1 /******************************************************************************
2 *
3 * Copyright 2009-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /*******************************************************************************
20 *
21 * Filename: btif_dm.c
22 *
23 * Description: Contains Device Management (DM) related functionality
24 *
25 *
26 ******************************************************************************/
27
28 #define LOG_TAG "bt_btif_dm"
29
30 #include "btif_dm.h"
31
32 #include <base/bind.h>
33 #include <base/logging.h>
34 #include <signal.h>
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38 #include <sys/types.h>
39 #include <time.h>
40 #include <unistd.h>
41
42 #include <mutex>
43
44 #include <bluetooth/uuid.h>
45 #include <hardware/bluetooth.h>
46 #include <hardware/bt_hearing_aid.h>
47
48 #include "advertise_data_parser.h"
49 #include "bt_common.h"
50 #include "bta_closure_api.h"
51 #include "bta_gatt_api.h"
52 #include "btif_api.h"
53 #include "btif_av.h"
54 #include "btif_config.h"
55 #include "btif_dm.h"
56 #include "btif_hd.h"
57 #include "btif_hf.h"
58 #include "btif_hh.h"
59 #include "btif_sdp.h"
60 #include "btif_storage.h"
61 #include "btif_util.h"
62 #include "btu.h"
63 #include "device/include/controller.h"
64 #include "device/include/interop.h"
65 #include "internal_include/stack_config.h"
66 #include "osi/include/allocator.h"
67 #include "osi/include/log.h"
68 #include "osi/include/metrics.h"
69 #include "osi/include/osi.h"
70 #include "osi/include/properties.h"
71 #include "stack/btm/btm_int.h"
72 #include "stack_config.h"
73
74 using bluetooth::Uuid;
75 /******************************************************************************
76 * Constants & Macros
77 *****************************************************************************/
78
79 const Uuid UUID_HEARING_AID = Uuid::FromString("FDF0");
80
81 #define COD_MASK 0x07FF
82
83 #define COD_UNCLASSIFIED ((0x1F) << 8)
84 #define COD_HID_KEYBOARD 0x0540
85 #define COD_HID_POINTING 0x0580
86 #define COD_HID_COMBO 0x05C0
87 #define COD_HID_MAJOR 0x0500
88 #define COD_HID_MASK 0x0700
89 #define COD_AV_HEADSETS 0x0404
90 #define COD_AV_HANDSFREE 0x0408
91 #define COD_AV_HEADPHONES 0x0418
92 #define COD_AV_PORTABLE_AUDIO 0x041C
93 #define COD_AV_HIFI_AUDIO 0x0428
94
95 #define BTIF_DM_DEFAULT_INQ_MAX_RESULTS 0
96 #define BTIF_DM_DEFAULT_INQ_MAX_DURATION 10
97 #define BTIF_DM_MAX_SDP_ATTEMPTS_AFTER_PAIRING 2
98
99 #define NUM_TIMEOUT_RETRIES 5
100
101 #define PROPERTY_PRODUCT_MODEL "ro.product.model"
102 #define DEFAULT_LOCAL_NAME_MAX 31
103 #if (DEFAULT_LOCAL_NAME_MAX > BTM_MAX_LOC_BD_NAME_LEN)
104 #error "default btif local name size exceeds stack supported length"
105 #endif
106
107 #define ENCRYPTED_BREDR 2
108 #define ENCRYPTED_LE 4
109
110 typedef struct {
111 bt_bond_state_t state;
112 RawAddress static_bdaddr;
113 RawAddress bd_addr;
114 tBTM_BOND_TYPE bond_type;
115 uint8_t pin_code_len;
116 uint8_t is_ssp;
117 uint8_t auth_req;
118 uint8_t io_cap;
119 uint8_t autopair_attempts;
120 uint8_t timeout_retries;
121 uint8_t is_local_initiated;
122 uint8_t sdp_attempts;
123 bool is_le_only;
124 bool is_le_nc; /* LE Numeric comparison */
125 btif_dm_ble_cb_t ble;
126 } btif_dm_pairing_cb_t;
127
128 typedef struct {
129 uint8_t ir[BT_OCTET16_LEN];
130 uint8_t irk[BT_OCTET16_LEN];
131 uint8_t dhk[BT_OCTET16_LEN];
132 } btif_dm_local_key_id_t;
133
134 typedef struct {
135 bool is_er_rcvd;
136 uint8_t er[BT_OCTET16_LEN];
137 bool is_id_keys_rcvd;
138 btif_dm_local_key_id_t id_keys; /* ID kyes */
139
140 } btif_dm_local_key_cb_t;
141
142 typedef struct {
143 RawAddress bd_addr;
144 BD_NAME bd_name;
145 } btif_dm_remote_name_t;
146
147 /* this structure holds optional OOB data for remote device */
148 typedef struct {
149 RawAddress bdaddr; /* peer bdaddr */
150 bt_out_of_band_data_t oob_data;
151 } btif_dm_oob_cb_t;
152
153 typedef struct {
154 RawAddress bdaddr;
155 uint8_t transport; /* 0=Unknown, 1=BR/EDR, 2=LE */
156 } btif_dm_create_bond_cb_t;
157
158 typedef struct {
159 uint8_t status;
160 uint8_t ctrl_state;
161 uint64_t tx_time;
162 uint64_t rx_time;
163 uint64_t idle_time;
164 uint64_t energy_used;
165 } btif_activity_energy_info_cb_t;
166
167 typedef struct { unsigned int manufact_id; } skip_sdp_entry_t;
168
169 typedef enum {
170 BTIF_DM_FUNC_CREATE_BOND,
171 BTIF_DM_FUNC_CANCEL_BOND,
172 BTIF_DM_FUNC_REMOVE_BOND,
173 BTIF_DM_FUNC_BOND_STATE_CHANGED,
174 } bt_bond_function_t;
175
176 typedef struct {
177 RawAddress bd_addr;
178 bt_bond_function_t function;
179 bt_bond_state_t state;
180 struct timespec timestamp;
181 } btif_bond_event_t;
182
183 #define BTA_SERVICE_ID_TO_SERVICE_MASK(id) (1 << (id))
184
185 #define MAX_BTIF_BOND_EVENT_ENTRIES 15
186
187 static skip_sdp_entry_t sdp_blacklist[] = {{76}}; // Apple Mouse and Keyboard
188
189 /* This flag will be true if HCI_Inquiry is in progress */
190 static bool btif_dm_inquiry_in_progress = false;
191
192 /*******************************************************************************
193 * Static variables
194 ******************************************************************************/
195 static char btif_default_local_name[DEFAULT_LOCAL_NAME_MAX + 1] = {'\0'};
196 static uid_set_t* uid_set = NULL;
197
198 /* A circular array to keep track of the most recent bond events */
199 static btif_bond_event_t btif_dm_bond_events[MAX_BTIF_BOND_EVENT_ENTRIES + 1];
200
201 static std::mutex bond_event_lock;
202
203 /* |btif_num_bond_events| keeps track of the total number of events and can be
204 greater than |MAX_BTIF_BOND_EVENT_ENTRIES| */
205 static size_t btif_num_bond_events = 0;
206 static size_t btif_events_start_index = 0;
207 static size_t btif_events_end_index = 0;
208
209 /******************************************************************************
210 * Static functions
211 *****************************************************************************/
212 static btif_dm_pairing_cb_t pairing_cb;
213 static btif_dm_oob_cb_t oob_cb;
214 static void btif_dm_generic_evt(uint16_t event, char* p_param);
215 static void btif_dm_cb_create_bond(const RawAddress& bd_addr,
216 tBTA_TRANSPORT transport);
217 static void btif_dm_cb_hid_remote_name(tBTM_REMOTE_DEV_NAME* p_remote_name);
218 static void btif_update_remote_properties(const RawAddress& bd_addr,
219 BD_NAME bd_name, DEV_CLASS dev_class,
220 tBT_DEVICE_TYPE dev_type);
221 static btif_dm_local_key_cb_t ble_local_key_cb;
222 static void btif_dm_ble_key_notif_evt(tBTA_DM_SP_KEY_NOTIF* p_ssp_key_notif);
223 static void btif_dm_ble_auth_cmpl_evt(tBTA_DM_AUTH_CMPL* p_auth_cmpl);
224 static void btif_dm_ble_passkey_req_evt(tBTA_DM_PIN_REQ* p_pin_req);
225 static void btif_dm_ble_key_nc_req_evt(tBTA_DM_SP_KEY_NOTIF* p_notif_req);
226 static void btif_dm_ble_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type);
227 static void btif_dm_ble_sc_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type);
228
229 static void bte_scan_filt_param_cfg_evt(uint8_t action_type, uint8_t avbl_space,
230 uint8_t ref_value, uint8_t status);
231
232 static char* btif_get_default_local_name();
233
234 static void btif_stats_add_bond_event(const RawAddress& bd_addr,
235 bt_bond_function_t function,
236 bt_bond_state_t state);
237
238 /******************************************************************************
239 * Externs
240 *****************************************************************************/
241 extern bt_status_t btif_av_execute_service(bool b_enable);
242 extern bt_status_t btif_av_sink_execute_service(bool b_enable);
243 extern bt_status_t btif_hh_execute_service(bool b_enable);
244 extern bt_status_t btif_hf_client_execute_service(bool b_enable);
245 extern bt_status_t btif_sdp_execute_service(bool b_enable);
246 extern int btif_hh_connect(const RawAddress* bd_addr);
247 extern bt_status_t btif_hd_execute_service(bool b_enable);
248 extern bluetooth::hearing_aid::HearingAidInterface*
249 btif_hearing_aid_get_interface();
250
251 /******************************************************************************
252 * Functions
253 *****************************************************************************/
254
is_empty_128bit(uint8_t * data)255 static bool is_empty_128bit(uint8_t* data) {
256 static const uint8_t zero[16] = {0};
257 return !memcmp(zero, data, sizeof(zero));
258 }
259
is_bonding_or_sdp()260 static bool is_bonding_or_sdp() {
261 return pairing_cb.state == BT_BOND_STATE_BONDING ||
262 (pairing_cb.state == BT_BOND_STATE_BONDED && pairing_cb.sdp_attempts);
263 }
264
btif_dm_data_copy(uint16_t event,char * dst,char * src)265 static void btif_dm_data_copy(uint16_t event, char* dst, char* src) {
266 tBTA_DM_SEC* dst_dm_sec = (tBTA_DM_SEC*)dst;
267 tBTA_DM_SEC* src_dm_sec = (tBTA_DM_SEC*)src;
268
269 if (!src_dm_sec) return;
270
271 CHECK(dst_dm_sec);
272 maybe_non_aligned_memcpy(dst_dm_sec, src_dm_sec, sizeof(*src_dm_sec));
273
274 if (event == BTA_DM_BLE_KEY_EVT) {
275 dst_dm_sec->ble_key.p_key_value =
276 (tBTM_LE_KEY_VALUE*)osi_malloc(sizeof(tBTM_LE_KEY_VALUE));
277 CHECK(src_dm_sec->ble_key.p_key_value);
278 memcpy(dst_dm_sec->ble_key.p_key_value, src_dm_sec->ble_key.p_key_value,
279 sizeof(tBTM_LE_KEY_VALUE));
280 }
281 }
282
btif_dm_data_free(uint16_t event,tBTA_DM_SEC * dm_sec)283 static void btif_dm_data_free(uint16_t event, tBTA_DM_SEC* dm_sec) {
284 if (event == BTA_DM_BLE_KEY_EVT)
285 osi_free_and_reset((void**)&dm_sec->ble_key.p_key_value);
286 }
287
btif_dm_init(uid_set_t * set)288 void btif_dm_init(uid_set_t* set) { uid_set = set; }
289
btif_dm_cleanup(void)290 void btif_dm_cleanup(void) {
291 if (uid_set) {
292 uid_set_destroy(uid_set);
293 uid_set = NULL;
294 }
295 }
296
btif_in_execute_service_request(tBTA_SERVICE_ID service_id,bool b_enable)297 bt_status_t btif_in_execute_service_request(tBTA_SERVICE_ID service_id,
298 bool b_enable) {
299 BTIF_TRACE_DEBUG("%s service_id: %d", __func__, service_id);
300 /* Check the service_ID and invoke the profile's BT state changed API */
301 switch (service_id) {
302 case BTA_HFP_SERVICE_ID:
303 case BTA_HSP_SERVICE_ID: {
304 bluetooth::headset::ExecuteService(b_enable);
305 } break;
306 case BTA_A2DP_SOURCE_SERVICE_ID: {
307 btif_av_source_execute_service(b_enable);
308 } break;
309 case BTA_A2DP_SINK_SERVICE_ID: {
310 btif_av_sink_execute_service(b_enable);
311 } break;
312 case BTA_HID_SERVICE_ID: {
313 btif_hh_execute_service(b_enable);
314 } break;
315 case BTA_HFP_HS_SERVICE_ID: {
316 btif_hf_client_execute_service(b_enable);
317 } break;
318 case BTA_SDP_SERVICE_ID: {
319 btif_sdp_execute_service(b_enable);
320 } break;
321 case BTA_HIDD_SERVICE_ID: {
322 btif_hd_execute_service(b_enable);
323 } break;
324 default:
325 BTIF_TRACE_ERROR("%s: Unknown service %d being %s", __func__, service_id,
326 (b_enable) ? "enabled" : "disabled");
327 return BT_STATUS_FAIL;
328 }
329 return BT_STATUS_SUCCESS;
330 }
331
332 /*******************************************************************************
333 *
334 * Function check_eir_remote_name
335 *
336 * Description Check if remote name is in the EIR data
337 *
338 * Returns true if remote name found
339 * Populate p_remote_name, if provided and remote name found
340 *
341 ******************************************************************************/
check_eir_remote_name(tBTA_DM_SEARCH * p_search_data,uint8_t * p_remote_name,uint8_t * p_remote_name_len)342 static bool check_eir_remote_name(tBTA_DM_SEARCH* p_search_data,
343 uint8_t* p_remote_name,
344 uint8_t* p_remote_name_len) {
345 const uint8_t* p_eir_remote_name = NULL;
346 uint8_t remote_name_len = 0;
347
348 /* Check EIR for remote name and services */
349 if (p_search_data->inq_res.p_eir) {
350 p_eir_remote_name = AdvertiseDataParser::GetFieldByType(
351 p_search_data->inq_res.p_eir, p_search_data->inq_res.eir_len,
352 BTM_EIR_COMPLETE_LOCAL_NAME_TYPE, &remote_name_len);
353 if (!p_eir_remote_name) {
354 p_eir_remote_name = AdvertiseDataParser::GetFieldByType(
355 p_search_data->inq_res.p_eir, p_search_data->inq_res.eir_len,
356 BTM_EIR_SHORTENED_LOCAL_NAME_TYPE, &remote_name_len);
357 }
358
359 if (p_eir_remote_name) {
360 if (remote_name_len > BD_NAME_LEN) remote_name_len = BD_NAME_LEN;
361
362 if (p_remote_name && p_remote_name_len) {
363 memcpy(p_remote_name, p_eir_remote_name, remote_name_len);
364 *(p_remote_name + remote_name_len) = 0;
365 *p_remote_name_len = remote_name_len;
366 }
367
368 return true;
369 }
370 }
371
372 return false;
373 }
374
375 /*******************************************************************************
376 *
377 * Function check_cached_remote_name
378 *
379 * Description Check if remote name is in the NVRAM cache
380 *
381 * Returns true if remote name found
382 * Populate p_remote_name, if provided and remote name found
383 *
384 ******************************************************************************/
check_cached_remote_name(tBTA_DM_SEARCH * p_search_data,uint8_t * p_remote_name,uint8_t * p_remote_name_len)385 static bool check_cached_remote_name(tBTA_DM_SEARCH* p_search_data,
386 uint8_t* p_remote_name,
387 uint8_t* p_remote_name_len) {
388 bt_bdname_t bdname;
389 bt_property_t prop_name;
390
391 /* check if we already have it in our btif_storage cache */
392
393 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_BDNAME,
394 sizeof(bt_bdname_t), &bdname);
395 if (btif_storage_get_remote_device_property(
396 &p_search_data->inq_res.bd_addr, &prop_name) == BT_STATUS_SUCCESS) {
397 if (p_remote_name && p_remote_name_len) {
398 strcpy((char*)p_remote_name, (char*)bdname.name);
399 *p_remote_name_len = strlen((char*)p_remote_name);
400 }
401 return true;
402 }
403
404 return false;
405 }
406
get_cod(const RawAddress * remote_bdaddr)407 static uint32_t get_cod(const RawAddress* remote_bdaddr) {
408 uint32_t remote_cod;
409 bt_property_t prop_name;
410
411 /* check if we already have it in our btif_storage cache */
412 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_CLASS_OF_DEVICE,
413 sizeof(uint32_t), &remote_cod);
414 if (btif_storage_get_remote_device_property(
415 (RawAddress*)remote_bdaddr, &prop_name) == BT_STATUS_SUCCESS) {
416 LOG_INFO(LOG_TAG, "%s remote_cod = 0x%08x", __func__, remote_cod);
417 return remote_cod & COD_MASK;
418 }
419
420 return 0;
421 }
422
check_cod(const RawAddress * remote_bdaddr,uint32_t cod)423 bool check_cod(const RawAddress* remote_bdaddr, uint32_t cod) {
424 return get_cod(remote_bdaddr) == cod;
425 }
426
check_cod_hid(const RawAddress * remote_bdaddr)427 bool check_cod_hid(const RawAddress* remote_bdaddr) {
428 return (get_cod(remote_bdaddr) & COD_HID_MASK) == COD_HID_MAJOR;
429 }
430
check_hid_le(const RawAddress * remote_bdaddr)431 bool check_hid_le(const RawAddress* remote_bdaddr) {
432 uint32_t remote_dev_type;
433 bt_property_t prop_name;
434
435 /* check if we already have it in our btif_storage cache */
436 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_TYPE_OF_DEVICE,
437 sizeof(uint32_t), &remote_dev_type);
438 if (btif_storage_get_remote_device_property(
439 (RawAddress*)remote_bdaddr, &prop_name) == BT_STATUS_SUCCESS) {
440 if (remote_dev_type == BT_DEVICE_DEVTYPE_BLE) {
441 if (btif_config_exist(remote_bdaddr->ToString().c_str(), "HidAppId"))
442 return true;
443 }
444 }
445 return false;
446 }
447
448 /*****************************************************************************
449 *
450 * Function check_sdp_bl
451 *
452 * Description Checks if a given device is blacklisted to skip sdp
453 *
454 * Parameters skip_sdp_entry
455 *
456 * Returns true if the device is present in blacklist, else false
457 *
458 ******************************************************************************/
check_sdp_bl(const RawAddress * remote_bdaddr)459 bool check_sdp_bl(const RawAddress* remote_bdaddr) {
460 uint16_t manufacturer = 0;
461 uint8_t lmp_ver = 0;
462 uint16_t lmp_subver = 0;
463 bt_property_t prop_name;
464 bt_remote_version_t info;
465
466 if (remote_bdaddr == NULL) return false;
467
468 /* fetch additional info about remote device used in iop query */
469 BTM_ReadRemoteVersion(*remote_bdaddr, &lmp_ver, &manufacturer, &lmp_subver);
470
471 /* if not available yet, try fetching from config database */
472 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_REMOTE_VERSION_INFO,
473 sizeof(bt_remote_version_t), &info);
474
475 if (btif_storage_get_remote_device_property(remote_bdaddr, &prop_name) !=
476 BT_STATUS_SUCCESS) {
477 return false;
478 }
479 manufacturer = info.manufacturer;
480
481 for (unsigned int i = 0; i < ARRAY_SIZE(sdp_blacklist); i++) {
482 if (manufacturer == sdp_blacklist[i].manufact_id) return true;
483 }
484 return false;
485 }
486
bond_state_changed(bt_status_t status,const RawAddress & bd_addr,bt_bond_state_t state)487 static void bond_state_changed(bt_status_t status, const RawAddress& bd_addr,
488 bt_bond_state_t state) {
489 btif_stats_add_bond_event(bd_addr, BTIF_DM_FUNC_BOND_STATE_CHANGED, state);
490
491 if ((pairing_cb.state == state) && (state == BT_BOND_STATE_BONDING)) {
492 // Cross key pairing so send callback for static address
493 if (!pairing_cb.static_bdaddr.IsEmpty()) {
494 auto tmp = bd_addr;
495 HAL_CBACK(bt_hal_cbacks, bond_state_changed_cb, status, &tmp, state);
496 }
497 return;
498 }
499
500 if (pairing_cb.bond_type == BOND_TYPE_TEMPORARY) state = BT_BOND_STATE_NONE;
501
502 BTIF_TRACE_DEBUG("%s: state=%d, prev_state=%d, sdp_attempts = %d", __func__,
503 state, pairing_cb.state, pairing_cb.sdp_attempts);
504
505 auto tmp = bd_addr;
506 HAL_CBACK(bt_hal_cbacks, bond_state_changed_cb, status, &tmp, state);
507
508 if (state == BT_BOND_STATE_BONDING ||
509 (state == BT_BOND_STATE_BONDED && pairing_cb.sdp_attempts > 0)) {
510 // Save state for the device is bonding or SDP.
511 pairing_cb.state = state;
512 pairing_cb.bd_addr = bd_addr;
513 } else {
514 pairing_cb = {};
515 }
516 }
517
518 /* store remote version in bt config to always have access
519 to it post pairing*/
btif_update_remote_version_property(RawAddress * p_bd)520 static void btif_update_remote_version_property(RawAddress* p_bd) {
521 bt_property_t property;
522 uint8_t lmp_ver = 0;
523 uint16_t lmp_subver = 0;
524 uint16_t mfct_set = 0;
525 tBTM_STATUS btm_status;
526 bt_remote_version_t info;
527 bt_status_t status;
528
529 btm_status = BTM_ReadRemoteVersion(*p_bd, &lmp_ver, &mfct_set, &lmp_subver);
530
531 LOG_DEBUG(LOG_TAG, "remote version info [%s]: %x, %x, %x",
532 p_bd->ToString().c_str(), lmp_ver, mfct_set, lmp_subver);
533
534 if (btm_status == BTM_SUCCESS) {
535 // Always update cache to ensure we have availability whenever BTM API is
536 // not populated
537 info.manufacturer = mfct_set;
538 info.sub_ver = lmp_subver;
539 info.version = lmp_ver;
540 BTIF_STORAGE_FILL_PROPERTY(&property, BT_PROPERTY_REMOTE_VERSION_INFO,
541 sizeof(bt_remote_version_t), &info);
542 status = btif_storage_set_remote_device_property(p_bd, &property);
543 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote version",
544 status);
545 }
546 }
547
btif_update_remote_properties(const RawAddress & bdaddr,BD_NAME bd_name,DEV_CLASS dev_class,tBT_DEVICE_TYPE device_type)548 static void btif_update_remote_properties(const RawAddress& bdaddr,
549 BD_NAME bd_name, DEV_CLASS dev_class,
550 tBT_DEVICE_TYPE device_type) {
551 int num_properties = 0;
552 bt_property_t properties[3];
553 bt_status_t status;
554 uint32_t cod;
555 bt_device_type_t dev_type;
556
557 memset(properties, 0, sizeof(properties));
558
559 /* remote name */
560 if (strlen((const char*)bd_name)) {
561 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties], BT_PROPERTY_BDNAME,
562 strlen((char*)bd_name), bd_name);
563 status = btif_storage_set_remote_device_property(
564 &bdaddr, &properties[num_properties]);
565 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device name",
566 status);
567 num_properties++;
568 }
569
570 /* class of device */
571 cod = devclass2uint(dev_class);
572 BTIF_TRACE_DEBUG("%s cod is 0x%06x", __func__, cod);
573 if (cod == 0) {
574 /* Try to retrieve cod from storage */
575 BTIF_TRACE_DEBUG("%s cod is 0, checking cod from storage", __func__);
576 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
577 BT_PROPERTY_CLASS_OF_DEVICE, sizeof(cod), &cod);
578 status = btif_storage_get_remote_device_property(
579 &bdaddr, &properties[num_properties]);
580 BTIF_TRACE_DEBUG("%s cod retrieved from storage is 0x%06x", __func__, cod);
581 if (cod == 0) {
582 BTIF_TRACE_DEBUG("%s cod is again 0, set as unclassified", __func__);
583 cod = COD_UNCLASSIFIED;
584 }
585 }
586
587 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
588 BT_PROPERTY_CLASS_OF_DEVICE, sizeof(cod), &cod);
589 status = btif_storage_set_remote_device_property(&bdaddr,
590 &properties[num_properties]);
591 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device class",
592 status);
593 num_properties++;
594
595 /* device type */
596 bt_property_t prop_name;
597 uint8_t remote_dev_type;
598 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_TYPE_OF_DEVICE,
599 sizeof(uint8_t), &remote_dev_type);
600 if (btif_storage_get_remote_device_property(&bdaddr, &prop_name) ==
601 BT_STATUS_SUCCESS)
602 dev_type = (bt_device_type_t)(remote_dev_type | device_type);
603 else
604 dev_type = (bt_device_type_t)device_type;
605
606 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
607 BT_PROPERTY_TYPE_OF_DEVICE, sizeof(dev_type),
608 &dev_type);
609 status = btif_storage_set_remote_device_property(&bdaddr,
610 &properties[num_properties]);
611 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device type",
612 status);
613 num_properties++;
614
615 auto tmp = bdaddr;
616 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, status, &tmp,
617 num_properties, properties);
618 }
619
620 /*******************************************************************************
621 *
622 * Function btif_dm_cb_hid_remote_name
623 *
624 * Description Remote name callback for HID device. Called in btif context
625 * Special handling for HID devices
626 *
627 * Returns void
628 *
629 ******************************************************************************/
btif_dm_cb_hid_remote_name(tBTM_REMOTE_DEV_NAME * p_remote_name)630 static void btif_dm_cb_hid_remote_name(tBTM_REMOTE_DEV_NAME* p_remote_name) {
631 BTIF_TRACE_DEBUG("%s: status=%d pairing_cb.state=%d", __func__,
632 p_remote_name->status, pairing_cb.state);
633 if (pairing_cb.state == BT_BOND_STATE_BONDING) {
634 if (p_remote_name->status == BTM_SUCCESS) {
635 bond_state_changed(BT_STATUS_SUCCESS, pairing_cb.bd_addr,
636 BT_BOND_STATE_BONDED);
637 } else
638 bond_state_changed(BT_STATUS_FAIL, pairing_cb.bd_addr,
639 BT_BOND_STATE_NONE);
640 }
641 }
642
643 /*******************************************************************************
644 *
645 * Function btif_dm_cb_create_bond
646 *
647 * Description Create bond initiated from the BTIF thread context
648 * Special handling for HID devices
649 *
650 * Returns void
651 *
652 ******************************************************************************/
btif_dm_cb_create_bond(const RawAddress & bd_addr,tBTA_TRANSPORT transport)653 static void btif_dm_cb_create_bond(const RawAddress& bd_addr,
654 tBTA_TRANSPORT transport) {
655 bool is_hid = check_cod(&bd_addr, COD_HID_POINTING);
656 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
657
658 int device_type;
659 int addr_type;
660 std::string addrstr = bd_addr.ToString();
661 const char* bdstr = addrstr.c_str();
662 if (transport == BT_TRANSPORT_LE) {
663 if (!btif_config_get_int(bdstr, "DevType", &device_type)) {
664 btif_config_set_int(bdstr, "DevType", BT_DEVICE_TYPE_BLE);
665 }
666 if (btif_storage_get_remote_addr_type(&bd_addr, &addr_type) !=
667 BT_STATUS_SUCCESS) {
668 // Try to read address type. OOB pairing might have set it earlier, but
669 // didn't store it, it defaults to BLE_ADDR_PUBLIC
670 uint8_t tmp_dev_type;
671 uint8_t tmp_addr_type;
672 BTM_ReadDevInfo(bd_addr, &tmp_dev_type, &tmp_addr_type);
673 addr_type = tmp_addr_type;
674
675 btif_storage_set_remote_addr_type(&bd_addr, addr_type);
676 }
677 }
678 if ((btif_config_get_int(bdstr, "DevType", &device_type) &&
679 (btif_storage_get_remote_addr_type(&bd_addr, &addr_type) ==
680 BT_STATUS_SUCCESS) &&
681 (device_type & BT_DEVICE_TYPE_BLE) == BT_DEVICE_TYPE_BLE) ||
682 (transport == BT_TRANSPORT_LE)) {
683 BTA_DmAddBleDevice(bd_addr, addr_type, device_type);
684 }
685
686 if (is_hid && (device_type & BT_DEVICE_TYPE_BLE) == 0) {
687 bt_status_t status;
688 status = (bt_status_t)btif_hh_connect(&bd_addr);
689 if (status != BT_STATUS_SUCCESS)
690 bond_state_changed(status, bd_addr, BT_BOND_STATE_NONE);
691 } else {
692 BTA_DmBondByTransport(bd_addr, transport);
693 }
694 /* Track originator of bond creation */
695 pairing_cb.is_local_initiated = true;
696 }
697
698 /*******************************************************************************
699 *
700 * Function btif_dm_cb_remove_bond
701 *
702 * Description remove bond initiated from the BTIF thread context
703 * Special handling for HID devices
704 *
705 * Returns void
706 *
707 ******************************************************************************/
btif_dm_cb_remove_bond(const RawAddress * bd_addr)708 void btif_dm_cb_remove_bond(const RawAddress* bd_addr) {
709 /*special handling for HID devices */
710 /* VUP needs to be sent if its a HID Device. The HID HOST module will check if
711 there
712 is a valid hid connection with this bd_addr. If yes VUP will be issued.*/
713 #if (BTA_HH_INCLUDED == TRUE)
714 if (btif_hh_virtual_unplug(bd_addr) != BT_STATUS_SUCCESS)
715 #endif
716 {
717 BTIF_TRACE_DEBUG("%s: Removing HH device", __func__);
718 BTA_DmRemoveDevice(*bd_addr);
719 }
720 }
721
722 /*******************************************************************************
723 *
724 * Function btif_dm_get_connection_state
725 *
726 * Description Returns whether the remote device is currently connected
727 * and whether encryption is active for the connection
728 *
729 * Returns 0 if not connected; 1 if connected and > 1 if connection is
730 * encrypted
731 *
732 ******************************************************************************/
btif_dm_get_connection_state(const RawAddress * bd_addr)733 uint16_t btif_dm_get_connection_state(const RawAddress* bd_addr) {
734 uint16_t rc = BTA_DmGetConnectionState(*bd_addr);
735
736 if (rc != 0) {
737 uint8_t flags = 0;
738
739 BTM_GetSecurityFlagsByTransport(*bd_addr, &flags, BT_TRANSPORT_BR_EDR);
740 BTIF_TRACE_DEBUG("%s: security flags (BR/EDR)=0x%02x", __func__, flags);
741 if (flags & BTM_SEC_FLAG_ENCRYPTED) rc |= ENCRYPTED_BREDR;
742
743 BTM_GetSecurityFlagsByTransport(*bd_addr, &flags, BT_TRANSPORT_LE);
744 BTIF_TRACE_DEBUG("%s: security flags (LE)=0x%02x", __func__, flags);
745 if (flags & BTM_SEC_FLAG_ENCRYPTED) rc |= ENCRYPTED_LE;
746 }
747
748 return rc;
749 }
750
751 /*******************************************************************************
752 *
753 * Function search_devices_copy_cb
754 *
755 * Description Deep copy callback for search devices event
756 *
757 * Returns void
758 *
759 ******************************************************************************/
search_devices_copy_cb(uint16_t event,char * p_dest,char * p_src)760 static void search_devices_copy_cb(uint16_t event, char* p_dest, char* p_src) {
761 tBTA_DM_SEARCH* p_dest_data = (tBTA_DM_SEARCH*)p_dest;
762 tBTA_DM_SEARCH* p_src_data = (tBTA_DM_SEARCH*)p_src;
763
764 if (!p_src) return;
765
766 BTIF_TRACE_DEBUG("%s: event=%s", __func__, dump_dm_search_event(event));
767 maybe_non_aligned_memcpy(p_dest_data, p_src_data, sizeof(*p_src_data));
768 switch (event) {
769 case BTA_DM_INQ_RES_EVT: {
770 if (p_src_data->inq_res.p_eir) {
771 p_dest_data->inq_res.p_eir =
772 (uint8_t*)(p_dest + sizeof(tBTA_DM_SEARCH));
773 memcpy(p_dest_data->inq_res.p_eir, p_src_data->inq_res.p_eir,
774 p_src_data->inq_res.eir_len);
775 p_dest_data->inq_res.eir_len = p_src_data->inq_res.eir_len;
776 }
777 } break;
778
779 case BTA_DM_DISC_RES_EVT: {
780 if (p_src_data->disc_res.raw_data_size &&
781 p_src_data->disc_res.p_raw_data) {
782 p_dest_data->disc_res.p_raw_data =
783 (uint8_t*)(p_dest + sizeof(tBTA_DM_SEARCH));
784 memcpy(p_dest_data->disc_res.p_raw_data,
785 p_src_data->disc_res.p_raw_data,
786 p_src_data->disc_res.raw_data_size);
787 }
788 } break;
789 }
790 }
791
search_services_copy_cb(uint16_t event,char * p_dest,char * p_src)792 static void search_services_copy_cb(uint16_t event, char* p_dest, char* p_src) {
793 tBTA_DM_SEARCH* p_dest_data = (tBTA_DM_SEARCH*)p_dest;
794 tBTA_DM_SEARCH* p_src_data = (tBTA_DM_SEARCH*)p_src;
795
796 if (!p_src) return;
797 maybe_non_aligned_memcpy(p_dest_data, p_src_data, sizeof(*p_src_data));
798 switch (event) {
799 case BTA_DM_DISC_RES_EVT: {
800 if (p_src_data->disc_res.result == BTA_SUCCESS) {
801 if (p_src_data->disc_res.num_uuids > 0) {
802 p_dest_data->disc_res.p_uuid_list =
803 (Uuid*)(p_dest + sizeof(tBTA_DM_SEARCH));
804 memcpy(p_dest_data->disc_res.p_uuid_list,
805 p_src_data->disc_res.p_uuid_list,
806 p_src_data->disc_res.num_uuids * sizeof(Uuid));
807 osi_free_and_reset((void**)&p_src_data->disc_res.p_uuid_list);
808 }
809 osi_free_and_reset((void**)&p_src_data->disc_res.p_raw_data);
810 }
811 } break;
812 }
813 }
814 /******************************************************************************
815 *
816 * BTIF DM callback events
817 *
818 ****************************************************************************/
819
820 /*******************************************************************************
821 *
822 * Function btif_dm_pin_req_evt
823 *
824 * Description Executes pin request event in btif context
825 *
826 * Returns void
827 *
828 ******************************************************************************/
btif_dm_pin_req_evt(tBTA_DM_PIN_REQ * p_pin_req)829 static void btif_dm_pin_req_evt(tBTA_DM_PIN_REQ* p_pin_req) {
830 bt_bdname_t bd_name;
831 uint32_t cod;
832 bt_pin_code_t pin_code;
833 int dev_type;
834
835 /* Remote properties update */
836 if (!btif_get_device_type(p_pin_req->bd_addr, &dev_type)) {
837 dev_type = BT_DEVICE_TYPE_BREDR;
838 }
839 btif_update_remote_properties(p_pin_req->bd_addr, p_pin_req->bd_name,
840 p_pin_req->dev_class,
841 (tBT_DEVICE_TYPE)dev_type);
842
843 const RawAddress& bd_addr = p_pin_req->bd_addr;
844 memcpy(bd_name.name, p_pin_req->bd_name, BD_NAME_LEN);
845
846 if (pairing_cb.state == BT_BOND_STATE_BONDING &&
847 bd_addr != pairing_cb.bd_addr) {
848 BTIF_TRACE_WARNING("%s(): already in bonding state, reject request",
849 __FUNCTION__);
850 btif_dm_pin_reply(&bd_addr, 0, 0, NULL);
851 return;
852 }
853
854 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
855
856 cod = devclass2uint(p_pin_req->dev_class);
857
858 if (cod == 0) {
859 BTIF_TRACE_DEBUG("%s cod is 0, set as unclassified", __func__);
860 cod = COD_UNCLASSIFIED;
861 }
862
863 /* check for auto pair possiblity only if bond was initiated by local device
864 */
865 if (pairing_cb.is_local_initiated && !p_pin_req->min_16_digit) {
866 if (check_cod(&bd_addr, COD_AV_HEADSETS) ||
867 check_cod(&bd_addr, COD_AV_HEADPHONES) ||
868 check_cod(&bd_addr, COD_AV_PORTABLE_AUDIO) ||
869 check_cod(&bd_addr, COD_AV_HIFI_AUDIO) ||
870 check_cod(&bd_addr, COD_HID_POINTING)) {
871 /* Check if this device can be auto paired */
872 if (!interop_match_addr(INTEROP_DISABLE_AUTO_PAIRING, &bd_addr) &&
873 !interop_match_name(INTEROP_DISABLE_AUTO_PAIRING,
874 (const char*)bd_name.name) &&
875 (pairing_cb.autopair_attempts == 0)) {
876 BTIF_TRACE_DEBUG("%s() Attempting auto pair", __func__);
877 pin_code.pin[0] = 0x30;
878 pin_code.pin[1] = 0x30;
879 pin_code.pin[2] = 0x30;
880 pin_code.pin[3] = 0x30;
881
882 pairing_cb.autopair_attempts++;
883 BTA_DmPinReply(bd_addr, true, 4, pin_code.pin);
884 return;
885 }
886 } else if (check_cod(&bd_addr, COD_HID_KEYBOARD) ||
887 check_cod(&bd_addr, COD_HID_COMBO)) {
888 if ((interop_match_addr(INTEROP_KEYBOARD_REQUIRES_FIXED_PIN, &bd_addr) ==
889 true) &&
890 (pairing_cb.autopair_attempts == 0)) {
891 BTIF_TRACE_DEBUG("%s() Attempting auto pair", __func__);
892 pin_code.pin[0] = 0x30;
893 pin_code.pin[1] = 0x30;
894 pin_code.pin[2] = 0x30;
895 pin_code.pin[3] = 0x30;
896
897 pairing_cb.autopair_attempts++;
898 BTA_DmPinReply(bd_addr, true, 4, pin_code.pin);
899 return;
900 }
901 }
902 }
903 // TODO: make cback accept const and get rid of tmp!
904 auto tmp = bd_addr;
905 HAL_CBACK(bt_hal_cbacks, pin_request_cb, &tmp, &bd_name, cod,
906 p_pin_req->min_16_digit);
907 }
908
909 /*******************************************************************************
910 *
911 * Function btif_dm_ssp_cfm_req_evt
912 *
913 * Description Executes SSP confirm request event in btif context
914 *
915 * Returns void
916 *
917 ******************************************************************************/
btif_dm_ssp_cfm_req_evt(tBTA_DM_SP_CFM_REQ * p_ssp_cfm_req)918 static void btif_dm_ssp_cfm_req_evt(tBTA_DM_SP_CFM_REQ* p_ssp_cfm_req) {
919 bt_bdname_t bd_name;
920 uint32_t cod;
921 bool is_incoming = !(pairing_cb.state == BT_BOND_STATE_BONDING);
922 int dev_type;
923
924 BTIF_TRACE_DEBUG("%s", __func__);
925
926 /* Remote properties update */
927 if (!btif_get_device_type(p_ssp_cfm_req->bd_addr, &dev_type)) {
928 dev_type = BT_DEVICE_TYPE_BREDR;
929 }
930 btif_update_remote_properties(p_ssp_cfm_req->bd_addr, p_ssp_cfm_req->bd_name,
931 p_ssp_cfm_req->dev_class,
932 (tBT_DEVICE_TYPE)dev_type);
933
934 RawAddress bd_addr = p_ssp_cfm_req->bd_addr;
935 memcpy(bd_name.name, p_ssp_cfm_req->bd_name, BD_NAME_LEN);
936
937 if (pairing_cb.state == BT_BOND_STATE_BONDING &&
938 bd_addr != pairing_cb.bd_addr) {
939 BTIF_TRACE_WARNING("%s(): already in bonding state, reject request",
940 __FUNCTION__);
941 btif_dm_ssp_reply(&bd_addr, BT_SSP_VARIANT_PASSKEY_CONFIRMATION, 0, 0);
942 return;
943 }
944
945 /* Set the pairing_cb based on the local & remote authentication requirements
946 */
947 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
948
949 BTIF_TRACE_EVENT("%s: just_works:%d, loc_auth_req=%d, rmt_auth_req=%d",
950 __func__, p_ssp_cfm_req->just_works,
951 p_ssp_cfm_req->loc_auth_req, p_ssp_cfm_req->rmt_auth_req);
952
953 /* if just_works and bonding bit is not set treat this as temporary */
954 if (p_ssp_cfm_req->just_works &&
955 !(p_ssp_cfm_req->loc_auth_req & BTM_AUTH_BONDS) &&
956 !(p_ssp_cfm_req->rmt_auth_req & BTM_AUTH_BONDS) &&
957 !(check_cod((RawAddress*)&p_ssp_cfm_req->bd_addr, COD_HID_POINTING)))
958 pairing_cb.bond_type = BOND_TYPE_TEMPORARY;
959 else
960 pairing_cb.bond_type = BOND_TYPE_PERSISTENT;
961
962 btm_set_bond_type_dev(p_ssp_cfm_req->bd_addr, pairing_cb.bond_type);
963
964 pairing_cb.is_ssp = true;
965
966 /* If JustWorks auto-accept */
967 if (p_ssp_cfm_req->just_works) {
968 /* Pairing consent for JustWorks NOT needed if:
969 * 1. Incoming temporary pairing is detected
970 */
971 if (is_incoming && pairing_cb.bond_type == BOND_TYPE_TEMPORARY) {
972 BTIF_TRACE_EVENT(
973 "%s: Auto-accept JustWorks pairing for temporary incoming", __func__);
974 btif_dm_ssp_reply(&bd_addr, BT_SSP_VARIANT_CONSENT, true, 0);
975 return;
976 }
977 }
978
979 cod = devclass2uint(p_ssp_cfm_req->dev_class);
980
981 if (cod == 0) {
982 LOG_DEBUG(LOG_TAG, "%s cod is 0, set as unclassified", __func__);
983 cod = COD_UNCLASSIFIED;
984 }
985
986 pairing_cb.sdp_attempts = 0;
987 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
988 (p_ssp_cfm_req->just_works ? BT_SSP_VARIANT_CONSENT
989 : BT_SSP_VARIANT_PASSKEY_CONFIRMATION),
990 p_ssp_cfm_req->num_val);
991 }
992
btif_dm_ssp_key_notif_evt(tBTA_DM_SP_KEY_NOTIF * p_ssp_key_notif)993 static void btif_dm_ssp_key_notif_evt(tBTA_DM_SP_KEY_NOTIF* p_ssp_key_notif) {
994 bt_bdname_t bd_name;
995 uint32_t cod;
996 int dev_type;
997
998 BTIF_TRACE_DEBUG("%s", __func__);
999
1000 /* Remote properties update */
1001 if (!btif_get_device_type(p_ssp_key_notif->bd_addr, &dev_type)) {
1002 dev_type = BT_DEVICE_TYPE_BREDR;
1003 }
1004 btif_update_remote_properties(
1005 p_ssp_key_notif->bd_addr, p_ssp_key_notif->bd_name,
1006 p_ssp_key_notif->dev_class, (tBT_DEVICE_TYPE)dev_type);
1007
1008 RawAddress bd_addr = p_ssp_key_notif->bd_addr;
1009 memcpy(bd_name.name, p_ssp_key_notif->bd_name, BD_NAME_LEN);
1010
1011 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
1012 pairing_cb.is_ssp = true;
1013 cod = devclass2uint(p_ssp_key_notif->dev_class);
1014
1015 if (cod == 0) {
1016 LOG_DEBUG(LOG_TAG, "%s cod is 0, set as unclassified", __func__);
1017 cod = COD_UNCLASSIFIED;
1018 }
1019
1020 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
1021 BT_SSP_VARIANT_PASSKEY_NOTIFICATION, p_ssp_key_notif->passkey);
1022 }
1023 /*******************************************************************************
1024 *
1025 * Function btif_dm_auth_cmpl_evt
1026 *
1027 * Description Executes authentication complete event in btif context
1028 *
1029 * Returns void
1030 *
1031 ******************************************************************************/
btif_dm_auth_cmpl_evt(tBTA_DM_AUTH_CMPL * p_auth_cmpl)1032 static void btif_dm_auth_cmpl_evt(tBTA_DM_AUTH_CMPL* p_auth_cmpl) {
1033 /* Save link key, if not temporary */
1034 bt_status_t status = BT_STATUS_FAIL;
1035 bt_bond_state_t state = BT_BOND_STATE_NONE;
1036 bool skip_sdp = false;
1037
1038 BTIF_TRACE_DEBUG("%s: bond state=%d, success=%d, key_present=%d", __func__,
1039 pairing_cb.state, p_auth_cmpl->success,
1040 p_auth_cmpl->key_present);
1041
1042 RawAddress bd_addr = p_auth_cmpl->bd_addr;
1043 if ((p_auth_cmpl->success) && (p_auth_cmpl->key_present)) {
1044 if ((p_auth_cmpl->key_type < HCI_LKEY_TYPE_DEBUG_COMB) ||
1045 (p_auth_cmpl->key_type == HCI_LKEY_TYPE_AUTH_COMB) ||
1046 (p_auth_cmpl->key_type == HCI_LKEY_TYPE_CHANGED_COMB) ||
1047 (p_auth_cmpl->key_type == HCI_LKEY_TYPE_AUTH_COMB_P_256) ||
1048 pairing_cb.bond_type == BOND_TYPE_PERSISTENT) {
1049 bt_status_t ret;
1050 BTIF_TRACE_DEBUG("%s: Storing link key. key_type=0x%x, bond_type=%d",
1051 __func__, p_auth_cmpl->key_type, pairing_cb.bond_type);
1052 ret = btif_storage_add_bonded_device(&bd_addr, p_auth_cmpl->key,
1053 p_auth_cmpl->key_type,
1054 pairing_cb.pin_code_len);
1055 ASSERTC(ret == BT_STATUS_SUCCESS, "storing link key failed", ret);
1056 } else {
1057 BTIF_TRACE_DEBUG(
1058 "%s: Temporary key. Not storing. key_type=0x%x, bond_type=%d",
1059 __func__, p_auth_cmpl->key_type, pairing_cb.bond_type);
1060 if (pairing_cb.bond_type == BOND_TYPE_TEMPORARY) {
1061 BTIF_TRACE_DEBUG("%s: sending BT_BOND_STATE_NONE for Temp pairing",
1062 __func__);
1063 btif_storage_remove_bonded_device(&bd_addr);
1064 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_NONE);
1065 return;
1066 }
1067 }
1068 }
1069
1070 if (p_auth_cmpl->success) {
1071 // We could have received a new link key without going through the pairing
1072 // flow. If so, we don't want to perform SDP or any other operations on the
1073 // authenticated device. Also, make sure that the link key is not derived
1074 // from secure LTK, because we will need to perform SDP in case of link key
1075 // derivation to allow bond state change notification for the BR/EDR
1076 // transport so that the subsequent BR/EDR connections to the remote can use
1077 // the derived link key.
1078 if (p_auth_cmpl->bd_addr != pairing_cb.bd_addr &&
1079 (!pairing_cb.ble.is_penc_key_rcvd)) {
1080 LOG(INFO) << __func__
1081 << " skipping SDP since we did not initiate pairing to "
1082 << p_auth_cmpl->bd_addr;
1083 return;
1084 }
1085
1086 btif_storage_set_remote_addr_type(&bd_addr, p_auth_cmpl->addr_type);
1087 btif_update_remote_properties(p_auth_cmpl->bd_addr, p_auth_cmpl->bd_name,
1088 NULL, p_auth_cmpl->dev_type);
1089 pairing_cb.timeout_retries = 0;
1090 status = BT_STATUS_SUCCESS;
1091 state = BT_BOND_STATE_BONDED;
1092 bd_addr = p_auth_cmpl->bd_addr;
1093
1094 if (check_sdp_bl(&bd_addr) && check_cod_hid(&bd_addr)) {
1095 LOG_WARN(LOG_TAG, "%s:skip SDP", __func__);
1096 skip_sdp = true;
1097 }
1098 if (!pairing_cb.is_local_initiated && skip_sdp) {
1099 bond_state_changed(status, bd_addr, state);
1100
1101 LOG_WARN(LOG_TAG, "%s: Incoming HID Connection", __func__);
1102 bt_property_t prop;
1103 RawAddress bd_addr;
1104 Uuid uuid = Uuid::From16Bit(UUID_SERVCLASS_HUMAN_INTERFACE);
1105
1106 prop.type = BT_PROPERTY_UUIDS;
1107 prop.val = &uuid;
1108 prop.len = Uuid::kNumBytes128;
1109
1110 /* Send the event to the BTIF */
1111 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1112 &bd_addr, 1, &prop);
1113 } else {
1114 bool is_crosskey = false;
1115 /* If bonded due to cross-key, save the static address too*/
1116 if (pairing_cb.state == BT_BOND_STATE_BONDING &&
1117 p_auth_cmpl->bd_addr != pairing_cb.bd_addr) {
1118 BTIF_TRACE_DEBUG(
1119 "%s: bonding initiated due to cross key, adding static address",
1120 __func__);
1121 pairing_cb.static_bdaddr = bd_addr;
1122 is_crosskey = true;
1123 }
1124 if (!is_crosskey ||
1125 !(stack_config_get_interface()->get_pts_crosskey_sdp_disable())) {
1126 // Ensure inquiry is stopped before attempting service discovery
1127 btif_dm_cancel_discovery();
1128
1129 /* Trigger SDP on the device */
1130 pairing_cb.sdp_attempts = 1;
1131
1132 if (is_crosskey) {
1133 // If bonding occurred due to cross-key pairing, send bonding callback
1134 // for static address now
1135 LOG_INFO(LOG_TAG,
1136 "%s: send bonding state update for static address %s",
1137 __func__, bd_addr.ToString().c_str());
1138 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
1139 }
1140 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDED);
1141
1142 btif_dm_get_remote_services(bd_addr);
1143 }
1144 }
1145 // Do not call bond_state_changed_cb yet. Wait until remote service
1146 // discovery is complete
1147 } else {
1148 // Map the HCI fail reason to bt status
1149 switch (p_auth_cmpl->fail_reason) {
1150 case HCI_ERR_PAGE_TIMEOUT:
1151 case HCI_ERR_LMP_RESPONSE_TIMEOUT:
1152 if (interop_match_addr(INTEROP_AUTO_RETRY_PAIRING, &bd_addr) &&
1153 pairing_cb.timeout_retries) {
1154 BTIF_TRACE_WARNING("%s() - Pairing timeout; retrying (%d) ...",
1155 __func__, pairing_cb.timeout_retries);
1156 --pairing_cb.timeout_retries;
1157 btif_dm_cb_create_bond(bd_addr, BTA_TRANSPORT_UNKNOWN);
1158 return;
1159 }
1160 /* Fall-through */
1161 case HCI_ERR_CONNECTION_TOUT:
1162 status = BT_STATUS_RMT_DEV_DOWN;
1163 break;
1164
1165 case HCI_ERR_PAIRING_NOT_ALLOWED:
1166 btif_storage_remove_bonded_device(&bd_addr);
1167 status = BT_STATUS_AUTH_REJECTED;
1168 break;
1169
1170 /* map the auth failure codes, so we can retry pairing if necessary */
1171 case HCI_ERR_AUTH_FAILURE:
1172 case HCI_ERR_KEY_MISSING:
1173 btif_storage_remove_bonded_device(&bd_addr);
1174 case HCI_ERR_HOST_REJECT_SECURITY:
1175 case HCI_ERR_ENCRY_MODE_NOT_ACCEPTABLE:
1176 case HCI_ERR_UNIT_KEY_USED:
1177 case HCI_ERR_PAIRING_WITH_UNIT_KEY_NOT_SUPPORTED:
1178 case HCI_ERR_INSUFFCIENT_SECURITY:
1179 case HCI_ERR_PEER_USER:
1180 case HCI_ERR_UNSPECIFIED:
1181 BTIF_TRACE_DEBUG(" %s() Authentication fail reason %d", __func__,
1182 p_auth_cmpl->fail_reason);
1183 if (pairing_cb.autopair_attempts == 1) {
1184 /* Create the Bond once again */
1185 BTIF_TRACE_WARNING("%s() auto pair failed. Reinitiate Bond",
1186 __func__);
1187 btif_dm_cb_create_bond(bd_addr, BTA_TRANSPORT_UNKNOWN);
1188 return;
1189 } else {
1190 /* if autopair attempts are more than 1, or not attempted */
1191 status = BT_STATUS_AUTH_FAILURE;
1192 }
1193 break;
1194
1195 default:
1196 status = BT_STATUS_FAIL;
1197 }
1198 /* Special Handling for HID Devices */
1199 if (check_cod(&bd_addr, COD_HID_POINTING)) {
1200 /* Remove Device as bonded in nvram as authentication failed */
1201 BTIF_TRACE_DEBUG("%s(): removing hid pointing device from nvram",
1202 __func__);
1203 btif_storage_remove_bonded_device(&bd_addr);
1204 }
1205 bond_state_changed(status, bd_addr, state);
1206 }
1207 }
1208
1209 /******************************************************************************
1210 *
1211 * Function btif_dm_search_devices_evt
1212 *
1213 * Description Executes search devices callback events in btif context
1214 *
1215 * Returns void
1216 *
1217 *****************************************************************************/
btif_dm_search_devices_evt(uint16_t event,char * p_param)1218 static void btif_dm_search_devices_evt(uint16_t event, char* p_param) {
1219 tBTA_DM_SEARCH* p_search_data;
1220 BTIF_TRACE_EVENT("%s event=%s", __func__, dump_dm_search_event(event));
1221
1222 switch (event) {
1223 case BTA_DM_DISC_RES_EVT: {
1224 p_search_data = (tBTA_DM_SEARCH*)p_param;
1225 /* Remote name update */
1226 if (strlen((const char*)p_search_data->disc_res.bd_name)) {
1227 bt_property_t properties[1];
1228 bt_status_t status;
1229
1230 properties[0].type = BT_PROPERTY_BDNAME;
1231 properties[0].val = p_search_data->disc_res.bd_name;
1232 properties[0].len = strlen((char*)p_search_data->disc_res.bd_name);
1233 RawAddress& bdaddr = p_search_data->disc_res.bd_addr;
1234
1235 status =
1236 btif_storage_set_remote_device_property(&bdaddr, &properties[0]);
1237 ASSERTC(status == BT_STATUS_SUCCESS,
1238 "failed to save remote device property", status);
1239 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, status, &bdaddr,
1240 1, properties);
1241 }
1242 /* TODO: Services? */
1243 } break;
1244
1245 case BTA_DM_INQ_RES_EVT: {
1246 /* inquiry result */
1247 bt_bdname_t bdname;
1248 uint8_t remote_name_len;
1249 tBTA_SERVICE_MASK services = 0;
1250
1251 p_search_data = (tBTA_DM_SEARCH*)p_param;
1252 RawAddress& bdaddr = p_search_data->inq_res.bd_addr;
1253
1254 BTIF_TRACE_DEBUG("%s() %s device_type = 0x%x\n", __func__,
1255 bdaddr.ToString().c_str(),
1256 p_search_data->inq_res.device_type);
1257 bdname.name[0] = 0;
1258
1259 if (!check_eir_remote_name(p_search_data, bdname.name, &remote_name_len))
1260 check_cached_remote_name(p_search_data, bdname.name, &remote_name_len);
1261
1262 /* Check EIR for remote name and services */
1263 if (p_search_data->inq_res.p_eir) {
1264 BTA_GetEirService(p_search_data->inq_res.p_eir,
1265 p_search_data->inq_res.eir_len, &services);
1266 BTIF_TRACE_DEBUG("%s()EIR BTA services = %08X", __func__,
1267 (uint32_t)services);
1268 /* TODO: Get the service list and check to see which uuids we got and
1269 * send it back to the client. */
1270 }
1271
1272 {
1273 bt_property_t properties[5];
1274 bt_device_type_t dev_type;
1275 uint32_t num_properties = 0;
1276 bt_status_t status;
1277 int addr_type = 0;
1278
1279 memset(properties, 0, sizeof(properties));
1280 /* RawAddress */
1281 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1282 BT_PROPERTY_BDADDR, sizeof(bdaddr), &bdaddr);
1283 num_properties++;
1284 /* BD_NAME */
1285 /* Don't send BDNAME if it is empty */
1286 if (bdname.name[0]) {
1287 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1288 BT_PROPERTY_BDNAME,
1289 strlen((char*)bdname.name), &bdname);
1290 num_properties++;
1291 }
1292
1293 /* DEV_CLASS */
1294 uint32_t cod = devclass2uint(p_search_data->inq_res.dev_class);
1295 BTIF_TRACE_DEBUG("%s cod is 0x%06x", __func__, cod);
1296 if (cod != 0) {
1297 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1298 BT_PROPERTY_CLASS_OF_DEVICE, sizeof(cod),
1299 &cod);
1300 num_properties++;
1301 }
1302
1303 /* DEV_TYPE */
1304 /* FixMe: Assumption is that bluetooth.h and BTE enums match */
1305
1306 /* Verify if the device is dual mode in NVRAM */
1307 int stored_device_type = 0;
1308 if (btif_get_device_type(bdaddr, &stored_device_type) &&
1309 ((stored_device_type != BT_DEVICE_TYPE_BREDR &&
1310 p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BREDR) ||
1311 (stored_device_type != BT_DEVICE_TYPE_BLE &&
1312 p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BLE))) {
1313 dev_type = (bt_device_type_t)BT_DEVICE_TYPE_DUMO;
1314 } else {
1315 dev_type = (bt_device_type_t)p_search_data->inq_res.device_type;
1316 }
1317
1318 if (p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BLE)
1319 addr_type = p_search_data->inq_res.ble_addr_type;
1320 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1321 BT_PROPERTY_TYPE_OF_DEVICE, sizeof(dev_type),
1322 &dev_type);
1323 num_properties++;
1324 /* RSSI */
1325 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1326 BT_PROPERTY_REMOTE_RSSI, sizeof(int8_t),
1327 &(p_search_data->inq_res.rssi));
1328 num_properties++;
1329
1330 status =
1331 btif_storage_add_remote_device(&bdaddr, num_properties, properties);
1332 ASSERTC(status == BT_STATUS_SUCCESS,
1333 "failed to save remote device (inquiry)", status);
1334 status = btif_storage_set_remote_addr_type(&bdaddr, addr_type);
1335 ASSERTC(status == BT_STATUS_SUCCESS,
1336 "failed to save remote addr type (inquiry)", status);
1337 /* Callback to notify upper layer of device */
1338 HAL_CBACK(bt_hal_cbacks, device_found_cb, num_properties, properties);
1339 }
1340 } break;
1341
1342 case BTA_DM_INQ_CMPL_EVT: {
1343 do_in_bta_thread(
1344 FROM_HERE,
1345 base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_DELETE, 0,
1346 nullptr, base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
1347 } break;
1348 case BTA_DM_DISC_CMPL_EVT: {
1349 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1350 BT_DISCOVERY_STOPPED);
1351 } break;
1352 case BTA_DM_SEARCH_CANCEL_CMPL_EVT: {
1353 /* if inquiry is not in progress and we get a cancel event, then
1354 * it means we are done with inquiry, but remote_name fetches are in
1355 * progress
1356 *
1357 * if inquiry is in progress, then we don't want to act on this
1358 * cancel_cmpl_evt
1359 * but instead wait for the cancel_cmpl_evt via the Busy Level
1360 *
1361 */
1362 if (!btif_dm_inquiry_in_progress) {
1363 btgatt_filt_param_setup_t adv_filt_param;
1364 memset(&adv_filt_param, 0, sizeof(btgatt_filt_param_setup_t));
1365 do_in_bta_thread(
1366 FROM_HERE,
1367 base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_DELETE, 0,
1368 nullptr, base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
1369 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1370 BT_DISCOVERY_STOPPED);
1371 }
1372 } break;
1373 }
1374 }
1375
1376 /*******************************************************************************
1377 *
1378 * Function btif_dm_search_services_evt
1379 *
1380 * Description Executes search services event in btif context
1381 *
1382 * Returns void
1383 *
1384 ******************************************************************************/
btif_dm_search_services_evt(uint16_t event,char * p_param)1385 static void btif_dm_search_services_evt(uint16_t event, char* p_param) {
1386 tBTA_DM_SEARCH* p_data = (tBTA_DM_SEARCH*)p_param;
1387
1388 BTIF_TRACE_EVENT("%s: event = %d", __func__, event);
1389 switch (event) {
1390 case BTA_DM_DISC_RES_EVT: {
1391 bt_property_t prop;
1392 uint32_t i = 0;
1393 bt_status_t ret;
1394
1395 RawAddress& bd_addr = p_data->disc_res.bd_addr;
1396
1397 BTIF_TRACE_DEBUG("%s:(result=0x%x, services 0x%x)", __func__,
1398 p_data->disc_res.result, p_data->disc_res.services);
1399 if ((p_data->disc_res.result != BTA_SUCCESS) &&
1400 (pairing_cb.state == BT_BOND_STATE_BONDED) &&
1401 (pairing_cb.sdp_attempts < BTIF_DM_MAX_SDP_ATTEMPTS_AFTER_PAIRING)) {
1402 BTIF_TRACE_WARNING("%s:SDP failed after bonding re-attempting",
1403 __func__);
1404 pairing_cb.sdp_attempts++;
1405 btif_dm_get_remote_services(bd_addr);
1406 return;
1407 }
1408 prop.type = BT_PROPERTY_UUIDS;
1409 prop.len = 0;
1410 if ((p_data->disc_res.result == BTA_SUCCESS) &&
1411 (p_data->disc_res.num_uuids > 0)) {
1412 prop.val = p_data->disc_res.p_uuid_list;
1413 prop.len = p_data->disc_res.num_uuids * Uuid::kNumBytes128;
1414 for (i = 0; i < p_data->disc_res.num_uuids; i++) {
1415 std::string temp = ((p_data->disc_res.p_uuid_list + i))->ToString();
1416 LOG_INFO(LOG_TAG, "%s index:%d uuid:%s", __func__, i, temp.c_str());
1417 }
1418 }
1419
1420 /* onUuidChanged requires getBondedDevices to be populated.
1421 ** bond_state_changed needs to be sent prior to remote_device_property
1422 */
1423 if (pairing_cb.state == BT_BOND_STATE_BONDED && pairing_cb.sdp_attempts &&
1424 (p_data->disc_res.bd_addr == pairing_cb.bd_addr ||
1425 p_data->disc_res.bd_addr == pairing_cb.static_bdaddr)) {
1426 LOG_INFO(LOG_TAG, "%s: SDP search done for %s", __func__,
1427 bd_addr.ToString().c_str());
1428 pairing_cb.sdp_attempts = 0;
1429
1430 // Both SDP and bonding are done, clear pairing control block
1431 pairing_cb = {};
1432
1433 // Send one empty UUID to Java to unblock pairing intent when SDP failed
1434 // or no UUID is discovered
1435 if (p_data->disc_res.result != BTA_SUCCESS ||
1436 p_data->disc_res.num_uuids == 0) {
1437 LOG_INFO(LOG_TAG,
1438 "%s: SDP failed, send empty UUID to unblock bonding %s",
1439 __func__, bd_addr.ToString().c_str());
1440 bt_property_t prop;
1441 Uuid uuid = {};
1442
1443 prop.type = BT_PROPERTY_UUIDS;
1444 prop.val = &uuid;
1445 prop.len = Uuid::kNumBytes128;
1446
1447 /* Send the event to the BTIF */
1448 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb,
1449 BT_STATUS_SUCCESS, &bd_addr, 1, &prop);
1450 break;
1451 }
1452 }
1453
1454 if (p_data->disc_res.num_uuids != 0) {
1455 /* Also write this to the NVRAM */
1456 ret = btif_storage_set_remote_device_property(&bd_addr, &prop);
1457 ASSERTC(ret == BT_STATUS_SUCCESS, "storing remote services failed",
1458 ret);
1459 /* Send the event to the BTIF */
1460 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1461 &bd_addr, 1, &prop);
1462 }
1463 } break;
1464
1465 case BTA_DM_DISC_CMPL_EVT:
1466 /* fixme */
1467 break;
1468
1469 case BTA_DM_SEARCH_CANCEL_CMPL_EVT:
1470 /* no-op */
1471 break;
1472
1473 case BTA_DM_DISC_BLE_RES_EVT: {
1474 BTIF_TRACE_DEBUG("%s: service %s", __func__,
1475 p_data->disc_ble_res.service.ToString().c_str());
1476 int num_properties = 0;
1477 if (p_data->disc_ble_res.service.As16Bit() == UUID_SERVCLASS_LE_HID ||
1478 p_data->disc_ble_res.service == UUID_HEARING_AID) {
1479 BTIF_TRACE_DEBUG("%s: Found HOGP or HEARING AID UUID", __func__);
1480 bt_property_t prop[2];
1481 bt_status_t ret;
1482
1483 const auto& arr = p_data->disc_ble_res.service.To128BitBE();
1484
1485 RawAddress& bd_addr = p_data->disc_ble_res.bd_addr;
1486 prop[0].type = BT_PROPERTY_UUIDS;
1487 prop[0].val = (void*)arr.data();
1488 prop[0].len = Uuid::kNumBytes128;
1489
1490 /* Also write this to the NVRAM */
1491 ret = btif_storage_set_remote_device_property(&bd_addr, &prop[0]);
1492 ASSERTC(ret == BT_STATUS_SUCCESS, "storing remote services failed",
1493 ret);
1494 num_properties++;
1495
1496 /* Remote name update */
1497 if (strnlen((const char*)p_data->disc_ble_res.bd_name, BD_NAME_LEN)) {
1498 prop[1].type = BT_PROPERTY_BDNAME;
1499 prop[1].val = p_data->disc_ble_res.bd_name;
1500 prop[1].len =
1501 strnlen((char*)p_data->disc_ble_res.bd_name, BD_NAME_LEN);
1502
1503 ret = btif_storage_set_remote_device_property(&bd_addr, &prop[1]);
1504 ASSERTC(ret == BT_STATUS_SUCCESS,
1505 "failed to save remote device property", ret);
1506 num_properties++;
1507 }
1508
1509 /* Send the event to the BTIF */
1510 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1511 &bd_addr, num_properties, prop);
1512 }
1513 } break;
1514
1515 default: { ASSERTC(0, "unhandled search services event", event); } break;
1516 }
1517 }
1518
1519 /*******************************************************************************
1520 *
1521 * Function btif_dm_remote_service_record_evt
1522 *
1523 * Description Executes search service record event in btif context
1524 *
1525 * Returns void
1526 *
1527 ******************************************************************************/
btif_dm_remote_service_record_evt(uint16_t event,char * p_param)1528 static void btif_dm_remote_service_record_evt(uint16_t event, char* p_param) {
1529 tBTA_DM_SEARCH* p_data = (tBTA_DM_SEARCH*)p_param;
1530
1531 BTIF_TRACE_EVENT("%s: event = %d", __func__, event);
1532 switch (event) {
1533 case BTA_DM_DISC_RES_EVT: {
1534 bt_service_record_t rec;
1535 bt_property_t prop;
1536
1537 memset(&rec, 0, sizeof(bt_service_record_t));
1538 RawAddress& bd_addr = p_data->disc_res.bd_addr;
1539
1540 BTIF_TRACE_DEBUG("%s:(result=0x%x, services 0x%x)", __func__,
1541 p_data->disc_res.result, p_data->disc_res.services);
1542 prop.type = BT_PROPERTY_SERVICE_RECORD;
1543 prop.val = (void*)&rec;
1544 prop.len = sizeof(rec);
1545
1546 /* disc_res.result is overloaded with SCN. Cannot check result */
1547 p_data->disc_res.services &= ~BTA_USER_SERVICE_MASK;
1548 /* TODO: Get the UUID as well */
1549 rec.channel = p_data->disc_res.result - 3;
1550 /* TODO: Need to get the service name using p_raw_data */
1551 rec.name[0] = 0;
1552
1553 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1554 &bd_addr, 1, &prop);
1555 } break;
1556
1557 default: {
1558 ASSERTC(0, "unhandled remote service record event", event);
1559 } break;
1560 }
1561 }
1562
1563 /*******************************************************************************
1564 *
1565 * Function btif_dm_upstreams_cback
1566 *
1567 * Description Executes UPSTREAMS events in btif context
1568 *
1569 * Returns void
1570 *
1571 ******************************************************************************/
btif_dm_upstreams_evt(uint16_t event,char * p_param)1572 static void btif_dm_upstreams_evt(uint16_t event, char* p_param) {
1573 tBTA_DM_SEC* p_data = (tBTA_DM_SEC*)p_param;
1574 tBTA_SERVICE_MASK service_mask;
1575 uint32_t i;
1576 RawAddress bd_addr;
1577
1578 BTIF_TRACE_EVENT("%s: ev: %s", __func__, dump_dm_event(event));
1579
1580 switch (event) {
1581 case BTA_DM_ENABLE_EVT: {
1582 BD_NAME bdname;
1583 bt_status_t status;
1584 bt_property_t prop;
1585 prop.type = BT_PROPERTY_BDNAME;
1586 prop.len = BD_NAME_LEN;
1587 prop.val = (void*)bdname;
1588
1589 status = btif_storage_get_adapter_property(&prop);
1590 if (status == BT_STATUS_SUCCESS) {
1591 /* A name exists in the storage. Make this the device name */
1592 BTA_DmSetDeviceName((char*)prop.val);
1593 } else {
1594 /* Storage does not have a name yet.
1595 * Use the default name and write it to the chip
1596 */
1597 BTA_DmSetDeviceName(btif_get_default_local_name());
1598 }
1599
1600 /* Enable local privacy */
1601 BTA_DmBleConfigLocalPrivacy(BLE_LOCAL_PRIVACY_ENABLED);
1602
1603 /* for each of the enabled services in the mask, trigger the profile
1604 * enable */
1605 service_mask = btif_get_enabled_services_mask();
1606 for (i = 0; i <= BTA_MAX_SERVICE_ID; i++) {
1607 if (service_mask &
1608 (tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(i))) {
1609 btif_in_execute_service_request(i, true);
1610 }
1611 }
1612 /* clear control blocks */
1613 memset(&pairing_cb, 0, sizeof(btif_dm_pairing_cb_t));
1614 pairing_cb.bond_type = BOND_TYPE_PERSISTENT;
1615
1616 /* This function will also trigger the adapter_properties_cb
1617 ** and bonded_devices_info_cb
1618 */
1619 btif_storage_load_bonded_devices();
1620
1621 btif_enable_bluetooth_evt(p_data->enable.status);
1622 } break;
1623
1624 case BTA_DM_DISABLE_EVT:
1625 /* for each of the enabled services in the mask, trigger the profile
1626 * disable */
1627 service_mask = btif_get_enabled_services_mask();
1628 for (i = 0; i <= BTA_MAX_SERVICE_ID; i++) {
1629 if (service_mask &
1630 (tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(i))) {
1631 btif_in_execute_service_request(i, false);
1632 }
1633 }
1634 btif_disable_bluetooth_evt();
1635 break;
1636
1637 case BTA_DM_PIN_REQ_EVT:
1638 btif_dm_pin_req_evt(&p_data->pin_req);
1639 break;
1640
1641 case BTA_DM_AUTH_CMPL_EVT:
1642 btif_dm_auth_cmpl_evt(&p_data->auth_cmpl);
1643 break;
1644
1645 case BTA_DM_BOND_CANCEL_CMPL_EVT:
1646 if (is_bonding_or_sdp()) {
1647 bd_addr = pairing_cb.bd_addr;
1648 btm_set_bond_type_dev(pairing_cb.bd_addr, BOND_TYPE_UNKNOWN);
1649 bond_state_changed((bt_status_t)p_data->bond_cancel_cmpl.result,
1650 bd_addr, BT_BOND_STATE_NONE);
1651 }
1652 break;
1653
1654 case BTA_DM_SP_CFM_REQ_EVT:
1655 btif_dm_ssp_cfm_req_evt(&p_data->cfm_req);
1656 break;
1657 case BTA_DM_SP_KEY_NOTIF_EVT:
1658 btif_dm_ssp_key_notif_evt(&p_data->key_notif);
1659 break;
1660
1661 case BTA_DM_DEV_UNPAIRED_EVT:
1662 bd_addr = p_data->link_down.bd_addr;
1663 btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
1664
1665 /*special handling for HID devices */
1666 #if (defined(BTA_HH_INCLUDED) && (BTA_HH_INCLUDED == TRUE))
1667 btif_hh_remove_device(bd_addr);
1668 #endif
1669 #if (defined(BTA_HD_INCLUDED) && (BTA_HD_INCLUDED == TRUE))
1670 btif_hd_remove_device(bd_addr);
1671 #endif
1672 btif_hearing_aid_get_interface()->RemoveDevice(bd_addr);
1673 btif_storage_remove_bonded_device(&bd_addr);
1674 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_NONE);
1675 break;
1676
1677 case BTA_DM_BUSY_LEVEL_EVT: {
1678 if (p_data->busy_level.level_flags & BTM_BL_INQUIRY_PAGING_MASK) {
1679 if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_STARTED) {
1680 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1681 BT_DISCOVERY_STARTED);
1682 btif_dm_inquiry_in_progress = true;
1683 } else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_CANCELLED) {
1684 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1685 BT_DISCOVERY_STOPPED);
1686 btif_dm_inquiry_in_progress = false;
1687 } else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_COMPLETE) {
1688 btif_dm_inquiry_in_progress = false;
1689 }
1690 }
1691 } break;
1692
1693 case BTA_DM_LINK_UP_EVT:
1694 bd_addr = p_data->link_up.bd_addr;
1695 BTIF_TRACE_DEBUG("BTA_DM_LINK_UP_EVT. Sending BT_ACL_STATE_CONNECTED");
1696
1697 btif_update_remote_version_property(&bd_addr);
1698
1699 HAL_CBACK(bt_hal_cbacks, acl_state_changed_cb, BT_STATUS_SUCCESS,
1700 &bd_addr, BT_ACL_STATE_CONNECTED);
1701 break;
1702
1703 case BTA_DM_LINK_DOWN_EVT:
1704 bd_addr = p_data->link_down.bd_addr;
1705 btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
1706 btif_av_acl_disconnected(bd_addr);
1707 BTIF_TRACE_DEBUG(
1708 "BTA_DM_LINK_DOWN_EVT. Sending BT_ACL_STATE_DISCONNECTED");
1709 HAL_CBACK(bt_hal_cbacks, acl_state_changed_cb, BT_STATUS_SUCCESS,
1710 &bd_addr, BT_ACL_STATE_DISCONNECTED);
1711 break;
1712
1713 case BTA_DM_HW_ERROR_EVT:
1714 BTIF_TRACE_ERROR("Received H/W Error. ");
1715 /* Flush storage data */
1716 btif_config_flush();
1717 usleep(100000); /* 100milliseconds */
1718 /* Killing the process to force a restart as part of fault tolerance */
1719 kill(getpid(), SIGKILL);
1720 break;
1721
1722 case BTA_DM_BLE_KEY_EVT:
1723 BTIF_TRACE_DEBUG("BTA_DM_BLE_KEY_EVT key_type=0x%02x ",
1724 p_data->ble_key.key_type);
1725
1726 /* If this pairing is by-product of local initiated GATT client Read or
1727 Write,
1728 BTA would not have sent BTA_DM_BLE_SEC_REQ_EVT event and Bond state would
1729 not
1730 have setup properly. Setup pairing_cb and notify App about Bonding state
1731 now*/
1732 if (pairing_cb.state != BT_BOND_STATE_BONDING) {
1733 BTIF_TRACE_DEBUG(
1734 "Bond state not sent to App so far.Notify the app now");
1735 bond_state_changed(BT_STATUS_SUCCESS, p_data->ble_key.bd_addr,
1736 BT_BOND_STATE_BONDING);
1737 } else if (pairing_cb.bd_addr != p_data->ble_key.bd_addr) {
1738 BTIF_TRACE_ERROR("BD mismatch discard BLE key_type=%d ",
1739 p_data->ble_key.key_type);
1740 break;
1741 }
1742
1743 switch (p_data->ble_key.key_type) {
1744 case BTA_LE_KEY_PENC:
1745 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_PENC");
1746 pairing_cb.ble.is_penc_key_rcvd = true;
1747 pairing_cb.ble.penc_key = p_data->ble_key.p_key_value->penc_key;
1748 break;
1749
1750 case BTA_LE_KEY_PID:
1751 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_PID");
1752 pairing_cb.ble.is_pid_key_rcvd = true;
1753 pairing_cb.ble.pid_key = p_data->ble_key.p_key_value->pid_key;
1754 break;
1755
1756 case BTA_LE_KEY_PCSRK:
1757 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_PCSRK");
1758 pairing_cb.ble.is_pcsrk_key_rcvd = true;
1759 pairing_cb.ble.pcsrk_key = p_data->ble_key.p_key_value->pcsrk_key;
1760 break;
1761
1762 case BTA_LE_KEY_LENC:
1763 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_LENC");
1764 pairing_cb.ble.is_lenc_key_rcvd = true;
1765 pairing_cb.ble.lenc_key = p_data->ble_key.p_key_value->lenc_key;
1766 break;
1767
1768 case BTA_LE_KEY_LCSRK:
1769 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_LCSRK");
1770 pairing_cb.ble.is_lcsrk_key_rcvd = true;
1771 pairing_cb.ble.lcsrk_key = p_data->ble_key.p_key_value->lcsrk_key;
1772 break;
1773
1774 case BTA_LE_KEY_LID:
1775 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_LID");
1776 pairing_cb.ble.is_lidk_key_rcvd = true;
1777 break;
1778
1779 default:
1780 BTIF_TRACE_ERROR("unknown BLE key type (0x%02x)",
1781 p_data->ble_key.key_type);
1782 break;
1783 }
1784 break;
1785 case BTA_DM_BLE_SEC_REQ_EVT:
1786 BTIF_TRACE_DEBUG("BTA_DM_BLE_SEC_REQ_EVT. ");
1787 btif_dm_ble_sec_req_evt(&p_data->ble_req);
1788 break;
1789 case BTA_DM_BLE_PASSKEY_NOTIF_EVT:
1790 BTIF_TRACE_DEBUG("BTA_DM_BLE_PASSKEY_NOTIF_EVT. ");
1791 btif_dm_ble_key_notif_evt(&p_data->key_notif);
1792 break;
1793 case BTA_DM_BLE_PASSKEY_REQ_EVT:
1794 BTIF_TRACE_DEBUG("BTA_DM_BLE_PASSKEY_REQ_EVT. ");
1795 btif_dm_ble_passkey_req_evt(&p_data->pin_req);
1796 break;
1797 case BTA_DM_BLE_NC_REQ_EVT:
1798 BTIF_TRACE_DEBUG("BTA_DM_BLE_PASSKEY_REQ_EVT. ");
1799 btif_dm_ble_key_nc_req_evt(&p_data->key_notif);
1800 break;
1801 case BTA_DM_BLE_OOB_REQ_EVT:
1802 BTIF_TRACE_DEBUG("BTA_DM_BLE_OOB_REQ_EVT. ");
1803 btif_dm_ble_oob_req_evt(&p_data->rmt_oob);
1804 break;
1805 case BTA_DM_BLE_SC_OOB_REQ_EVT:
1806 BTIF_TRACE_DEBUG("BTA_DM_BLE_SC_OOB_REQ_EVT. ");
1807 btif_dm_ble_sc_oob_req_evt(&p_data->rmt_oob);
1808 break;
1809 case BTA_DM_BLE_LOCAL_IR_EVT:
1810 BTIF_TRACE_DEBUG("BTA_DM_BLE_LOCAL_IR_EVT. ");
1811 ble_local_key_cb.is_id_keys_rcvd = true;
1812 memcpy(&ble_local_key_cb.id_keys.irk[0], &p_data->ble_id_keys.irk[0],
1813 sizeof(BT_OCTET16));
1814 memcpy(&ble_local_key_cb.id_keys.ir[0], &p_data->ble_id_keys.ir[0],
1815 sizeof(BT_OCTET16));
1816 memcpy(&ble_local_key_cb.id_keys.dhk[0], &p_data->ble_id_keys.dhk[0],
1817 sizeof(BT_OCTET16));
1818 btif_storage_add_ble_local_key((char*)&ble_local_key_cb.id_keys.irk[0],
1819 BTIF_DM_LE_LOCAL_KEY_IRK, BT_OCTET16_LEN);
1820 btif_storage_add_ble_local_key((char*)&ble_local_key_cb.id_keys.ir[0],
1821 BTIF_DM_LE_LOCAL_KEY_IR, BT_OCTET16_LEN);
1822 btif_storage_add_ble_local_key((char*)&ble_local_key_cb.id_keys.dhk[0],
1823 BTIF_DM_LE_LOCAL_KEY_DHK, BT_OCTET16_LEN);
1824 break;
1825 case BTA_DM_BLE_LOCAL_ER_EVT:
1826 BTIF_TRACE_DEBUG("BTA_DM_BLE_LOCAL_ER_EVT. ");
1827 ble_local_key_cb.is_er_rcvd = true;
1828 memcpy(&ble_local_key_cb.er[0], &p_data->ble_er[0], sizeof(BT_OCTET16));
1829 btif_storage_add_ble_local_key((char*)&ble_local_key_cb.er[0],
1830 BTIF_DM_LE_LOCAL_KEY_ER, BT_OCTET16_LEN);
1831 break;
1832
1833 case BTA_DM_BLE_AUTH_CMPL_EVT:
1834 BTIF_TRACE_DEBUG("BTA_DM_BLE_AUTH_CMPL_EVT. ");
1835 btif_dm_ble_auth_cmpl_evt(&p_data->auth_cmpl);
1836 break;
1837
1838 case BTA_DM_LE_FEATURES_READ: {
1839 tBTM_BLE_VSC_CB cmn_vsc_cb;
1840 bt_local_le_features_t local_le_features;
1841 char buf[512];
1842 bt_property_t prop;
1843 prop.type = BT_PROPERTY_LOCAL_LE_FEATURES;
1844 prop.val = (void*)buf;
1845 prop.len = sizeof(buf);
1846
1847 /* LE features are not stored in storage. Should be retrived from stack */
1848 BTM_BleGetVendorCapabilities(&cmn_vsc_cb);
1849 local_le_features.local_privacy_enabled = BTM_BleLocalPrivacyEnabled();
1850
1851 prop.len = sizeof(bt_local_le_features_t);
1852 if (cmn_vsc_cb.filter_support == 1)
1853 local_le_features.max_adv_filter_supported = cmn_vsc_cb.max_filter;
1854 else
1855 local_le_features.max_adv_filter_supported = 0;
1856 local_le_features.max_adv_instance = cmn_vsc_cb.adv_inst_max;
1857 local_le_features.max_irk_list_size = cmn_vsc_cb.max_irk_list_sz;
1858 local_le_features.rpa_offload_supported = cmn_vsc_cb.rpa_offloading;
1859 local_le_features.activity_energy_info_supported =
1860 cmn_vsc_cb.energy_support;
1861 local_le_features.scan_result_storage_size =
1862 cmn_vsc_cb.tot_scan_results_strg;
1863 local_le_features.version_supported = cmn_vsc_cb.version_supported;
1864 local_le_features.total_trackable_advertisers =
1865 cmn_vsc_cb.total_trackable_advertisers;
1866
1867 local_le_features.extended_scan_support =
1868 cmn_vsc_cb.extended_scan_support > 0;
1869 local_le_features.debug_logging_supported =
1870 cmn_vsc_cb.debug_logging_supported > 0;
1871
1872 const controller_t* controller = controller_get_interface();
1873
1874 local_le_features.le_2m_phy_supported = controller->supports_ble_2m_phy();
1875 local_le_features.le_coded_phy_supported =
1876 controller->supports_ble_coded_phy();
1877 local_le_features.le_extended_advertising_supported =
1878 controller->supports_ble_extended_advertising();
1879 local_le_features.le_periodic_advertising_supported =
1880 controller->supports_ble_periodic_advertising();
1881 local_le_features.le_maximum_advertising_data_length =
1882 controller->get_ble_maxium_advertising_data_length();
1883
1884 memcpy(prop.val, &local_le_features, prop.len);
1885 HAL_CBACK(bt_hal_cbacks, adapter_properties_cb, BT_STATUS_SUCCESS, 1,
1886 &prop);
1887 break;
1888 }
1889
1890 case BTA_DM_ENER_INFO_READ: {
1891 btif_activity_energy_info_cb_t* p_ener_data =
1892 (btif_activity_energy_info_cb_t*)p_param;
1893 bt_activity_energy_info energy_info;
1894 energy_info.status = p_ener_data->status;
1895 energy_info.ctrl_state = p_ener_data->ctrl_state;
1896 energy_info.rx_time = p_ener_data->rx_time;
1897 energy_info.tx_time = p_ener_data->tx_time;
1898 energy_info.idle_time = p_ener_data->idle_time;
1899 energy_info.energy_used = p_ener_data->energy_used;
1900
1901 bt_uid_traffic_t* data = uid_set_read_and_clear(uid_set);
1902 HAL_CBACK(bt_hal_cbacks, energy_info_cb, &energy_info, data);
1903 osi_free(data);
1904 break;
1905 }
1906
1907 case BTA_DM_AUTHORIZE_EVT:
1908 case BTA_DM_SIG_STRENGTH_EVT:
1909 case BTA_DM_SP_RMT_OOB_EVT:
1910 case BTA_DM_SP_KEYPRESS_EVT:
1911 case BTA_DM_ROLE_CHG_EVT:
1912
1913 default:
1914 BTIF_TRACE_WARNING("%s: unhandled event (%d)", __func__, event);
1915 break;
1916 }
1917
1918 btif_dm_data_free(event, p_data);
1919 }
1920
1921 /*******************************************************************************
1922 *
1923 * Function btif_dm_generic_evt
1924 *
1925 * Description Executes non-BTA upstream events in BTIF context
1926 *
1927 * Returns void
1928 *
1929 ******************************************************************************/
btif_dm_generic_evt(uint16_t event,char * p_param)1930 static void btif_dm_generic_evt(uint16_t event, char* p_param) {
1931 BTIF_TRACE_EVENT("%s: event=%d", __func__, event);
1932 switch (event) {
1933 case BTIF_DM_CB_DISCOVERY_STARTED: {
1934 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1935 BT_DISCOVERY_STARTED);
1936 } break;
1937
1938 case BTIF_DM_CB_CREATE_BOND: {
1939 pairing_cb.timeout_retries = NUM_TIMEOUT_RETRIES;
1940 btif_dm_create_bond_cb_t* create_bond_cb =
1941 (btif_dm_create_bond_cb_t*)p_param;
1942 btif_dm_cb_create_bond(create_bond_cb->bdaddr, create_bond_cb->transport);
1943 } break;
1944
1945 case BTIF_DM_CB_REMOVE_BOND: {
1946 btif_dm_cb_remove_bond((RawAddress*)p_param);
1947 } break;
1948
1949 case BTIF_DM_CB_HID_REMOTE_NAME: {
1950 btif_dm_cb_hid_remote_name((tBTM_REMOTE_DEV_NAME*)p_param);
1951 } break;
1952
1953 case BTIF_DM_CB_BOND_STATE_BONDING: {
1954 bond_state_changed(BT_STATUS_SUCCESS, *((RawAddress*)p_param),
1955 BT_BOND_STATE_BONDING);
1956 } break;
1957 case BTIF_DM_CB_LE_TX_TEST:
1958 case BTIF_DM_CB_LE_RX_TEST: {
1959 uint8_t status;
1960 STREAM_TO_UINT8(status, p_param);
1961 HAL_CBACK(bt_hal_cbacks, le_test_mode_cb,
1962 (status == 0) ? BT_STATUS_SUCCESS : BT_STATUS_FAIL, 0);
1963 } break;
1964 case BTIF_DM_CB_LE_TEST_END: {
1965 uint8_t status;
1966 uint16_t count = 0;
1967 STREAM_TO_UINT8(status, p_param);
1968 if (status == 0) STREAM_TO_UINT16(count, p_param);
1969 HAL_CBACK(bt_hal_cbacks, le_test_mode_cb,
1970 (status == 0) ? BT_STATUS_SUCCESS : BT_STATUS_FAIL, count);
1971 } break;
1972 default: {
1973 BTIF_TRACE_WARNING("%s : Unknown event 0x%x", __func__, event);
1974 } break;
1975 }
1976 }
1977
1978 /*******************************************************************************
1979 *
1980 * Function bte_dm_evt
1981 *
1982 * Description Switches context from BTE to BTIF for all DM events
1983 *
1984 * Returns void
1985 *
1986 ******************************************************************************/
1987
bte_dm_evt(tBTA_DM_SEC_EVT event,tBTA_DM_SEC * p_data)1988 void bte_dm_evt(tBTA_DM_SEC_EVT event, tBTA_DM_SEC* p_data) {
1989 /* switch context to btif task context (copy full union size for convenience)
1990 */
1991 bt_status_t status = btif_transfer_context(
1992 btif_dm_upstreams_evt, (uint16_t)event, (char*)p_data,
1993 sizeof(tBTA_DM_SEC), btif_dm_data_copy);
1994
1995 /* catch any failed context transfers */
1996 ASSERTC(status == BT_STATUS_SUCCESS, "context transfer failed", status);
1997 }
1998
1999 /*******************************************************************************
2000 *
2001 * Function bte_search_devices_evt
2002 *
2003 * Description Switches context from BTE to BTIF for DM search events
2004 *
2005 * Returns void
2006 *
2007 ******************************************************************************/
bte_search_devices_evt(tBTA_DM_SEARCH_EVT event,tBTA_DM_SEARCH * p_data)2008 static void bte_search_devices_evt(tBTA_DM_SEARCH_EVT event,
2009 tBTA_DM_SEARCH* p_data) {
2010 uint16_t param_len = 0;
2011
2012 if (p_data) param_len += sizeof(tBTA_DM_SEARCH);
2013 /* Allocate buffer to hold the pointers (deep copy). The pointers will point
2014 * to the end of the tBTA_DM_SEARCH */
2015 switch (event) {
2016 case BTA_DM_INQ_RES_EVT: {
2017 if (p_data->inq_res.p_eir) param_len += p_data->inq_res.eir_len;
2018 } break;
2019
2020 case BTA_DM_DISC_RES_EVT: {
2021 if (p_data->disc_res.raw_data_size && p_data->disc_res.p_raw_data)
2022 param_len += p_data->disc_res.raw_data_size;
2023 } break;
2024 }
2025 BTIF_TRACE_DEBUG("%s event=%s param_len=%d", __func__,
2026 dump_dm_search_event(event), param_len);
2027
2028 /* if remote name is available in EIR, set teh flag so that stack doesnt
2029 * trigger RNR */
2030 if (event == BTA_DM_INQ_RES_EVT)
2031 p_data->inq_res.remt_name_not_required =
2032 check_eir_remote_name(p_data, NULL, NULL);
2033
2034 btif_transfer_context(
2035 btif_dm_search_devices_evt, (uint16_t)event, (char*)p_data, param_len,
2036 (param_len > sizeof(tBTA_DM_SEARCH)) ? search_devices_copy_cb : NULL);
2037 }
2038
2039 /*******************************************************************************
2040 *
2041 * Function bte_dm_search_services_evt
2042 *
2043 * Description Switches context from BTE to BTIF for DM search services
2044 * event
2045 *
2046 * Returns void
2047 *
2048 ******************************************************************************/
bte_dm_search_services_evt(tBTA_DM_SEARCH_EVT event,tBTA_DM_SEARCH * p_data)2049 static void bte_dm_search_services_evt(tBTA_DM_SEARCH_EVT event,
2050 tBTA_DM_SEARCH* p_data) {
2051 uint16_t param_len = 0;
2052 if (p_data) param_len += sizeof(tBTA_DM_SEARCH);
2053 switch (event) {
2054 case BTA_DM_DISC_RES_EVT: {
2055 if ((p_data->disc_res.result == BTA_SUCCESS) &&
2056 (p_data->disc_res.num_uuids > 0)) {
2057 param_len += (p_data->disc_res.num_uuids * Uuid::kNumBytes128);
2058 }
2059 } break;
2060 }
2061 /* TODO: The only other member that needs a deep copy is the p_raw_data. But
2062 * not sure
2063 * if raw_data is needed. */
2064 btif_transfer_context(
2065 btif_dm_search_services_evt, event, (char*)p_data, param_len,
2066 (param_len > sizeof(tBTA_DM_SEARCH)) ? search_services_copy_cb : NULL);
2067 }
2068
2069 /*******************************************************************************
2070 *
2071 * Function bte_dm_remote_service_record_evt
2072 *
2073 * Description Switches context from BTE to BTIF for DM search service
2074 * record event
2075 *
2076 * Returns void
2077 *
2078 ******************************************************************************/
bte_dm_remote_service_record_evt(tBTA_DM_SEARCH_EVT event,tBTA_DM_SEARCH * p_data)2079 static void bte_dm_remote_service_record_evt(tBTA_DM_SEARCH_EVT event,
2080 tBTA_DM_SEARCH* p_data) {
2081 /* TODO: The only member that needs a deep copy is the p_raw_data. But not
2082 * sure yet if this is needed. */
2083 btif_transfer_context(btif_dm_remote_service_record_evt, event, (char*)p_data,
2084 sizeof(tBTA_DM_SEARCH), NULL);
2085 }
2086
2087 /*******************************************************************************
2088 *
2089 * Function bta_energy_info_cb
2090 *
2091 * Description Switches context from BTE to BTIF for DM energy info event
2092 *
2093 * Returns void
2094 *
2095 ******************************************************************************/
bta_energy_info_cb(tBTA_DM_BLE_TX_TIME_MS tx_time,tBTA_DM_BLE_RX_TIME_MS rx_time,tBTA_DM_BLE_IDLE_TIME_MS idle_time,tBTA_DM_BLE_ENERGY_USED energy_used,tBTA_DM_CONTRL_STATE ctrl_state,tBTA_STATUS status)2096 static void bta_energy_info_cb(tBTA_DM_BLE_TX_TIME_MS tx_time,
2097 tBTA_DM_BLE_RX_TIME_MS rx_time,
2098 tBTA_DM_BLE_IDLE_TIME_MS idle_time,
2099 tBTA_DM_BLE_ENERGY_USED energy_used,
2100 tBTA_DM_CONTRL_STATE ctrl_state,
2101 tBTA_STATUS status) {
2102 BTIF_TRACE_DEBUG(
2103 "energy_info_cb-Status:%d,state=%d,tx_t=%ld, rx_t=%ld, "
2104 "idle_time=%ld,used=%ld",
2105 status, ctrl_state, tx_time, rx_time, idle_time, energy_used);
2106
2107 btif_activity_energy_info_cb_t btif_cb;
2108 btif_cb.status = status;
2109 btif_cb.ctrl_state = ctrl_state;
2110 btif_cb.tx_time = (uint64_t)tx_time;
2111 btif_cb.rx_time = (uint64_t)rx_time;
2112 btif_cb.idle_time = (uint64_t)idle_time;
2113 btif_cb.energy_used = (uint64_t)energy_used;
2114 btif_transfer_context(btif_dm_upstreams_evt, BTA_DM_ENER_INFO_READ,
2115 (char*)&btif_cb, sizeof(btif_activity_energy_info_cb_t),
2116 NULL);
2117 }
2118
2119 /* Scan filter param config event */
bte_scan_filt_param_cfg_evt(uint8_t ref_value,uint8_t avbl_space,uint8_t action_type,uint8_t status)2120 static void bte_scan_filt_param_cfg_evt(uint8_t ref_value, uint8_t avbl_space,
2121 uint8_t action_type, uint8_t status) {
2122 /* This event occurs on calling BTA_DmBleCfgFilterCondition internally,
2123 ** and that is why there is no HAL callback
2124 */
2125 if (BTA_SUCCESS != status) {
2126 BTIF_TRACE_ERROR("%s, %d", __func__, status);
2127 } else {
2128 BTIF_TRACE_DEBUG("%s", __func__);
2129 }
2130 }
2131
2132 /*****************************************************************************
2133 *
2134 * btif api functions (no context switch)
2135 *
2136 ****************************************************************************/
2137
2138 /*******************************************************************************
2139 *
2140 * Function btif_dm_start_discovery
2141 *
2142 * Description Start device discovery/inquiry
2143 *
2144 * Returns bt_status_t
2145 *
2146 ******************************************************************************/
btif_dm_start_discovery(void)2147 bt_status_t btif_dm_start_discovery(void) {
2148 tBTA_DM_INQ inq_params;
2149 tBTA_SERVICE_MASK services = 0;
2150
2151 BTIF_TRACE_EVENT("%s", __func__);
2152
2153 /* Cleanup anything remaining on index 0 */
2154 do_in_bta_thread(
2155 FROM_HERE,
2156 base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_DELETE, 0,
2157 nullptr, base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
2158
2159 auto adv_filt_param = std::make_unique<btgatt_filt_param_setup_t>();
2160 /* Add an allow-all filter on index 0*/
2161 adv_filt_param->dely_mode = IMMEDIATE_DELY_MODE;
2162 adv_filt_param->feat_seln = ALLOW_ALL_FILTER;
2163 adv_filt_param->filt_logic_type = BTA_DM_BLE_PF_FILT_LOGIC_OR;
2164 adv_filt_param->list_logic_type = BTA_DM_BLE_PF_LIST_LOGIC_OR;
2165 adv_filt_param->rssi_low_thres = LOWEST_RSSI_VALUE;
2166 adv_filt_param->rssi_high_thres = LOWEST_RSSI_VALUE;
2167 do_in_bta_thread(
2168 FROM_HERE, base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_ADD,
2169 0, base::Passed(&adv_filt_param),
2170 base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
2171
2172 /* TODO: Do we need to handle multiple inquiries at the same time? */
2173
2174 /* Set inquiry params and call API */
2175 inq_params.mode = BTA_DM_GENERAL_INQUIRY | BTA_BLE_GENERAL_INQUIRY;
2176 inq_params.duration = BTIF_DM_DEFAULT_INQ_MAX_DURATION;
2177
2178 inq_params.max_resps = BTIF_DM_DEFAULT_INQ_MAX_RESULTS;
2179 inq_params.report_dup = true;
2180
2181 inq_params.filter_type = BTA_DM_INQ_CLR;
2182 /* TODO: Filter device by BDA needs to be implemented here */
2183
2184 /* Will be enabled to true once inquiry busy level has been received */
2185 btif_dm_inquiry_in_progress = false;
2186 /* find nearby devices */
2187 BTA_DmSearch(&inq_params, services, bte_search_devices_evt);
2188
2189 return BT_STATUS_SUCCESS;
2190 }
2191
2192 /*******************************************************************************
2193 *
2194 * Function btif_dm_cancel_discovery
2195 *
2196 * Description Cancels search
2197 *
2198 * Returns bt_status_t
2199 *
2200 ******************************************************************************/
btif_dm_cancel_discovery(void)2201 bt_status_t btif_dm_cancel_discovery(void) {
2202 BTIF_TRACE_EVENT("%s", __func__);
2203 BTA_DmSearchCancel();
2204 return BT_STATUS_SUCCESS;
2205 }
2206
2207 /*******************************************************************************
2208 *
2209 * Function btif_dm_create_bond
2210 *
2211 * Description Initiate bonding with the specified device
2212 *
2213 * Returns bt_status_t
2214 *
2215 ******************************************************************************/
btif_dm_create_bond(const RawAddress * bd_addr,int transport)2216 bt_status_t btif_dm_create_bond(const RawAddress* bd_addr, int transport) {
2217 btif_dm_create_bond_cb_t create_bond_cb;
2218 create_bond_cb.transport = transport;
2219 create_bond_cb.bdaddr = *bd_addr;
2220
2221 BTIF_TRACE_EVENT("%s: bd_addr=%s, transport=%d", __func__,
2222 bd_addr->ToString().c_str(), transport);
2223 if (pairing_cb.state != BT_BOND_STATE_NONE) return BT_STATUS_BUSY;
2224
2225 btif_stats_add_bond_event(*bd_addr, BTIF_DM_FUNC_CREATE_BOND,
2226 pairing_cb.state);
2227
2228 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_CREATE_BOND,
2229 (char*)&create_bond_cb,
2230 sizeof(btif_dm_create_bond_cb_t), NULL);
2231
2232 return BT_STATUS_SUCCESS;
2233 }
2234
2235 /*******************************************************************************
2236 *
2237 * Function btif_dm_create_bond_out_of_band
2238 *
2239 * Description Initiate bonding with the specified device using out of band
2240 * data
2241 *
2242 * Returns bt_status_t
2243 *
2244 ******************************************************************************/
btif_dm_create_bond_out_of_band(const RawAddress * bd_addr,int transport,const bt_out_of_band_data_t * oob_data)2245 bt_status_t btif_dm_create_bond_out_of_band(
2246 const RawAddress* bd_addr, int transport,
2247 const bt_out_of_band_data_t* oob_data) {
2248 oob_cb.bdaddr = *bd_addr;
2249 memcpy(&oob_cb.oob_data, oob_data, sizeof(bt_out_of_band_data_t));
2250
2251 uint8_t empty[] = {0, 0, 0, 0, 0, 0, 0};
2252 // If LE Bluetooth Device Address is provided, use provided address type
2253 // value.
2254 if (memcmp(oob_data->le_bt_dev_addr, empty, 7) != 0) {
2255 /* byte no 7 is address type in LE Bluetooth Address OOB data */
2256 uint8_t address_type = oob_data->le_bt_dev_addr[6];
2257 if (address_type == BLE_ADDR_PUBLIC || address_type == BLE_ADDR_RANDOM) {
2258 // bd_addr->address is already reversed, so use it instead of
2259 // oob_data->le_bt_dev_addr
2260 BTM_SecAddBleDevice(*bd_addr, NULL, BT_DEVICE_TYPE_BLE, address_type);
2261 }
2262 }
2263
2264 BTIF_TRACE_EVENT("%s: bd_addr=%s, transport=%d", __func__,
2265 bd_addr->ToString().c_str(), transport);
2266 return btif_dm_create_bond(bd_addr, transport);
2267 }
2268
2269 /*******************************************************************************
2270 *
2271 * Function btif_dm_cancel_bond
2272 *
2273 * Description Initiate bonding with the specified device
2274 *
2275 * Returns bt_status_t
2276 *
2277 ******************************************************************************/
2278
btif_dm_cancel_bond(const RawAddress * bd_addr)2279 bt_status_t btif_dm_cancel_bond(const RawAddress* bd_addr) {
2280 BTIF_TRACE_EVENT("%s: bd_addr=%s", __func__, bd_addr->ToString().c_str());
2281
2282 btif_stats_add_bond_event(*bd_addr, BTIF_DM_FUNC_CANCEL_BOND,
2283 pairing_cb.state);
2284
2285 /* TODO:
2286 ** 1. Restore scan modes
2287 ** 2. special handling for HID devices
2288 */
2289 if (is_bonding_or_sdp()) {
2290 if (pairing_cb.is_ssp) {
2291 if (pairing_cb.is_le_only) {
2292 BTA_DmBleSecurityGrant(*bd_addr, BTA_DM_SEC_PAIR_NOT_SPT);
2293 } else {
2294 BTA_DmConfirm(*bd_addr, false);
2295 BTA_DmBondCancel(*bd_addr);
2296 btif_storage_remove_bonded_device(bd_addr);
2297 }
2298 } else {
2299 if (pairing_cb.is_le_only) {
2300 BTA_DmBondCancel(*bd_addr);
2301 } else {
2302 BTA_DmPinReply(*bd_addr, false, 0, NULL);
2303 }
2304 /* Cancel bonding, in case it is in ACL connection setup state */
2305 BTA_DmBondCancel(*bd_addr);
2306 }
2307 }
2308
2309 return BT_STATUS_SUCCESS;
2310 }
2311
2312 /*******************************************************************************
2313 *
2314 * Function btif_dm_hh_open_failed
2315 *
2316 * Description informs the upper layers if the HH have failed during
2317 * bonding
2318 *
2319 * Returns none
2320 *
2321 ******************************************************************************/
2322
btif_dm_hh_open_failed(RawAddress * bdaddr)2323 void btif_dm_hh_open_failed(RawAddress* bdaddr) {
2324 if (pairing_cb.state == BT_BOND_STATE_BONDING &&
2325 *bdaddr == pairing_cb.bd_addr) {
2326 bond_state_changed(BT_STATUS_FAIL, *bdaddr, BT_BOND_STATE_NONE);
2327 }
2328 }
2329
2330 /*******************************************************************************
2331 *
2332 * Function btif_dm_remove_bond
2333 *
2334 * Description Removes bonding with the specified device
2335 *
2336 * Returns bt_status_t
2337 *
2338 ******************************************************************************/
2339
btif_dm_remove_bond(const RawAddress * bd_addr)2340 bt_status_t btif_dm_remove_bond(const RawAddress* bd_addr) {
2341 BTIF_TRACE_EVENT("%s: bd_addr=%s", __func__, bd_addr->ToString().c_str());
2342
2343 btif_stats_add_bond_event(*bd_addr, BTIF_DM_FUNC_REMOVE_BOND,
2344 pairing_cb.state);
2345
2346 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_REMOVE_BOND,
2347 (char*)bd_addr, sizeof(RawAddress), NULL);
2348
2349 return BT_STATUS_SUCCESS;
2350 }
2351
2352 /*******************************************************************************
2353 *
2354 * Function btif_dm_pin_reply
2355 *
2356 * Description BT legacy pairing - PIN code reply
2357 *
2358 * Returns bt_status_t
2359 *
2360 ******************************************************************************/
2361
btif_dm_pin_reply(const RawAddress * bd_addr,uint8_t accept,uint8_t pin_len,bt_pin_code_t * pin_code)2362 bt_status_t btif_dm_pin_reply(const RawAddress* bd_addr, uint8_t accept,
2363 uint8_t pin_len, bt_pin_code_t* pin_code) {
2364 BTIF_TRACE_EVENT("%s: accept=%d", __func__, accept);
2365 if (pin_code == NULL || pin_len > PIN_CODE_LEN) return BT_STATUS_FAIL;
2366 if (pairing_cb.is_le_only) {
2367 int i;
2368 uint32_t passkey = 0;
2369 int multi[] = {100000, 10000, 1000, 100, 10, 1};
2370 for (i = 0; i < 6; i++) {
2371 passkey += (multi[i] * (pin_code->pin[i] - '0'));
2372 }
2373 BTIF_TRACE_DEBUG("btif_dm_pin_reply: passkey: %d", passkey);
2374 BTA_DmBlePasskeyReply(*bd_addr, accept, passkey);
2375
2376 } else {
2377 BTA_DmPinReply(*bd_addr, accept, pin_len, pin_code->pin);
2378 if (accept) pairing_cb.pin_code_len = pin_len;
2379 }
2380 return BT_STATUS_SUCCESS;
2381 }
2382
2383 /*******************************************************************************
2384 *
2385 * Function btif_dm_ssp_reply
2386 *
2387 * Description BT SSP Reply - Just Works, Numeric Comparison & Passkey
2388 * Entry
2389 *
2390 * Returns bt_status_t
2391 *
2392 ******************************************************************************/
btif_dm_ssp_reply(const RawAddress * bd_addr,bt_ssp_variant_t variant,uint8_t accept,UNUSED_ATTR uint32_t passkey)2393 bt_status_t btif_dm_ssp_reply(const RawAddress* bd_addr,
2394 bt_ssp_variant_t variant, uint8_t accept,
2395 UNUSED_ATTR uint32_t passkey) {
2396 if (variant == BT_SSP_VARIANT_PASSKEY_ENTRY) {
2397 /* This is not implemented in the stack.
2398 * For devices with display, this is not needed
2399 */
2400 BTIF_TRACE_WARNING("%s: Not implemented", __func__);
2401 return BT_STATUS_FAIL;
2402 }
2403 /* BT_SSP_VARIANT_CONSENT & BT_SSP_VARIANT_PASSKEY_CONFIRMATION supported */
2404 BTIF_TRACE_EVENT("%s: accept=%d", __func__, accept);
2405 if (pairing_cb.is_le_only) {
2406 if (pairing_cb.is_le_nc) {
2407 BTA_DmBleConfirmReply(*bd_addr, accept);
2408 } else {
2409 if (accept)
2410 BTA_DmBleSecurityGrant(*bd_addr, BTA_DM_SEC_GRANTED);
2411 else
2412 BTA_DmBleSecurityGrant(*bd_addr, BTA_DM_SEC_PAIR_NOT_SPT);
2413 }
2414 } else {
2415 BTA_DmConfirm(*bd_addr, accept);
2416 }
2417 return BT_STATUS_SUCCESS;
2418 }
2419
2420 /*******************************************************************************
2421 *
2422 * Function btif_dm_get_adapter_property
2423 *
2424 * Description Queries the BTA for the adapter property
2425 *
2426 * Returns bt_status_t
2427 *
2428 ******************************************************************************/
btif_dm_get_adapter_property(bt_property_t * prop)2429 bt_status_t btif_dm_get_adapter_property(bt_property_t* prop) {
2430 BTIF_TRACE_EVENT("%s: type=0x%x", __func__, prop->type);
2431 switch (prop->type) {
2432 case BT_PROPERTY_BDNAME: {
2433 bt_bdname_t* bd_name = (bt_bdname_t*)prop->val;
2434 strncpy((char*)bd_name->name, (char*)btif_get_default_local_name(),
2435 sizeof(bd_name->name) - 1);
2436 bd_name->name[sizeof(bd_name->name) - 1] = 0;
2437 prop->len = strlen((char*)bd_name->name);
2438 } break;
2439
2440 case BT_PROPERTY_ADAPTER_SCAN_MODE: {
2441 /* if the storage does not have it. Most likely app never set it. Default
2442 * is NONE */
2443 bt_scan_mode_t* mode = (bt_scan_mode_t*)prop->val;
2444 *mode = BT_SCAN_MODE_NONE;
2445 prop->len = sizeof(bt_scan_mode_t);
2446 } break;
2447
2448 case BT_PROPERTY_ADAPTER_DISCOVERY_TIMEOUT: {
2449 uint32_t* tmt = (uint32_t*)prop->val;
2450 *tmt = 120; /* default to 120s, if not found in NV */
2451 prop->len = sizeof(uint32_t);
2452 } break;
2453
2454 case BT_PROPERTY_CLASS_OF_DEVICE: {
2455 DEV_CLASS dev_class = BTA_DM_COD;
2456 memcpy(prop->val, dev_class, sizeof(DEV_CLASS));
2457 prop->len = sizeof(DEV_CLASS);
2458 } break;
2459
2460 default:
2461 prop->len = 0;
2462 return BT_STATUS_FAIL;
2463 }
2464 return BT_STATUS_SUCCESS;
2465 }
2466
2467 /*******************************************************************************
2468 *
2469 * Function btif_dm_get_remote_services
2470 *
2471 * Description Start SDP to get remote services
2472 *
2473 * Returns bt_status_t
2474 *
2475 ******************************************************************************/
btif_dm_get_remote_services(const RawAddress & remote_addr)2476 bt_status_t btif_dm_get_remote_services(const RawAddress& remote_addr) {
2477 BTIF_TRACE_EVENT("%s: bd_addr=%s", __func__, remote_addr.ToString().c_str());
2478
2479 BTA_DmDiscover(remote_addr, BTA_ALL_SERVICE_MASK, bte_dm_search_services_evt,
2480 true);
2481
2482 return BT_STATUS_SUCCESS;
2483 }
2484
2485 /*******************************************************************************
2486 *
2487 * Function btif_dm_get_remote_services_by_transport
2488 *
2489 * Description Start SDP to get remote services by transport
2490 *
2491 * Returns bt_status_t
2492 *
2493 ******************************************************************************/
btif_dm_get_remote_services_by_transport(RawAddress * remote_addr,const int transport)2494 bt_status_t btif_dm_get_remote_services_by_transport(RawAddress* remote_addr,
2495 const int transport) {
2496 BTIF_TRACE_EVENT("%s: transport=%d, remote_addr=%s", __func__, transport,
2497 remote_addr->ToString().c_str());
2498
2499 /* Set the mask extension */
2500 tBTA_SERVICE_MASK_EXT mask_ext;
2501 mask_ext.num_uuid = 0;
2502 mask_ext.p_uuid = NULL;
2503 mask_ext.srvc_mask = BTA_ALL_SERVICE_MASK;
2504
2505 BTA_DmDiscoverByTransport(*remote_addr, &mask_ext, bte_dm_search_services_evt,
2506 true, transport);
2507
2508 return BT_STATUS_SUCCESS;
2509 }
2510
2511 /*******************************************************************************
2512 *
2513 * Function btif_dm_get_remote_service_record
2514 *
2515 * Description Start SDP to get remote service record
2516 *
2517 *
2518 * Returns bt_status_t
2519 ******************************************************************************/
btif_dm_get_remote_service_record(const RawAddress & remote_addr,const Uuid & uuid)2520 bt_status_t btif_dm_get_remote_service_record(const RawAddress& remote_addr,
2521 const Uuid& uuid) {
2522 BTIF_TRACE_EVENT("%s: bd_addr=%s", __func__, remote_addr.ToString().c_str());
2523 BTA_DmDiscoverUUID(remote_addr, uuid, bte_dm_remote_service_record_evt, true);
2524
2525 return BT_STATUS_SUCCESS;
2526 }
2527
btif_dm_execute_service_request(uint16_t event,char * p_param)2528 void btif_dm_execute_service_request(uint16_t event, char* p_param) {
2529 bool b_enable = false;
2530 bt_status_t status;
2531 if (event == BTIF_DM_ENABLE_SERVICE) {
2532 b_enable = true;
2533 }
2534 status =
2535 btif_in_execute_service_request(*((tBTA_SERVICE_ID*)p_param), b_enable);
2536 if (status == BT_STATUS_SUCCESS) {
2537 bt_property_t property;
2538 Uuid local_uuids[BT_MAX_NUM_UUIDS];
2539
2540 /* Now send the UUID_PROPERTY_CHANGED event to the upper layer */
2541 BTIF_STORAGE_FILL_PROPERTY(&property, BT_PROPERTY_UUIDS,
2542 sizeof(local_uuids), local_uuids);
2543 btif_storage_get_adapter_property(&property);
2544 HAL_CBACK(bt_hal_cbacks, adapter_properties_cb, BT_STATUS_SUCCESS, 1,
2545 &property);
2546 }
2547 return;
2548 }
2549
btif_dm_proc_io_req(UNUSED_ATTR const RawAddress & bd_addr,UNUSED_ATTR tBTA_IO_CAP * p_io_cap,UNUSED_ATTR tBTA_OOB_DATA * p_oob_data,tBTA_AUTH_REQ * p_auth_req,bool is_orig)2550 void btif_dm_proc_io_req(UNUSED_ATTR const RawAddress& bd_addr,
2551 UNUSED_ATTR tBTA_IO_CAP* p_io_cap,
2552 UNUSED_ATTR tBTA_OOB_DATA* p_oob_data,
2553 tBTA_AUTH_REQ* p_auth_req, bool is_orig) {
2554 uint8_t yes_no_bit = BTA_AUTH_SP_YES & *p_auth_req;
2555 /* if local initiated:
2556 ** 1. set DD + MITM
2557 ** if remote initiated:
2558 ** 1. Copy over the auth_req from peer's io_rsp
2559 ** 2. Set the MITM if peer has it set or if peer has DisplayYesNo
2560 *(iPhone)
2561 ** as a fallback set MITM+GB if peer had MITM set
2562 */
2563
2564 BTIF_TRACE_DEBUG("+%s: p_auth_req=%d", __func__, *p_auth_req);
2565 if (pairing_cb.is_local_initiated) {
2566 /* if initing/responding to a dedicated bonding, use dedicate bonding bit */
2567 *p_auth_req = BTA_AUTH_DD_BOND | BTA_AUTH_SP_YES;
2568 } else if (!is_orig) {
2569 /* peer initiated paring. They probably know what they want.
2570 ** Copy the mitm from peer device.
2571 */
2572 BTIF_TRACE_DEBUG("%s: setting p_auth_req to peer's: %d", __func__,
2573 pairing_cb.auth_req);
2574 *p_auth_req = (pairing_cb.auth_req & BTA_AUTH_BONDS);
2575
2576 /* copy over the MITM bit as well. In addition if the peer has DisplayYesNo,
2577 * force MITM */
2578 if ((yes_no_bit) || (pairing_cb.io_cap & BTM_IO_CAP_IO))
2579 *p_auth_req |= BTA_AUTH_SP_YES;
2580 } else if (yes_no_bit) {
2581 /* set the general bonding bit for stored device */
2582 *p_auth_req = BTA_AUTH_GEN_BOND | yes_no_bit;
2583 }
2584 BTIF_TRACE_DEBUG("-%s: p_auth_req=%d", __func__, *p_auth_req);
2585 }
2586
btif_dm_proc_io_rsp(UNUSED_ATTR const RawAddress & bd_addr,tBTA_IO_CAP io_cap,UNUSED_ATTR tBTA_OOB_DATA oob_data,tBTA_AUTH_REQ auth_req)2587 void btif_dm_proc_io_rsp(UNUSED_ATTR const RawAddress& bd_addr,
2588 tBTA_IO_CAP io_cap, UNUSED_ATTR tBTA_OOB_DATA oob_data,
2589 tBTA_AUTH_REQ auth_req) {
2590 if (auth_req & BTA_AUTH_BONDS) {
2591 BTIF_TRACE_DEBUG("%s auth_req:%d", __func__, auth_req);
2592 pairing_cb.auth_req = auth_req;
2593 pairing_cb.io_cap = io_cap;
2594 }
2595 }
2596
btif_dm_set_oob_for_io_req(tBTA_OOB_DATA * p_has_oob_data)2597 void btif_dm_set_oob_for_io_req(tBTA_OOB_DATA* p_has_oob_data) {
2598 if (is_empty_128bit(oob_cb.oob_data.c192)) {
2599 *p_has_oob_data = false;
2600 } else {
2601 *p_has_oob_data = true;
2602 }
2603 BTIF_TRACE_DEBUG("%s: *p_has_oob_data=%d", __func__, *p_has_oob_data);
2604 }
2605
btif_dm_set_oob_for_le_io_req(const RawAddress & bd_addr,tBTA_OOB_DATA * p_has_oob_data,tBTA_LE_AUTH_REQ * p_auth_req)2606 void btif_dm_set_oob_for_le_io_req(const RawAddress& bd_addr,
2607 tBTA_OOB_DATA* p_has_oob_data,
2608 tBTA_LE_AUTH_REQ* p_auth_req) {
2609 if (!is_empty_128bit(oob_cb.oob_data.le_sc_c) &&
2610 !is_empty_128bit(oob_cb.oob_data.le_sc_r)) {
2611 /* We have LE SC OOB data */
2612
2613 /* make sure OOB data is for this particular device */
2614 if (bd_addr == oob_cb.bdaddr) {
2615 *p_auth_req = ((*p_auth_req) | BTM_LE_AUTH_REQ_SC_ONLY);
2616 *p_has_oob_data = true;
2617 } else {
2618 *p_has_oob_data = false;
2619 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
2620 __func__);
2621 }
2622 } else if (!is_empty_128bit(oob_cb.oob_data.sm_tk)) {
2623 /* We have security manager TK */
2624
2625 /* make sure OOB data is for this particular device */
2626 if (bd_addr == oob_cb.bdaddr) {
2627 // When using OOB with TK, SC Secure Connections bit must be disabled.
2628 tBTA_LE_AUTH_REQ mask = ~BTM_LE_AUTH_REQ_SC_ONLY;
2629 *p_auth_req = ((*p_auth_req) & mask);
2630
2631 *p_has_oob_data = true;
2632 } else {
2633 *p_has_oob_data = false;
2634 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
2635 __func__);
2636 }
2637 } else {
2638 *p_has_oob_data = false;
2639 }
2640 BTIF_TRACE_DEBUG("%s *p_has_oob_data=%d", __func__, *p_has_oob_data);
2641 }
2642
2643 #ifdef BTIF_DM_OOB_TEST
btif_dm_load_local_oob(void)2644 void btif_dm_load_local_oob(void) {
2645 char prop_oob[PROPERTY_VALUE_MAX];
2646 osi_property_get("service.brcm.bt.oob", prop_oob, "3");
2647 BTIF_TRACE_DEBUG("%s: prop_oob = %s", __func__, prop_oob);
2648 if (prop_oob[0] != '3') {
2649 if (is_empty_128bit(oob_cb.oob_data.c192)) {
2650 BTIF_TRACE_DEBUG("%s: read OOB, call BTA_DmLocalOob()", __func__);
2651 BTA_DmLocalOob();
2652 }
2653 }
2654 }
2655
btif_dm_proc_loc_oob(bool valid,BT_OCTET16 c,BT_OCTET16 r)2656 void btif_dm_proc_loc_oob(bool valid, BT_OCTET16 c, BT_OCTET16 r) {
2657 FILE* fp;
2658 const char* path_a = "/data/misc/bluedroid/LOCAL/a.key";
2659 const char* path_b = "/data/misc/bluedroid/LOCAL/b.key";
2660 const char* path = NULL;
2661 char prop_oob[PROPERTY_VALUE_MAX];
2662 BTIF_TRACE_DEBUG("%s: valid=%d", __func__, valid);
2663 if (is_empty_128bit(oob_cb.oob_data.c192) && valid) {
2664 BTIF_TRACE_DEBUG("save local OOB data in memory");
2665 memcpy(oob_cb.oob_data.c192, c, BT_OCTET16_LEN);
2666 memcpy(oob_cb.oob_data.r192, r, BT_OCTET16_LEN);
2667 osi_property_get("service.brcm.bt.oob", prop_oob, "3");
2668 BTIF_TRACE_DEBUG("%s: prop_oob = %s", __func__, prop_oob);
2669 if (prop_oob[0] == '1')
2670 path = path_a;
2671 else if (prop_oob[0] == '2')
2672 path = path_b;
2673 if (path) {
2674 fp = fopen(path, "wb+");
2675 if (fp == NULL) {
2676 BTIF_TRACE_DEBUG("%s: failed to save local OOB data to %s", __func__,
2677 path);
2678 } else {
2679 BTIF_TRACE_DEBUG("%s: save local OOB data into file %s", __func__,
2680 path);
2681 fwrite(c, 1, BT_OCTET16_LEN, fp);
2682 fwrite(r, 1, BT_OCTET16_LEN, fp);
2683 fclose(fp);
2684 }
2685 }
2686 }
2687 }
2688
2689 /*******************************************************************************
2690 *
2691 * Function btif_dm_get_smp_config
2692 *
2693 * Description Retrieve the SMP pairing options from the bt_stack.conf
2694 * file. To provide specific pairing options for the host
2695 * add a node with label "SmpOptions" to the config file
2696 * and assign it a comma separated list of 5 values in the
2697 * format: auth, io, ikey, rkey, ksize, oob
2698 * eg: PTS_SmpOptions=0xD,0x4,0xf,0xf,0x10
2699 *
2700 * Parameters: tBTE_APPL_CFG*: pointer to struct defining pairing options
2701 *
2702 * Returns true if the options were successfully read, else false
2703 *
2704 ******************************************************************************/
btif_dm_get_smp_config(tBTE_APPL_CFG * p_cfg)2705 bool btif_dm_get_smp_config(tBTE_APPL_CFG* p_cfg) {
2706 const std::string* recv = stack_config_get_interface()->get_pts_smp_options();
2707 if (!recv) {
2708 BTIF_TRACE_DEBUG("%s: SMP options not found in configuration", __func__);
2709 return false;
2710 }
2711
2712 char conf[64];
2713 char* pch;
2714 char* endptr;
2715
2716 strncpy(conf, recv->c_str(), 64);
2717 conf[63] = 0; // null terminate
2718
2719 pch = strtok(conf, ",");
2720 if (pch != NULL)
2721 p_cfg->ble_auth_req = (uint8_t)strtoul(pch, &endptr, 16);
2722 else
2723 return false;
2724
2725 pch = strtok(NULL, ",");
2726 if (pch != NULL)
2727 p_cfg->ble_io_cap = (uint8_t)strtoul(pch, &endptr, 16);
2728 else
2729 return false;
2730
2731 pch = strtok(NULL, ",");
2732 if (pch != NULL)
2733 p_cfg->ble_init_key = (uint8_t)strtoul(pch, &endptr, 16);
2734 else
2735 return false;
2736
2737 pch = strtok(NULL, ",");
2738 if (pch != NULL)
2739 p_cfg->ble_resp_key = (uint8_t)strtoul(pch, &endptr, 16);
2740 else
2741 return false;
2742
2743 pch = strtok(NULL, ",");
2744 if (pch != NULL)
2745 p_cfg->ble_max_key_size = (uint8_t)strtoul(pch, &endptr, 16);
2746 else
2747 return false;
2748
2749 return true;
2750 }
2751
btif_dm_proc_rmt_oob(const RawAddress & bd_addr,BT_OCTET16 p_c,BT_OCTET16 p_r)2752 bool btif_dm_proc_rmt_oob(const RawAddress& bd_addr, BT_OCTET16 p_c,
2753 BT_OCTET16 p_r) {
2754 const char* path_a = "/data/misc/bluedroid/LOCAL/a.key";
2755 const char* path_b = "/data/misc/bluedroid/LOCAL/b.key";
2756 const char* path = NULL;
2757 char prop_oob[PROPERTY_VALUE_MAX];
2758 osi_property_get("service.brcm.bt.oob", prop_oob, "3");
2759 BTIF_TRACE_DEBUG("%s: prop_oob = %s", __func__, prop_oob);
2760 if (prop_oob[0] == '1')
2761 path = path_b;
2762 else if (prop_oob[0] == '2')
2763 path = path_a;
2764 if (!path) {
2765 BTIF_TRACE_DEBUG("%s: can't open path!", __func__);
2766 return false;
2767 }
2768
2769 FILE* fp = fopen(path, "rb");
2770 if (fp == NULL) {
2771 BTIF_TRACE_DEBUG("%s: failed to read OOB keys from %s", __func__, path);
2772 return false;
2773 }
2774
2775 BTIF_TRACE_DEBUG("%s: read OOB data from %s", __func__, path);
2776 fread(p_c, 1, BT_OCTET16_LEN, fp);
2777 fread(p_r, 1, BT_OCTET16_LEN, fp);
2778 fclose(fp);
2779
2780 RawAddress bt_bd_addr = bd_addr;
2781 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_BOND_STATE_BONDING,
2782 (char*)&bt_bd_addr, sizeof(RawAddress), NULL);
2783 return true;
2784 }
2785 #endif /* BTIF_DM_OOB_TEST */
2786
btif_dm_ble_key_notif_evt(tBTA_DM_SP_KEY_NOTIF * p_ssp_key_notif)2787 static void btif_dm_ble_key_notif_evt(tBTA_DM_SP_KEY_NOTIF* p_ssp_key_notif) {
2788 RawAddress bd_addr;
2789 bt_bdname_t bd_name;
2790 uint32_t cod;
2791 int dev_type;
2792
2793 BTIF_TRACE_DEBUG("%s", __func__);
2794
2795 /* Remote name update */
2796 if (!btif_get_device_type(p_ssp_key_notif->bd_addr, &dev_type)) {
2797 dev_type = BT_DEVICE_TYPE_BLE;
2798 }
2799 btif_dm_update_ble_remote_properties(p_ssp_key_notif->bd_addr,
2800 p_ssp_key_notif->bd_name,
2801 (tBT_DEVICE_TYPE)dev_type);
2802 bd_addr = p_ssp_key_notif->bd_addr;
2803 memcpy(bd_name.name, p_ssp_key_notif->bd_name, BD_NAME_LEN);
2804
2805 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
2806 pairing_cb.is_ssp = false;
2807 cod = COD_UNCLASSIFIED;
2808
2809 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
2810 BT_SSP_VARIANT_PASSKEY_NOTIFICATION, p_ssp_key_notif->passkey);
2811 }
2812
2813 /*******************************************************************************
2814 *
2815 * Function btif_dm_ble_auth_cmpl_evt
2816 *
2817 * Description Executes authentication complete event in btif context
2818 *
2819 * Returns void
2820 *
2821 ******************************************************************************/
btif_dm_ble_auth_cmpl_evt(tBTA_DM_AUTH_CMPL * p_auth_cmpl)2822 static void btif_dm_ble_auth_cmpl_evt(tBTA_DM_AUTH_CMPL* p_auth_cmpl) {
2823 /* Save link key, if not temporary */
2824 bt_status_t status = BT_STATUS_FAIL;
2825 bt_bond_state_t state = BT_BOND_STATE_NONE;
2826
2827 RawAddress bd_addr = p_auth_cmpl->bd_addr;
2828
2829 /* Clear OOB data */
2830 memset(&oob_cb, 0, sizeof(oob_cb));
2831
2832 if ((p_auth_cmpl->success) && (p_auth_cmpl->key_present)) {
2833 /* store keys */
2834 }
2835 if (p_auth_cmpl->success) {
2836 status = BT_STATUS_SUCCESS;
2837 state = BT_BOND_STATE_BONDED;
2838 int addr_type;
2839 RawAddress bdaddr = p_auth_cmpl->bd_addr;
2840 if (btif_storage_get_remote_addr_type(&bdaddr, &addr_type) !=
2841 BT_STATUS_SUCCESS)
2842 btif_storage_set_remote_addr_type(&bdaddr, p_auth_cmpl->addr_type);
2843
2844 /* Test for temporary bonding */
2845 if (btm_get_bond_type_dev(p_auth_cmpl->bd_addr) == BOND_TYPE_TEMPORARY) {
2846 BTIF_TRACE_DEBUG("%s: sending BT_BOND_STATE_NONE for Temp pairing",
2847 __func__);
2848 btif_storage_remove_bonded_device(&bdaddr);
2849 state = BT_BOND_STATE_NONE;
2850 } else {
2851 btif_dm_save_ble_bonding_keys(bdaddr);
2852 BTA_GATTC_Refresh(bd_addr);
2853 btif_dm_get_remote_services_by_transport(&bd_addr, GATT_TRANSPORT_LE);
2854 }
2855 } else {
2856 /*Map the HCI fail reason to bt status */
2857 switch (p_auth_cmpl->fail_reason) {
2858 case BTA_DM_AUTH_SMP_PAIR_AUTH_FAIL:
2859 case BTA_DM_AUTH_SMP_CONFIRM_VALUE_FAIL:
2860 case BTA_DM_AUTH_SMP_UNKNOWN_ERR:
2861 case BTA_DM_AUTH_SMP_CONN_TOUT:
2862 btif_dm_remove_ble_bonding_keys();
2863 status = BT_STATUS_AUTH_FAILURE;
2864 break;
2865 case BTA_DM_AUTH_SMP_PAIR_NOT_SUPPORT:
2866 status = BT_STATUS_AUTH_REJECTED;
2867 break;
2868 default:
2869 btif_dm_remove_ble_bonding_keys();
2870 status = BT_STATUS_FAIL;
2871 break;
2872 }
2873 }
2874 if (state == BT_BOND_STATE_BONDED && bd_addr != pairing_cb.static_bdaddr) {
2875 // Report RPA bonding state to Java in crosskey paring
2876 bond_state_changed(status, bd_addr, BT_BOND_STATE_BONDING);
2877 }
2878 bond_state_changed(status, bd_addr, state);
2879 }
2880
btif_dm_load_ble_local_keys(void)2881 void btif_dm_load_ble_local_keys(void) {
2882 memset(&ble_local_key_cb, 0, sizeof(btif_dm_local_key_cb_t));
2883
2884 if (btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_ER,
2885 (char*)&ble_local_key_cb.er[0],
2886 BT_OCTET16_LEN) == BT_STATUS_SUCCESS) {
2887 ble_local_key_cb.is_er_rcvd = true;
2888 BTIF_TRACE_DEBUG("%s BLE ER key loaded", __func__);
2889 }
2890
2891 if ((btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_IR,
2892 (char*)&ble_local_key_cb.id_keys.ir[0],
2893 BT_OCTET16_LEN) == BT_STATUS_SUCCESS) &&
2894 (btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_IRK,
2895 (char*)&ble_local_key_cb.id_keys.irk[0],
2896 BT_OCTET16_LEN) == BT_STATUS_SUCCESS) &&
2897 (btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_DHK,
2898 (char*)&ble_local_key_cb.id_keys.dhk[0],
2899 BT_OCTET16_LEN) == BT_STATUS_SUCCESS)) {
2900 ble_local_key_cb.is_id_keys_rcvd = true;
2901 BTIF_TRACE_DEBUG("%s BLE ID keys loaded", __func__);
2902 }
2903 }
btif_dm_get_ble_local_keys(tBTA_DM_BLE_LOCAL_KEY_MASK * p_key_mask,BT_OCTET16 er,tBTA_BLE_LOCAL_ID_KEYS * p_id_keys)2904 void btif_dm_get_ble_local_keys(tBTA_DM_BLE_LOCAL_KEY_MASK* p_key_mask,
2905 BT_OCTET16 er,
2906 tBTA_BLE_LOCAL_ID_KEYS* p_id_keys) {
2907 if (ble_local_key_cb.is_er_rcvd) {
2908 memcpy(&er[0], &ble_local_key_cb.er[0], sizeof(BT_OCTET16));
2909 *p_key_mask |= BTA_BLE_LOCAL_KEY_TYPE_ER;
2910 }
2911
2912 if (ble_local_key_cb.is_id_keys_rcvd) {
2913 memcpy(&p_id_keys->ir[0], &ble_local_key_cb.id_keys.ir[0],
2914 sizeof(BT_OCTET16));
2915 memcpy(&p_id_keys->irk[0], &ble_local_key_cb.id_keys.irk[0],
2916 sizeof(BT_OCTET16));
2917 memcpy(&p_id_keys->dhk[0], &ble_local_key_cb.id_keys.dhk[0],
2918 sizeof(BT_OCTET16));
2919 *p_key_mask |= BTA_BLE_LOCAL_KEY_TYPE_ID;
2920 }
2921 BTIF_TRACE_DEBUG("%s *p_key_mask=0x%02x", __func__, *p_key_mask);
2922 }
2923
btif_dm_save_ble_bonding_keys(RawAddress & bd_addr)2924 void btif_dm_save_ble_bonding_keys(RawAddress& bd_addr) {
2925 BTIF_TRACE_DEBUG("%s", __func__);
2926
2927 if (pairing_cb.ble.is_penc_key_rcvd) {
2928 btif_storage_add_ble_bonding_key(
2929 &bd_addr, (uint8_t*)&pairing_cb.ble.penc_key, BTIF_DM_LE_KEY_PENC,
2930 sizeof(tBTM_LE_PENC_KEYS));
2931 }
2932
2933 if (pairing_cb.ble.is_pid_key_rcvd) {
2934 btif_storage_add_ble_bonding_key(
2935 &bd_addr, (uint8_t*)&pairing_cb.ble.pid_key, BTIF_DM_LE_KEY_PID,
2936 sizeof(tBTM_LE_PID_KEYS));
2937 }
2938
2939 if (pairing_cb.ble.is_pcsrk_key_rcvd) {
2940 btif_storage_add_ble_bonding_key(
2941 &bd_addr, (uint8_t*)&pairing_cb.ble.pcsrk_key, BTIF_DM_LE_KEY_PCSRK,
2942 sizeof(tBTM_LE_PCSRK_KEYS));
2943 }
2944
2945 if (pairing_cb.ble.is_lenc_key_rcvd) {
2946 btif_storage_add_ble_bonding_key(
2947 &bd_addr, (uint8_t*)&pairing_cb.ble.lenc_key, BTIF_DM_LE_KEY_LENC,
2948 sizeof(tBTM_LE_LENC_KEYS));
2949 }
2950
2951 if (pairing_cb.ble.is_lcsrk_key_rcvd) {
2952 btif_storage_add_ble_bonding_key(
2953 &bd_addr, (uint8_t*)&pairing_cb.ble.lcsrk_key, BTIF_DM_LE_KEY_LCSRK,
2954 sizeof(tBTM_LE_LCSRK_KEYS));
2955 }
2956
2957 if (pairing_cb.ble.is_lidk_key_rcvd) {
2958 btif_storage_add_ble_bonding_key(&bd_addr, NULL, BTIF_DM_LE_KEY_LID, 0);
2959 }
2960 }
2961
btif_dm_remove_ble_bonding_keys(void)2962 void btif_dm_remove_ble_bonding_keys(void) {
2963 BTIF_TRACE_DEBUG("%s", __func__);
2964
2965 RawAddress bd_addr = pairing_cb.bd_addr;
2966 btif_storage_remove_ble_bonding_keys(&bd_addr);
2967 }
2968
2969 /*******************************************************************************
2970 *
2971 * Function btif_dm_ble_sec_req_evt
2972 *
2973 * Description Eprocess security request event in btif context
2974 *
2975 * Returns void
2976 *
2977 ******************************************************************************/
btif_dm_ble_sec_req_evt(tBTA_DM_BLE_SEC_REQ * p_ble_req)2978 void btif_dm_ble_sec_req_evt(tBTA_DM_BLE_SEC_REQ* p_ble_req) {
2979 bt_bdname_t bd_name;
2980 uint32_t cod;
2981 int dev_type;
2982
2983 BTIF_TRACE_DEBUG("%s", __func__);
2984
2985 if (pairing_cb.state == BT_BOND_STATE_BONDING) {
2986 BTIF_TRACE_DEBUG("%s Discard security request", __func__);
2987 return;
2988 }
2989
2990 /* Remote name update */
2991 if (!btif_get_device_type(p_ble_req->bd_addr, &dev_type)) {
2992 dev_type = BT_DEVICE_TYPE_BLE;
2993 }
2994 btif_dm_update_ble_remote_properties(p_ble_req->bd_addr, p_ble_req->bd_name,
2995 (tBT_DEVICE_TYPE)dev_type);
2996
2997 RawAddress bd_addr = p_ble_req->bd_addr;
2998 memcpy(bd_name.name, p_ble_req->bd_name, BD_NAME_LEN);
2999
3000 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
3001
3002 pairing_cb.bond_type = BOND_TYPE_PERSISTENT;
3003 pairing_cb.is_le_only = true;
3004 pairing_cb.is_le_nc = false;
3005 pairing_cb.is_ssp = true;
3006 btm_set_bond_type_dev(p_ble_req->bd_addr, pairing_cb.bond_type);
3007
3008 cod = COD_UNCLASSIFIED;
3009
3010 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
3011 BT_SSP_VARIANT_CONSENT, 0);
3012 }
3013
3014 /*******************************************************************************
3015 *
3016 * Function btif_dm_ble_passkey_req_evt
3017 *
3018 * Description Executes pin request event in btif context
3019 *
3020 * Returns void
3021 *
3022 ******************************************************************************/
btif_dm_ble_passkey_req_evt(tBTA_DM_PIN_REQ * p_pin_req)3023 static void btif_dm_ble_passkey_req_evt(tBTA_DM_PIN_REQ* p_pin_req) {
3024 bt_bdname_t bd_name;
3025 uint32_t cod;
3026 int dev_type;
3027
3028 /* Remote name update */
3029 if (!btif_get_device_type(p_pin_req->bd_addr, &dev_type)) {
3030 dev_type = BT_DEVICE_TYPE_BLE;
3031 }
3032 btif_dm_update_ble_remote_properties(p_pin_req->bd_addr, p_pin_req->bd_name,
3033 (tBT_DEVICE_TYPE)dev_type);
3034
3035 RawAddress bd_addr = p_pin_req->bd_addr;
3036 memcpy(bd_name.name, p_pin_req->bd_name, BD_NAME_LEN);
3037
3038 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
3039 pairing_cb.is_le_only = true;
3040
3041 cod = COD_UNCLASSIFIED;
3042
3043 HAL_CBACK(bt_hal_cbacks, pin_request_cb, &bd_addr, &bd_name, cod, false);
3044 }
btif_dm_ble_key_nc_req_evt(tBTA_DM_SP_KEY_NOTIF * p_notif_req)3045 static void btif_dm_ble_key_nc_req_evt(tBTA_DM_SP_KEY_NOTIF* p_notif_req) {
3046 /* TODO implement key notification for numeric comparison */
3047 BTIF_TRACE_DEBUG("%s", __func__);
3048
3049 /* Remote name update */
3050 btif_update_remote_properties(p_notif_req->bd_addr, p_notif_req->bd_name,
3051 NULL, BT_DEVICE_TYPE_BLE);
3052
3053 RawAddress bd_addr = p_notif_req->bd_addr;
3054
3055 bt_bdname_t bd_name;
3056 memcpy(bd_name.name, p_notif_req->bd_name, BD_NAME_LEN);
3057
3058 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
3059 pairing_cb.is_ssp = false;
3060 pairing_cb.is_le_only = true;
3061 pairing_cb.is_le_nc = true;
3062
3063 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, COD_UNCLASSIFIED,
3064 BT_SSP_VARIANT_PASSKEY_CONFIRMATION, p_notif_req->passkey);
3065 }
3066
btif_dm_ble_oob_req_evt(tBTA_DM_SP_RMT_OOB * req_oob_type)3067 static void btif_dm_ble_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type) {
3068 BTIF_TRACE_DEBUG("%s", __func__);
3069
3070 RawAddress bd_addr = req_oob_type->bd_addr;
3071 /* We already checked if OOB data is present in
3072 * btif_dm_set_oob_for_le_io_req, but check here again. If it's not present
3073 * do nothing, pairing will timeout.
3074 */
3075 if (is_empty_128bit(oob_cb.oob_data.sm_tk)) {
3076 return;
3077 }
3078
3079 /* make sure OOB data is for this particular device */
3080 if (req_oob_type->bd_addr != oob_cb.bdaddr) {
3081 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
3082 __func__);
3083 return;
3084 }
3085
3086 /* Remote name update */
3087 btif_update_remote_properties(req_oob_type->bd_addr, req_oob_type->bd_name,
3088 NULL, BT_DEVICE_TYPE_BLE);
3089
3090 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
3091 pairing_cb.is_ssp = false;
3092 pairing_cb.is_le_only = true;
3093 pairing_cb.is_le_nc = false;
3094
3095 BTM_BleOobDataReply(req_oob_type->bd_addr, 0, 16, oob_cb.oob_data.sm_tk);
3096 }
3097
btif_dm_ble_sc_oob_req_evt(tBTA_DM_SP_RMT_OOB * req_oob_type)3098 static void btif_dm_ble_sc_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type) {
3099 BTIF_TRACE_DEBUG("%s", __func__);
3100
3101 RawAddress bd_addr = req_oob_type->bd_addr;
3102
3103 /* We already checked if OOB data is present in
3104 * btif_dm_set_oob_for_le_io_req, but check here again. If it's not present
3105 * do nothing, pairing will timeout.
3106 */
3107 if (is_empty_128bit(oob_cb.oob_data.le_sc_c) &&
3108 is_empty_128bit(oob_cb.oob_data.le_sc_r)) {
3109 BTIF_TRACE_WARNING("%s: LE SC OOB data is empty", __func__);
3110 return;
3111 }
3112
3113 /* make sure OOB data is for this particular device */
3114 if (req_oob_type->bd_addr != oob_cb.bdaddr) {
3115 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
3116 __func__);
3117 return;
3118 }
3119
3120 /* Remote name update */
3121 btif_update_remote_properties(req_oob_type->bd_addr, req_oob_type->bd_name,
3122 NULL, BT_DEVICE_TYPE_BLE);
3123
3124 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
3125 pairing_cb.is_ssp = false;
3126 pairing_cb.is_le_only =
3127 true; // TODO: we can derive classic pairing from this one
3128 pairing_cb.is_le_nc = false;
3129
3130 BTM_BleSecureConnectionOobDataReply(
3131 req_oob_type->bd_addr, oob_cb.oob_data.le_sc_c, oob_cb.oob_data.le_sc_r);
3132 }
3133
btif_dm_update_ble_remote_properties(const RawAddress & bd_addr,BD_NAME bd_name,tBT_DEVICE_TYPE dev_type)3134 void btif_dm_update_ble_remote_properties(const RawAddress& bd_addr,
3135 BD_NAME bd_name,
3136 tBT_DEVICE_TYPE dev_type) {
3137 btif_update_remote_properties(bd_addr, bd_name, NULL, dev_type);
3138 }
3139
btif_dm_ble_tx_test_cback(void * p)3140 static void btif_dm_ble_tx_test_cback(void* p) {
3141 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_LE_TX_TEST, (char*)p, 1,
3142 NULL);
3143 }
3144
btif_dm_ble_rx_test_cback(void * p)3145 static void btif_dm_ble_rx_test_cback(void* p) {
3146 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_LE_RX_TEST, (char*)p, 1,
3147 NULL);
3148 }
3149
btif_dm_ble_test_end_cback(void * p)3150 static void btif_dm_ble_test_end_cback(void* p) {
3151 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_LE_TEST_END, (char*)p,
3152 3, NULL);
3153 }
3154 /*******************************************************************************
3155 *
3156 * Function btif_le_test_mode
3157 *
3158 * Description Sends a HCI BLE Test command to the Controller
3159 *
3160 * Returns BT_STATUS_SUCCESS on success
3161 *
3162 ******************************************************************************/
btif_le_test_mode(uint16_t opcode,uint8_t * buf,uint8_t len)3163 bt_status_t btif_le_test_mode(uint16_t opcode, uint8_t* buf, uint8_t len) {
3164 switch (opcode) {
3165 case HCI_BLE_TRANSMITTER_TEST:
3166 if (len != 3) return BT_STATUS_PARM_INVALID;
3167 BTM_BleTransmitterTest(buf[0], buf[1], buf[2], btif_dm_ble_tx_test_cback);
3168 break;
3169 case HCI_BLE_RECEIVER_TEST:
3170 if (len != 1) return BT_STATUS_PARM_INVALID;
3171 BTM_BleReceiverTest(buf[0], btif_dm_ble_rx_test_cback);
3172 break;
3173 case HCI_BLE_TEST_END:
3174 BTM_BleTestEnd(btif_dm_ble_test_end_cback);
3175 break;
3176 default:
3177 BTIF_TRACE_ERROR("%s: Unknown LE Test Mode Command 0x%x", __func__,
3178 opcode);
3179 return BT_STATUS_UNSUPPORTED;
3180 }
3181 return BT_STATUS_SUCCESS;
3182 }
3183
btif_dm_on_disable()3184 void btif_dm_on_disable() {
3185 /* cancel any pending pairing requests */
3186 if (is_bonding_or_sdp()) {
3187 BTIF_TRACE_DEBUG("%s: Cancel pending pairing request", __func__);
3188 btif_dm_cancel_bond(&pairing_cb.bd_addr);
3189 }
3190 }
3191
3192 /*******************************************************************************
3193 *
3194 * Function btif_dm_read_energy_info
3195 *
3196 * Description Reads the energy info from controller
3197 *
3198 * Returns void
3199 *
3200 ******************************************************************************/
btif_dm_read_energy_info()3201 void btif_dm_read_energy_info() { BTA_DmBleGetEnergyInfo(bta_energy_info_cb); }
3202
btif_get_default_local_name()3203 static char* btif_get_default_local_name() {
3204 if (btif_default_local_name[0] == '\0') {
3205 int max_len = sizeof(btif_default_local_name) - 1;
3206 if (BTM_DEF_LOCAL_NAME[0] != '\0') {
3207 strncpy(btif_default_local_name, BTM_DEF_LOCAL_NAME, max_len);
3208 } else {
3209 char prop_model[PROPERTY_VALUE_MAX];
3210 osi_property_get(PROPERTY_PRODUCT_MODEL, prop_model, "");
3211 strncpy(btif_default_local_name, prop_model, max_len);
3212 }
3213 btif_default_local_name[max_len] = '\0';
3214 }
3215 return btif_default_local_name;
3216 }
3217
btif_stats_add_bond_event(const RawAddress & bd_addr,bt_bond_function_t function,bt_bond_state_t state)3218 static void btif_stats_add_bond_event(const RawAddress& bd_addr,
3219 bt_bond_function_t function,
3220 bt_bond_state_t state) {
3221 std::unique_lock<std::mutex> lock(bond_event_lock);
3222
3223 btif_bond_event_t* event = &btif_dm_bond_events[btif_events_end_index];
3224 event->bd_addr = bd_addr;
3225 event->function = function;
3226 event->state = state;
3227 clock_gettime(CLOCK_REALTIME, &event->timestamp);
3228
3229 btif_num_bond_events++;
3230 btif_events_end_index =
3231 (btif_events_end_index + 1) % (MAX_BTIF_BOND_EVENT_ENTRIES + 1);
3232 if (btif_events_end_index == btif_events_start_index) {
3233 btif_events_start_index =
3234 (btif_events_start_index + 1) % (MAX_BTIF_BOND_EVENT_ENTRIES + 1);
3235 }
3236
3237 int type;
3238 btif_get_device_type(bd_addr, &type);
3239
3240 system_bt_osi::device_type_t device_type;
3241 switch (type) {
3242 case BT_DEVICE_TYPE_BREDR:
3243 device_type = system_bt_osi::DEVICE_TYPE_BREDR;
3244 break;
3245 case BT_DEVICE_TYPE_BLE:
3246 device_type = system_bt_osi::DEVICE_TYPE_LE;
3247 break;
3248 case BT_DEVICE_TYPE_DUMO:
3249 device_type = system_bt_osi::DEVICE_TYPE_DUMO;
3250 break;
3251 default:
3252 device_type = system_bt_osi::DEVICE_TYPE_UNKNOWN;
3253 break;
3254 }
3255
3256 uint32_t cod = get_cod(&bd_addr);
3257 uint64_t ts =
3258 event->timestamp.tv_sec * 1000 + event->timestamp.tv_nsec / 1000000;
3259 system_bt_osi::BluetoothMetricsLogger::GetInstance()->LogPairEvent(
3260 0, ts, cod, device_type);
3261 }
3262
btif_debug_bond_event_dump(int fd)3263 void btif_debug_bond_event_dump(int fd) {
3264 std::unique_lock<std::mutex> lock(bond_event_lock);
3265 dprintf(fd, "\nBond Events: \n");
3266 dprintf(fd, " Total Number of events: %zu\n", btif_num_bond_events);
3267 if (btif_num_bond_events > 0)
3268 dprintf(fd,
3269 " Time address Function State\n");
3270
3271 for (size_t i = btif_events_start_index; i != btif_events_end_index;
3272 i = (i + 1) % (MAX_BTIF_BOND_EVENT_ENTRIES + 1)) {
3273 btif_bond_event_t* event = &btif_dm_bond_events[i];
3274
3275 char eventtime[20];
3276 char temptime[20];
3277 struct tm* tstamp = localtime(&event->timestamp.tv_sec);
3278 strftime(temptime, sizeof(temptime), "%H:%M:%S", tstamp);
3279 snprintf(eventtime, sizeof(eventtime), "%s.%03ld", temptime,
3280 event->timestamp.tv_nsec / 1000000);
3281
3282 const char* func_name;
3283 switch (event->function) {
3284 case BTIF_DM_FUNC_CREATE_BOND:
3285 func_name = "btif_dm_create_bond";
3286 break;
3287 case BTIF_DM_FUNC_REMOVE_BOND:
3288 func_name = "btif_dm_remove_bond";
3289 break;
3290 case BTIF_DM_FUNC_BOND_STATE_CHANGED:
3291 func_name = "bond_state_changed ";
3292 break;
3293 default:
3294 func_name = "Invalid value ";
3295 break;
3296 }
3297
3298 const char* bond_state;
3299 switch (event->state) {
3300 case BT_BOND_STATE_NONE:
3301 bond_state = "BOND_STATE_NONE";
3302 break;
3303 case BT_BOND_STATE_BONDING:
3304 bond_state = "BOND_STATE_BONDING";
3305 break;
3306 case BT_BOND_STATE_BONDED:
3307 bond_state = "BOND_STATE_BONDED";
3308 break;
3309 default:
3310 bond_state = "Invalid bond state";
3311 break;
3312 }
3313
3314 dprintf(fd, " %s %s %s %s\n", eventtime,
3315 event->bd_addr.ToString().c_str(), func_name, bond_state);
3316 }
3317 }
3318