1 /******************************************************************************
2 *
3 * Copyright 2009-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /*******************************************************************************
20 *
21 * Filename: btif_dm.c
22 *
23 * Description: Contains Device Management (DM) related functionality
24 *
25 *
26 ******************************************************************************/
27
28 #define LOG_TAG "bt_btif_dm"
29
30 #include "btif_dm.h"
31
32 #include <base/bind.h>
33 #include <base/logging.h>
34 #include <signal.h>
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38 #include <sys/types.h>
39 #include <time.h>
40 #include <unistd.h>
41
42 #include <mutex>
43
44 #include <bluetooth/uuid.h>
45 #include <hardware/bluetooth.h>
46 #include <hardware/bt_hearing_aid.h>
47
48 #include "advertise_data_parser.h"
49 #include "bt_common.h"
50 #include "bta_gatt_api.h"
51 #include "btif_api.h"
52 #include "btif_av.h"
53 #include "btif_bqr.h"
54 #include "btif_config.h"
55 #include "btif_dm.h"
56 #include "btif_hd.h"
57 #include "btif_hf.h"
58 #include "btif_hh.h"
59 #include "btif_sdp.h"
60 #include "btif_storage.h"
61 #include "btif_util.h"
62 #include "btu.h"
63 #include "common/metric_id_allocator.h"
64 #include "common/metrics.h"
65 #include "device/include/controller.h"
66 #include "device/include/interop.h"
67 #include "internal_include/stack_config.h"
68 #include "main/shim/btif_dm.h"
69 #include "main/shim/shim.h"
70 #include "osi/include/allocator.h"
71 #include "osi/include/log.h"
72 #include "osi/include/osi.h"
73 #include "osi/include/properties.h"
74 #include "stack/btm/btm_int.h"
75 #include "stack_config.h"
76
77 using bluetooth::Uuid;
78 using bluetooth::common::MetricIdAllocator;
79 /******************************************************************************
80 * Constants & Macros
81 *****************************************************************************/
82
83 const Uuid UUID_HEARING_AID = Uuid::FromString("FDF0");
84
85 #define COD_MASK 0x07FF
86
87 #define COD_UNCLASSIFIED ((0x1F) << 8)
88 #define COD_HID_KEYBOARD 0x0540
89 #define COD_HID_POINTING 0x0580
90 #define COD_HID_COMBO 0x05C0
91 #define COD_HID_MAJOR 0x0500
92 #define COD_HID_MASK 0x0700
93 #define COD_AV_HEADSETS 0x0404
94 #define COD_AV_HANDSFREE 0x0408
95 #define COD_AV_HEADPHONES 0x0418
96 #define COD_AV_PORTABLE_AUDIO 0x041C
97 #define COD_AV_HIFI_AUDIO 0x0428
98
99 #define BTIF_DM_DEFAULT_INQ_MAX_RESULTS 0
100 #define BTIF_DM_DEFAULT_INQ_MAX_DURATION 10
101 #define BTIF_DM_MAX_SDP_ATTEMPTS_AFTER_PAIRING 2
102
103 #define NUM_TIMEOUT_RETRIES 5
104 #ifndef PROPERTY_PRODUCT_MODEL
105 #define PROPERTY_PRODUCT_MODEL "ro.product.model"
106 #endif
107 #define DEFAULT_LOCAL_NAME_MAX 31
108 #if (DEFAULT_LOCAL_NAME_MAX > BTM_MAX_LOC_BD_NAME_LEN)
109 #error "default btif local name size exceeds stack supported length"
110 #endif
111
112 #define ENCRYPTED_BREDR 2
113 #define ENCRYPTED_LE 4
114
115 typedef struct {
116 bt_bond_state_t state;
117 RawAddress static_bdaddr;
118 RawAddress bd_addr;
119 tBTM_BOND_TYPE bond_type;
120 uint8_t pin_code_len;
121 uint8_t is_ssp;
122 uint8_t auth_req;
123 uint8_t io_cap;
124 uint8_t autopair_attempts;
125 uint8_t timeout_retries;
126 uint8_t is_local_initiated;
127 uint8_t sdp_attempts;
128 bool is_le_only;
129 bool is_le_nc; /* LE Numeric comparison */
130 btif_dm_ble_cb_t ble;
131 } btif_dm_pairing_cb_t;
132
133 // TODO(jpawlowski): unify ?
134 // btif_dm_local_key_id_t == tBTM_BLE_LOCAL_ID_KEYS == tBTA_BLE_LOCAL_ID_KEYS
135 typedef struct {
136 Octet16 ir;
137 Octet16 irk;
138 Octet16 dhk;
139 } btif_dm_local_key_id_t;
140
141 typedef struct {
142 bool is_er_rcvd;
143 Octet16 er;
144 bool is_id_keys_rcvd;
145 btif_dm_local_key_id_t id_keys; /* ID kyes */
146
147 } btif_dm_local_key_cb_t;
148
149 typedef struct {
150 RawAddress bd_addr;
151 BD_NAME bd_name;
152 } btif_dm_remote_name_t;
153
154 /* this structure holds optional OOB data for remote device */
155 typedef struct {
156 RawAddress bdaddr; /* peer bdaddr */
157 bt_out_of_band_data_t oob_data;
158 } btif_dm_oob_cb_t;
159
160 typedef struct {
161 RawAddress bdaddr;
162 uint8_t transport; /* 0=Unknown, 1=BR/EDR, 2=LE */
163 } btif_dm_create_bond_cb_t;
164
165 typedef struct {
166 uint8_t status;
167 uint8_t ctrl_state;
168 uint64_t tx_time;
169 uint64_t rx_time;
170 uint64_t idle_time;
171 uint64_t energy_used;
172 } btif_activity_energy_info_cb_t;
173
174 typedef struct { unsigned int manufact_id; } skip_sdp_entry_t;
175
176 typedef enum {
177 BTIF_DM_FUNC_CREATE_BOND,
178 BTIF_DM_FUNC_CANCEL_BOND,
179 BTIF_DM_FUNC_REMOVE_BOND,
180 BTIF_DM_FUNC_BOND_STATE_CHANGED,
181 } bt_bond_function_t;
182
183 typedef struct {
184 RawAddress bd_addr;
185 bt_bond_function_t function;
186 bt_bond_state_t state;
187 struct timespec timestamp;
188 } btif_bond_event_t;
189
190 #define BTA_SERVICE_ID_TO_SERVICE_MASK(id) (1 << (id))
191
192 #define MAX_BTIF_BOND_EVENT_ENTRIES 15
193
194 static skip_sdp_entry_t sdp_blacklist[] = {{76}}; // Apple Mouse and Keyboard
195
196 /* This flag will be true if HCI_Inquiry is in progress */
197 static bool btif_dm_inquiry_in_progress = false;
198
199 /*******************************************************************************
200 * Static variables
201 ******************************************************************************/
202 static char btif_default_local_name[DEFAULT_LOCAL_NAME_MAX + 1] = {'\0'};
203 static uid_set_t* uid_set = NULL;
204
205 /* A circular array to keep track of the most recent bond events */
206 static btif_bond_event_t btif_dm_bond_events[MAX_BTIF_BOND_EVENT_ENTRIES + 1];
207
208 static std::mutex bond_event_lock;
209
210 /* |btif_num_bond_events| keeps track of the total number of events and can be
211 greater than |MAX_BTIF_BOND_EVENT_ENTRIES| */
212 static size_t btif_num_bond_events = 0;
213 static size_t btif_events_start_index = 0;
214 static size_t btif_events_end_index = 0;
215
216 /******************************************************************************
217 * Static functions
218 *****************************************************************************/
219 static btif_dm_pairing_cb_t pairing_cb;
220 static btif_dm_oob_cb_t oob_cb;
221 static void btif_dm_generic_evt(uint16_t event, char* p_param);
222 static void btif_dm_cb_create_bond(const RawAddress& bd_addr,
223 tBTA_TRANSPORT transport);
224 static void btif_dm_cb_hid_remote_name(tBTM_REMOTE_DEV_NAME* p_remote_name);
225 static void btif_update_remote_properties(const RawAddress& bd_addr,
226 BD_NAME bd_name, DEV_CLASS dev_class,
227 tBT_DEVICE_TYPE dev_type);
228 static btif_dm_local_key_cb_t ble_local_key_cb;
229 static void btif_dm_ble_key_notif_evt(tBTA_DM_SP_KEY_NOTIF* p_ssp_key_notif);
230 static void btif_dm_ble_auth_cmpl_evt(tBTA_DM_AUTH_CMPL* p_auth_cmpl);
231 static void btif_dm_ble_passkey_req_evt(tBTA_DM_PIN_REQ* p_pin_req);
232 static void btif_dm_ble_key_nc_req_evt(tBTA_DM_SP_KEY_NOTIF* p_notif_req);
233 static void btif_dm_ble_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type);
234 static void btif_dm_ble_sc_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type);
235
236 static void bte_scan_filt_param_cfg_evt(uint8_t action_type, uint8_t avbl_space,
237 uint8_t ref_value, uint8_t status);
238
239 static char* btif_get_default_local_name();
240
241 static void btif_stats_add_bond_event(const RawAddress& bd_addr,
242 bt_bond_function_t function,
243 bt_bond_state_t state);
244
245 /******************************************************************************
246 * Externs
247 *****************************************************************************/
248 extern bt_status_t btif_av_execute_service(bool b_enable);
249 extern bt_status_t btif_av_sink_execute_service(bool b_enable);
250 extern bt_status_t btif_hh_execute_service(bool b_enable);
251 extern bt_status_t btif_hf_client_execute_service(bool b_enable);
252 extern bt_status_t btif_sdp_execute_service(bool b_enable);
253 extern int btif_hh_connect(const RawAddress* bd_addr);
254 extern bt_status_t btif_hd_execute_service(bool b_enable);
255 extern bluetooth::hearing_aid::HearingAidInterface*
256 btif_hearing_aid_get_interface();
257
258 /******************************************************************************
259 * Functions
260 *****************************************************************************/
261
is_empty_128bit(uint8_t * data)262 static bool is_empty_128bit(uint8_t* data) {
263 static const uint8_t zero[16] = {0};
264 return !memcmp(zero, data, sizeof(zero));
265 }
266
is_bonding_or_sdp()267 static bool is_bonding_or_sdp() {
268 return pairing_cb.state == BT_BOND_STATE_BONDING ||
269 (pairing_cb.state == BT_BOND_STATE_BONDED && pairing_cb.sdp_attempts);
270 }
271
btif_dm_data_copy(uint16_t event,char * dst,char * src)272 static void btif_dm_data_copy(uint16_t event, char* dst, char* src) {
273 tBTA_DM_SEC* dst_dm_sec = (tBTA_DM_SEC*)dst;
274 tBTA_DM_SEC* src_dm_sec = (tBTA_DM_SEC*)src;
275
276 if (!src_dm_sec) return;
277
278 CHECK(dst_dm_sec);
279 maybe_non_aligned_memcpy(dst_dm_sec, src_dm_sec, sizeof(*src_dm_sec));
280
281 if (event == BTA_DM_BLE_KEY_EVT) {
282 dst_dm_sec->ble_key.p_key_value =
283 (tBTM_LE_KEY_VALUE*)osi_malloc(sizeof(tBTM_LE_KEY_VALUE));
284 CHECK(src_dm_sec->ble_key.p_key_value);
285 memcpy(dst_dm_sec->ble_key.p_key_value, src_dm_sec->ble_key.p_key_value,
286 sizeof(tBTM_LE_KEY_VALUE));
287 }
288 }
289
btif_dm_data_free(uint16_t event,tBTA_DM_SEC * dm_sec)290 static void btif_dm_data_free(uint16_t event, tBTA_DM_SEC* dm_sec) {
291 if (event == BTA_DM_BLE_KEY_EVT)
292 osi_free_and_reset((void**)&dm_sec->ble_key.p_key_value);
293 }
294
btif_dm_send_bond_state_changed(RawAddress address,bt_bond_state_t bond_state)295 static void btif_dm_send_bond_state_changed(RawAddress address, bt_bond_state_t bond_state) {
296 do_in_jni_thread(FROM_HERE, base::BindOnce([](RawAddress address, bt_bond_state_t bond_state) {
297 btif_stats_add_bond_event(address, BTIF_DM_FUNC_BOND_STATE_CHANGED, bond_state);
298 if (bond_state == BT_BOND_STATE_NONE) {
299 MetricIdAllocator::GetInstance().ForgetDevice(address);
300 } else if (bond_state == BT_BOND_STATE_BONDED) {
301 MetricIdAllocator::GetInstance().AllocateId(address);
302 if (!MetricIdAllocator::GetInstance().SaveDevice(address)) {
303 LOG(FATAL) << __func__ << ": Fail to save metric id for device "
304 << address;
305 }
306 }
307 HAL_CBACK(bt_hal_cbacks, bond_state_changed_cb, BT_STATUS_SUCCESS, &address, bond_state);
308 }, address, bond_state));
309 btif_dm_get_remote_services_by_transport(&address, BTA_TRANSPORT_UNKNOWN);
310 }
311
btif_dm_init(uid_set_t * set)312 void btif_dm_init(uid_set_t* set) {
313 uid_set = set;
314 if (bluetooth::shim::is_gd_shim_enabled()) {
315 bluetooth::shim::BTIF_DM_SetUiCallback([](RawAddress address, bt_bdname_t bd_name, uint32_t cod, bt_ssp_variant_t pairing_variant, uint32_t pass_key) {
316 do_in_jni_thread(FROM_HERE, base::BindOnce([](RawAddress address, bt_bdname_t bd_name, uint32_t cod, bt_ssp_variant_t pairing_variant, uint32_t pass_key) {
317 LOG(ERROR) << __func__ << ": UI Callback fired!";
318
319 //TODO: java BondStateMachine requires change into bonding state. If we ever send this event separately, consider removing this line
320 HAL_CBACK(bt_hal_cbacks, bond_state_changed_cb, BT_STATUS_SUCCESS, &address, BT_BOND_STATE_BONDING);
321
322 if (pairing_variant == BT_SSP_VARIANT_PASSKEY_ENTRY) {
323 // For passkey entry we must actually use pin request, due to BluetoothPairingController (in Settings)
324 HAL_CBACK(bt_hal_cbacks, pin_request_cb, &address, &bd_name, cod, false);
325 return;
326 }
327
328 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &address, &bd_name, cod, pairing_variant, pass_key);
329 }, address, bd_name, cod, pairing_variant, pass_key));
330 });
331
332 bluetooth::shim::BTIF_RegisterBondStateChangeListener(
333 [](RawAddress address) {
334 btif_dm_send_bond_state_changed(address, BT_BOND_STATE_BONDING);
335 },
336 [](RawAddress address) {
337 btif_dm_send_bond_state_changed(address, BT_BOND_STATE_BONDED);
338 },
339 [](RawAddress address) {
340 btif_dm_send_bond_state_changed(address, BT_BOND_STATE_NONE);
341 });
342 }
343 }
344
btif_dm_cleanup(void)345 void btif_dm_cleanup(void) {
346 if (uid_set) {
347 uid_set_destroy(uid_set);
348 uid_set = NULL;
349 }
350 }
351
btif_in_execute_service_request(tBTA_SERVICE_ID service_id,bool b_enable)352 bt_status_t btif_in_execute_service_request(tBTA_SERVICE_ID service_id,
353 bool b_enable) {
354 BTIF_TRACE_DEBUG("%s service_id: %d", __func__, service_id);
355 /* Check the service_ID and invoke the profile's BT state changed API */
356 switch (service_id) {
357 case BTA_HFP_SERVICE_ID:
358 case BTA_HSP_SERVICE_ID: {
359 bluetooth::headset::ExecuteService(b_enable);
360 } break;
361 case BTA_A2DP_SOURCE_SERVICE_ID: {
362 btif_av_source_execute_service(b_enable);
363 } break;
364 case BTA_A2DP_SINK_SERVICE_ID: {
365 btif_av_sink_execute_service(b_enable);
366 } break;
367 case BTA_HID_SERVICE_ID: {
368 btif_hh_execute_service(b_enable);
369 } break;
370 case BTA_HFP_HS_SERVICE_ID: {
371 btif_hf_client_execute_service(b_enable);
372 } break;
373 case BTA_SDP_SERVICE_ID: {
374 btif_sdp_execute_service(b_enable);
375 } break;
376 case BTA_HIDD_SERVICE_ID: {
377 btif_hd_execute_service(b_enable);
378 } break;
379 default:
380 BTIF_TRACE_ERROR("%s: Unknown service %d being %s", __func__, service_id,
381 (b_enable) ? "enabled" : "disabled");
382 return BT_STATUS_FAIL;
383 }
384 return BT_STATUS_SUCCESS;
385 }
386
387 /*******************************************************************************
388 *
389 * Function check_eir_remote_name
390 *
391 * Description Check if remote name is in the EIR data
392 *
393 * Returns true if remote name found
394 * Populate p_remote_name, if provided and remote name found
395 *
396 ******************************************************************************/
check_eir_remote_name(tBTA_DM_SEARCH * p_search_data,uint8_t * p_remote_name,uint8_t * p_remote_name_len)397 static bool check_eir_remote_name(tBTA_DM_SEARCH* p_search_data,
398 uint8_t* p_remote_name,
399 uint8_t* p_remote_name_len) {
400 const uint8_t* p_eir_remote_name = NULL;
401 uint8_t remote_name_len = 0;
402
403 /* Check EIR for remote name and services */
404 if (p_search_data->inq_res.p_eir) {
405 p_eir_remote_name = AdvertiseDataParser::GetFieldByType(
406 p_search_data->inq_res.p_eir, p_search_data->inq_res.eir_len,
407 BTM_EIR_COMPLETE_LOCAL_NAME_TYPE, &remote_name_len);
408 if (!p_eir_remote_name) {
409 p_eir_remote_name = AdvertiseDataParser::GetFieldByType(
410 p_search_data->inq_res.p_eir, p_search_data->inq_res.eir_len,
411 BTM_EIR_SHORTENED_LOCAL_NAME_TYPE, &remote_name_len);
412 }
413
414 if (p_eir_remote_name) {
415 if (remote_name_len > BD_NAME_LEN) remote_name_len = BD_NAME_LEN;
416
417 if (p_remote_name && p_remote_name_len) {
418 memcpy(p_remote_name, p_eir_remote_name, remote_name_len);
419 *(p_remote_name + remote_name_len) = 0;
420 *p_remote_name_len = remote_name_len;
421 }
422
423 return true;
424 }
425 }
426
427 return false;
428 }
429
430 /*******************************************************************************
431 *
432 * Function check_cached_remote_name
433 *
434 * Description Check if remote name is in the NVRAM cache
435 *
436 * Returns true if remote name found
437 * Populate p_remote_name, if provided and remote name found
438 *
439 ******************************************************************************/
check_cached_remote_name(tBTA_DM_SEARCH * p_search_data,uint8_t * p_remote_name,uint8_t * p_remote_name_len)440 static bool check_cached_remote_name(tBTA_DM_SEARCH* p_search_data,
441 uint8_t* p_remote_name,
442 uint8_t* p_remote_name_len) {
443 bt_bdname_t bdname;
444 bt_property_t prop_name;
445
446 /* check if we already have it in our btif_storage cache */
447
448 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_BDNAME,
449 sizeof(bt_bdname_t), &bdname);
450 if (btif_storage_get_remote_device_property(
451 &p_search_data->inq_res.bd_addr, &prop_name) == BT_STATUS_SUCCESS) {
452 if (p_remote_name && p_remote_name_len) {
453 strcpy((char*)p_remote_name, (char*)bdname.name);
454 *p_remote_name_len = strlen((char*)p_remote_name);
455 }
456 return true;
457 }
458
459 return false;
460 }
461
get_cod(const RawAddress * remote_bdaddr)462 static uint32_t get_cod(const RawAddress* remote_bdaddr) {
463 uint32_t remote_cod;
464 bt_property_t prop_name;
465
466 /* check if we already have it in our btif_storage cache */
467 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_CLASS_OF_DEVICE,
468 sizeof(uint32_t), &remote_cod);
469 if (btif_storage_get_remote_device_property(
470 (RawAddress*)remote_bdaddr, &prop_name) == BT_STATUS_SUCCESS) {
471 LOG_INFO("%s remote_cod = 0x%08x", __func__, remote_cod);
472 return remote_cod & COD_MASK;
473 }
474
475 return 0;
476 }
477
check_cod(const RawAddress * remote_bdaddr,uint32_t cod)478 bool check_cod(const RawAddress* remote_bdaddr, uint32_t cod) {
479 return get_cod(remote_bdaddr) == cod;
480 }
481
check_cod_hid(const RawAddress * remote_bdaddr)482 bool check_cod_hid(const RawAddress* remote_bdaddr) {
483 return (get_cod(remote_bdaddr) & COD_HID_MASK) == COD_HID_MAJOR;
484 }
485
check_hid_le(const RawAddress * remote_bdaddr)486 bool check_hid_le(const RawAddress* remote_bdaddr) {
487 uint32_t remote_dev_type;
488 bt_property_t prop_name;
489
490 /* check if we already have it in our btif_storage cache */
491 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_TYPE_OF_DEVICE,
492 sizeof(uint32_t), &remote_dev_type);
493 if (btif_storage_get_remote_device_property(
494 (RawAddress*)remote_bdaddr, &prop_name) == BT_STATUS_SUCCESS) {
495 if (remote_dev_type == BT_DEVICE_DEVTYPE_BLE) {
496 if (btif_config_exist(remote_bdaddr->ToString().c_str(), "HidAppId"))
497 return true;
498 }
499 }
500 return false;
501 }
502
503 /*****************************************************************************
504 *
505 * Function check_sdp_bl
506 *
507 * Description Checks if a given device is blacklisted to skip sdp
508 *
509 * Parameters skip_sdp_entry
510 *
511 * Returns true if the device is present in blacklist, else false
512 *
513 ******************************************************************************/
check_sdp_bl(const RawAddress * remote_bdaddr)514 bool check_sdp_bl(const RawAddress* remote_bdaddr) {
515 uint16_t manufacturer = 0;
516 uint8_t lmp_ver = 0;
517 uint16_t lmp_subver = 0;
518 bt_property_t prop_name;
519 bt_remote_version_t info;
520
521 if (remote_bdaddr == NULL) return false;
522
523 /* fetch additional info about remote device used in iop query */
524 BTM_ReadRemoteVersion(*remote_bdaddr, &lmp_ver, &manufacturer, &lmp_subver);
525
526 /* if not available yet, try fetching from config database */
527 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_REMOTE_VERSION_INFO,
528 sizeof(bt_remote_version_t), &info);
529
530 if (btif_storage_get_remote_device_property(remote_bdaddr, &prop_name) !=
531 BT_STATUS_SUCCESS) {
532 return false;
533 }
534 manufacturer = info.manufacturer;
535
536 for (unsigned int i = 0; i < ARRAY_SIZE(sdp_blacklist); i++) {
537 if (manufacturer == sdp_blacklist[i].manufact_id) return true;
538 }
539 return false;
540 }
541
bond_state_changed(bt_status_t status,const RawAddress & bd_addr,bt_bond_state_t state)542 static void bond_state_changed(bt_status_t status, const RawAddress& bd_addr,
543 bt_bond_state_t state) {
544 btif_stats_add_bond_event(bd_addr, BTIF_DM_FUNC_BOND_STATE_CHANGED, state);
545
546 if ((pairing_cb.state == state) && (state == BT_BOND_STATE_BONDING)) {
547 // Cross key pairing so send callback for static address
548 if (!pairing_cb.static_bdaddr.IsEmpty()) {
549 auto tmp = bd_addr;
550 HAL_CBACK(bt_hal_cbacks, bond_state_changed_cb, status, &tmp, state);
551 }
552 return;
553 }
554
555 if (pairing_cb.bond_type == BOND_TYPE_TEMPORARY) state = BT_BOND_STATE_NONE;
556
557 BTIF_TRACE_DEBUG("%s: state=%d, prev_state=%d, sdp_attempts = %d", __func__,
558 state, pairing_cb.state, pairing_cb.sdp_attempts);
559
560 if (state == BT_BOND_STATE_NONE) {
561 MetricIdAllocator::GetInstance().ForgetDevice(bd_addr);
562 } else if (state == BT_BOND_STATE_BONDED) {
563 MetricIdAllocator::GetInstance().AllocateId(bd_addr);
564 if (!MetricIdAllocator::GetInstance().SaveDevice(bd_addr)) {
565 LOG(FATAL) << __func__ << ": Fail to save metric id for device "
566 << bd_addr;
567 }
568 }
569 auto tmp = bd_addr;
570 HAL_CBACK(bt_hal_cbacks, bond_state_changed_cb, status, &tmp, state);
571
572 int dev_type;
573 if (!btif_get_device_type(bd_addr, &dev_type)) {
574 dev_type = BT_DEVICE_TYPE_BREDR;
575 }
576
577 if (state == BT_BOND_STATE_BONDING ||
578 (state == BT_BOND_STATE_BONDED && pairing_cb.sdp_attempts > 0)) {
579 // Save state for the device is bonding or SDP.
580 pairing_cb.state = state;
581 pairing_cb.bd_addr = bd_addr;
582 } else {
583 pairing_cb = {};
584 }
585 }
586
587 /* store remote version in bt config to always have access
588 to it post pairing*/
btif_update_remote_version_property(RawAddress * p_bd)589 static void btif_update_remote_version_property(RawAddress* p_bd) {
590 bt_property_t property;
591 uint8_t lmp_ver = 0;
592 uint16_t lmp_subver = 0;
593 uint16_t mfct_set = 0;
594 tBTM_STATUS btm_status;
595 bt_remote_version_t info;
596 bt_status_t status;
597
598 btm_status = BTM_ReadRemoteVersion(*p_bd, &lmp_ver, &mfct_set, &lmp_subver);
599
600 LOG_DEBUG("remote version info [%s]: %x, %x, %x", p_bd->ToString().c_str(),
601 lmp_ver, mfct_set, lmp_subver);
602
603 if (btm_status == BTM_SUCCESS) {
604 // Always update cache to ensure we have availability whenever BTM API is
605 // not populated
606 info.manufacturer = mfct_set;
607 info.sub_ver = lmp_subver;
608 info.version = lmp_ver;
609 BTIF_STORAGE_FILL_PROPERTY(&property, BT_PROPERTY_REMOTE_VERSION_INFO,
610 sizeof(bt_remote_version_t), &info);
611 status = btif_storage_set_remote_device_property(p_bd, &property);
612 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote version",
613 status);
614 }
615 }
616
btif_update_remote_properties(const RawAddress & bdaddr,BD_NAME bd_name,DEV_CLASS dev_class,tBT_DEVICE_TYPE device_type)617 static void btif_update_remote_properties(const RawAddress& bdaddr,
618 BD_NAME bd_name, DEV_CLASS dev_class,
619 tBT_DEVICE_TYPE device_type) {
620 int num_properties = 0;
621 bt_property_t properties[3];
622 bt_status_t status;
623 uint32_t cod;
624 bt_device_type_t dev_type;
625
626 memset(properties, 0, sizeof(properties));
627
628 /* remote name */
629 if (strlen((const char*)bd_name)) {
630 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties], BT_PROPERTY_BDNAME,
631 strlen((char*)bd_name), bd_name);
632 status = btif_storage_set_remote_device_property(
633 &bdaddr, &properties[num_properties]);
634 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device name",
635 status);
636 num_properties++;
637 }
638
639 /* class of device */
640 cod = devclass2uint(dev_class);
641 BTIF_TRACE_DEBUG("%s cod is 0x%06x", __func__, cod);
642 if (cod == 0) {
643 /* Try to retrieve cod from storage */
644 BTIF_TRACE_DEBUG("%s cod is 0, checking cod from storage", __func__);
645 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
646 BT_PROPERTY_CLASS_OF_DEVICE, sizeof(cod), &cod);
647 status = btif_storage_get_remote_device_property(
648 &bdaddr, &properties[num_properties]);
649 BTIF_TRACE_DEBUG("%s cod retrieved from storage is 0x%06x", __func__, cod);
650 if (cod == 0) {
651 BTIF_TRACE_DEBUG("%s cod is again 0, set as unclassified", __func__);
652 cod = COD_UNCLASSIFIED;
653 }
654 }
655
656 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
657 BT_PROPERTY_CLASS_OF_DEVICE, sizeof(cod), &cod);
658 status = btif_storage_set_remote_device_property(&bdaddr,
659 &properties[num_properties]);
660 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device class",
661 status);
662 num_properties++;
663
664 /* device type */
665 bt_property_t prop_name;
666 uint8_t remote_dev_type;
667 BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_TYPE_OF_DEVICE,
668 sizeof(uint8_t), &remote_dev_type);
669 if (btif_storage_get_remote_device_property(&bdaddr, &prop_name) ==
670 BT_STATUS_SUCCESS)
671 dev_type = (bt_device_type_t)(remote_dev_type | device_type);
672 else
673 dev_type = (bt_device_type_t)device_type;
674
675 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
676 BT_PROPERTY_TYPE_OF_DEVICE, sizeof(dev_type),
677 &dev_type);
678 status = btif_storage_set_remote_device_property(&bdaddr,
679 &properties[num_properties]);
680 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device type",
681 status);
682 num_properties++;
683
684 auto tmp = bdaddr;
685 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, status, &tmp,
686 num_properties, properties);
687 }
688
689 /*******************************************************************************
690 *
691 * Function btif_dm_cb_hid_remote_name
692 *
693 * Description Remote name callback for HID device. Called in btif context
694 * Special handling for HID devices
695 *
696 * Returns void
697 *
698 ******************************************************************************/
btif_dm_cb_hid_remote_name(tBTM_REMOTE_DEV_NAME * p_remote_name)699 static void btif_dm_cb_hid_remote_name(tBTM_REMOTE_DEV_NAME* p_remote_name) {
700 BTIF_TRACE_DEBUG("%s: status=%d pairing_cb.state=%d", __func__,
701 p_remote_name->status, pairing_cb.state);
702 if (pairing_cb.state == BT_BOND_STATE_BONDING) {
703 if (p_remote_name->status == BTM_SUCCESS) {
704 bond_state_changed(BT_STATUS_SUCCESS, pairing_cb.bd_addr,
705 BT_BOND_STATE_BONDED);
706 } else
707 bond_state_changed(BT_STATUS_FAIL, pairing_cb.bd_addr,
708 BT_BOND_STATE_NONE);
709 }
710 }
711
712 /*******************************************************************************
713 *
714 * Function btif_dm_cb_create_bond
715 *
716 * Description Create bond initiated from the BTIF thread context
717 * Special handling for HID devices
718 *
719 * Returns void
720 *
721 ******************************************************************************/
btif_dm_cb_create_bond(const RawAddress & bd_addr,tBTA_TRANSPORT transport)722 static void btif_dm_cb_create_bond(const RawAddress& bd_addr,
723 tBTA_TRANSPORT transport) {
724 bool is_hid = check_cod(&bd_addr, COD_HID_POINTING);
725 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
726
727 int device_type = 0;
728 int addr_type;
729 std::string addrstr = bd_addr.ToString();
730 const char* bdstr = addrstr.c_str();
731 if (transport == BT_TRANSPORT_LE) {
732 if (!btif_config_get_int(bdstr, "DevType", &device_type)) {
733 btif_config_set_int(bdstr, "DevType", BT_DEVICE_TYPE_BLE);
734 }
735 if (btif_storage_get_remote_addr_type(&bd_addr, &addr_type) !=
736 BT_STATUS_SUCCESS) {
737 // Try to read address type. OOB pairing might have set it earlier, but
738 // didn't store it, it defaults to BLE_ADDR_PUBLIC
739 uint8_t tmp_dev_type;
740 uint8_t tmp_addr_type;
741 BTM_ReadDevInfo(bd_addr, &tmp_dev_type, &tmp_addr_type);
742 addr_type = tmp_addr_type;
743
744 btif_storage_set_remote_addr_type(&bd_addr, addr_type);
745 }
746 }
747 if ((btif_config_get_int(bdstr, "DevType", &device_type) &&
748 (btif_storage_get_remote_addr_type(&bd_addr, &addr_type) ==
749 BT_STATUS_SUCCESS) &&
750 (device_type & BT_DEVICE_TYPE_BLE) == BT_DEVICE_TYPE_BLE) ||
751 (transport == BT_TRANSPORT_LE)) {
752 BTA_DmAddBleDevice(bd_addr, addr_type, device_type);
753 }
754
755 if (is_hid && (device_type & BT_DEVICE_TYPE_BLE) == 0) {
756 bt_status_t status;
757 status = (bt_status_t)btif_hh_connect(&bd_addr);
758 if (status != BT_STATUS_SUCCESS)
759 bond_state_changed(status, bd_addr, BT_BOND_STATE_NONE);
760 } else {
761 BTA_DmBond(bd_addr, addr_type, transport, device_type);
762 }
763 /* Track originator of bond creation */
764 pairing_cb.is_local_initiated = true;
765 }
766
767 /*******************************************************************************
768 *
769 * Function btif_dm_cb_remove_bond
770 *
771 * Description remove bond initiated from the BTIF thread context
772 * Special handling for HID devices
773 *
774 * Returns void
775 *
776 ******************************************************************************/
btif_dm_cb_remove_bond(const RawAddress * bd_addr)777 void btif_dm_cb_remove_bond(const RawAddress* bd_addr) {
778 /*special handling for HID devices */
779 /* VUP needs to be sent if its a HID Device. The HID HOST module will check if
780 there
781 is a valid hid connection with this bd_addr. If yes VUP will be issued.*/
782 #if (BTA_HH_INCLUDED == TRUE)
783 if (btif_hh_virtual_unplug(bd_addr) != BT_STATUS_SUCCESS)
784 #endif
785 {
786 BTIF_TRACE_DEBUG("%s: Removing HH device", __func__);
787 BTA_DmRemoveDevice(*bd_addr);
788 }
789 }
790
791 /*******************************************************************************
792 *
793 * Function btif_dm_get_connection_state
794 *
795 * Description Returns whether the remote device is currently connected
796 * and whether encryption is active for the connection
797 *
798 * Returns 0 if not connected; 1 if connected and > 1 if connection is
799 * encrypted
800 *
801 ******************************************************************************/
btif_dm_get_connection_state(const RawAddress * bd_addr)802 uint16_t btif_dm_get_connection_state(const RawAddress* bd_addr) {
803 uint16_t rc = BTA_DmGetConnectionState(*bd_addr);
804
805 if (rc != 0) {
806 uint8_t flags = 0;
807
808 BTM_GetSecurityFlagsByTransport(*bd_addr, &flags, BT_TRANSPORT_BR_EDR);
809 BTIF_TRACE_DEBUG("%s: security flags (BR/EDR)=0x%02x", __func__, flags);
810 if (flags & BTM_SEC_FLAG_ENCRYPTED) rc |= ENCRYPTED_BREDR;
811
812 BTM_GetSecurityFlagsByTransport(*bd_addr, &flags, BT_TRANSPORT_LE);
813 BTIF_TRACE_DEBUG("%s: security flags (LE)=0x%02x", __func__, flags);
814 if (flags & BTM_SEC_FLAG_ENCRYPTED) rc |= ENCRYPTED_LE;
815 }
816
817 return rc;
818 }
819
820 /*******************************************************************************
821 *
822 * Function search_devices_copy_cb
823 *
824 * Description Deep copy callback for search devices event
825 *
826 * Returns void
827 *
828 ******************************************************************************/
search_devices_copy_cb(uint16_t event,char * p_dest,char * p_src)829 static void search_devices_copy_cb(uint16_t event, char* p_dest, char* p_src) {
830 tBTA_DM_SEARCH* p_dest_data = (tBTA_DM_SEARCH*)p_dest;
831 tBTA_DM_SEARCH* p_src_data = (tBTA_DM_SEARCH*)p_src;
832
833 if (!p_src) return;
834
835 BTIF_TRACE_DEBUG("%s: event=%s", __func__, dump_dm_search_event(event));
836 maybe_non_aligned_memcpy(p_dest_data, p_src_data, sizeof(*p_src_data));
837 switch (event) {
838 case BTA_DM_INQ_RES_EVT: {
839 if (p_src_data->inq_res.p_eir) {
840 p_dest_data->inq_res.p_eir =
841 (uint8_t*)(p_dest + sizeof(tBTA_DM_SEARCH));
842 memcpy(p_dest_data->inq_res.p_eir, p_src_data->inq_res.p_eir,
843 p_src_data->inq_res.eir_len);
844 p_dest_data->inq_res.eir_len = p_src_data->inq_res.eir_len;
845 }
846 } break;
847
848 case BTA_DM_DISC_RES_EVT: {
849 if (p_src_data->disc_res.raw_data_size &&
850 p_src_data->disc_res.p_raw_data) {
851 p_dest_data->disc_res.p_raw_data =
852 (uint8_t*)(p_dest + sizeof(tBTA_DM_SEARCH));
853 memcpy(p_dest_data->disc_res.p_raw_data,
854 p_src_data->disc_res.p_raw_data,
855 p_src_data->disc_res.raw_data_size);
856 }
857 } break;
858 }
859 }
860
search_services_copy_cb(uint16_t event,char * p_dest,char * p_src)861 static void search_services_copy_cb(uint16_t event, char* p_dest, char* p_src) {
862 tBTA_DM_SEARCH* p_dest_data = (tBTA_DM_SEARCH*)p_dest;
863 tBTA_DM_SEARCH* p_src_data = (tBTA_DM_SEARCH*)p_src;
864
865 if (!p_src) return;
866 maybe_non_aligned_memcpy(p_dest_data, p_src_data, sizeof(*p_src_data));
867 switch (event) {
868 case BTA_DM_DISC_RES_EVT: {
869 if (p_src_data->disc_res.result == BTA_SUCCESS) {
870 if (p_src_data->disc_res.num_uuids > 0) {
871 p_dest_data->disc_res.p_uuid_list =
872 (Uuid*)(p_dest + sizeof(tBTA_DM_SEARCH));
873 memcpy(p_dest_data->disc_res.p_uuid_list,
874 p_src_data->disc_res.p_uuid_list,
875 p_src_data->disc_res.num_uuids * sizeof(Uuid));
876 osi_free_and_reset((void**)&p_src_data->disc_res.p_uuid_list);
877 }
878 osi_free_and_reset((void**)&p_src_data->disc_res.p_raw_data);
879 }
880 } break;
881 }
882 }
883 /******************************************************************************
884 *
885 * BTIF DM callback events
886 *
887 ****************************************************************************/
888
889 /*******************************************************************************
890 *
891 * Function btif_dm_pin_req_evt
892 *
893 * Description Executes pin request event in btif context
894 *
895 * Returns void
896 *
897 ******************************************************************************/
btif_dm_pin_req_evt(tBTA_DM_PIN_REQ * p_pin_req)898 static void btif_dm_pin_req_evt(tBTA_DM_PIN_REQ* p_pin_req) {
899 bt_bdname_t bd_name;
900 uint32_t cod;
901 bt_pin_code_t pin_code;
902 int dev_type;
903
904 /* Remote properties update */
905 if (!btif_get_device_type(p_pin_req->bd_addr, &dev_type)) {
906 dev_type = BT_DEVICE_TYPE_BREDR;
907 }
908 btif_update_remote_properties(p_pin_req->bd_addr, p_pin_req->bd_name,
909 p_pin_req->dev_class,
910 (tBT_DEVICE_TYPE)dev_type);
911
912 const RawAddress& bd_addr = p_pin_req->bd_addr;
913 memcpy(bd_name.name, p_pin_req->bd_name, BD_NAME_LEN);
914
915 if (pairing_cb.state == BT_BOND_STATE_BONDING &&
916 bd_addr != pairing_cb.bd_addr) {
917 BTIF_TRACE_WARNING("%s(): already in bonding state, reject request",
918 __FUNCTION__);
919 btif_dm_pin_reply(&bd_addr, 0, 0, NULL);
920 return;
921 }
922
923 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
924
925 cod = devclass2uint(p_pin_req->dev_class);
926
927 if (cod == 0) {
928 BTIF_TRACE_DEBUG("%s cod is 0, set as unclassified", __func__);
929 cod = COD_UNCLASSIFIED;
930 }
931
932 /* check for auto pair possiblity only if bond was initiated by local device
933 */
934 if (pairing_cb.is_local_initiated && !p_pin_req->min_16_digit) {
935 if (check_cod(&bd_addr, COD_AV_HEADSETS) ||
936 check_cod(&bd_addr, COD_AV_HEADPHONES) ||
937 check_cod(&bd_addr, COD_AV_PORTABLE_AUDIO) ||
938 check_cod(&bd_addr, COD_AV_HIFI_AUDIO) ||
939 check_cod(&bd_addr, COD_HID_POINTING)) {
940 /* Check if this device can be auto paired */
941 if (!interop_match_addr(INTEROP_DISABLE_AUTO_PAIRING, &bd_addr) &&
942 !interop_match_name(INTEROP_DISABLE_AUTO_PAIRING,
943 (const char*)bd_name.name) &&
944 (pairing_cb.autopair_attempts == 0)) {
945 BTIF_TRACE_DEBUG("%s() Attempting auto pair", __func__);
946 pin_code.pin[0] = 0x30;
947 pin_code.pin[1] = 0x30;
948 pin_code.pin[2] = 0x30;
949 pin_code.pin[3] = 0x30;
950
951 pairing_cb.autopair_attempts++;
952 BTA_DmPinReply(bd_addr, true, 4, pin_code.pin);
953 return;
954 }
955 } else if (check_cod(&bd_addr, COD_HID_KEYBOARD) ||
956 check_cod(&bd_addr, COD_HID_COMBO)) {
957 if ((interop_match_addr(INTEROP_KEYBOARD_REQUIRES_FIXED_PIN, &bd_addr) ==
958 true) &&
959 (pairing_cb.autopair_attempts == 0)) {
960 BTIF_TRACE_DEBUG("%s() Attempting auto pair", __func__);
961 pin_code.pin[0] = 0x30;
962 pin_code.pin[1] = 0x30;
963 pin_code.pin[2] = 0x30;
964 pin_code.pin[3] = 0x30;
965
966 pairing_cb.autopair_attempts++;
967 BTA_DmPinReply(bd_addr, true, 4, pin_code.pin);
968 return;
969 }
970 }
971 }
972 // TODO: make cback accept const and get rid of tmp!
973 auto tmp = bd_addr;
974 HAL_CBACK(bt_hal_cbacks, pin_request_cb, &tmp, &bd_name, cod,
975 p_pin_req->min_16_digit);
976 }
977
978 /*******************************************************************************
979 *
980 * Function btif_dm_ssp_cfm_req_evt
981 *
982 * Description Executes SSP confirm request event in btif context
983 *
984 * Returns void
985 *
986 ******************************************************************************/
btif_dm_ssp_cfm_req_evt(tBTA_DM_SP_CFM_REQ * p_ssp_cfm_req)987 static void btif_dm_ssp_cfm_req_evt(tBTA_DM_SP_CFM_REQ* p_ssp_cfm_req) {
988 bt_bdname_t bd_name;
989 uint32_t cod;
990 bool is_incoming = !(pairing_cb.state == BT_BOND_STATE_BONDING);
991 int dev_type;
992
993 BTIF_TRACE_DEBUG("%s", __func__);
994
995 /* Remote properties update */
996 if (!btif_get_device_type(p_ssp_cfm_req->bd_addr, &dev_type)) {
997 dev_type = BT_DEVICE_TYPE_BREDR;
998 }
999 btif_update_remote_properties(p_ssp_cfm_req->bd_addr, p_ssp_cfm_req->bd_name,
1000 p_ssp_cfm_req->dev_class,
1001 (tBT_DEVICE_TYPE)dev_type);
1002
1003 RawAddress bd_addr = p_ssp_cfm_req->bd_addr;
1004 memcpy(bd_name.name, p_ssp_cfm_req->bd_name, BD_NAME_LEN);
1005
1006 if (pairing_cb.state == BT_BOND_STATE_BONDING &&
1007 bd_addr != pairing_cb.bd_addr) {
1008 BTIF_TRACE_WARNING("%s(): already in bonding state, reject request",
1009 __FUNCTION__);
1010 btif_dm_ssp_reply(&bd_addr, BT_SSP_VARIANT_PASSKEY_CONFIRMATION, 0, 0);
1011 return;
1012 }
1013
1014 /* Set the pairing_cb based on the local & remote authentication requirements
1015 */
1016 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
1017
1018 BTIF_TRACE_EVENT("%s: just_works:%d, loc_auth_req=%d, rmt_auth_req=%d",
1019 __func__, p_ssp_cfm_req->just_works,
1020 p_ssp_cfm_req->loc_auth_req, p_ssp_cfm_req->rmt_auth_req);
1021
1022 /* if just_works and bonding bit is not set treat this as temporary */
1023 if (p_ssp_cfm_req->just_works &&
1024 !(p_ssp_cfm_req->loc_auth_req & BTM_AUTH_BONDS) &&
1025 !(p_ssp_cfm_req->rmt_auth_req & BTM_AUTH_BONDS) &&
1026 !(check_cod((RawAddress*)&p_ssp_cfm_req->bd_addr, COD_HID_POINTING)))
1027 pairing_cb.bond_type = BOND_TYPE_TEMPORARY;
1028 else
1029 pairing_cb.bond_type = BOND_TYPE_PERSISTENT;
1030
1031 btm_set_bond_type_dev(p_ssp_cfm_req->bd_addr, pairing_cb.bond_type);
1032
1033 pairing_cb.is_ssp = true;
1034
1035 /* If JustWorks auto-accept */
1036 if (p_ssp_cfm_req->just_works) {
1037 /* Pairing consent for JustWorks NOT needed if:
1038 * 1. Incoming temporary pairing is detected
1039 */
1040 if (is_incoming && pairing_cb.bond_type == BOND_TYPE_TEMPORARY) {
1041 BTIF_TRACE_EVENT(
1042 "%s: Auto-accept JustWorks pairing for temporary incoming", __func__);
1043 btif_dm_ssp_reply(&bd_addr, BT_SSP_VARIANT_CONSENT, true, 0);
1044 return;
1045 }
1046 }
1047
1048 cod = devclass2uint(p_ssp_cfm_req->dev_class);
1049
1050 if (cod == 0) {
1051 LOG_DEBUG("%s cod is 0, set as unclassified", __func__);
1052 cod = COD_UNCLASSIFIED;
1053 }
1054
1055 pairing_cb.sdp_attempts = 0;
1056 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
1057 (p_ssp_cfm_req->just_works ? BT_SSP_VARIANT_CONSENT
1058 : BT_SSP_VARIANT_PASSKEY_CONFIRMATION),
1059 p_ssp_cfm_req->num_val);
1060 }
1061
btif_dm_ssp_key_notif_evt(tBTA_DM_SP_KEY_NOTIF * p_ssp_key_notif)1062 static void btif_dm_ssp_key_notif_evt(tBTA_DM_SP_KEY_NOTIF* p_ssp_key_notif) {
1063 bt_bdname_t bd_name;
1064 uint32_t cod;
1065 int dev_type;
1066
1067 BTIF_TRACE_DEBUG("%s", __func__);
1068
1069 /* Remote properties update */
1070 if (!btif_get_device_type(p_ssp_key_notif->bd_addr, &dev_type)) {
1071 dev_type = BT_DEVICE_TYPE_BREDR;
1072 }
1073 btif_update_remote_properties(
1074 p_ssp_key_notif->bd_addr, p_ssp_key_notif->bd_name,
1075 p_ssp_key_notif->dev_class, (tBT_DEVICE_TYPE)dev_type);
1076
1077 RawAddress bd_addr = p_ssp_key_notif->bd_addr;
1078 memcpy(bd_name.name, p_ssp_key_notif->bd_name, BD_NAME_LEN);
1079
1080 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
1081 pairing_cb.is_ssp = true;
1082 cod = devclass2uint(p_ssp_key_notif->dev_class);
1083
1084 if (cod == 0) {
1085 LOG_DEBUG("%s cod is 0, set as unclassified", __func__);
1086 cod = COD_UNCLASSIFIED;
1087 }
1088
1089 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
1090 BT_SSP_VARIANT_PASSKEY_NOTIFICATION, p_ssp_key_notif->passkey);
1091 }
1092 /*******************************************************************************
1093 *
1094 * Function btif_dm_auth_cmpl_evt
1095 *
1096 * Description Executes authentication complete event in btif context
1097 *
1098 * Returns void
1099 *
1100 ******************************************************************************/
btif_dm_auth_cmpl_evt(tBTA_DM_AUTH_CMPL * p_auth_cmpl)1101 static void btif_dm_auth_cmpl_evt(tBTA_DM_AUTH_CMPL* p_auth_cmpl) {
1102 /* Save link key, if not temporary */
1103 bt_status_t status = BT_STATUS_FAIL;
1104 bt_bond_state_t state = BT_BOND_STATE_NONE;
1105 bool skip_sdp = false;
1106
1107 BTIF_TRACE_DEBUG("%s: bond state=%d, success=%d, key_present=%d", __func__,
1108 pairing_cb.state, p_auth_cmpl->success,
1109 p_auth_cmpl->key_present);
1110
1111 RawAddress bd_addr = p_auth_cmpl->bd_addr;
1112 if ((p_auth_cmpl->success) && (p_auth_cmpl->key_present)) {
1113 if ((p_auth_cmpl->key_type < HCI_LKEY_TYPE_DEBUG_COMB) ||
1114 (p_auth_cmpl->key_type == HCI_LKEY_TYPE_AUTH_COMB) ||
1115 (p_auth_cmpl->key_type == HCI_LKEY_TYPE_CHANGED_COMB) ||
1116 (p_auth_cmpl->key_type == HCI_LKEY_TYPE_AUTH_COMB_P_256) ||
1117 pairing_cb.bond_type == BOND_TYPE_PERSISTENT) {
1118 bt_status_t ret;
1119 BTIF_TRACE_DEBUG("%s: Storing link key. key_type=0x%x, bond_type=%d",
1120 __func__, p_auth_cmpl->key_type, pairing_cb.bond_type);
1121 ret = btif_storage_add_bonded_device(&bd_addr, p_auth_cmpl->key,
1122 p_auth_cmpl->key_type,
1123 pairing_cb.pin_code_len);
1124 ASSERTC(ret == BT_STATUS_SUCCESS, "storing link key failed", ret);
1125 } else {
1126 BTIF_TRACE_DEBUG(
1127 "%s: Temporary key. Not storing. key_type=0x%x, bond_type=%d",
1128 __func__, p_auth_cmpl->key_type, pairing_cb.bond_type);
1129 if (pairing_cb.bond_type == BOND_TYPE_TEMPORARY) {
1130 BTIF_TRACE_DEBUG("%s: sending BT_BOND_STATE_NONE for Temp pairing",
1131 __func__);
1132 btif_storage_remove_bonded_device(&bd_addr);
1133 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_NONE);
1134 return;
1135 }
1136 }
1137 }
1138
1139 if (p_auth_cmpl->success) {
1140 // We could have received a new link key without going through the pairing
1141 // flow. If so, we don't want to perform SDP or any other operations on the
1142 // authenticated device. Also, make sure that the link key is not derived
1143 // from secure LTK, because we will need to perform SDP in case of link key
1144 // derivation to allow bond state change notification for the BR/EDR
1145 // transport so that the subsequent BR/EDR connections to the remote can use
1146 // the derived link key.
1147 if (p_auth_cmpl->bd_addr != pairing_cb.bd_addr &&
1148 (!pairing_cb.ble.is_penc_key_rcvd)) {
1149 LOG(INFO) << __func__
1150 << " skipping SDP since we did not initiate pairing to "
1151 << p_auth_cmpl->bd_addr;
1152 return;
1153 }
1154
1155 btif_storage_set_remote_addr_type(&bd_addr, p_auth_cmpl->addr_type);
1156 btif_update_remote_properties(p_auth_cmpl->bd_addr, p_auth_cmpl->bd_name,
1157 NULL, p_auth_cmpl->dev_type);
1158 pairing_cb.timeout_retries = 0;
1159 status = BT_STATUS_SUCCESS;
1160 state = BT_BOND_STATE_BONDED;
1161 bd_addr = p_auth_cmpl->bd_addr;
1162
1163 if (check_sdp_bl(&bd_addr) && check_cod_hid(&bd_addr)) {
1164 LOG_WARN("%s:skip SDP", __func__);
1165 skip_sdp = true;
1166 }
1167 if (!pairing_cb.is_local_initiated && skip_sdp) {
1168 bond_state_changed(status, bd_addr, state);
1169
1170 LOG_WARN("%s: Incoming HID Connection", __func__);
1171 bt_property_t prop;
1172 Uuid uuid = Uuid::From16Bit(UUID_SERVCLASS_HUMAN_INTERFACE);
1173
1174 prop.type = BT_PROPERTY_UUIDS;
1175 prop.val = &uuid;
1176 prop.len = Uuid::kNumBytes128;
1177
1178 /* Send the event to the BTIF */
1179 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1180 &bd_addr, 1, &prop);
1181 } else {
1182 bool is_crosskey = false;
1183 /* If bonded due to cross-key, save the static address too*/
1184 if (pairing_cb.state == BT_BOND_STATE_BONDING &&
1185 p_auth_cmpl->bd_addr != pairing_cb.bd_addr) {
1186 BTIF_TRACE_DEBUG(
1187 "%s: bonding initiated due to cross key, adding static address",
1188 __func__);
1189 pairing_cb.static_bdaddr = bd_addr;
1190 is_crosskey = true;
1191 }
1192 if (!is_crosskey ||
1193 !(stack_config_get_interface()->get_pts_crosskey_sdp_disable())) {
1194 // Ensure inquiry is stopped before attempting service discovery
1195 btif_dm_cancel_discovery();
1196
1197 /* Trigger SDP on the device */
1198 pairing_cb.sdp_attempts = 1;
1199
1200 if (is_crosskey) {
1201 // If bonding occurred due to cross-key pairing, send bonding callback
1202 // for static address now
1203 LOG_INFO("%s: send bonding state update for static address %s",
1204 __func__, bd_addr.ToString().c_str());
1205 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
1206 }
1207 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDED);
1208
1209 btif_dm_get_remote_services(bd_addr);
1210 }
1211 }
1212 // Do not call bond_state_changed_cb yet. Wait until remote service
1213 // discovery is complete
1214 } else {
1215 bool is_bonded_device_removed = false;
1216 // Map the HCI fail reason to bt status
1217 switch (p_auth_cmpl->fail_reason) {
1218 case HCI_ERR_PAGE_TIMEOUT:
1219 case HCI_ERR_LMP_RESPONSE_TIMEOUT:
1220 if (interop_match_addr(INTEROP_AUTO_RETRY_PAIRING, &bd_addr) &&
1221 pairing_cb.timeout_retries) {
1222 BTIF_TRACE_WARNING("%s() - Pairing timeout; retrying (%d) ...",
1223 __func__, pairing_cb.timeout_retries);
1224 --pairing_cb.timeout_retries;
1225 btif_dm_cb_create_bond(bd_addr, BTA_TRANSPORT_UNKNOWN);
1226 return;
1227 }
1228 FALLTHROUGH_INTENDED; /* FALLTHROUGH */
1229 case HCI_ERR_CONNECTION_TOUT:
1230 status = BT_STATUS_RMT_DEV_DOWN;
1231 break;
1232
1233 case HCI_ERR_PAIRING_NOT_ALLOWED:
1234 is_bonded_device_removed =
1235 (btif_storage_remove_bonded_device(&bd_addr) == BT_STATUS_SUCCESS);
1236 status = BT_STATUS_AUTH_REJECTED;
1237 break;
1238
1239 /* map the auth failure codes, so we can retry pairing if necessary */
1240 case HCI_ERR_AUTH_FAILURE:
1241 case HCI_ERR_KEY_MISSING:
1242 is_bonded_device_removed =
1243 (btif_storage_remove_bonded_device(&bd_addr) == BT_STATUS_SUCCESS);
1244 [[fallthrough]];
1245 case HCI_ERR_HOST_REJECT_SECURITY:
1246 case HCI_ERR_ENCRY_MODE_NOT_ACCEPTABLE:
1247 case HCI_ERR_UNIT_KEY_USED:
1248 case HCI_ERR_PAIRING_WITH_UNIT_KEY_NOT_SUPPORTED:
1249 case HCI_ERR_INSUFFCIENT_SECURITY:
1250 case HCI_ERR_PEER_USER:
1251 case HCI_ERR_UNSPECIFIED:
1252 BTIF_TRACE_DEBUG(" %s() Authentication fail reason %d", __func__,
1253 p_auth_cmpl->fail_reason);
1254 if (pairing_cb.autopair_attempts == 1) {
1255 /* Create the Bond once again */
1256 BTIF_TRACE_WARNING("%s() auto pair failed. Reinitiate Bond",
1257 __func__);
1258 btif_dm_cb_create_bond(bd_addr, BTA_TRANSPORT_UNKNOWN);
1259 return;
1260 } else {
1261 /* if autopair attempts are more than 1, or not attempted */
1262 status = BT_STATUS_AUTH_FAILURE;
1263 }
1264 break;
1265
1266 default:
1267 status = BT_STATUS_FAIL;
1268 }
1269 /* Special Handling for HID Devices */
1270 if (check_cod(&bd_addr, COD_HID_POINTING)) {
1271 /* Remove Device as bonded in nvram as authentication failed */
1272 BTIF_TRACE_DEBUG("%s(): removing hid pointing device from nvram",
1273 __func__);
1274 is_bonded_device_removed =
1275 (btif_storage_remove_bonded_device(&bd_addr) == BT_STATUS_SUCCESS);
1276 }
1277 // Report bond state change to java only if we are bonding to a device or
1278 // a device is removed from the pairing list.
1279 if (pairing_cb.state == BT_BOND_STATE_BONDING || is_bonded_device_removed) {
1280 bond_state_changed(status, bd_addr, state);
1281 }
1282 }
1283 }
1284
1285 /******************************************************************************
1286 *
1287 * Function btif_dm_search_devices_evt
1288 *
1289 * Description Executes search devices callback events in btif context
1290 *
1291 * Returns void
1292 *
1293 *****************************************************************************/
btif_dm_search_devices_evt(uint16_t event,char * p_param)1294 static void btif_dm_search_devices_evt(uint16_t event, char* p_param) {
1295 tBTA_DM_SEARCH* p_search_data;
1296 BTIF_TRACE_EVENT("%s event=%s", __func__, dump_dm_search_event(event));
1297
1298 switch (event) {
1299 case BTA_DM_DISC_RES_EVT: {
1300 p_search_data = (tBTA_DM_SEARCH*)p_param;
1301 /* Remote name update */
1302 if (strlen((const char*)p_search_data->disc_res.bd_name)) {
1303 bt_property_t properties[1];
1304 bt_status_t status;
1305
1306 properties[0].type = BT_PROPERTY_BDNAME;
1307 properties[0].val = p_search_data->disc_res.bd_name;
1308 properties[0].len = strlen((char*)p_search_data->disc_res.bd_name);
1309 RawAddress& bdaddr = p_search_data->disc_res.bd_addr;
1310
1311 status =
1312 btif_storage_set_remote_device_property(&bdaddr, &properties[0]);
1313 ASSERTC(status == BT_STATUS_SUCCESS,
1314 "failed to save remote device property", status);
1315 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, status, &bdaddr,
1316 1, properties);
1317 }
1318 /* TODO: Services? */
1319 } break;
1320
1321 case BTA_DM_INQ_RES_EVT: {
1322 /* inquiry result */
1323 bt_bdname_t bdname;
1324 uint8_t remote_name_len;
1325 tBTA_SERVICE_MASK services = 0;
1326
1327 p_search_data = (tBTA_DM_SEARCH*)p_param;
1328 RawAddress& bdaddr = p_search_data->inq_res.bd_addr;
1329
1330 BTIF_TRACE_DEBUG("%s() %s device_type = 0x%x\n", __func__,
1331 bdaddr.ToString().c_str(),
1332 p_search_data->inq_res.device_type);
1333 bdname.name[0] = 0;
1334
1335 if (!check_eir_remote_name(p_search_data, bdname.name, &remote_name_len))
1336 check_cached_remote_name(p_search_data, bdname.name, &remote_name_len);
1337
1338 /* Check EIR for remote name and services */
1339 if (p_search_data->inq_res.p_eir) {
1340 BTA_GetEirService(p_search_data->inq_res.p_eir,
1341 p_search_data->inq_res.eir_len, &services);
1342 BTIF_TRACE_DEBUG("%s()EIR BTA services = %08X", __func__,
1343 (uint32_t)services);
1344 /* TODO: Get the service list and check to see which uuids we got and
1345 * send it back to the client. */
1346 }
1347
1348 {
1349 bt_property_t properties[5];
1350 bt_device_type_t dev_type;
1351 uint32_t num_properties = 0;
1352 bt_status_t status;
1353 int addr_type = 0;
1354
1355 memset(properties, 0, sizeof(properties));
1356 /* RawAddress */
1357 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1358 BT_PROPERTY_BDADDR, sizeof(bdaddr), &bdaddr);
1359 num_properties++;
1360 /* BD_NAME */
1361 /* Don't send BDNAME if it is empty */
1362 if (bdname.name[0]) {
1363 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1364 BT_PROPERTY_BDNAME,
1365 strlen((char*)bdname.name), &bdname);
1366 num_properties++;
1367 }
1368
1369 /* DEV_CLASS */
1370 uint32_t cod = devclass2uint(p_search_data->inq_res.dev_class);
1371 BTIF_TRACE_DEBUG("%s cod is 0x%06x", __func__, cod);
1372 if (cod != 0) {
1373 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1374 BT_PROPERTY_CLASS_OF_DEVICE, sizeof(cod),
1375 &cod);
1376 num_properties++;
1377 }
1378
1379 /* DEV_TYPE */
1380 /* FixMe: Assumption is that bluetooth.h and BTE enums match */
1381
1382 /* Verify if the device is dual mode in NVRAM */
1383 int stored_device_type = 0;
1384 if (btif_get_device_type(bdaddr, &stored_device_type) &&
1385 ((stored_device_type != BT_DEVICE_TYPE_BREDR &&
1386 p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BREDR) ||
1387 (stored_device_type != BT_DEVICE_TYPE_BLE &&
1388 p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BLE))) {
1389 dev_type = (bt_device_type_t)BT_DEVICE_TYPE_DUMO;
1390 } else {
1391 dev_type = (bt_device_type_t)p_search_data->inq_res.device_type;
1392 }
1393
1394 if (p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BLE)
1395 addr_type = p_search_data->inq_res.ble_addr_type;
1396 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1397 BT_PROPERTY_TYPE_OF_DEVICE, sizeof(dev_type),
1398 &dev_type);
1399 num_properties++;
1400 /* RSSI */
1401 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1402 BT_PROPERTY_REMOTE_RSSI, sizeof(int8_t),
1403 &(p_search_data->inq_res.rssi));
1404 num_properties++;
1405
1406 status =
1407 btif_storage_add_remote_device(&bdaddr, num_properties, properties);
1408 ASSERTC(status == BT_STATUS_SUCCESS,
1409 "failed to save remote device (inquiry)", status);
1410 status = btif_storage_set_remote_addr_type(&bdaddr, addr_type);
1411 ASSERTC(status == BT_STATUS_SUCCESS,
1412 "failed to save remote addr type (inquiry)", status);
1413 /* Callback to notify upper layer of device */
1414 HAL_CBACK(bt_hal_cbacks, device_found_cb, num_properties, properties);
1415 }
1416 } break;
1417
1418 case BTA_DM_INQ_CMPL_EVT: {
1419 do_in_main_thread(
1420 FROM_HERE,
1421 base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_DELETE, 0,
1422 nullptr, base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
1423 } break;
1424 case BTA_DM_DISC_CMPL_EVT: {
1425 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1426 BT_DISCOVERY_STOPPED);
1427 } break;
1428 case BTA_DM_SEARCH_CANCEL_CMPL_EVT: {
1429 /* if inquiry is not in progress and we get a cancel event, then
1430 * it means we are done with inquiry, but remote_name fetches are in
1431 * progress
1432 *
1433 * if inquiry is in progress, then we don't want to act on this
1434 * cancel_cmpl_evt
1435 * but instead wait for the cancel_cmpl_evt via the Busy Level
1436 *
1437 */
1438 if (!btif_dm_inquiry_in_progress) {
1439 btgatt_filt_param_setup_t adv_filt_param;
1440 memset(&adv_filt_param, 0, sizeof(btgatt_filt_param_setup_t));
1441 do_in_main_thread(
1442 FROM_HERE,
1443 base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_DELETE, 0,
1444 nullptr, base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
1445 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1446 BT_DISCOVERY_STOPPED);
1447 }
1448 } break;
1449 }
1450 }
1451
1452 /*******************************************************************************
1453 *
1454 * Function btif_dm_search_services_evt
1455 *
1456 * Description Executes search services event in btif context
1457 *
1458 * Returns void
1459 *
1460 ******************************************************************************/
btif_dm_search_services_evt(uint16_t event,char * p_param)1461 static void btif_dm_search_services_evt(uint16_t event, char* p_param) {
1462 tBTA_DM_SEARCH* p_data = (tBTA_DM_SEARCH*)p_param;
1463
1464 BTIF_TRACE_EVENT("%s: event = %d", __func__, event);
1465 switch (event) {
1466 case BTA_DM_DISC_RES_EVT: {
1467 bt_property_t prop;
1468 uint32_t i = 0;
1469 bt_status_t ret;
1470
1471 RawAddress& bd_addr = p_data->disc_res.bd_addr;
1472
1473 BTIF_TRACE_DEBUG("%s:(result=0x%x, services 0x%x)", __func__,
1474 p_data->disc_res.result, p_data->disc_res.services);
1475 if (p_data->disc_res.result != BTA_SUCCESS &&
1476 pairing_cb.state == BT_BOND_STATE_BONDED &&
1477 pairing_cb.sdp_attempts < BTIF_DM_MAX_SDP_ATTEMPTS_AFTER_PAIRING) {
1478 if (pairing_cb.sdp_attempts) {
1479 BTIF_TRACE_WARNING("%s: SDP failed after bonding re-attempting",
1480 __func__);
1481 pairing_cb.sdp_attempts++;
1482 btif_dm_get_remote_services(bd_addr);
1483 } else {
1484 BTIF_TRACE_WARNING("%s: SDP triggered by someone failed when bonding",
1485 __func__);
1486 }
1487 return;
1488 }
1489 prop.type = BT_PROPERTY_UUIDS;
1490 prop.len = 0;
1491 if ((p_data->disc_res.result == BTA_SUCCESS) &&
1492 (p_data->disc_res.num_uuids > 0)) {
1493 prop.val = p_data->disc_res.p_uuid_list;
1494 prop.len = p_data->disc_res.num_uuids * Uuid::kNumBytes128;
1495 for (i = 0; i < p_data->disc_res.num_uuids; i++) {
1496 std::string temp = ((p_data->disc_res.p_uuid_list + i))->ToString();
1497 LOG_INFO("%s index:%d uuid:%s", __func__, i, temp.c_str());
1498 }
1499 }
1500
1501 /* onUuidChanged requires getBondedDevices to be populated.
1502 ** bond_state_changed needs to be sent prior to remote_device_property
1503 */
1504 if (pairing_cb.state == BT_BOND_STATE_BONDED && pairing_cb.sdp_attempts &&
1505 (p_data->disc_res.bd_addr == pairing_cb.bd_addr ||
1506 p_data->disc_res.bd_addr == pairing_cb.static_bdaddr)) {
1507 LOG_INFO("%s: SDP search done for %s", __func__,
1508 bd_addr.ToString().c_str());
1509 pairing_cb.sdp_attempts = 0;
1510
1511 // Both SDP and bonding are done, clear pairing control block in case
1512 // it is not already cleared
1513 pairing_cb = {};
1514
1515 // Send one empty UUID to Java to unblock pairing intent when SDP failed
1516 // or no UUID is discovered
1517 if (p_data->disc_res.result != BTA_SUCCESS ||
1518 p_data->disc_res.num_uuids == 0) {
1519 LOG_INFO("%s: SDP failed, send empty UUID to unblock bonding %s",
1520 __func__, bd_addr.ToString().c_str());
1521 bt_property_t prop;
1522 Uuid uuid = {};
1523
1524 prop.type = BT_PROPERTY_UUIDS;
1525 prop.val = &uuid;
1526 prop.len = Uuid::kNumBytes128;
1527
1528 /* Send the event to the BTIF */
1529 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb,
1530 BT_STATUS_SUCCESS, &bd_addr, 1, &prop);
1531 break;
1532 }
1533 }
1534
1535 if (p_data->disc_res.num_uuids != 0) {
1536 /* Also write this to the NVRAM */
1537 ret = btif_storage_set_remote_device_property(&bd_addr, &prop);
1538 ASSERTC(ret == BT_STATUS_SUCCESS, "storing remote services failed",
1539 ret);
1540 /* Send the event to the BTIF */
1541 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1542 &bd_addr, 1, &prop);
1543 }
1544 } break;
1545
1546 case BTA_DM_DISC_CMPL_EVT:
1547 /* fixme */
1548 break;
1549
1550 case BTA_DM_SEARCH_CANCEL_CMPL_EVT:
1551 /* no-op */
1552 break;
1553
1554 case BTA_DM_DISC_BLE_RES_EVT: {
1555 BTIF_TRACE_DEBUG("%s: service %s", __func__,
1556 p_data->disc_ble_res.service.ToString().c_str());
1557 int num_properties = 0;
1558 if (p_data->disc_ble_res.service.As16Bit() == UUID_SERVCLASS_LE_HID ||
1559 p_data->disc_ble_res.service == UUID_HEARING_AID) {
1560 BTIF_TRACE_DEBUG("%s: Found HOGP or HEARING AID UUID", __func__);
1561 bt_property_t prop[2];
1562 bt_status_t ret;
1563
1564 const auto& arr = p_data->disc_ble_res.service.To128BitBE();
1565
1566 RawAddress& bd_addr = p_data->disc_ble_res.bd_addr;
1567 prop[0].type = BT_PROPERTY_UUIDS;
1568 prop[0].val = (void*)arr.data();
1569 prop[0].len = Uuid::kNumBytes128;
1570
1571 /* Also write this to the NVRAM */
1572 ret = btif_storage_set_remote_device_property(&bd_addr, &prop[0]);
1573 ASSERTC(ret == BT_STATUS_SUCCESS, "storing remote services failed",
1574 ret);
1575 num_properties++;
1576
1577 /* Remote name update */
1578 if (strnlen((const char*)p_data->disc_ble_res.bd_name, BD_NAME_LEN)) {
1579 prop[1].type = BT_PROPERTY_BDNAME;
1580 prop[1].val = p_data->disc_ble_res.bd_name;
1581 prop[1].len =
1582 strnlen((char*)p_data->disc_ble_res.bd_name, BD_NAME_LEN);
1583
1584 ret = btif_storage_set_remote_device_property(&bd_addr, &prop[1]);
1585 ASSERTC(ret == BT_STATUS_SUCCESS,
1586 "failed to save remote device property", ret);
1587 num_properties++;
1588 }
1589
1590 /* Send the event to the BTIF */
1591 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1592 &bd_addr, num_properties, prop);
1593 }
1594 } break;
1595
1596 default: { ASSERTC(0, "unhandled search services event", event); } break;
1597 }
1598 }
1599
1600 /*******************************************************************************
1601 *
1602 * Function btif_dm_remote_service_record_evt
1603 *
1604 * Description Executes search service record event in btif context
1605 *
1606 * Returns void
1607 *
1608 ******************************************************************************/
btif_dm_remote_service_record_evt(uint16_t event,char * p_param)1609 static void btif_dm_remote_service_record_evt(uint16_t event, char* p_param) {
1610 tBTA_DM_SEARCH* p_data = (tBTA_DM_SEARCH*)p_param;
1611
1612 BTIF_TRACE_EVENT("%s: event = %d", __func__, event);
1613 switch (event) {
1614 case BTA_DM_DISC_RES_EVT: {
1615 bt_service_record_t rec;
1616 bt_property_t prop;
1617
1618 memset(&rec, 0, sizeof(bt_service_record_t));
1619 RawAddress& bd_addr = p_data->disc_res.bd_addr;
1620
1621 BTIF_TRACE_DEBUG("%s:(result=0x%x, services 0x%x)", __func__,
1622 p_data->disc_res.result, p_data->disc_res.services);
1623 prop.type = BT_PROPERTY_SERVICE_RECORD;
1624 prop.val = (void*)&rec;
1625 prop.len = sizeof(rec);
1626
1627 /* disc_res.result is overloaded with SCN. Cannot check result */
1628 p_data->disc_res.services &= ~BTA_USER_SERVICE_MASK;
1629 /* TODO: Get the UUID as well */
1630 rec.channel = p_data->disc_res.result - 3;
1631 /* TODO: Need to get the service name using p_raw_data */
1632 rec.name[0] = 0;
1633
1634 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb, BT_STATUS_SUCCESS,
1635 &bd_addr, 1, &prop);
1636 } break;
1637
1638 default: {
1639 ASSERTC(0, "unhandled remote service record event", event);
1640 } break;
1641 }
1642 }
1643
1644 /*******************************************************************************
1645 *
1646 * Function btif_dm_upstreams_cback
1647 *
1648 * Description Executes UPSTREAMS events in btif context
1649 *
1650 * Returns void
1651 *
1652 ******************************************************************************/
btif_dm_upstreams_evt(uint16_t event,char * p_param)1653 static void btif_dm_upstreams_evt(uint16_t event, char* p_param) {
1654 tBTA_DM_SEC* p_data = (tBTA_DM_SEC*)p_param;
1655 tBTA_SERVICE_MASK service_mask;
1656 uint32_t i;
1657 RawAddress bd_addr;
1658
1659 BTIF_TRACE_EVENT("%s: ev: %s", __func__, dump_dm_event(event));
1660
1661 switch (event) {
1662 case BTA_DM_ENABLE_EVT: {
1663 BD_NAME bdname;
1664 bt_status_t status;
1665 bt_property_t prop;
1666 prop.type = BT_PROPERTY_BDNAME;
1667 prop.len = BD_NAME_LEN;
1668 prop.val = (void*)bdname;
1669
1670 status = btif_storage_get_adapter_property(&prop);
1671 if (status == BT_STATUS_SUCCESS) {
1672 /* A name exists in the storage. Make this the device name */
1673 BTA_DmSetDeviceName((char*)prop.val);
1674 } else {
1675 /* Storage does not have a name yet.
1676 * Use the default name and write it to the chip
1677 */
1678 BTA_DmSetDeviceName(btif_get_default_local_name());
1679 }
1680
1681 /* Enable local privacy */
1682 BTA_DmBleConfigLocalPrivacy(BLE_LOCAL_PRIVACY_ENABLED);
1683
1684 /* for each of the enabled services in the mask, trigger the profile
1685 * enable */
1686 service_mask = btif_get_enabled_services_mask();
1687 for (i = 0; i <= BTA_MAX_SERVICE_ID; i++) {
1688 if (service_mask &
1689 (tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(i))) {
1690 btif_in_execute_service_request(i, true);
1691 }
1692 }
1693 /* clear control blocks */
1694 memset(&pairing_cb, 0, sizeof(btif_dm_pairing_cb_t));
1695 pairing_cb.bond_type = BOND_TYPE_PERSISTENT;
1696
1697 /* This function will also trigger the adapter_properties_cb
1698 ** and bonded_devices_info_cb
1699 */
1700 btif_storage_load_bonded_devices();
1701 bluetooth::bqr::EnableBtQualityReport(true);
1702 btif_enable_bluetooth_evt(p_data->enable.status);
1703 } break;
1704
1705 case BTA_DM_DISABLE_EVT:
1706 /* for each of the enabled services in the mask, trigger the profile
1707 * disable */
1708 service_mask = btif_get_enabled_services_mask();
1709 for (i = 0; i <= BTA_MAX_SERVICE_ID; i++) {
1710 if (service_mask &
1711 (tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(i))) {
1712 btif_in_execute_service_request(i, false);
1713 }
1714 }
1715 bluetooth::bqr::EnableBtQualityReport(false);
1716 btif_disable_bluetooth_evt();
1717 break;
1718
1719 case BTA_DM_PIN_REQ_EVT:
1720 btif_dm_pin_req_evt(&p_data->pin_req);
1721 break;
1722
1723 case BTA_DM_AUTH_CMPL_EVT:
1724 btif_dm_auth_cmpl_evt(&p_data->auth_cmpl);
1725 break;
1726
1727 case BTA_DM_BOND_CANCEL_CMPL_EVT:
1728 if (is_bonding_or_sdp()) {
1729 bd_addr = pairing_cb.bd_addr;
1730 btm_set_bond_type_dev(pairing_cb.bd_addr, BOND_TYPE_UNKNOWN);
1731 bond_state_changed((bt_status_t)p_data->bond_cancel_cmpl.result,
1732 bd_addr, BT_BOND_STATE_NONE);
1733 }
1734 break;
1735
1736 case BTA_DM_SP_CFM_REQ_EVT:
1737 btif_dm_ssp_cfm_req_evt(&p_data->cfm_req);
1738 break;
1739 case BTA_DM_SP_KEY_NOTIF_EVT:
1740 btif_dm_ssp_key_notif_evt(&p_data->key_notif);
1741 break;
1742
1743 case BTA_DM_DEV_UNPAIRED_EVT:
1744 bd_addr = p_data->link_down.bd_addr;
1745 btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
1746
1747 /*special handling for HID devices */
1748 #if (defined(BTA_HH_INCLUDED) && (BTA_HH_INCLUDED == TRUE))
1749 btif_hh_remove_device(bd_addr);
1750 #endif
1751 #if (defined(BTA_HD_INCLUDED) && (BTA_HD_INCLUDED == TRUE))
1752 btif_hd_remove_device(bd_addr);
1753 #endif
1754 btif_hearing_aid_get_interface()->RemoveDevice(bd_addr);
1755 btif_storage_remove_bonded_device(&bd_addr);
1756 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_NONE);
1757 break;
1758
1759 case BTA_DM_BUSY_LEVEL_EVT: {
1760 if (p_data->busy_level.level_flags & BTM_BL_INQUIRY_PAGING_MASK) {
1761 if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_STARTED) {
1762 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1763 BT_DISCOVERY_STARTED);
1764 btif_dm_inquiry_in_progress = true;
1765 } else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_CANCELLED) {
1766 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1767 BT_DISCOVERY_STOPPED);
1768 btif_dm_inquiry_in_progress = false;
1769 } else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_COMPLETE) {
1770 btif_dm_inquiry_in_progress = false;
1771 }
1772 }
1773 } break;
1774
1775 case BTA_DM_LINK_UP_EVT:
1776 bd_addr = p_data->link_up.bd_addr;
1777 BTIF_TRACE_DEBUG("BTA_DM_LINK_UP_EVT. Sending BT_ACL_STATE_CONNECTED");
1778
1779 btif_update_remote_version_property(&bd_addr);
1780
1781 HAL_CBACK(bt_hal_cbacks, acl_state_changed_cb, BT_STATUS_SUCCESS,
1782 &bd_addr, BT_ACL_STATE_CONNECTED);
1783 break;
1784
1785 case BTA_DM_LINK_DOWN_EVT:
1786 bd_addr = p_data->link_down.bd_addr;
1787 btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
1788 btif_av_acl_disconnected(bd_addr);
1789 BTIF_TRACE_DEBUG(
1790 "BTA_DM_LINK_DOWN_EVT. Sending BT_ACL_STATE_DISCONNECTED");
1791 HAL_CBACK(bt_hal_cbacks, acl_state_changed_cb, BT_STATUS_SUCCESS,
1792 &bd_addr, BT_ACL_STATE_DISCONNECTED);
1793 break;
1794
1795 case BTA_DM_HW_ERROR_EVT:
1796 BTIF_TRACE_ERROR("Received H/W Error. ");
1797 /* Flush storage data */
1798 btif_config_flush();
1799 usleep(100000); /* 100milliseconds */
1800 /* Killing the process to force a restart as part of fault tolerance */
1801 kill(getpid(), SIGKILL);
1802 break;
1803
1804 case BTA_DM_BLE_KEY_EVT:
1805 BTIF_TRACE_DEBUG("BTA_DM_BLE_KEY_EVT key_type=0x%02x ",
1806 p_data->ble_key.key_type);
1807
1808 /* If this pairing is by-product of local initiated GATT client Read or
1809 Write,
1810 BTA would not have sent BTA_DM_BLE_SEC_REQ_EVT event and Bond state would
1811 not
1812 have setup properly. Setup pairing_cb and notify App about Bonding state
1813 now*/
1814 if (pairing_cb.state != BT_BOND_STATE_BONDING) {
1815 BTIF_TRACE_DEBUG(
1816 "Bond state not sent to App so far.Notify the app now");
1817 bond_state_changed(BT_STATUS_SUCCESS, p_data->ble_key.bd_addr,
1818 BT_BOND_STATE_BONDING);
1819 } else if (pairing_cb.bd_addr != p_data->ble_key.bd_addr) {
1820 BTIF_TRACE_ERROR("BD mismatch discard BLE key_type=%d ",
1821 p_data->ble_key.key_type);
1822 break;
1823 }
1824
1825 switch (p_data->ble_key.key_type) {
1826 case BTA_LE_KEY_PENC:
1827 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_PENC");
1828 pairing_cb.ble.is_penc_key_rcvd = true;
1829 pairing_cb.ble.penc_key = p_data->ble_key.p_key_value->penc_key;
1830 break;
1831
1832 case BTA_LE_KEY_PID:
1833 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_PID");
1834 pairing_cb.ble.is_pid_key_rcvd = true;
1835 pairing_cb.ble.pid_key = p_data->ble_key.p_key_value->pid_key;
1836 break;
1837
1838 case BTA_LE_KEY_PCSRK:
1839 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_PCSRK");
1840 pairing_cb.ble.is_pcsrk_key_rcvd = true;
1841 pairing_cb.ble.pcsrk_key = p_data->ble_key.p_key_value->pcsrk_key;
1842 break;
1843
1844 case BTA_LE_KEY_LENC:
1845 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_LENC");
1846 pairing_cb.ble.is_lenc_key_rcvd = true;
1847 pairing_cb.ble.lenc_key = p_data->ble_key.p_key_value->lenc_key;
1848 break;
1849
1850 case BTA_LE_KEY_LCSRK:
1851 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_LCSRK");
1852 pairing_cb.ble.is_lcsrk_key_rcvd = true;
1853 pairing_cb.ble.lcsrk_key = p_data->ble_key.p_key_value->lcsrk_key;
1854 break;
1855
1856 case BTA_LE_KEY_LID:
1857 BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_LID");
1858 pairing_cb.ble.is_lidk_key_rcvd = true;
1859 break;
1860
1861 default:
1862 BTIF_TRACE_ERROR("unknown BLE key type (0x%02x)",
1863 p_data->ble_key.key_type);
1864 break;
1865 }
1866 break;
1867 case BTA_DM_BLE_SEC_REQ_EVT:
1868 BTIF_TRACE_DEBUG("BTA_DM_BLE_SEC_REQ_EVT. ");
1869 btif_dm_ble_sec_req_evt(&p_data->ble_req);
1870 break;
1871 case BTA_DM_BLE_PASSKEY_NOTIF_EVT:
1872 BTIF_TRACE_DEBUG("BTA_DM_BLE_PASSKEY_NOTIF_EVT. ");
1873 btif_dm_ble_key_notif_evt(&p_data->key_notif);
1874 break;
1875 case BTA_DM_BLE_PASSKEY_REQ_EVT:
1876 BTIF_TRACE_DEBUG("BTA_DM_BLE_PASSKEY_REQ_EVT. ");
1877 btif_dm_ble_passkey_req_evt(&p_data->pin_req);
1878 break;
1879 case BTA_DM_BLE_NC_REQ_EVT:
1880 BTIF_TRACE_DEBUG("BTA_DM_BLE_PASSKEY_REQ_EVT. ");
1881 btif_dm_ble_key_nc_req_evt(&p_data->key_notif);
1882 break;
1883 case BTA_DM_BLE_OOB_REQ_EVT:
1884 BTIF_TRACE_DEBUG("BTA_DM_BLE_OOB_REQ_EVT. ");
1885 btif_dm_ble_oob_req_evt(&p_data->rmt_oob);
1886 break;
1887 case BTA_DM_BLE_SC_OOB_REQ_EVT:
1888 BTIF_TRACE_DEBUG("BTA_DM_BLE_SC_OOB_REQ_EVT. ");
1889 btif_dm_ble_sc_oob_req_evt(&p_data->rmt_oob);
1890 break;
1891 case BTA_DM_BLE_LOCAL_IR_EVT:
1892 BTIF_TRACE_DEBUG("BTA_DM_BLE_LOCAL_IR_EVT. ");
1893 ble_local_key_cb.is_id_keys_rcvd = true;
1894 ble_local_key_cb.id_keys.irk = p_data->ble_id_keys.irk;
1895 ble_local_key_cb.id_keys.ir = p_data->ble_id_keys.ir;
1896 ble_local_key_cb.id_keys.dhk = p_data->ble_id_keys.dhk;
1897 btif_storage_add_ble_local_key(ble_local_key_cb.id_keys.irk,
1898 BTIF_DM_LE_LOCAL_KEY_IRK);
1899 btif_storage_add_ble_local_key(ble_local_key_cb.id_keys.ir,
1900 BTIF_DM_LE_LOCAL_KEY_IR);
1901 btif_storage_add_ble_local_key(ble_local_key_cb.id_keys.dhk,
1902 BTIF_DM_LE_LOCAL_KEY_DHK);
1903 break;
1904 case BTA_DM_BLE_LOCAL_ER_EVT:
1905 BTIF_TRACE_DEBUG("BTA_DM_BLE_LOCAL_ER_EVT. ");
1906 ble_local_key_cb.is_er_rcvd = true;
1907 ble_local_key_cb.er = p_data->ble_er;
1908 btif_storage_add_ble_local_key(ble_local_key_cb.er,
1909 BTIF_DM_LE_LOCAL_KEY_ER);
1910 break;
1911
1912 case BTA_DM_BLE_AUTH_CMPL_EVT:
1913 BTIF_TRACE_DEBUG("BTA_DM_BLE_AUTH_CMPL_EVT. ");
1914 btif_dm_ble_auth_cmpl_evt(&p_data->auth_cmpl);
1915 break;
1916
1917 case BTA_DM_LE_FEATURES_READ: {
1918 tBTM_BLE_VSC_CB cmn_vsc_cb;
1919 bt_local_le_features_t local_le_features;
1920 char buf[512];
1921 bt_property_t prop;
1922 prop.type = BT_PROPERTY_LOCAL_LE_FEATURES;
1923 prop.val = (void*)buf;
1924 prop.len = sizeof(buf);
1925
1926 /* LE features are not stored in storage. Should be retrived from stack */
1927 BTM_BleGetVendorCapabilities(&cmn_vsc_cb);
1928 local_le_features.local_privacy_enabled = BTM_BleLocalPrivacyEnabled();
1929
1930 prop.len = sizeof(bt_local_le_features_t);
1931 if (cmn_vsc_cb.filter_support == 1)
1932 local_le_features.max_adv_filter_supported = cmn_vsc_cb.max_filter;
1933 else
1934 local_le_features.max_adv_filter_supported = 0;
1935 local_le_features.max_adv_instance = cmn_vsc_cb.adv_inst_max;
1936 local_le_features.max_irk_list_size = cmn_vsc_cb.max_irk_list_sz;
1937 local_le_features.rpa_offload_supported = cmn_vsc_cb.rpa_offloading;
1938 local_le_features.activity_energy_info_supported =
1939 cmn_vsc_cb.energy_support;
1940 local_le_features.scan_result_storage_size =
1941 cmn_vsc_cb.tot_scan_results_strg;
1942 local_le_features.version_supported = cmn_vsc_cb.version_supported;
1943 local_le_features.total_trackable_advertisers =
1944 cmn_vsc_cb.total_trackable_advertisers;
1945
1946 local_le_features.extended_scan_support =
1947 cmn_vsc_cb.extended_scan_support > 0;
1948 local_le_features.debug_logging_supported =
1949 cmn_vsc_cb.debug_logging_supported > 0;
1950
1951 const controller_t* controller = controller_get_interface();
1952
1953 local_le_features.le_2m_phy_supported = controller->supports_ble_2m_phy();
1954 local_le_features.le_coded_phy_supported =
1955 controller->supports_ble_coded_phy();
1956 local_le_features.le_extended_advertising_supported =
1957 controller->supports_ble_extended_advertising();
1958 local_le_features.le_periodic_advertising_supported =
1959 controller->supports_ble_periodic_advertising();
1960 local_le_features.le_maximum_advertising_data_length =
1961 controller->get_ble_maxium_advertising_data_length();
1962
1963 memcpy(prop.val, &local_le_features, prop.len);
1964 HAL_CBACK(bt_hal_cbacks, adapter_properties_cb, BT_STATUS_SUCCESS, 1,
1965 &prop);
1966 break;
1967 }
1968
1969 case BTA_DM_ENER_INFO_READ: {
1970 btif_activity_energy_info_cb_t* p_ener_data =
1971 (btif_activity_energy_info_cb_t*)p_param;
1972 bt_activity_energy_info energy_info;
1973 energy_info.status = p_ener_data->status;
1974 energy_info.ctrl_state = p_ener_data->ctrl_state;
1975 energy_info.rx_time = p_ener_data->rx_time;
1976 energy_info.tx_time = p_ener_data->tx_time;
1977 energy_info.idle_time = p_ener_data->idle_time;
1978 energy_info.energy_used = p_ener_data->energy_used;
1979
1980 bt_uid_traffic_t* data = uid_set_read_and_clear(uid_set);
1981 HAL_CBACK(bt_hal_cbacks, energy_info_cb, &energy_info, data);
1982 osi_free(data);
1983 break;
1984 }
1985
1986 case BTA_DM_AUTHORIZE_EVT:
1987 case BTA_DM_SIG_STRENGTH_EVT:
1988 case BTA_DM_SP_RMT_OOB_EVT:
1989 case BTA_DM_SP_KEYPRESS_EVT:
1990 case BTA_DM_ROLE_CHG_EVT:
1991
1992 default:
1993 BTIF_TRACE_WARNING("%s: unhandled event (%d)", __func__, event);
1994 break;
1995 }
1996
1997 btif_dm_data_free(event, p_data);
1998 }
1999
2000 /*******************************************************************************
2001 *
2002 * Function btif_dm_generic_evt
2003 *
2004 * Description Executes non-BTA upstream events in BTIF context
2005 *
2006 * Returns void
2007 *
2008 ******************************************************************************/
btif_dm_generic_evt(uint16_t event,char * p_param)2009 static void btif_dm_generic_evt(uint16_t event, char* p_param) {
2010 BTIF_TRACE_EVENT("%s: event=%d", __func__, event);
2011 switch (event) {
2012 case BTIF_DM_CB_DISCOVERY_STARTED: {
2013 HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
2014 BT_DISCOVERY_STARTED);
2015 } break;
2016
2017 case BTIF_DM_CB_CREATE_BOND: {
2018 pairing_cb.timeout_retries = NUM_TIMEOUT_RETRIES;
2019 btif_dm_create_bond_cb_t* create_bond_cb =
2020 (btif_dm_create_bond_cb_t*)p_param;
2021 btif_dm_cb_create_bond(create_bond_cb->bdaddr, create_bond_cb->transport);
2022 } break;
2023
2024 case BTIF_DM_CB_REMOVE_BOND: {
2025 btif_dm_cb_remove_bond((RawAddress*)p_param);
2026 } break;
2027
2028 case BTIF_DM_CB_HID_REMOTE_NAME: {
2029 btif_dm_cb_hid_remote_name((tBTM_REMOTE_DEV_NAME*)p_param);
2030 } break;
2031
2032 case BTIF_DM_CB_BOND_STATE_BONDING: {
2033 bond_state_changed(BT_STATUS_SUCCESS, *((RawAddress*)p_param),
2034 BT_BOND_STATE_BONDING);
2035 } break;
2036 case BTIF_DM_CB_LE_TX_TEST:
2037 case BTIF_DM_CB_LE_RX_TEST: {
2038 uint8_t status;
2039 STREAM_TO_UINT8(status, p_param);
2040 HAL_CBACK(bt_hal_cbacks, le_test_mode_cb,
2041 (status == 0) ? BT_STATUS_SUCCESS : BT_STATUS_FAIL, 0);
2042 } break;
2043 case BTIF_DM_CB_LE_TEST_END: {
2044 uint8_t status;
2045 uint16_t count = 0;
2046 STREAM_TO_UINT8(status, p_param);
2047 if (status == 0) STREAM_TO_UINT16(count, p_param);
2048 HAL_CBACK(bt_hal_cbacks, le_test_mode_cb,
2049 (status == 0) ? BT_STATUS_SUCCESS : BT_STATUS_FAIL, count);
2050 } break;
2051 default: {
2052 BTIF_TRACE_WARNING("%s : Unknown event 0x%x", __func__, event);
2053 } break;
2054 }
2055 }
2056
2057 /*******************************************************************************
2058 *
2059 * Function bte_dm_evt
2060 *
2061 * Description Switches context from BTE to BTIF for all DM events
2062 *
2063 * Returns void
2064 *
2065 ******************************************************************************/
2066
bte_dm_evt(tBTA_DM_SEC_EVT event,tBTA_DM_SEC * p_data)2067 void bte_dm_evt(tBTA_DM_SEC_EVT event, tBTA_DM_SEC* p_data) {
2068 /* switch context to btif task context (copy full union size for convenience)
2069 */
2070 bt_status_t status = btif_transfer_context(
2071 btif_dm_upstreams_evt, (uint16_t)event, (char*)p_data,
2072 sizeof(tBTA_DM_SEC), btif_dm_data_copy);
2073
2074 /* catch any failed context transfers */
2075 ASSERTC(status == BT_STATUS_SUCCESS, "context transfer failed", status);
2076 }
2077
2078 /*******************************************************************************
2079 *
2080 * Function bte_search_devices_evt
2081 *
2082 * Description Switches context from BTE to BTIF for DM search events
2083 *
2084 * Returns void
2085 *
2086 ******************************************************************************/
bte_search_devices_evt(tBTA_DM_SEARCH_EVT event,tBTA_DM_SEARCH * p_data)2087 static void bte_search_devices_evt(tBTA_DM_SEARCH_EVT event,
2088 tBTA_DM_SEARCH* p_data) {
2089 uint16_t param_len = 0;
2090
2091 if (p_data) param_len += sizeof(tBTA_DM_SEARCH);
2092 /* Allocate buffer to hold the pointers (deep copy). The pointers will point
2093 * to the end of the tBTA_DM_SEARCH */
2094 switch (event) {
2095 case BTA_DM_INQ_RES_EVT: {
2096 if (p_data->inq_res.p_eir) param_len += p_data->inq_res.eir_len;
2097 } break;
2098
2099 case BTA_DM_DISC_RES_EVT: {
2100 if (p_data->disc_res.raw_data_size && p_data->disc_res.p_raw_data)
2101 param_len += p_data->disc_res.raw_data_size;
2102 } break;
2103 }
2104 BTIF_TRACE_DEBUG("%s event=%s param_len=%d", __func__,
2105 dump_dm_search_event(event), param_len);
2106
2107 /* if remote name is available in EIR, set teh flag so that stack doesnt
2108 * trigger RNR */
2109 if (event == BTA_DM_INQ_RES_EVT)
2110 p_data->inq_res.remt_name_not_required =
2111 check_eir_remote_name(p_data, NULL, NULL);
2112
2113 btif_transfer_context(
2114 btif_dm_search_devices_evt, (uint16_t)event, (char*)p_data, param_len,
2115 (param_len > sizeof(tBTA_DM_SEARCH)) ? search_devices_copy_cb : NULL);
2116 }
2117
2118 /*******************************************************************************
2119 *
2120 * Function bte_dm_search_services_evt
2121 *
2122 * Description Switches context from BTE to BTIF for DM search services
2123 * event
2124 *
2125 * Returns void
2126 *
2127 ******************************************************************************/
bte_dm_search_services_evt(tBTA_DM_SEARCH_EVT event,tBTA_DM_SEARCH * p_data)2128 static void bte_dm_search_services_evt(tBTA_DM_SEARCH_EVT event,
2129 tBTA_DM_SEARCH* p_data) {
2130 uint16_t param_len = 0;
2131 if (p_data) param_len += sizeof(tBTA_DM_SEARCH);
2132 switch (event) {
2133 case BTA_DM_DISC_RES_EVT: {
2134 if ((p_data->disc_res.result == BTA_SUCCESS) &&
2135 (p_data->disc_res.num_uuids > 0)) {
2136 param_len += (p_data->disc_res.num_uuids * Uuid::kNumBytes128);
2137 }
2138 } break;
2139 }
2140 /* TODO: The only other member that needs a deep copy is the p_raw_data. But
2141 * not sure
2142 * if raw_data is needed. */
2143 btif_transfer_context(
2144 btif_dm_search_services_evt, event, (char*)p_data, param_len,
2145 (param_len > sizeof(tBTA_DM_SEARCH)) ? search_services_copy_cb : NULL);
2146 }
2147
2148 /*******************************************************************************
2149 *
2150 * Function bte_dm_remote_service_record_evt
2151 *
2152 * Description Switches context from BTE to BTIF for DM search service
2153 * record event
2154 *
2155 * Returns void
2156 *
2157 ******************************************************************************/
bte_dm_remote_service_record_evt(tBTA_DM_SEARCH_EVT event,tBTA_DM_SEARCH * p_data)2158 static void bte_dm_remote_service_record_evt(tBTA_DM_SEARCH_EVT event,
2159 tBTA_DM_SEARCH* p_data) {
2160 /* TODO: The only member that needs a deep copy is the p_raw_data. But not
2161 * sure yet if this is needed. */
2162 btif_transfer_context(btif_dm_remote_service_record_evt, event, (char*)p_data,
2163 sizeof(tBTA_DM_SEARCH), NULL);
2164 }
2165
2166 /*******************************************************************************
2167 *
2168 * Function bta_energy_info_cb
2169 *
2170 * Description Switches context from BTE to BTIF for DM energy info event
2171 *
2172 * Returns void
2173 *
2174 ******************************************************************************/
bta_energy_info_cb(tBTA_DM_BLE_TX_TIME_MS tx_time,tBTA_DM_BLE_RX_TIME_MS rx_time,tBTA_DM_BLE_IDLE_TIME_MS idle_time,tBTA_DM_BLE_ENERGY_USED energy_used,tBTA_DM_CONTRL_STATE ctrl_state,tBTA_STATUS status)2175 static void bta_energy_info_cb(tBTA_DM_BLE_TX_TIME_MS tx_time,
2176 tBTA_DM_BLE_RX_TIME_MS rx_time,
2177 tBTA_DM_BLE_IDLE_TIME_MS idle_time,
2178 tBTA_DM_BLE_ENERGY_USED energy_used,
2179 tBTA_DM_CONTRL_STATE ctrl_state,
2180 tBTA_STATUS status) {
2181 BTIF_TRACE_DEBUG(
2182 "energy_info_cb-Status:%d,state=%d,tx_t=%ld, rx_t=%ld, "
2183 "idle_time=%ld,used=%ld",
2184 status, ctrl_state, tx_time, rx_time, idle_time, energy_used);
2185
2186 btif_activity_energy_info_cb_t btif_cb;
2187 btif_cb.status = status;
2188 btif_cb.ctrl_state = ctrl_state;
2189 btif_cb.tx_time = (uint64_t)tx_time;
2190 btif_cb.rx_time = (uint64_t)rx_time;
2191 btif_cb.idle_time = (uint64_t)idle_time;
2192 btif_cb.energy_used = (uint64_t)energy_used;
2193 btif_transfer_context(btif_dm_upstreams_evt, BTA_DM_ENER_INFO_READ,
2194 (char*)&btif_cb, sizeof(btif_activity_energy_info_cb_t),
2195 NULL);
2196 }
2197
2198 /* Scan filter param config event */
bte_scan_filt_param_cfg_evt(uint8_t ref_value,uint8_t avbl_space,uint8_t action_type,uint8_t status)2199 static void bte_scan_filt_param_cfg_evt(uint8_t ref_value, uint8_t avbl_space,
2200 uint8_t action_type, uint8_t status) {
2201 /* This event occurs on calling BTA_DmBleCfgFilterCondition internally,
2202 ** and that is why there is no HAL callback
2203 */
2204 if (BTA_SUCCESS != status) {
2205 BTIF_TRACE_ERROR("%s, %d", __func__, status);
2206 } else {
2207 BTIF_TRACE_DEBUG("%s", __func__);
2208 }
2209 }
2210
2211 /*****************************************************************************
2212 *
2213 * btif api functions (no context switch)
2214 *
2215 ****************************************************************************/
2216
2217 /*******************************************************************************
2218 *
2219 * Function btif_dm_start_discovery
2220 *
2221 * Description Start device discovery/inquiry
2222 *
2223 * Returns bt_status_t
2224 *
2225 ******************************************************************************/
btif_dm_start_discovery(void)2226 bt_status_t btif_dm_start_discovery(void) {
2227 tBTA_DM_INQ inq_params;
2228 tBTA_SERVICE_MASK services = 0;
2229
2230 BTIF_TRACE_EVENT("%s", __func__);
2231
2232 /* Cleanup anything remaining on index 0 */
2233 do_in_main_thread(
2234 FROM_HERE,
2235 base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_DELETE, 0,
2236 nullptr, base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
2237
2238 auto adv_filt_param = std::make_unique<btgatt_filt_param_setup_t>();
2239 /* Add an allow-all filter on index 0*/
2240 adv_filt_param->dely_mode = IMMEDIATE_DELY_MODE;
2241 adv_filt_param->feat_seln = ALLOW_ALL_FILTER;
2242 adv_filt_param->filt_logic_type = BTA_DM_BLE_PF_FILT_LOGIC_OR;
2243 adv_filt_param->list_logic_type = BTA_DM_BLE_PF_LIST_LOGIC_OR;
2244 adv_filt_param->rssi_low_thres = LOWEST_RSSI_VALUE;
2245 adv_filt_param->rssi_high_thres = LOWEST_RSSI_VALUE;
2246 do_in_main_thread(
2247 FROM_HERE, base::Bind(&BTM_BleAdvFilterParamSetup, BTM_BLE_SCAN_COND_ADD,
2248 0, base::Passed(&adv_filt_param),
2249 base::Bind(&bte_scan_filt_param_cfg_evt, 0)));
2250
2251 /* TODO: Do we need to handle multiple inquiries at the same time? */
2252
2253 /* Set inquiry params and call API */
2254 inq_params.mode = BTA_DM_GENERAL_INQUIRY | BTA_BLE_GENERAL_INQUIRY;
2255 inq_params.duration = BTIF_DM_DEFAULT_INQ_MAX_DURATION;
2256
2257 inq_params.max_resps = BTIF_DM_DEFAULT_INQ_MAX_RESULTS;
2258 inq_params.report_dup = true;
2259
2260 inq_params.filter_type = BTA_DM_INQ_CLR;
2261 /* TODO: Filter device by BDA needs to be implemented here */
2262
2263 /* Will be enabled to true once inquiry busy level has been received */
2264 btif_dm_inquiry_in_progress = false;
2265 /* find nearby devices */
2266 BTA_DmSearch(&inq_params, services, bte_search_devices_evt);
2267
2268 return BT_STATUS_SUCCESS;
2269 }
2270
2271 /*******************************************************************************
2272 *
2273 * Function btif_dm_cancel_discovery
2274 *
2275 * Description Cancels search
2276 *
2277 * Returns bt_status_t
2278 *
2279 ******************************************************************************/
btif_dm_cancel_discovery(void)2280 bt_status_t btif_dm_cancel_discovery(void) {
2281 BTIF_TRACE_EVENT("%s", __func__);
2282 BTA_DmSearchCancel();
2283 return BT_STATUS_SUCCESS;
2284 }
2285
2286 /*******************************************************************************
2287 *
2288 * Function btif_dm_create_bond
2289 *
2290 * Description Initiate bonding with the specified device
2291 *
2292 * Returns bt_status_t
2293 *
2294 ******************************************************************************/
btif_dm_create_bond(const RawAddress * bd_addr,int transport)2295 bt_status_t btif_dm_create_bond(const RawAddress* bd_addr, int transport) {
2296 btif_dm_create_bond_cb_t create_bond_cb;
2297 create_bond_cb.transport = transport;
2298 create_bond_cb.bdaddr = *bd_addr;
2299
2300 BTIF_TRACE_EVENT("%s: bd_addr=%s, transport=%d", __func__,
2301 bd_addr->ToString().c_str(), transport);
2302 if (pairing_cb.state != BT_BOND_STATE_NONE) return BT_STATUS_BUSY;
2303
2304 btif_stats_add_bond_event(*bd_addr, BTIF_DM_FUNC_CREATE_BOND,
2305 pairing_cb.state);
2306
2307 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_CREATE_BOND,
2308 (char*)&create_bond_cb,
2309 sizeof(btif_dm_create_bond_cb_t), NULL);
2310
2311 return BT_STATUS_SUCCESS;
2312 }
2313
2314 /*******************************************************************************
2315 *
2316 * Function btif_dm_create_bond_out_of_band
2317 *
2318 * Description Initiate bonding with the specified device using out of band
2319 * data
2320 *
2321 * Returns bt_status_t
2322 *
2323 ******************************************************************************/
btif_dm_create_bond_out_of_band(const RawAddress * bd_addr,int transport,const bt_out_of_band_data_t * oob_data)2324 bt_status_t btif_dm_create_bond_out_of_band(
2325 const RawAddress* bd_addr, int transport,
2326 const bt_out_of_band_data_t* oob_data) {
2327 oob_cb.bdaddr = *bd_addr;
2328 memcpy(&oob_cb.oob_data, oob_data, sizeof(bt_out_of_band_data_t));
2329
2330 uint8_t empty[] = {0, 0, 0, 0, 0, 0, 0};
2331 // If LE Bluetooth Device Address is provided, use provided address type
2332 // value.
2333 if (memcmp(oob_data->le_bt_dev_addr, empty, 7) != 0) {
2334 /* byte no 7 is address type in LE Bluetooth Address OOB data */
2335 uint8_t address_type = oob_data->le_bt_dev_addr[6];
2336 if (address_type == BLE_ADDR_PUBLIC || address_type == BLE_ADDR_RANDOM) {
2337 // bd_addr->address is already reversed, so use it instead of
2338 // oob_data->le_bt_dev_addr
2339 BTM_SecAddBleDevice(*bd_addr, NULL, BT_DEVICE_TYPE_BLE, address_type);
2340 }
2341 }
2342
2343 BTIF_TRACE_EVENT("%s: bd_addr=%s, transport=%d", __func__,
2344 bd_addr->ToString().c_str(), transport);
2345 return btif_dm_create_bond(bd_addr, transport);
2346 }
2347
2348 /*******************************************************************************
2349 *
2350 * Function btif_dm_cancel_bond
2351 *
2352 * Description Initiate bonding with the specified device
2353 *
2354 * Returns bt_status_t
2355 *
2356 ******************************************************************************/
2357
btif_dm_cancel_bond(const RawAddress * bd_addr)2358 bt_status_t btif_dm_cancel_bond(const RawAddress* bd_addr) {
2359 BTIF_TRACE_EVENT("%s: bd_addr=%s", __func__, bd_addr->ToString().c_str());
2360
2361 btif_stats_add_bond_event(*bd_addr, BTIF_DM_FUNC_CANCEL_BOND,
2362 pairing_cb.state);
2363
2364 /* TODO:
2365 ** 1. Restore scan modes
2366 ** 2. special handling for HID devices
2367 */
2368 if (is_bonding_or_sdp()) {
2369 if (pairing_cb.is_ssp) {
2370 if (pairing_cb.is_le_only) {
2371 BTA_DmBleSecurityGrant(*bd_addr, BTA_DM_SEC_PAIR_NOT_SPT);
2372 } else {
2373 BTA_DmConfirm(*bd_addr, false);
2374 BTA_DmBondCancel(*bd_addr);
2375 btif_storage_remove_bonded_device(bd_addr);
2376 }
2377 } else {
2378 if (pairing_cb.is_le_only) {
2379 BTA_DmBondCancel(*bd_addr);
2380 } else {
2381 BTA_DmPinReply(*bd_addr, false, 0, NULL);
2382 }
2383 /* Cancel bonding, in case it is in ACL connection setup state */
2384 BTA_DmBondCancel(*bd_addr);
2385 }
2386 }
2387
2388 return BT_STATUS_SUCCESS;
2389 }
2390
2391 /*******************************************************************************
2392 *
2393 * Function btif_dm_hh_open_failed
2394 *
2395 * Description informs the upper layers if the HH have failed during
2396 * bonding
2397 *
2398 * Returns none
2399 *
2400 ******************************************************************************/
2401
btif_dm_hh_open_failed(RawAddress * bdaddr)2402 void btif_dm_hh_open_failed(RawAddress* bdaddr) {
2403 if (pairing_cb.state == BT_BOND_STATE_BONDING &&
2404 *bdaddr == pairing_cb.bd_addr) {
2405 bond_state_changed(BT_STATUS_FAIL, *bdaddr, BT_BOND_STATE_NONE);
2406 }
2407 }
2408
2409 /*******************************************************************************
2410 *
2411 * Function btif_dm_remove_bond
2412 *
2413 * Description Removes bonding with the specified device
2414 *
2415 * Returns bt_status_t
2416 *
2417 ******************************************************************************/
2418
btif_dm_remove_bond(const RawAddress * bd_addr)2419 bt_status_t btif_dm_remove_bond(const RawAddress* bd_addr) {
2420 BTIF_TRACE_EVENT("%s: bd_addr=%s", __func__, bd_addr->ToString().c_str());
2421
2422 btif_stats_add_bond_event(*bd_addr, BTIF_DM_FUNC_REMOVE_BOND,
2423 pairing_cb.state);
2424
2425 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_REMOVE_BOND,
2426 (char*)bd_addr, sizeof(RawAddress), NULL);
2427
2428 return BT_STATUS_SUCCESS;
2429 }
2430
2431 /*******************************************************************************
2432 *
2433 * Function btif_dm_pin_reply
2434 *
2435 * Description BT legacy pairing - PIN code reply
2436 *
2437 * Returns bt_status_t
2438 *
2439 ******************************************************************************/
2440
btif_dm_pin_reply(const RawAddress * bd_addr,uint8_t accept,uint8_t pin_len,bt_pin_code_t * pin_code)2441 bt_status_t btif_dm_pin_reply(const RawAddress* bd_addr, uint8_t accept,
2442 uint8_t pin_len, bt_pin_code_t* pin_code) {
2443 BTIF_TRACE_EVENT("%s: accept=%d", __func__, accept);
2444
2445 if (bluetooth::shim::is_gd_shim_enabled()) {
2446 if (pin_code == nullptr) {
2447 LOG_ERROR("Pin code must be not null with GD shim enabled");
2448 return BT_STATUS_FAIL;
2449 }
2450
2451 uint8_t tmp_dev_type = 0;
2452 uint8_t tmp_addr_type = 0;
2453 BTM_ReadDevInfo(*bd_addr, &tmp_dev_type, &tmp_addr_type);
2454
2455 do_in_main_thread(FROM_HERE, base::Bind(&bluetooth::shim::BTIF_DM_pin_reply, *bd_addr, tmp_addr_type, accept, pin_len, *pin_code));
2456 return BT_STATUS_SUCCESS;
2457 }
2458
2459 if (pin_code == NULL || pin_len > PIN_CODE_LEN) return BT_STATUS_FAIL;
2460 if (pairing_cb.is_le_only) {
2461 int i;
2462 uint32_t passkey = 0;
2463 int multi[] = {100000, 10000, 1000, 100, 10, 1};
2464 for (i = 0; i < 6; i++) {
2465 passkey += (multi[i] * (pin_code->pin[i] - '0'));
2466 }
2467 BTIF_TRACE_DEBUG("btif_dm_pin_reply: passkey: %d", passkey);
2468 BTA_DmBlePasskeyReply(*bd_addr, accept, passkey);
2469
2470 } else {
2471 BTA_DmPinReply(*bd_addr, accept, pin_len, pin_code->pin);
2472 if (accept) pairing_cb.pin_code_len = pin_len;
2473 }
2474 return BT_STATUS_SUCCESS;
2475 }
2476
2477 /*******************************************************************************
2478 *
2479 * Function btif_dm_ssp_reply
2480 *
2481 * Description BT SSP Reply - Just Works, Numeric Comparison & Passkey
2482 * Entry
2483 *
2484 * Returns bt_status_t
2485 *
2486 ******************************************************************************/
btif_dm_ssp_reply(const RawAddress * bd_addr,bt_ssp_variant_t variant,uint8_t accept,UNUSED_ATTR uint32_t passkey)2487 bt_status_t btif_dm_ssp_reply(const RawAddress* bd_addr,
2488 bt_ssp_variant_t variant, uint8_t accept,
2489 UNUSED_ATTR uint32_t passkey) {
2490 if (bluetooth::shim::is_gd_shim_enabled()) {
2491 uint8_t tmp_dev_type = 0;
2492 uint8_t tmp_addr_type = 0;
2493 BTM_ReadDevInfo(*bd_addr, &tmp_dev_type, &tmp_addr_type);
2494
2495 do_in_main_thread(
2496 FROM_HERE,
2497 base::Bind(&bluetooth::shim::BTIF_DM_ssp_reply, *bd_addr, tmp_addr_type, variant, accept));
2498 return BT_STATUS_SUCCESS;
2499 }
2500
2501 if (variant == BT_SSP_VARIANT_PASSKEY_ENTRY) {
2502 /* This is not implemented in the stack.
2503 * For devices with display, this is not needed
2504 */
2505 BTIF_TRACE_WARNING("%s: Not implemented", __func__);
2506 return BT_STATUS_FAIL;
2507 }
2508 /* BT_SSP_VARIANT_CONSENT & BT_SSP_VARIANT_PASSKEY_CONFIRMATION supported */
2509 BTIF_TRACE_EVENT("%s: accept=%d", __func__, accept);
2510 if (pairing_cb.is_le_only) {
2511 if (pairing_cb.is_le_nc) {
2512 BTA_DmBleConfirmReply(*bd_addr, accept);
2513 } else {
2514 if (accept)
2515 BTA_DmBleSecurityGrant(*bd_addr, BTA_DM_SEC_GRANTED);
2516 else
2517 BTA_DmBleSecurityGrant(*bd_addr, BTA_DM_SEC_PAIR_NOT_SPT);
2518 }
2519 } else {
2520 BTA_DmConfirm(*bd_addr, accept);
2521 }
2522 return BT_STATUS_SUCCESS;
2523 }
2524
2525 /*******************************************************************************
2526 *
2527 * Function btif_dm_get_adapter_property
2528 *
2529 * Description Queries the BTA for the adapter property
2530 *
2531 * Returns bt_status_t
2532 *
2533 ******************************************************************************/
btif_dm_get_adapter_property(bt_property_t * prop)2534 bt_status_t btif_dm_get_adapter_property(bt_property_t* prop) {
2535 BTIF_TRACE_EVENT("%s: type=0x%x", __func__, prop->type);
2536 switch (prop->type) {
2537 case BT_PROPERTY_BDNAME: {
2538 bt_bdname_t* bd_name = (bt_bdname_t*)prop->val;
2539 strncpy((char*)bd_name->name, (char*)btif_get_default_local_name(),
2540 sizeof(bd_name->name) - 1);
2541 bd_name->name[sizeof(bd_name->name) - 1] = 0;
2542 prop->len = strlen((char*)bd_name->name);
2543 } break;
2544
2545 case BT_PROPERTY_ADAPTER_SCAN_MODE: {
2546 /* if the storage does not have it. Most likely app never set it. Default
2547 * is NONE */
2548 bt_scan_mode_t* mode = (bt_scan_mode_t*)prop->val;
2549 *mode = BT_SCAN_MODE_NONE;
2550 prop->len = sizeof(bt_scan_mode_t);
2551 } break;
2552
2553 case BT_PROPERTY_ADAPTER_DISCOVERY_TIMEOUT: {
2554 uint32_t* tmt = (uint32_t*)prop->val;
2555 *tmt = 120; /* default to 120s, if not found in NV */
2556 prop->len = sizeof(uint32_t);
2557 } break;
2558
2559 case BT_PROPERTY_CLASS_OF_DEVICE: {
2560 DEV_CLASS dev_class = BTA_DM_COD;
2561 memcpy(prop->val, dev_class, sizeof(DEV_CLASS));
2562 prop->len = sizeof(DEV_CLASS);
2563 } break;
2564
2565 // While fetching IO_CAP* values for the local device, we maintain backward
2566 // compatibility by using the value from #define macros BTM_LOCAL_IO_CAPS,
2567 // BTM_LOCAL_IO_CAPS_BLE if the values have never been explicitly set.
2568
2569 case BT_PROPERTY_LOCAL_IO_CAPS: {
2570 *(bt_io_cap_t*)prop->val = (bt_io_cap_t)BTM_LOCAL_IO_CAPS;
2571 prop->len = sizeof(bt_io_cap_t);
2572 } break;
2573
2574 case BT_PROPERTY_LOCAL_IO_CAPS_BLE: {
2575 *(bt_io_cap_t*)prop->val = (bt_io_cap_t)BTM_LOCAL_IO_CAPS_BLE;
2576 prop->len = sizeof(bt_io_cap_t);
2577 } break;
2578
2579 default:
2580 prop->len = 0;
2581 return BT_STATUS_FAIL;
2582 }
2583 return BT_STATUS_SUCCESS;
2584 }
2585
2586 /*******************************************************************************
2587 *
2588 * Function btif_dm_get_remote_services
2589 *
2590 * Description Start SDP to get remote services
2591 *
2592 * Returns bt_status_t
2593 *
2594 ******************************************************************************/
btif_dm_get_remote_services(const RawAddress & remote_addr)2595 bt_status_t btif_dm_get_remote_services(const RawAddress& remote_addr) {
2596 BTIF_TRACE_EVENT("%s: bd_addr=%s", __func__, remote_addr.ToString().c_str());
2597
2598 BTA_DmDiscover(remote_addr, BTA_ALL_SERVICE_MASK, bte_dm_search_services_evt,
2599 true);
2600
2601 return BT_STATUS_SUCCESS;
2602 }
2603
2604 /*******************************************************************************
2605 *
2606 * Function btif_dm_get_remote_services_by_transport
2607 *
2608 * Description Start SDP to get remote services by transport
2609 *
2610 * Returns bt_status_t
2611 *
2612 ******************************************************************************/
btif_dm_get_remote_services_by_transport(RawAddress * remote_addr,const int transport)2613 bt_status_t btif_dm_get_remote_services_by_transport(RawAddress* remote_addr,
2614 const int transport) {
2615 BTIF_TRACE_EVENT("%s: transport=%d, remote_addr=%s", __func__, transport,
2616 remote_addr->ToString().c_str());
2617
2618 /* Set the mask extension */
2619 tBTA_SERVICE_MASK_EXT mask_ext;
2620 mask_ext.num_uuid = 0;
2621 mask_ext.p_uuid = NULL;
2622 mask_ext.srvc_mask = BTA_ALL_SERVICE_MASK;
2623
2624 BTA_DmDiscoverByTransport(*remote_addr, &mask_ext, bte_dm_search_services_evt,
2625 true, transport);
2626
2627 return BT_STATUS_SUCCESS;
2628 }
2629
2630 /*******************************************************************************
2631 *
2632 * Function btif_dm_get_remote_service_record
2633 *
2634 * Description Start SDP to get remote service record
2635 *
2636 *
2637 * Returns bt_status_t
2638 ******************************************************************************/
btif_dm_get_remote_service_record(const RawAddress & remote_addr,const Uuid & uuid)2639 bt_status_t btif_dm_get_remote_service_record(const RawAddress& remote_addr,
2640 const Uuid& uuid) {
2641 BTIF_TRACE_EVENT("%s: bd_addr=%s", __func__, remote_addr.ToString().c_str());
2642 BTA_DmDiscoverUUID(remote_addr, uuid, bte_dm_remote_service_record_evt, true);
2643
2644 return BT_STATUS_SUCCESS;
2645 }
2646
btif_dm_execute_service_request(uint16_t event,char * p_param)2647 void btif_dm_execute_service_request(uint16_t event, char* p_param) {
2648 bool b_enable = false;
2649 bt_status_t status;
2650 if (event == BTIF_DM_ENABLE_SERVICE) {
2651 b_enable = true;
2652 }
2653 status =
2654 btif_in_execute_service_request(*((tBTA_SERVICE_ID*)p_param), b_enable);
2655 if (status == BT_STATUS_SUCCESS) {
2656 bt_property_t property;
2657 Uuid local_uuids[BT_MAX_NUM_UUIDS];
2658
2659 /* Now send the UUID_PROPERTY_CHANGED event to the upper layer */
2660 BTIF_STORAGE_FILL_PROPERTY(&property, BT_PROPERTY_UUIDS,
2661 sizeof(local_uuids), local_uuids);
2662 btif_storage_get_adapter_property(&property);
2663 HAL_CBACK(bt_hal_cbacks, adapter_properties_cb, BT_STATUS_SUCCESS, 1,
2664 &property);
2665 }
2666 return;
2667 }
2668
btif_dm_proc_io_req(UNUSED_ATTR const RawAddress & bd_addr,UNUSED_ATTR tBTA_IO_CAP * p_io_cap,UNUSED_ATTR tBTA_OOB_DATA * p_oob_data,tBTA_AUTH_REQ * p_auth_req,bool is_orig)2669 void btif_dm_proc_io_req(UNUSED_ATTR const RawAddress& bd_addr,
2670 UNUSED_ATTR tBTA_IO_CAP* p_io_cap,
2671 UNUSED_ATTR tBTA_OOB_DATA* p_oob_data,
2672 tBTA_AUTH_REQ* p_auth_req, bool is_orig) {
2673 uint8_t yes_no_bit = BTA_AUTH_SP_YES & *p_auth_req;
2674 /* if local initiated:
2675 ** 1. set DD + MITM
2676 ** if remote initiated:
2677 ** 1. Copy over the auth_req from peer's io_rsp
2678 ** 2. Set the MITM if peer has it set or if peer has DisplayYesNo
2679 *(iPhone)
2680 ** as a fallback set MITM+GB if peer had MITM set
2681 */
2682
2683 BTIF_TRACE_DEBUG("+%s: p_auth_req=%d", __func__, *p_auth_req);
2684 if (pairing_cb.is_local_initiated) {
2685 /* if initing/responding to a dedicated bonding, use dedicate bonding bit */
2686 *p_auth_req = BTA_AUTH_DD_BOND | BTA_AUTH_SP_YES;
2687 } else if (!is_orig) {
2688 /* peer initiated paring. They probably know what they want.
2689 ** Copy the mitm from peer device.
2690 */
2691 BTIF_TRACE_DEBUG("%s: setting p_auth_req to peer's: %d", __func__,
2692 pairing_cb.auth_req);
2693 *p_auth_req = (pairing_cb.auth_req & BTA_AUTH_BONDS);
2694
2695 /* copy over the MITM bit as well. In addition if the peer has DisplayYesNo,
2696 * force MITM */
2697 if ((yes_no_bit) || (pairing_cb.io_cap & BTM_IO_CAP_IO))
2698 *p_auth_req |= BTA_AUTH_SP_YES;
2699 } else if (yes_no_bit) {
2700 /* set the general bonding bit for stored device */
2701 *p_auth_req = BTA_AUTH_GEN_BOND | yes_no_bit;
2702 }
2703 BTIF_TRACE_DEBUG("-%s: p_auth_req=%d", __func__, *p_auth_req);
2704 }
2705
btif_dm_proc_io_rsp(UNUSED_ATTR const RawAddress & bd_addr,tBTA_IO_CAP io_cap,UNUSED_ATTR tBTA_OOB_DATA oob_data,tBTA_AUTH_REQ auth_req)2706 void btif_dm_proc_io_rsp(UNUSED_ATTR const RawAddress& bd_addr,
2707 tBTA_IO_CAP io_cap, UNUSED_ATTR tBTA_OOB_DATA oob_data,
2708 tBTA_AUTH_REQ auth_req) {
2709 if (auth_req & BTA_AUTH_BONDS) {
2710 BTIF_TRACE_DEBUG("%s auth_req:%d", __func__, auth_req);
2711 pairing_cb.auth_req = auth_req;
2712 pairing_cb.io_cap = io_cap;
2713 }
2714 }
2715
btif_dm_set_oob_for_io_req(tBTA_OOB_DATA * p_has_oob_data)2716 void btif_dm_set_oob_for_io_req(tBTA_OOB_DATA* p_has_oob_data) {
2717 if (is_empty_128bit(oob_cb.oob_data.c192)) {
2718 *p_has_oob_data = false;
2719 } else {
2720 *p_has_oob_data = true;
2721 }
2722 BTIF_TRACE_DEBUG("%s: *p_has_oob_data=%d", __func__, *p_has_oob_data);
2723 }
2724
btif_dm_set_oob_for_le_io_req(const RawAddress & bd_addr,tBTA_OOB_DATA * p_has_oob_data,tBTA_LE_AUTH_REQ * p_auth_req)2725 void btif_dm_set_oob_for_le_io_req(const RawAddress& bd_addr,
2726 tBTA_OOB_DATA* p_has_oob_data,
2727 tBTA_LE_AUTH_REQ* p_auth_req) {
2728 if (!is_empty_128bit(oob_cb.oob_data.le_sc_c) &&
2729 !is_empty_128bit(oob_cb.oob_data.le_sc_r)) {
2730 /* We have LE SC OOB data */
2731
2732 /* make sure OOB data is for this particular device */
2733 if (bd_addr == oob_cb.bdaddr) {
2734 *p_auth_req = ((*p_auth_req) | BTM_LE_AUTH_REQ_SC_ONLY);
2735 *p_has_oob_data = true;
2736 } else {
2737 *p_has_oob_data = false;
2738 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
2739 __func__);
2740 }
2741 } else if (!is_empty_128bit(oob_cb.oob_data.sm_tk)) {
2742 /* We have security manager TK */
2743
2744 /* make sure OOB data is for this particular device */
2745 if (bd_addr == oob_cb.bdaddr) {
2746 // When using OOB with TK, SC Secure Connections bit must be disabled.
2747 tBTA_LE_AUTH_REQ mask = ~BTM_LE_AUTH_REQ_SC_ONLY;
2748 *p_auth_req = ((*p_auth_req) & mask);
2749
2750 *p_has_oob_data = true;
2751 } else {
2752 *p_has_oob_data = false;
2753 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
2754 __func__);
2755 }
2756 } else {
2757 *p_has_oob_data = false;
2758 }
2759 BTIF_TRACE_DEBUG("%s *p_has_oob_data=%d", __func__, *p_has_oob_data);
2760 }
2761
2762 #ifdef BTIF_DM_OOB_TEST
btif_dm_load_local_oob(void)2763 void btif_dm_load_local_oob(void) {
2764 char prop_oob[PROPERTY_VALUE_MAX];
2765 osi_property_get("service.brcm.bt.oob", prop_oob, "3");
2766 BTIF_TRACE_DEBUG("%s: prop_oob = %s", __func__, prop_oob);
2767 if (prop_oob[0] != '3') {
2768 if (is_empty_128bit(oob_cb.oob_data.c192)) {
2769 BTIF_TRACE_DEBUG("%s: read OOB, call BTA_DmLocalOob()", __func__);
2770 BTA_DmLocalOob();
2771 }
2772 }
2773 }
2774
btif_dm_proc_loc_oob(bool valid,const Octet16 & c,const Octet16 & r)2775 void btif_dm_proc_loc_oob(bool valid, const Octet16& c, const Octet16& r) {
2776 FILE* fp;
2777 const char* path_a = "/data/misc/bluedroid/LOCAL/a.key";
2778 const char* path_b = "/data/misc/bluedroid/LOCAL/b.key";
2779 const char* path = NULL;
2780 char prop_oob[PROPERTY_VALUE_MAX];
2781 BTIF_TRACE_DEBUG("%s: valid=%d", __func__, valid);
2782 if (is_empty_128bit(oob_cb.oob_data.c192) && valid) {
2783 BTIF_TRACE_DEBUG("save local OOB data in memory");
2784 memcpy(oob_cb.oob_data.c192, c.data(), OCTET16_LEN);
2785 memcpy(oob_cb.oob_data.r192, r.data(), OCTET16_LEN);
2786 osi_property_get("service.brcm.bt.oob", prop_oob, "3");
2787 BTIF_TRACE_DEBUG("%s: prop_oob = %s", __func__, prop_oob);
2788 if (prop_oob[0] == '1')
2789 path = path_a;
2790 else if (prop_oob[0] == '2')
2791 path = path_b;
2792 if (path) {
2793 fp = fopen(path, "wb+");
2794 if (fp == NULL) {
2795 BTIF_TRACE_DEBUG("%s: failed to save local OOB data to %s", __func__,
2796 path);
2797 } else {
2798 BTIF_TRACE_DEBUG("%s: save local OOB data into file %s", __func__,
2799 path);
2800 fwrite(c.data(), 1, OCTET16_LEN, fp);
2801 fwrite(r.data(), 1, OCTET16_LEN, fp);
2802 fclose(fp);
2803 }
2804 }
2805 }
2806 }
2807
2808 /*******************************************************************************
2809 *
2810 * Function btif_dm_get_smp_config
2811 *
2812 * Description Retrieve the SMP pairing options from the bt_stack.conf
2813 * file. To provide specific pairing options for the host
2814 * add a node with label "SmpOptions" to the config file
2815 * and assign it a comma separated list of 5 values in the
2816 * format: auth, io, ikey, rkey, ksize, oob
2817 * eg: PTS_SmpOptions=0xD,0x4,0xf,0xf,0x10
2818 *
2819 * Parameters: tBTE_APPL_CFG*: pointer to struct defining pairing options
2820 *
2821 * Returns true if the options were successfully read, else false
2822 *
2823 ******************************************************************************/
btif_dm_get_smp_config(tBTE_APPL_CFG * p_cfg)2824 bool btif_dm_get_smp_config(tBTE_APPL_CFG* p_cfg) {
2825 const std::string* recv = stack_config_get_interface()->get_pts_smp_options();
2826 if (!recv) {
2827 BTIF_TRACE_DEBUG("%s: SMP options not found in configuration", __func__);
2828 return false;
2829 }
2830
2831 char conf[64];
2832 char* pch;
2833 char* endptr;
2834
2835 strncpy(conf, recv->c_str(), 64);
2836 conf[63] = 0; // null terminate
2837
2838 pch = strtok(conf, ",");
2839 if (pch != NULL)
2840 p_cfg->ble_auth_req = (uint8_t)strtoul(pch, &endptr, 16);
2841 else
2842 return false;
2843
2844 pch = strtok(NULL, ",");
2845 if (pch != NULL)
2846 p_cfg->ble_io_cap = (uint8_t)strtoul(pch, &endptr, 16);
2847 else
2848 return false;
2849
2850 pch = strtok(NULL, ",");
2851 if (pch != NULL)
2852 p_cfg->ble_init_key = (uint8_t)strtoul(pch, &endptr, 16);
2853 else
2854 return false;
2855
2856 pch = strtok(NULL, ",");
2857 if (pch != NULL)
2858 p_cfg->ble_resp_key = (uint8_t)strtoul(pch, &endptr, 16);
2859 else
2860 return false;
2861
2862 pch = strtok(NULL, ",");
2863 if (pch != NULL)
2864 p_cfg->ble_max_key_size = (uint8_t)strtoul(pch, &endptr, 16);
2865 else
2866 return false;
2867
2868 return true;
2869 }
2870
btif_dm_proc_rmt_oob(const RawAddress & bd_addr,Octet16 * p_c,Octet16 * p_r)2871 bool btif_dm_proc_rmt_oob(const RawAddress& bd_addr, Octet16* p_c,
2872 Octet16* p_r) {
2873 const char* path_a = "/data/misc/bluedroid/LOCAL/a.key";
2874 const char* path_b = "/data/misc/bluedroid/LOCAL/b.key";
2875 const char* path = NULL;
2876 char prop_oob[PROPERTY_VALUE_MAX];
2877 osi_property_get("service.brcm.bt.oob", prop_oob, "3");
2878 BTIF_TRACE_DEBUG("%s: prop_oob = %s", __func__, prop_oob);
2879 if (prop_oob[0] == '1')
2880 path = path_b;
2881 else if (prop_oob[0] == '2')
2882 path = path_a;
2883 if (!path) {
2884 BTIF_TRACE_DEBUG("%s: can't open path!", __func__);
2885 return false;
2886 }
2887
2888 FILE* fp = fopen(path, "rb");
2889 if (fp == NULL) {
2890 BTIF_TRACE_DEBUG("%s: failed to read OOB keys from %s", __func__, path);
2891 return false;
2892 }
2893
2894 BTIF_TRACE_DEBUG("%s: read OOB data from %s", __func__, path);
2895 fread(p_c->data(), 1, OCTET16_LEN, fp);
2896 fread(p_r->data(), 1, OCTET16_LEN, fp);
2897 fclose(fp);
2898
2899 RawAddress bt_bd_addr = bd_addr;
2900 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_BOND_STATE_BONDING,
2901 (char*)&bt_bd_addr, sizeof(RawAddress), NULL);
2902 return true;
2903 }
2904 #endif /* BTIF_DM_OOB_TEST */
2905
btif_dm_ble_key_notif_evt(tBTA_DM_SP_KEY_NOTIF * p_ssp_key_notif)2906 static void btif_dm_ble_key_notif_evt(tBTA_DM_SP_KEY_NOTIF* p_ssp_key_notif) {
2907 RawAddress bd_addr;
2908 bt_bdname_t bd_name;
2909 uint32_t cod;
2910 int dev_type;
2911
2912 BTIF_TRACE_DEBUG("%s", __func__);
2913
2914 /* Remote name update */
2915 if (!btif_get_device_type(p_ssp_key_notif->bd_addr, &dev_type)) {
2916 dev_type = BT_DEVICE_TYPE_BLE;
2917 }
2918 btif_dm_update_ble_remote_properties(p_ssp_key_notif->bd_addr,
2919 p_ssp_key_notif->bd_name,
2920 (tBT_DEVICE_TYPE)dev_type);
2921 bd_addr = p_ssp_key_notif->bd_addr;
2922 memcpy(bd_name.name, p_ssp_key_notif->bd_name, BD_NAME_LEN);
2923
2924 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
2925 pairing_cb.is_ssp = false;
2926 cod = COD_UNCLASSIFIED;
2927
2928 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
2929 BT_SSP_VARIANT_PASSKEY_NOTIFICATION, p_ssp_key_notif->passkey);
2930 }
2931
2932 /*******************************************************************************
2933 *
2934 * Function btif_dm_ble_auth_cmpl_evt
2935 *
2936 * Description Executes authentication complete event in btif context
2937 *
2938 * Returns void
2939 *
2940 ******************************************************************************/
btif_dm_ble_auth_cmpl_evt(tBTA_DM_AUTH_CMPL * p_auth_cmpl)2941 static void btif_dm_ble_auth_cmpl_evt(tBTA_DM_AUTH_CMPL* p_auth_cmpl) {
2942 /* Save link key, if not temporary */
2943 bt_status_t status = BT_STATUS_FAIL;
2944 bt_bond_state_t state = BT_BOND_STATE_NONE;
2945
2946 RawAddress bd_addr = p_auth_cmpl->bd_addr;
2947
2948 /* Clear OOB data */
2949 memset(&oob_cb, 0, sizeof(oob_cb));
2950
2951 if ((p_auth_cmpl->success) && (p_auth_cmpl->key_present)) {
2952 /* store keys */
2953 }
2954 if (p_auth_cmpl->success) {
2955 status = BT_STATUS_SUCCESS;
2956 state = BT_BOND_STATE_BONDED;
2957 int addr_type;
2958 RawAddress bdaddr = p_auth_cmpl->bd_addr;
2959 if (btif_storage_get_remote_addr_type(&bdaddr, &addr_type) !=
2960 BT_STATUS_SUCCESS)
2961 btif_storage_set_remote_addr_type(&bdaddr, p_auth_cmpl->addr_type);
2962
2963 /* Test for temporary bonding */
2964 if (btm_get_bond_type_dev(p_auth_cmpl->bd_addr) == BOND_TYPE_TEMPORARY) {
2965 BTIF_TRACE_DEBUG("%s: sending BT_BOND_STATE_NONE for Temp pairing",
2966 __func__);
2967 btif_storage_remove_bonded_device(&bdaddr);
2968 state = BT_BOND_STATE_NONE;
2969 } else {
2970 btif_dm_save_ble_bonding_keys(bdaddr);
2971 btif_dm_get_remote_services_by_transport(&bd_addr, GATT_TRANSPORT_LE);
2972 }
2973 } else {
2974 /*Map the HCI fail reason to bt status */
2975 switch (p_auth_cmpl->fail_reason) {
2976 case BTA_DM_AUTH_SMP_PAIR_AUTH_FAIL:
2977 case BTA_DM_AUTH_SMP_CONFIRM_VALUE_FAIL:
2978 case BTA_DM_AUTH_SMP_UNKNOWN_ERR:
2979 btif_dm_remove_ble_bonding_keys();
2980 status = BT_STATUS_AUTH_FAILURE;
2981 break;
2982
2983 case BTA_DM_AUTH_SMP_CONN_TOUT: {
2984 if (btm_sec_is_a_bonded_dev(bd_addr)) {
2985 LOG(INFO) << __func__ << " Bonded device addr=" << bd_addr
2986 << " timed out - will not remove the keys";
2987 // Don't send state change to upper layers - otherwise Java think we
2988 // unbonded, and will disconnect HID profile.
2989 return;
2990 }
2991
2992 btif_dm_remove_ble_bonding_keys();
2993 status = BT_STATUS_AUTH_FAILURE;
2994 break;
2995 }
2996 case BTA_DM_AUTH_SMP_PAIR_NOT_SUPPORT:
2997 status = BT_STATUS_AUTH_REJECTED;
2998 break;
2999 default:
3000 btif_dm_remove_ble_bonding_keys();
3001 status = BT_STATUS_FAIL;
3002 break;
3003 }
3004 }
3005 if (state == BT_BOND_STATE_BONDED && !pairing_cb.static_bdaddr.IsEmpty() &&
3006 bd_addr != pairing_cb.static_bdaddr) {
3007 // Report RPA bonding state to Java in crosskey paring
3008 bond_state_changed(status, bd_addr, BT_BOND_STATE_BONDING);
3009 }
3010 bond_state_changed(status, bd_addr, state);
3011 }
3012
btif_dm_load_ble_local_keys(void)3013 void btif_dm_load_ble_local_keys(void) {
3014 memset(&ble_local_key_cb, 0, sizeof(btif_dm_local_key_cb_t));
3015
3016 if (btif_storage_get_ble_local_key(
3017 BTIF_DM_LE_LOCAL_KEY_ER, &ble_local_key_cb.er) == BT_STATUS_SUCCESS) {
3018 ble_local_key_cb.is_er_rcvd = true;
3019 BTIF_TRACE_DEBUG("%s BLE ER key loaded", __func__);
3020 }
3021
3022 if ((btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_IR,
3023 &ble_local_key_cb.id_keys.ir) ==
3024 BT_STATUS_SUCCESS) &&
3025 (btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_IRK,
3026 &ble_local_key_cb.id_keys.irk) ==
3027 BT_STATUS_SUCCESS) &&
3028 (btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_DHK,
3029 &ble_local_key_cb.id_keys.dhk) ==
3030 BT_STATUS_SUCCESS)) {
3031 ble_local_key_cb.is_id_keys_rcvd = true;
3032 BTIF_TRACE_DEBUG("%s BLE ID keys loaded", __func__);
3033 }
3034 }
btif_dm_get_ble_local_keys(tBTA_DM_BLE_LOCAL_KEY_MASK * p_key_mask,Octet16 * p_er,tBTA_BLE_LOCAL_ID_KEYS * p_id_keys)3035 void btif_dm_get_ble_local_keys(tBTA_DM_BLE_LOCAL_KEY_MASK* p_key_mask,
3036 Octet16* p_er,
3037 tBTA_BLE_LOCAL_ID_KEYS* p_id_keys) {
3038 if (ble_local_key_cb.is_er_rcvd) {
3039 *p_er = ble_local_key_cb.er;
3040 *p_key_mask |= BTA_BLE_LOCAL_KEY_TYPE_ER;
3041 }
3042
3043 if (ble_local_key_cb.is_id_keys_rcvd) {
3044 p_id_keys->ir = ble_local_key_cb.id_keys.ir;
3045 p_id_keys->irk = ble_local_key_cb.id_keys.irk;
3046 p_id_keys->dhk = ble_local_key_cb.id_keys.dhk;
3047 *p_key_mask |= BTA_BLE_LOCAL_KEY_TYPE_ID;
3048 }
3049 BTIF_TRACE_DEBUG("%s *p_key_mask=0x%02x", __func__, *p_key_mask);
3050 }
3051
btif_dm_save_ble_bonding_keys(RawAddress & bd_addr)3052 void btif_dm_save_ble_bonding_keys(RawAddress& bd_addr) {
3053 BTIF_TRACE_DEBUG("%s", __func__);
3054
3055 if (pairing_cb.ble.is_penc_key_rcvd) {
3056 btif_storage_add_ble_bonding_key(
3057 &bd_addr, (uint8_t*)&pairing_cb.ble.penc_key, BTIF_DM_LE_KEY_PENC,
3058 sizeof(tBTM_LE_PENC_KEYS));
3059 }
3060
3061 if (pairing_cb.ble.is_pid_key_rcvd) {
3062 btif_storage_add_ble_bonding_key(
3063 &bd_addr, (uint8_t*)&pairing_cb.ble.pid_key, BTIF_DM_LE_KEY_PID,
3064 sizeof(tBTM_LE_PID_KEYS));
3065 }
3066
3067 if (pairing_cb.ble.is_pcsrk_key_rcvd) {
3068 btif_storage_add_ble_bonding_key(
3069 &bd_addr, (uint8_t*)&pairing_cb.ble.pcsrk_key, BTIF_DM_LE_KEY_PCSRK,
3070 sizeof(tBTM_LE_PCSRK_KEYS));
3071 }
3072
3073 if (pairing_cb.ble.is_lenc_key_rcvd) {
3074 btif_storage_add_ble_bonding_key(
3075 &bd_addr, (uint8_t*)&pairing_cb.ble.lenc_key, BTIF_DM_LE_KEY_LENC,
3076 sizeof(tBTM_LE_LENC_KEYS));
3077 }
3078
3079 if (pairing_cb.ble.is_lcsrk_key_rcvd) {
3080 btif_storage_add_ble_bonding_key(
3081 &bd_addr, (uint8_t*)&pairing_cb.ble.lcsrk_key, BTIF_DM_LE_KEY_LCSRK,
3082 sizeof(tBTM_LE_LCSRK_KEYS));
3083 }
3084
3085 if (pairing_cb.ble.is_lidk_key_rcvd) {
3086 btif_storage_add_ble_bonding_key(&bd_addr, NULL, BTIF_DM_LE_KEY_LID, 0);
3087 }
3088 }
3089
btif_dm_remove_ble_bonding_keys(void)3090 void btif_dm_remove_ble_bonding_keys(void) {
3091 BTIF_TRACE_DEBUG("%s", __func__);
3092
3093 RawAddress bd_addr = pairing_cb.bd_addr;
3094 btif_storage_remove_ble_bonding_keys(&bd_addr);
3095 }
3096
3097 /*******************************************************************************
3098 *
3099 * Function btif_dm_ble_sec_req_evt
3100 *
3101 * Description Eprocess security request event in btif context
3102 *
3103 * Returns void
3104 *
3105 ******************************************************************************/
btif_dm_ble_sec_req_evt(tBTA_DM_BLE_SEC_REQ * p_ble_req)3106 void btif_dm_ble_sec_req_evt(tBTA_DM_BLE_SEC_REQ* p_ble_req) {
3107 bt_bdname_t bd_name;
3108 uint32_t cod;
3109 int dev_type;
3110
3111 BTIF_TRACE_DEBUG("%s", __func__);
3112
3113 if (pairing_cb.state == BT_BOND_STATE_BONDING) {
3114 BTIF_TRACE_DEBUG("%s Discard security request", __func__);
3115 return;
3116 }
3117
3118 /* Remote name update */
3119 if (!btif_get_device_type(p_ble_req->bd_addr, &dev_type)) {
3120 dev_type = BT_DEVICE_TYPE_BLE;
3121 }
3122 btif_dm_update_ble_remote_properties(p_ble_req->bd_addr, p_ble_req->bd_name,
3123 (tBT_DEVICE_TYPE)dev_type);
3124
3125 RawAddress bd_addr = p_ble_req->bd_addr;
3126 memcpy(bd_name.name, p_ble_req->bd_name, BD_NAME_LEN);
3127
3128 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
3129
3130 pairing_cb.bond_type = BOND_TYPE_PERSISTENT;
3131 pairing_cb.is_le_only = true;
3132 pairing_cb.is_le_nc = false;
3133 pairing_cb.is_ssp = true;
3134 btm_set_bond_type_dev(p_ble_req->bd_addr, pairing_cb.bond_type);
3135
3136 cod = COD_UNCLASSIFIED;
3137
3138 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
3139 BT_SSP_VARIANT_CONSENT, 0);
3140 }
3141
3142 /*******************************************************************************
3143 *
3144 * Function btif_dm_ble_passkey_req_evt
3145 *
3146 * Description Executes pin request event in btif context
3147 *
3148 * Returns void
3149 *
3150 ******************************************************************************/
btif_dm_ble_passkey_req_evt(tBTA_DM_PIN_REQ * p_pin_req)3151 static void btif_dm_ble_passkey_req_evt(tBTA_DM_PIN_REQ* p_pin_req) {
3152 bt_bdname_t bd_name;
3153 uint32_t cod;
3154 int dev_type;
3155
3156 /* Remote name update */
3157 if (!btif_get_device_type(p_pin_req->bd_addr, &dev_type)) {
3158 dev_type = BT_DEVICE_TYPE_BLE;
3159 }
3160 btif_dm_update_ble_remote_properties(p_pin_req->bd_addr, p_pin_req->bd_name,
3161 (tBT_DEVICE_TYPE)dev_type);
3162
3163 RawAddress bd_addr = p_pin_req->bd_addr;
3164 memcpy(bd_name.name, p_pin_req->bd_name, BD_NAME_LEN);
3165
3166 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
3167 pairing_cb.is_le_only = true;
3168
3169 cod = COD_UNCLASSIFIED;
3170
3171 HAL_CBACK(bt_hal_cbacks, pin_request_cb, &bd_addr, &bd_name, cod, false);
3172 }
btif_dm_ble_key_nc_req_evt(tBTA_DM_SP_KEY_NOTIF * p_notif_req)3173 static void btif_dm_ble_key_nc_req_evt(tBTA_DM_SP_KEY_NOTIF* p_notif_req) {
3174 /* TODO implement key notification for numeric comparison */
3175 BTIF_TRACE_DEBUG("%s", __func__);
3176
3177 /* Remote name update */
3178 btif_update_remote_properties(p_notif_req->bd_addr, p_notif_req->bd_name,
3179 NULL, BT_DEVICE_TYPE_BLE);
3180
3181 RawAddress bd_addr = p_notif_req->bd_addr;
3182
3183 bt_bdname_t bd_name;
3184 memcpy(bd_name.name, p_notif_req->bd_name, BD_NAME_LEN);
3185
3186 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
3187 pairing_cb.is_ssp = false;
3188 pairing_cb.is_le_only = true;
3189 pairing_cb.is_le_nc = true;
3190
3191 HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, COD_UNCLASSIFIED,
3192 BT_SSP_VARIANT_PASSKEY_CONFIRMATION, p_notif_req->passkey);
3193 }
3194
btif_dm_ble_oob_req_evt(tBTA_DM_SP_RMT_OOB * req_oob_type)3195 static void btif_dm_ble_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type) {
3196 BTIF_TRACE_DEBUG("%s", __func__);
3197
3198 RawAddress bd_addr = req_oob_type->bd_addr;
3199 /* We already checked if OOB data is present in
3200 * btif_dm_set_oob_for_le_io_req, but check here again. If it's not present
3201 * do nothing, pairing will timeout.
3202 */
3203 if (is_empty_128bit(oob_cb.oob_data.sm_tk)) {
3204 return;
3205 }
3206
3207 /* make sure OOB data is for this particular device */
3208 if (req_oob_type->bd_addr != oob_cb.bdaddr) {
3209 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
3210 __func__);
3211 return;
3212 }
3213
3214 /* Remote name update */
3215 btif_update_remote_properties(req_oob_type->bd_addr, req_oob_type->bd_name,
3216 NULL, BT_DEVICE_TYPE_BLE);
3217
3218 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
3219 pairing_cb.is_ssp = false;
3220 pairing_cb.is_le_only = true;
3221 pairing_cb.is_le_nc = false;
3222
3223 BTM_BleOobDataReply(req_oob_type->bd_addr, 0, 16, oob_cb.oob_data.sm_tk);
3224 }
3225
btif_dm_ble_sc_oob_req_evt(tBTA_DM_SP_RMT_OOB * req_oob_type)3226 static void btif_dm_ble_sc_oob_req_evt(tBTA_DM_SP_RMT_OOB* req_oob_type) {
3227 BTIF_TRACE_DEBUG("%s", __func__);
3228
3229 RawAddress bd_addr = req_oob_type->bd_addr;
3230
3231 /* We already checked if OOB data is present in
3232 * btif_dm_set_oob_for_le_io_req, but check here again. If it's not present
3233 * do nothing, pairing will timeout.
3234 */
3235 if (is_empty_128bit(oob_cb.oob_data.le_sc_c) &&
3236 is_empty_128bit(oob_cb.oob_data.le_sc_r)) {
3237 BTIF_TRACE_WARNING("%s: LE SC OOB data is empty", __func__);
3238 return;
3239 }
3240
3241 /* make sure OOB data is for this particular device */
3242 if (req_oob_type->bd_addr != oob_cb.bdaddr) {
3243 BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
3244 __func__);
3245 return;
3246 }
3247
3248 /* Remote name update */
3249 btif_update_remote_properties(req_oob_type->bd_addr, req_oob_type->bd_name,
3250 NULL, BT_DEVICE_TYPE_BLE);
3251
3252 bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
3253 pairing_cb.is_ssp = false;
3254 pairing_cb.is_le_only =
3255 true; // TODO: we can derive classic pairing from this one
3256 pairing_cb.is_le_nc = false;
3257
3258 BTM_BleSecureConnectionOobDataReply(
3259 req_oob_type->bd_addr, oob_cb.oob_data.le_sc_c, oob_cb.oob_data.le_sc_r);
3260 }
3261
btif_dm_update_ble_remote_properties(const RawAddress & bd_addr,BD_NAME bd_name,tBT_DEVICE_TYPE dev_type)3262 void btif_dm_update_ble_remote_properties(const RawAddress& bd_addr,
3263 BD_NAME bd_name,
3264 tBT_DEVICE_TYPE dev_type) {
3265 btif_update_remote_properties(bd_addr, bd_name, NULL, dev_type);
3266 }
3267
btif_dm_ble_tx_test_cback(void * p)3268 static void btif_dm_ble_tx_test_cback(void* p) {
3269 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_LE_TX_TEST, (char*)p, 1,
3270 NULL);
3271 }
3272
btif_dm_ble_rx_test_cback(void * p)3273 static void btif_dm_ble_rx_test_cback(void* p) {
3274 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_LE_RX_TEST, (char*)p, 1,
3275 NULL);
3276 }
3277
btif_dm_ble_test_end_cback(void * p)3278 static void btif_dm_ble_test_end_cback(void* p) {
3279 btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_LE_TEST_END, (char*)p,
3280 3, NULL);
3281 }
3282 /*******************************************************************************
3283 *
3284 * Function btif_le_test_mode
3285 *
3286 * Description Sends a HCI BLE Test command to the Controller
3287 *
3288 * Returns BT_STATUS_SUCCESS on success
3289 *
3290 ******************************************************************************/
btif_le_test_mode(uint16_t opcode,uint8_t * buf,uint8_t len)3291 bt_status_t btif_le_test_mode(uint16_t opcode, uint8_t* buf, uint8_t len) {
3292 switch (opcode) {
3293 case HCI_BLE_TRANSMITTER_TEST:
3294 if (len != 3) return BT_STATUS_PARM_INVALID;
3295 BTM_BleTransmitterTest(buf[0], buf[1], buf[2], btif_dm_ble_tx_test_cback);
3296 break;
3297 case HCI_BLE_RECEIVER_TEST:
3298 if (len != 1) return BT_STATUS_PARM_INVALID;
3299 BTM_BleReceiverTest(buf[0], btif_dm_ble_rx_test_cback);
3300 break;
3301 case HCI_BLE_TEST_END:
3302 BTM_BleTestEnd(btif_dm_ble_test_end_cback);
3303 break;
3304 default:
3305 BTIF_TRACE_ERROR("%s: Unknown LE Test Mode Command 0x%x", __func__,
3306 opcode);
3307 return BT_STATUS_UNSUPPORTED;
3308 }
3309 return BT_STATUS_SUCCESS;
3310 }
3311
btif_dm_on_disable()3312 void btif_dm_on_disable() {
3313 /* cancel any pending pairing requests */
3314 if (is_bonding_or_sdp()) {
3315 BTIF_TRACE_DEBUG("%s: Cancel pending pairing request", __func__);
3316 btif_dm_cancel_bond(&pairing_cb.bd_addr);
3317 }
3318 }
3319
3320 /*******************************************************************************
3321 *
3322 * Function btif_dm_read_energy_info
3323 *
3324 * Description Reads the energy info from controller
3325 *
3326 * Returns void
3327 *
3328 ******************************************************************************/
btif_dm_read_energy_info()3329 void btif_dm_read_energy_info() { BTA_DmBleGetEnergyInfo(bta_energy_info_cb); }
3330
btif_get_default_local_name()3331 static char* btif_get_default_local_name() {
3332 if (btif_default_local_name[0] == '\0') {
3333 int max_len = sizeof(btif_default_local_name) - 1;
3334 if (BTM_DEF_LOCAL_NAME[0] != '\0') {
3335 strncpy(btif_default_local_name, BTM_DEF_LOCAL_NAME, max_len);
3336 } else {
3337 char prop_model[PROPERTY_VALUE_MAX];
3338 osi_property_get(PROPERTY_PRODUCT_MODEL, prop_model, "");
3339 strncpy(btif_default_local_name, prop_model, max_len);
3340 }
3341 btif_default_local_name[max_len] = '\0';
3342 }
3343 return btif_default_local_name;
3344 }
3345
btif_stats_add_bond_event(const RawAddress & bd_addr,bt_bond_function_t function,bt_bond_state_t state)3346 static void btif_stats_add_bond_event(const RawAddress& bd_addr,
3347 bt_bond_function_t function,
3348 bt_bond_state_t state) {
3349 std::unique_lock<std::mutex> lock(bond_event_lock);
3350
3351 btif_bond_event_t* event = &btif_dm_bond_events[btif_events_end_index];
3352 event->bd_addr = bd_addr;
3353 event->function = function;
3354 event->state = state;
3355 clock_gettime(CLOCK_REALTIME, &event->timestamp);
3356
3357 btif_num_bond_events++;
3358 btif_events_end_index =
3359 (btif_events_end_index + 1) % (MAX_BTIF_BOND_EVENT_ENTRIES + 1);
3360 if (btif_events_end_index == btif_events_start_index) {
3361 btif_events_start_index =
3362 (btif_events_start_index + 1) % (MAX_BTIF_BOND_EVENT_ENTRIES + 1);
3363 }
3364
3365 int type;
3366 btif_get_device_type(bd_addr, &type);
3367
3368 bluetooth::common::device_type_t device_type;
3369 switch (type) {
3370 case BT_DEVICE_TYPE_BREDR:
3371 device_type = bluetooth::common::DEVICE_TYPE_BREDR;
3372 break;
3373 case BT_DEVICE_TYPE_BLE:
3374 device_type = bluetooth::common::DEVICE_TYPE_LE;
3375 break;
3376 case BT_DEVICE_TYPE_DUMO:
3377 device_type = bluetooth::common::DEVICE_TYPE_DUMO;
3378 break;
3379 default:
3380 device_type = bluetooth::common::DEVICE_TYPE_UNKNOWN;
3381 break;
3382 }
3383
3384 uint32_t cod = get_cod(&bd_addr);
3385 uint64_t ts =
3386 event->timestamp.tv_sec * 1000 + event->timestamp.tv_nsec / 1000000;
3387 bluetooth::common::BluetoothMetricsLogger::GetInstance()->LogPairEvent(
3388 0, ts, cod, device_type);
3389 }
3390
btif_debug_bond_event_dump(int fd)3391 void btif_debug_bond_event_dump(int fd) {
3392 std::unique_lock<std::mutex> lock(bond_event_lock);
3393 dprintf(fd, "\nBond Events: \n");
3394 dprintf(fd, " Total Number of events: %zu\n", btif_num_bond_events);
3395 if (btif_num_bond_events > 0)
3396 dprintf(fd,
3397 " Time address Function State\n");
3398
3399 for (size_t i = btif_events_start_index; i != btif_events_end_index;
3400 i = (i + 1) % (MAX_BTIF_BOND_EVENT_ENTRIES + 1)) {
3401 btif_bond_event_t* event = &btif_dm_bond_events[i];
3402
3403 char eventtime[20];
3404 char temptime[20];
3405 struct tm* tstamp = localtime(&event->timestamp.tv_sec);
3406 strftime(temptime, sizeof(temptime), "%H:%M:%S", tstamp);
3407 snprintf(eventtime, sizeof(eventtime), "%s.%03ld", temptime,
3408 event->timestamp.tv_nsec / 1000000);
3409
3410 const char* func_name;
3411 switch (event->function) {
3412 case BTIF_DM_FUNC_CREATE_BOND:
3413 func_name = "btif_dm_create_bond";
3414 break;
3415 case BTIF_DM_FUNC_REMOVE_BOND:
3416 func_name = "btif_dm_remove_bond";
3417 break;
3418 case BTIF_DM_FUNC_BOND_STATE_CHANGED:
3419 func_name = "bond_state_changed ";
3420 break;
3421 default:
3422 func_name = "Invalid value ";
3423 break;
3424 }
3425
3426 const char* bond_state;
3427 switch (event->state) {
3428 case BT_BOND_STATE_NONE:
3429 bond_state = "BOND_STATE_NONE";
3430 break;
3431 case BT_BOND_STATE_BONDING:
3432 bond_state = "BOND_STATE_BONDING";
3433 break;
3434 case BT_BOND_STATE_BONDED:
3435 bond_state = "BOND_STATE_BONDED";
3436 break;
3437 default:
3438 bond_state = "Invalid bond state";
3439 break;
3440 }
3441
3442 dprintf(fd, " %s %s %s %s\n", eventtime,
3443 event->bd_addr.ToString().c_str(), func_name, bond_state);
3444 }
3445 }
3446