_resolve_address_cmpl p_mgnt_cb->index = %d", p_mgnt_cb->index);
218
219 if (p_mgnt_cb->index < BTM_SEC_MAX_DEVICE_RECORDS)
220 {
221 p_dev_rec = &btm_cb.sec_dev_rec[p_mgnt_cb->index];
222 }
223
224 p_mgnt_cb->busy = FALSE;
225
226 (* p_mgnt_cb->p_resolve_cback)(p_dev_rec, p_mgnt_cb->p);
227 }
228 /*******************************************************************************
229 **
230 ** Function btm_ble_proc_resolve_x
231 **
232 ** Description This function compares the X with random address 3 MSO bytes
233 ** to find a match, if not match, continue for next record.
234 **
235 ** Returns None.
236 **
237 *******************************************************************************/
btm_ble_proc_resolve_x(tSMP_ENC * p)238 static BOOLEAN btm_ble_proc_resolve_x(tSMP_ENC *p)
239 {
240 tBTM_LE_RANDOM_CB *p_mgnt_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
241 UINT8 comp[3];
242 BTM_TRACE_EVENT0 ("btm_ble_proc_resolve_x");
243 /* compare the hash with 3 LSB of bd address */
244 comp[0] = p_mgnt_cb->random_bda[5];
245 comp[1] = p_mgnt_cb->random_bda[4];
246 comp[2] = p_mgnt_cb->random_bda[3];
247
248 if (p)
249 {
250 if (!memcmp(p->param_buf, &comp[0], 3))
251 {
252 /* match is found */
253 BTM_TRACE_EVENT0 ("match is found");
254 btm_ble_resolve_address_cmpl();
255 return TRUE;
256 }
257 }
258 return FALSE;
259 }
260 /*******************************************************************************
261 **
262 ** Function btm_ble_match_random_bda
263 **
264 ** Description This function match the random address to the appointed device
265 ** record, starting from calculating IRK. If record index exceed
266 ** the maximum record number, matching failed and send callback.
267 **
268 ** Returns None.
269 **
270 *******************************************************************************/
btm_ble_match_random_bda(UINT16 rec_index)271 static BOOLEAN btm_ble_match_random_bda(UINT16 rec_index)
272 {
273 #if (BLE_INCLUDED == TRUE && SMP_INCLUDED == TRUE)
274 tBTM_SEC_DEV_REC *p_dev_rec;
275 tBTM_LE_RANDOM_CB *p_mgnt_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
276 UINT8 rand[3];
277 tSMP_ENC output;
278
279 /* use the 3 MSB of bd address as prand */
280 rand[0] = p_mgnt_cb->random_bda[2];
281 rand[1] = p_mgnt_cb->random_bda[1];
282 rand[2] = p_mgnt_cb->random_bda[0];
283
284 BTM_TRACE_EVENT1("btm_ble_match_random_bda rec_index = %d", rec_index);
285
286 if (rec_index < BTM_SEC_MAX_DEVICE_RECORDS)
287 {
288 p_dev_rec = &btm_cb.sec_dev_rec[rec_index];
289
290 BTM_TRACE_ERROR2("sec_flags = %02x device_type = %d", p_dev_rec->sec_flags, p_dev_rec->device_type);
291
292 if ((p_dev_rec->device_type == BT_DEVICE_TYPE_BLE) &&
293 (p_dev_rec->ble.key_type & BTM_LE_KEY_PID))
294 {
295 /* generate X = E irk(R0, R1, R2) and R is random address 3 LSO */
296 SMP_Encrypt(p_dev_rec->ble.keys.irk, BT_OCTET16_LEN,
297 &rand[0], 3, &output);
298 return btm_ble_proc_resolve_x(&output);
299 }
300 else
301 {
302 // not completed
303 return FALSE;
304 }
305 }
306 else /* no match found */
307 {
308 btm_ble_resolve_address_cmpl();
309 return TRUE;
310 }
311 #endif
312 }
313
314 /*******************************************************************************
315 **
316 ** Function btm_ble_resolve_random_addr
317 **
318 ** Description This function is called to resolve a random address.
319 **
320 ** Returns pointer to the security record of the device whom a random
321 ** address is matched to.
322 **
323 *******************************************************************************/
btm_ble_resolve_random_addr(BD_ADDR random_bda,tBTM_BLE_RESOLVE_CBACK * p_cback,void * p)324 void btm_ble_resolve_random_addr(BD_ADDR random_bda, tBTM_BLE_RESOLVE_CBACK * p_cback, void *p)
325 {
326 tBTM_LE_RANDOM_CB *p_mgnt_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
327
328 BTM_TRACE_EVENT0 ("btm_ble_resolve_random_addr");
329 if ( !p_mgnt_cb->busy)
330 {
331 p_mgnt_cb->p = p;
332 p_mgnt_cb->busy = TRUE;
333 p_mgnt_cb->index = 0;
334 p_mgnt_cb->p_resolve_cback = p_cback;
335 memcpy(p_mgnt_cb->random_bda, random_bda, BD_ADDR_LEN);
336 /* start to resolve random address */
337 /* check for next security record */
338 while (TRUE)
339 {
340 if (btm_ble_match_random_bda(p_mgnt_cb->index))
341 {
342 /* atch found or went through the list */
343 break;
344 }
345 p_mgnt_cb->index ++;
346 }
347 }
348 else
349 (*p_cback)(NULL, p);
350 }
351 #endif
352 /*******************************************************************************
353 ** address mapping between pseudo address and real connection address
354 *******************************************************************************/
355 /*******************************************************************************
356 **
357 ** Function btm_ble_map_bda_to_conn_bda
358 **
359 ** Description This function map a BD address to the real connection address
360 ** and return the connection address type.
361 *******************************************************************************/
btm_ble_map_bda_to_conn_bda(BD_ADDR bd_addr)362 tBLE_ADDR_TYPE btm_ble_map_bda_to_conn_bda(BD_ADDR bd_addr)
363 {
364 tBTM_SEC_DEV_REC *p_dev_rec = NULL;
365 BTM_TRACE_EVENT0 ("btm_ble_map_bda_to_conn_bda");
366 if ((p_dev_rec = btm_find_dev (bd_addr)) != NULL &&
367 p_dev_rec->device_type == BT_DEVICE_TYPE_BLE)
368 {
369 if (p_dev_rec->ble.ble_addr_type != BLE_ADDR_PUBLIC)
370 {
371 memcpy(bd_addr, p_dev_rec->ble.static_addr, BD_ADDR_LEN);
372 }
373 return p_dev_rec->ble.ble_addr_type;
374 }
375 else
376 return BLE_ADDR_PUBLIC;
377 }
378
379 #endif
380
381
382