1 /******************************************************************************
2 *
3 * Copyright (C) 1999-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /******************************************************************************
20 *
21 * This file contains functions for BLE device control utilities, and LE
22 * security functions.
23 *
24 ******************************************************************************/
25 #include "common/bt_target.h"
26
27 #include <string.h>
28
29 #include "stack/bt_types.h"
30 #include "stack/hcimsgs.h"
31 #include "stack/btu.h"
32 #include "btm_int.h"
33 #include "stack/btm_ble_api.h"
34 #include "stack/smp_api.h"
35 #include "l2c_int.h"
36 #include "stack/gap_api.h"
37 //#include "bt_utils.h"
38 #include "device/controller.h"
39
40 //#define LOG_TAG "bt_btm_ble"
41 //#include "osi/include/log.h"
42 #if BLE_INCLUDED == TRUE
43 #if SMP_INCLUDED == TRUE
44 // The temp variable to pass parameter between functions when in the connected event callback.
45 static BOOLEAN temp_enhanced = FALSE;
46 extern BOOLEAN aes_cipher_msg_auth_code(BT_OCTET16 key, UINT8 *input, UINT16 length,
47 UINT16 tlen, UINT8 *p_signature);
48 extern void smp_link_encrypted(BD_ADDR bda, UINT8 encr_enable);
49 extern BOOLEAN smp_proc_ltk_request(BD_ADDR bda);
50 #endif
51 extern void gatt_notify_enc_cmpl(BD_ADDR bd_addr);
52 /*******************************************************************************/
53 /* External Function to be called by other modules */
54 /*******************************************************************************/
55 /********************************************************
56 **
57 ** Function BTM_SecAddBleDevice
58 **
59 ** Description Add/modify device. This function will be normally called
60 ** during host startup to restore all required information
61 ** for a LE device stored in the NVRAM.
62 **
63 ** Parameters: bd_addr - BD address of the peer
64 ** bd_name - Name of the peer device. NULL if unknown.
65 ** dev_type - Remote device's device type.
66 ** addr_type - LE device address type.
67 ** auth_mode - auth mode
68 **
69 ** Returns TRUE if added OK, else FALSE
70 **
71 *******************************************************************************/
72 #if (SMP_INCLUDED == TRUE)
BTM_SecAddBleDevice(BD_ADDR bd_addr,BD_NAME bd_name,tBT_DEVICE_TYPE dev_type,tBLE_ADDR_TYPE addr_type,UINT32 auth_mode)73 BOOLEAN BTM_SecAddBleDevice (BD_ADDR bd_addr, BD_NAME bd_name, tBT_DEVICE_TYPE dev_type,
74 tBLE_ADDR_TYPE addr_type, UINT32 auth_mode)
75 {
76 tBTM_SEC_DEV_REC *p_dev_rec;
77 tBTM_INQ_INFO *p_info = NULL;
78
79 BTM_TRACE_DEBUG ("BTM_SecAddBleDevice dev_type=0x%x", dev_type);
80 p_dev_rec = btm_find_dev (bd_addr);
81
82 if (!p_dev_rec) {
83 BTM_TRACE_DEBUG("Add a new device");
84
85 /* There is no device record, allocate one.
86 * If we can not find an empty spot for this one, let it fail. */
87 if (list_length(btm_cb.p_sec_dev_rec_list) < BTM_SEC_MAX_DEVICE_RECORDS) {
88 p_dev_rec = (tBTM_SEC_DEV_REC *)osi_malloc(sizeof(tBTM_SEC_DEV_REC));
89 if(p_dev_rec) {
90 list_append(btm_cb.p_sec_dev_rec_list, p_dev_rec);
91 BTM_TRACE_DEBUG ("allocate a new dev rec idx=0x%x\n", list_length(btm_cb.p_sec_dev_rec_list));
92
93 /* Mark this record as in use and initialize */
94 memset (p_dev_rec, 0, sizeof (tBTM_SEC_DEV_REC));
95 p_dev_rec->sec_flags = BTM_SEC_IN_USE;
96 memcpy (p_dev_rec->bd_addr, bd_addr, BD_ADDR_LEN);
97 p_dev_rec->hci_handle = BTM_GetHCIConnHandle (bd_addr, BT_TRANSPORT_BR_EDR);
98 p_dev_rec->ble_hci_handle = BTM_GetHCIConnHandle (bd_addr, BT_TRANSPORT_LE);
99
100 /* update conn params, use default value for background connection params */
101 p_dev_rec->conn_params.min_conn_int =
102 p_dev_rec->conn_params.max_conn_int =
103 p_dev_rec->conn_params.supervision_tout =
104 p_dev_rec->conn_params.slave_latency = BTM_BLE_CONN_PARAM_UNDEF;
105
106 BTM_TRACE_DEBUG ("hci_handl=0x%x ", p_dev_rec->ble_hci_handle );
107 }
108 }
109
110 if (!p_dev_rec) {
111 return (FALSE);
112 }
113 } else {
114 BTM_TRACE_DEBUG("Device already exist");
115 }
116
117 memset(p_dev_rec->sec_bd_name, 0, sizeof(tBTM_BD_NAME));
118
119 if (bd_name && bd_name[0]) {
120 p_dev_rec->sec_flags |= BTM_SEC_NAME_KNOWN;
121 BCM_STRNCPY_S ((char *)p_dev_rec->sec_bd_name, (char *)bd_name, BTM_MAX_REM_BD_NAME_LEN);
122 }
123 p_dev_rec->device_type |= dev_type;
124 p_dev_rec->ble.ble_addr_type = addr_type;
125 p_dev_rec->ble.auth_mode = auth_mode;
126
127 memcpy (p_dev_rec->ble.pseudo_addr, bd_addr, BD_ADDR_LEN);
128 /* sync up with the Inq Data base*/
129 p_info = BTM_InqDbRead(bd_addr);
130 if (p_info) {
131 p_info->results.ble_addr_type = p_dev_rec->ble.ble_addr_type ;
132 p_info->results.device_type = p_dev_rec->device_type;
133 BTM_TRACE_DEBUG ("InqDb device_type =0x%x addr_type=0x%x",
134 p_info->results.device_type, p_info->results.ble_addr_type);
135 }
136 return (TRUE);
137 }
138 #endif ///SMP_INCLUDED == TRUE
139
140
141 /*******************************************************************************
142 **
143 ** Function BTM_SecAddBleKey
144 **
145 ** Description Add/modify LE device information. This function will be
146 ** normally called during host startup to restore all required
147 ** information stored in the NVRAM.
148 **
149 ** Parameters: bd_addr - BD address of the peer
150 ** p_le_key - LE key values.
151 ** key_type - LE SMP key type.
152 *
153 ** Returns TRUE if added OK, else FALSE
154 **
155 *******************************************************************************/
156 #if SMP_INCLUDED == TRUE
BTM_SecAddBleKey(BD_ADDR bd_addr,tBTM_LE_KEY_VALUE * p_le_key,tBTM_LE_KEY_TYPE key_type)157 BOOLEAN BTM_SecAddBleKey (BD_ADDR bd_addr, tBTM_LE_KEY_VALUE *p_le_key, tBTM_LE_KEY_TYPE key_type)
158 {
159 tBTM_SEC_DEV_REC *p_dev_rec;
160 BTM_TRACE_DEBUG ("BTM_SecAddBleKey");
161 p_dev_rec = btm_find_dev (bd_addr);
162 if (!p_dev_rec || !p_le_key ||
163 (key_type != BTM_LE_KEY_PENC && key_type != BTM_LE_KEY_PID &&
164 key_type != BTM_LE_KEY_PCSRK && key_type != BTM_LE_KEY_LENC &&
165 key_type != BTM_LE_KEY_LCSRK && key_type != BTM_LE_KEY_LID)) {
166 BTM_TRACE_WARNING ("BTM_SecAddBleKey() Wrong Type, or No Device record \
167 for bdaddr: %08x%04x, Type: %d",
168 (bd_addr[0] << 24) + (bd_addr[1] << 16) + (bd_addr[2] << 8) + bd_addr[3],
169 (bd_addr[4] << 8) + bd_addr[5], key_type);
170 return (FALSE);
171 }
172
173 BTM_TRACE_DEBUG ("BTM_SecAddLeKey() BDA: %08x%04x, Type: 0x%02x",
174 (bd_addr[0] << 24) + (bd_addr[1] << 16) + (bd_addr[2] << 8) + bd_addr[3],
175 (bd_addr[4] << 8) + bd_addr[5], key_type);
176
177 btm_sec_save_le_key (bd_addr, key_type, p_le_key, FALSE);
178
179 #if (BLE_PRIVACY_SPT == TRUE)
180 if (key_type == BTM_LE_KEY_PID || key_type == BTM_LE_KEY_LID) {
181 btm_ble_resolving_list_load_dev (p_dev_rec);
182 }
183 #endif
184
185
186 return (TRUE);
187 }
188 #endif
189
190
191 /*******************************************************************************
192 **
193 ** Function BTM_BleLoadLocalKeys
194 **
195 ** Description Local local identity key, encryption root or sign counter.
196 **
197 ** Parameters: key_type: type of key, can be BTM_BLE_KEY_TYPE_ID, BTM_BLE_KEY_TYPE_ER
198 ** or BTM_BLE_KEY_TYPE_COUNTER.
199 ** p_key: pointer to the key.
200 *
201 ** Returns non2.
202 **
203 *******************************************************************************/
BTM_BleLoadLocalKeys(UINT8 key_type,tBTM_BLE_LOCAL_KEYS * p_key)204 void BTM_BleLoadLocalKeys(UINT8 key_type, tBTM_BLE_LOCAL_KEYS *p_key)
205 {
206 tBTM_DEVCB *p_devcb = &btm_cb.devcb;
207 BTM_TRACE_DEBUG ("%s", __func__);
208 if (p_key != NULL) {
209 switch (key_type) {
210 case BTM_BLE_KEY_TYPE_ID:
211 memcpy(&p_devcb->id_keys, &p_key->id_keys, sizeof(tBTM_BLE_LOCAL_ID_KEYS));
212 break;
213
214 case BTM_BLE_KEY_TYPE_ER:
215 memcpy(p_devcb->ble_encryption_key_value, p_key->er, sizeof(BT_OCTET16));
216 break;
217
218 default:
219 BTM_TRACE_ERROR("unknow local key type: %d", key_type);
220 break;
221 }
222 }
223 }
224
225 /*******************************************************************************
226 **
227 ** Function BTM_GetDeviceEncRoot
228 **
229 ** Description This function is called to read the local device encryption
230 ** root.
231 **
232 ** Returns void
233 ** the local device ER is copied into ble_encr_key_value
234 **
235 *******************************************************************************/
BTM_GetDeviceEncRoot(BT_OCTET16 ble_encr_key_value)236 void BTM_GetDeviceEncRoot (BT_OCTET16 ble_encr_key_value)
237 {
238 BTM_TRACE_DEBUG ("%s", __func__);
239 memcpy (ble_encr_key_value, btm_cb.devcb.ble_encryption_key_value, BT_OCTET16_LEN);
240 }
241
242 /*******************************************************************************
243 **
244 ** Function BTM_GetDeviceIDRoot
245 **
246 ** Description This function is called to read the local device identity
247 ** root.
248 **
249 ** Returns void
250 ** the local device IR is copied into irk
251 **
252 *******************************************************************************/
BTM_GetDeviceIDRoot(BT_OCTET16 irk)253 void BTM_GetDeviceIDRoot (BT_OCTET16 irk)
254 {
255 BTM_TRACE_DEBUG ("BTM_GetDeviceIDRoot ");
256
257 memcpy (irk, btm_cb.devcb.id_keys.irk, BT_OCTET16_LEN);
258 }
259
260 /*******************************************************************************
261 **
262 ** Function BTM_GetDeviceDHK
263 **
264 ** Description This function is called to read the local device DHK.
265 **
266 ** Returns void
267 ** the local device DHK is copied into dhk
268 **
269 *******************************************************************************/
BTM_GetDeviceDHK(BT_OCTET16 dhk)270 void BTM_GetDeviceDHK (BT_OCTET16 dhk)
271 {
272 BTM_TRACE_DEBUG ("BTM_GetDeviceDHK");
273 memcpy (dhk, btm_cb.devcb.id_keys.dhk, BT_OCTET16_LEN);
274 }
275
276 /*******************************************************************************
277 **
278 ** Function BTM_ReadConnectionAddr
279 **
280 ** Description This function is called to get the local device address information
281 ** .
282 **
283 ** Returns void
284 **
285 *******************************************************************************/
BTM_ReadConnectionAddr(BD_ADDR remote_bda,BD_ADDR local_conn_addr,tBLE_ADDR_TYPE * p_addr_type)286 void BTM_ReadConnectionAddr (BD_ADDR remote_bda, BD_ADDR local_conn_addr, tBLE_ADDR_TYPE *p_addr_type)
287 {
288 tACL_CONN *p_acl = btm_bda_to_acl(remote_bda, BT_TRANSPORT_LE);
289
290 if (p_acl == NULL) {
291 BTM_TRACE_ERROR("No connection exist!");
292 return;
293 }
294 memcpy(local_conn_addr, p_acl->conn_addr, BD_ADDR_LEN);
295 * p_addr_type = p_acl->conn_addr_type;
296
297 BTM_TRACE_DEBUG ("BTM_ReadConnectionAddr address type: %d addr: 0x%02x",
298 p_acl->conn_addr_type, p_acl->conn_addr[0]);
299 }
300
301 /*******************************************************************************
302 **
303 ** Function BTM_IsBleConnection
304 **
305 ** Description This function is called to check if the connection handle
306 ** for an LE link
307 **
308 ** Returns TRUE if connection is LE link, otherwise FALSE.
309 **
310 *******************************************************************************/
BTM_IsBleConnection(UINT16 conn_handle)311 BOOLEAN BTM_IsBleConnection (UINT16 conn_handle)
312 {
313 #if (BLE_INCLUDED == TRUE)
314 tACL_CONN *p;
315
316 BTM_TRACE_API ("BTM_IsBleConnection: conn_handle: %d", conn_handle);
317
318 p = btm_handle_to_acl(conn_handle);
319 if (!p) {
320 return FALSE;
321 }
322 return (p->transport == BT_TRANSPORT_LE);
323 #else
324 return FALSE;
325 #endif
326 }
327
328 /*******************************************************************************
329 **
330 ** Function BTM_ReadRemoteConnectionAddr
331 **
332 ** Description This function is read the remote device address currently used
333 **
334 ** Parameters pseudo_addr: pseudo random address available
335 ** conn_addr:connection address used
336 ** p_addr_type : BD Address type, Public or Random of the address used
337 **
338 ** Returns BOOLEAN , TRUE if connection to remote device exists, else FALSE
339 **
340 *******************************************************************************/
BTM_ReadRemoteConnectionAddr(BD_ADDR pseudo_addr,BD_ADDR conn_addr,tBLE_ADDR_TYPE * p_addr_type)341 BOOLEAN BTM_ReadRemoteConnectionAddr(BD_ADDR pseudo_addr, BD_ADDR conn_addr,
342 tBLE_ADDR_TYPE *p_addr_type)
343 {
344 BOOLEAN st = TRUE;
345 #if (BLE_PRIVACY_SPT == TRUE)
346 tACL_CONN *p = btm_bda_to_acl (pseudo_addr, BT_TRANSPORT_LE);
347
348 if (p == NULL) {
349 BTM_TRACE_ERROR("BTM_ReadRemoteConnectionAddr can not find connection"
350 " with matching address");
351 return FALSE;
352 }
353
354 memcpy(conn_addr, p->active_remote_addr, BD_ADDR_LEN);
355 *p_addr_type = p->active_remote_addr_type;
356 #else
357 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev(pseudo_addr);
358
359 memcpy(conn_addr, pseudo_addr, BD_ADDR_LEN);
360 if (p_dev_rec != NULL) {
361 *p_addr_type = p_dev_rec->ble.ble_addr_type;
362 }
363 #endif
364 return st;
365
366 }
367 /*******************************************************************************
368 **
369 ** Function BTM_SecurityGrant
370 **
371 ** Description This function is called to grant security process.
372 **
373 ** Parameters bd_addr - peer device bd address.
374 ** res - result of the operation BTM_SUCCESS if success.
375 ** Otherwise, BTM_REPEATED_ATTEMPTS is too many attempts.
376 **
377 ** Returns None
378 **
379 *******************************************************************************/
BTM_SecurityGrant(BD_ADDR bd_addr,UINT8 res)380 void BTM_SecurityGrant(BD_ADDR bd_addr, UINT8 res)
381 {
382 #if SMP_INCLUDED == TRUE
383 tSMP_STATUS res_smp = (res == BTM_SUCCESS) ? SMP_SUCCESS : SMP_REPEATED_ATTEMPTS;
384 BTM_TRACE_DEBUG ("BTM_SecurityGrant");
385 SMP_SecurityGrant(bd_addr, res_smp);
386 #endif
387 }
388
389 /*******************************************************************************
390 **
391 ** Function BTM_BlePasskeyReply
392 **
393 ** Description This function is called after Security Manager submitted
394 ** passkey request to the application.
395 **
396 ** Parameters: bd_addr - Address of the device for which passkey was requested
397 ** res - result of the operation BTM_SUCCESS if success
398 ** key_len - length in bytes of the Passkey
399 ** p_passkey - pointer to array with the passkey
400 ** trusted_mask - bitwise OR of trusted services (array of UINT32)
401 **
402 *******************************************************************************/
BTM_BlePasskeyReply(BD_ADDR bd_addr,UINT8 res,UINT32 passkey)403 void BTM_BlePasskeyReply (BD_ADDR bd_addr, UINT8 res, UINT32 passkey)
404 {
405 #if SMP_INCLUDED == TRUE
406 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bd_addr);
407 tSMP_STATUS res_smp = (res == BTM_SUCCESS) ? SMP_SUCCESS : SMP_PASSKEY_ENTRY_FAIL;
408
409 if (p_dev_rec == NULL) {
410 BTM_TRACE_ERROR("Passkey reply to Unknown device");
411 return;
412 }
413
414 p_dev_rec->sec_flags |= BTM_SEC_LE_AUTHENTICATED;
415 BTM_TRACE_DEBUG ("BTM_BlePasskeyReply");
416 SMP_PasskeyReply(bd_addr, res_smp, passkey);
417 #endif
418 }
419
420 /*******************************************************************************
421 **
422 ** Function BTM_BleSetStaticPasskey
423 **
424 ** Description This function is called to set static passkey
425 **
426 **
427 ** Parameters: add - set static passkey when add is TRUE
428 ** clear static passkey when add is FALSE
429 ** passkey - static passkey
430 **
431 **
432 *******************************************************************************/
BTM_BleSetStaticPasskey(BOOLEAN add,UINT32 passkey)433 void BTM_BleSetStaticPasskey(BOOLEAN add, UINT32 passkey)
434 {
435 #if SMP_INCLUDED == TRUE
436 SMP_SetStaticPasskey(add, passkey);
437 #endif
438 }
439
440 /*******************************************************************************
441 **
442 ** Function BTM_BleConfirmReply
443 **
444 ** Description This function is called after Security Manager submitted
445 ** numeric comparison request to the application.
446 **
447 ** Parameters: bd_addr - Address of the device with which numeric
448 ** comparison was requested
449 ** res - comparison result BTM_SUCCESS if success
450 **
451 *******************************************************************************/
452 #if (SMP_INCLUDED == TRUE)
BTM_BleConfirmReply(BD_ADDR bd_addr,UINT8 res)453 void BTM_BleConfirmReply (BD_ADDR bd_addr, UINT8 res)
454 {
455 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bd_addr);
456 tSMP_STATUS res_smp = (res == BTM_SUCCESS) ? SMP_SUCCESS : SMP_PASSKEY_ENTRY_FAIL;
457
458 if (p_dev_rec == NULL) {
459 BTM_TRACE_ERROR("Passkey reply to Unknown device");
460 return;
461 }
462
463 p_dev_rec->sec_flags |= BTM_SEC_LE_AUTHENTICATED;
464 BTM_TRACE_DEBUG ("%s\n", __func__);
465 SMP_ConfirmReply(bd_addr, res_smp);
466 }
467 #endif ///SMP_INCLUDED == TRUE
468
469 /*******************************************************************************
470 **
471 ** Function BTM_BleOobDataReply
472 **
473 ** Description This function is called to provide the OOB data for
474 ** SMP in response to BTM_LE_OOB_REQ_EVT
475 **
476 ** Parameters: bd_addr - Address of the peer device
477 ** res - result of the operation SMP_SUCCESS if success
478 ** p_data - simple pairing Randomizer C.
479 **
480 *******************************************************************************/
BTM_BleOobDataReply(BD_ADDR bd_addr,UINT8 res,UINT8 len,UINT8 * p_data)481 void BTM_BleOobDataReply(BD_ADDR bd_addr, UINT8 res, UINT8 len, UINT8 *p_data)
482 {
483 #if SMP_INCLUDED == TRUE
484 tSMP_STATUS res_smp = (res == BTM_SUCCESS) ? SMP_SUCCESS : SMP_OOB_FAIL;
485 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bd_addr);
486
487 BTM_TRACE_DEBUG ("BTM_BleOobDataReply");
488
489 if (p_dev_rec == NULL) {
490 BTM_TRACE_ERROR("BTM_BleOobDataReply() to Unknown device");
491 return;
492 }
493
494 p_dev_rec->sec_flags |= BTM_SEC_LE_AUTHENTICATED;
495 SMP_OobDataReply(bd_addr, res_smp, len, p_data);
496 #endif
497 }
498
499 /******************************************************************************
500 **
501 ** Function BTM_BleSetConnScanParams
502 **
503 ** Description Set scan parameter used in BLE connection request
504 **
505 ** Parameters: scan_interval: scan interval
506 ** scan_window: scan window
507 **
508 ** Returns void
509 **
510 *******************************************************************************/
BTM_BleSetConnScanParams(UINT32 scan_interval,UINT32 scan_window)511 void BTM_BleSetConnScanParams (UINT32 scan_interval, UINT32 scan_window)
512 {
513 #if SMP_INCLUDED == TRUE
514 tBTM_BLE_CB *p_ble_cb = &btm_cb.ble_ctr_cb;
515 BOOLEAN new_param = FALSE;
516
517 if (BTM_BLE_ISVALID_PARAM(scan_interval, BTM_BLE_SCAN_INT_MIN, BTM_BLE_SCAN_INT_MAX) &&
518 BTM_BLE_ISVALID_PARAM(scan_window, BTM_BLE_SCAN_WIN_MIN, BTM_BLE_SCAN_WIN_MAX)) {
519 if (p_ble_cb->scan_int != scan_interval) {
520 p_ble_cb->scan_int = scan_interval;
521 new_param = TRUE;
522 }
523
524 if (p_ble_cb->scan_win != scan_window) {
525 p_ble_cb->scan_win = scan_window;
526 new_param = TRUE;
527 }
528
529 if (new_param && p_ble_cb->conn_state == BLE_BG_CONN) {
530 btm_ble_suspend_bg_conn();
531 }
532 } else {
533 BTM_TRACE_ERROR("Illegal Connection Scan Parameters");
534 }
535 #endif
536 }
537
538 /********************************************************
539 **
540 ** Function BTM_BleSetPrefConnParams
541 **
542 ** Description Set a peripheral's preferred connection parameters
543 **
544 ** Parameters: bd_addr - BD address of the peripheral
545 ** scan_interval: scan interval
546 ** scan_window: scan window
547 ** min_conn_int - minimum preferred connection interval
548 ** max_conn_int - maximum preferred connection interval
549 ** slave_latency - preferred slave latency
550 ** supervision_tout - preferred supervision timeout
551 **
552 ** Returns void
553 **
554 *******************************************************************************/
BTM_BleSetPrefConnParams(BD_ADDR bd_addr,UINT16 min_conn_int,UINT16 max_conn_int,UINT16 slave_latency,UINT16 supervision_tout)555 void BTM_BleSetPrefConnParams (BD_ADDR bd_addr,
556 UINT16 min_conn_int, UINT16 max_conn_int,
557 UINT16 slave_latency, UINT16 supervision_tout)
558 {
559 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_or_alloc_dev (bd_addr);
560
561 BTM_TRACE_API ("BTM_BleSetPrefConnParams min: %u max: %u latency: %u \
562 tout: %u",
563 min_conn_int, max_conn_int, slave_latency, supervision_tout);
564
565 if (BTM_BLE_ISVALID_PARAM(min_conn_int, BTM_BLE_CONN_INT_MIN, BTM_BLE_CONN_INT_MAX) &&
566 BTM_BLE_ISVALID_PARAM(max_conn_int, BTM_BLE_CONN_INT_MIN, BTM_BLE_CONN_INT_MAX) &&
567 BTM_BLE_ISVALID_PARAM(supervision_tout, BTM_BLE_CONN_SUP_TOUT_MIN, BTM_BLE_CONN_SUP_TOUT_MAX) &&
568 (slave_latency <= BTM_BLE_CONN_LATENCY_MAX || slave_latency == BTM_BLE_CONN_PARAM_UNDEF)) {
569 if (p_dev_rec) {
570 /* expect conn int and stout and slave latency to be updated all together */
571 if (min_conn_int != BTM_BLE_CONN_PARAM_UNDEF || max_conn_int != BTM_BLE_CONN_PARAM_UNDEF) {
572 if (min_conn_int != BTM_BLE_CONN_PARAM_UNDEF) {
573 p_dev_rec->conn_params.min_conn_int = min_conn_int;
574 } else {
575 p_dev_rec->conn_params.min_conn_int = max_conn_int;
576 }
577
578 if (max_conn_int != BTM_BLE_CONN_PARAM_UNDEF) {
579 p_dev_rec->conn_params.max_conn_int = max_conn_int;
580 } else {
581 p_dev_rec->conn_params.max_conn_int = min_conn_int;
582 }
583
584 if (slave_latency != BTM_BLE_CONN_PARAM_UNDEF) {
585 p_dev_rec->conn_params.slave_latency = slave_latency;
586 } else {
587 p_dev_rec->conn_params.slave_latency = BTM_BLE_CONN_SLAVE_LATENCY_DEF;
588 }
589
590 if (supervision_tout != BTM_BLE_CONN_PARAM_UNDEF) {
591 p_dev_rec->conn_params.supervision_tout = supervision_tout;
592 } else {
593 p_dev_rec->conn_params.supervision_tout = BTM_BLE_CONN_TIMEOUT_DEF;
594 }
595
596 }
597
598 } else {
599 BTM_TRACE_ERROR("Unknown Device, setting rejected");
600 }
601 } else {
602 BTM_TRACE_ERROR("Illegal Connection Parameters");
603 }
604 }
605
606 /*******************************************************************************
607 **
608 ** Function BTM_ReadDevInfo
609 **
610 ** Description This function is called to read the device/address type
611 ** of BD address.
612 **
613 ** Parameter remote_bda: remote device address
614 ** p_dev_type: output parameter to read the device type.
615 ** p_addr_type: output parameter to read the address type.
616 **
617 *******************************************************************************/
BTM_ReadDevInfo(BD_ADDR remote_bda,tBT_DEVICE_TYPE * p_dev_type,tBLE_ADDR_TYPE * p_addr_type)618 void BTM_ReadDevInfo (BD_ADDR remote_bda, tBT_DEVICE_TYPE *p_dev_type, tBLE_ADDR_TYPE *p_addr_type)
619 {
620 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (remote_bda);
621 tBTM_INQ_INFO *p_inq_info = BTM_InqDbRead(remote_bda);
622 tBLE_ADDR_TYPE temp_addr_type = (*p_addr_type);
623
624 *p_addr_type = BLE_ADDR_PUBLIC;
625
626 if (!p_dev_rec) {
627 *p_dev_type = BT_DEVICE_TYPE_BREDR;
628 /* Check with the BT manager if details about remote device are known */
629 if (p_inq_info != NULL) {
630 *p_dev_type = p_inq_info->results.device_type ;
631 *p_addr_type = p_inq_info->results.ble_addr_type;
632 } else {
633 if(temp_addr_type <= BLE_ADDR_TYPE_MAX) {
634 *p_addr_type = temp_addr_type;
635 } else {
636 /* unknown device, assume BR/EDR */
637 BTM_TRACE_DEBUG ("btm_find_dev_type - unknown device, BR/EDR assumed");
638 }
639 }
640 } else { /* there is a security device record exisitng */
641 /* new inquiry result, overwrite device type in security device record */
642 if (p_inq_info) {
643 p_dev_rec->device_type = p_inq_info->results.device_type;
644 p_dev_rec->ble.ble_addr_type = p_inq_info->results.ble_addr_type;
645 }
646 if (memcmp(p_dev_rec->bd_addr, remote_bda, BD_ADDR_LEN) == 0 &&
647 memcmp(p_dev_rec->ble.pseudo_addr, remote_bda, BD_ADDR_LEN) == 0) {
648 *p_dev_type = p_dev_rec->device_type;
649 *p_addr_type = p_dev_rec->ble.ble_addr_type;
650 } else if (memcmp(p_dev_rec->ble.pseudo_addr, remote_bda, BD_ADDR_LEN) == 0) {
651 *p_dev_type = BT_DEVICE_TYPE_BLE;
652 *p_addr_type = p_dev_rec->ble.ble_addr_type;
653 } else { /* matching static adddress only */
654 *p_dev_type = BT_DEVICE_TYPE_BREDR;
655 *p_addr_type = BLE_ADDR_PUBLIC;
656 }
657
658 }
659
660 BTM_TRACE_DEBUG ("btm_find_dev_type - device_type = %d addr_type = %d", *p_dev_type , *p_addr_type);
661 }
662 #endif ///BLE_INCLUDED == TRUE
663
664 /*******************************************************************************
665 **
666 ** Function BTM_ReadConnectedTransportAddress
667 **
668 ** Description This function is called to read the paired device/address type of other device paired
669 ** corresponding to the BD_address
670 **
671 ** Parameter remote_bda: remote device address, carry out the transport address
672 ** transport: active transport
673 **
674 ** Return TRUE if an active link is identified; FALSE otherwise
675 **
676 *******************************************************************************/
BTM_ReadConnectedTransportAddress(BD_ADDR remote_bda,tBT_TRANSPORT transport)677 BOOLEAN BTM_ReadConnectedTransportAddress(BD_ADDR remote_bda, tBT_TRANSPORT transport)
678 {
679 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev(remote_bda);
680
681 /* if no device can be located, return */
682 if (p_dev_rec == NULL) {
683 memset(remote_bda, 0, BD_ADDR_LEN);
684 return FALSE;
685 }
686
687 if (transport == BT_TRANSPORT_BR_EDR) {
688 if (btm_bda_to_acl(p_dev_rec->bd_addr, transport) != NULL) {
689 memcpy(remote_bda, p_dev_rec->bd_addr, BD_ADDR_LEN);
690 return TRUE;
691 } else if (p_dev_rec->device_type & BT_DEVICE_TYPE_BREDR) {
692 memcpy(remote_bda, p_dev_rec->bd_addr, BD_ADDR_LEN);
693 } else {
694 memset(remote_bda, 0, BD_ADDR_LEN);
695 }
696 return FALSE;
697 }
698 #if (BLE_INCLUDED == TRUE)
699 if (transport == BT_TRANSPORT_LE) {
700 memcpy(remote_bda, p_dev_rec->ble.pseudo_addr, BD_ADDR_LEN);
701 if (btm_bda_to_acl(p_dev_rec->ble.pseudo_addr, transport) != NULL) {
702 return TRUE;
703 } else {
704 return FALSE;
705 }
706 }
707 #endif ///BLE_INCLUDED == TRUE
708 return FALSE;
709 }
710
711 #if (BLE_INCLUDED == TRUE)
712 /*******************************************************************************
713 **
714 ** Function BTM_BleReceiverTest
715 **
716 ** Description This function is called to start the LE Receiver test
717 **
718 ** Parameter rx_freq - Frequency Range
719 ** p_cmd_cmpl_cback - Command Complete callback
720 **
721 *******************************************************************************/
BTM_BleReceiverTest(UINT8 rx_freq,tBTM_CMPL_CB * p_cmd_cmpl_cback)722 void BTM_BleReceiverTest(UINT8 rx_freq, tBTM_CMPL_CB *p_cmd_cmpl_cback)
723 {
724 btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
725
726 if (btsnd_hcic_ble_receiver_test(rx_freq) == FALSE) {
727 BTM_TRACE_ERROR("%s: Unable to Trigger LE receiver test", __FUNCTION__);
728 }
729 }
730
731 /*******************************************************************************
732 **
733 ** Function BTM_BleTransmitterTest
734 **
735 ** Description This function is called to start the LE Transmitter test
736 **
737 ** Parameter tx_freq - Frequency Range
738 ** test_data_len - Length in bytes of payload data in each packet
739 ** packet_payload - Pattern to use in the payload
740 ** p_cmd_cmpl_cback - Command Complete callback
741 **
742 *******************************************************************************/
BTM_BleTransmitterTest(UINT8 tx_freq,UINT8 test_data_len,UINT8 packet_payload,tBTM_CMPL_CB * p_cmd_cmpl_cback)743 void BTM_BleTransmitterTest(UINT8 tx_freq, UINT8 test_data_len,
744 UINT8 packet_payload, tBTM_CMPL_CB *p_cmd_cmpl_cback)
745 {
746 btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
747 if (btsnd_hcic_ble_transmitter_test(tx_freq, test_data_len, packet_payload) == FALSE) {
748 BTM_TRACE_ERROR("%s: Unable to Trigger LE transmitter test", __FUNCTION__);
749 }
750 }
751
752 /*******************************************************************************
753 **
754 ** Function BTM_BleTestEnd
755 **
756 ** Description This function is called to stop the in-progress TX or RX test
757 **
758 ** Parameter p_cmd_cmpl_cback - Command complete callback
759 **
760 *******************************************************************************/
BTM_BleTestEnd(tBTM_CMPL_CB * p_cmd_cmpl_cback)761 void BTM_BleTestEnd(tBTM_CMPL_CB *p_cmd_cmpl_cback)
762 {
763 btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
764
765 if (btsnd_hcic_ble_test_end() == FALSE) {
766 BTM_TRACE_ERROR("%s: Unable to End the LE TX/RX test", __FUNCTION__);
767 }
768 }
769
770 /*******************************************************************************
771 ** Internal Functions
772 *******************************************************************************/
btm_ble_test_command_complete(UINT8 * p)773 void btm_ble_test_command_complete(UINT8 *p)
774 {
775 tBTM_CMPL_CB *p_cb = btm_cb.devcb.p_le_test_cmd_cmpl_cb;
776
777 btm_cb.devcb.p_le_test_cmd_cmpl_cb = NULL;
778
779 if (p_cb) {
780 (*p_cb)(p);
781 }
782 }
783
784
785 #if (BLE_50_FEATURE_SUPPORT == TRUE)
786 /*******************************************************************************
787 **
788 ** Function BTM_BleEnhancedReceiverTest
789 **
790 ** Description This function is called to start the LE Enhanced Receiver test
791 **
792 ** Parameter rx_freq - Frequency Range
793 ** phy - The type of phy that receives data
794 ** modulation_index - modulation index
795 ** p_cmd_cmpl_cback - Command Complete callback
796 **
797 *******************************************************************************/
BTM_BleEnhancedReceiverTest(UINT8 rx_freq,UINT8 phy,UINT8 modulation_index,tBTM_CMPL_CB * p_cmd_cmpl_cback)798 void BTM_BleEnhancedReceiverTest(UINT8 rx_freq, UINT8 phy, UINT8 modulation_index, tBTM_CMPL_CB *p_cmd_cmpl_cback)
799 {
800 btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
801
802 if (btsnd_hcic_ble_enhand_rx_test(rx_freq, phy, modulation_index) == FALSE) {
803 BTM_TRACE_ERROR("%s: Unable to Trigger LE enhanced receiver test", __FUNCTION__);
804 }
805 }
806
807 /*******************************************************************************
808 **
809 ** Function BTM_BleEnhancedTransmitterTest
810 **
811 ** Description This function is called to start the LE Enhanced Transmitter test
812 **
813 ** Parameter tx_freq - Frequency Range
814 ** test_data_len - Length in bytes of payload data in each packet
815 ** packet_payload - Pattern to use in the payload
816 ** phy - The type of phy that sends data
817 ** p_cmd_cmpl_cback - Command Complete callback
818 **
819 *******************************************************************************/
BTM_BleEnhancedTransmitterTest(UINT8 tx_freq,UINT8 test_data_len,UINT8 packet_payload,UINT8 phy,tBTM_CMPL_CB * p_cmd_cmpl_cback)820 void BTM_BleEnhancedTransmitterTest(UINT8 tx_freq, UINT8 test_data_len,
821 UINT8 packet_payload, UINT8 phy, tBTM_CMPL_CB *p_cmd_cmpl_cback)
822 {
823 btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
824 if (btsnd_hcic_ble_enhand_tx_test(tx_freq, test_data_len, packet_payload, phy) == FALSE) {
825 BTM_TRACE_ERROR("%s: Unable to Trigger LE enhanced transmitter test", __FUNCTION__);
826 }
827 }
828 #endif // BLE_50_FEATURE_SUPPORT
829
830 /*******************************************************************************
831 **
832 ** Function BTM_UseLeLink
833 **
834 ** Description This function is to select the underneath physical link to use.
835 **
836 ** Returns TRUE to use LE, FALSE use BR/EDR.
837 **
838 *******************************************************************************/
BTM_UseLeLink(BD_ADDR bd_addr)839 BOOLEAN BTM_UseLeLink (BD_ADDR bd_addr)
840 {
841 tACL_CONN *p;
842 tBT_DEVICE_TYPE dev_type;
843 tBLE_ADDR_TYPE addr_type;
844 BOOLEAN use_le = FALSE;
845
846 if ((p = btm_bda_to_acl(bd_addr, BT_TRANSPORT_BR_EDR)) != NULL) {
847 return use_le;
848 } else if ((p = btm_bda_to_acl(bd_addr, BT_TRANSPORT_LE)) != NULL) {
849 use_le = TRUE;
850 } else {
851 BTM_ReadDevInfo(bd_addr, &dev_type, &addr_type);
852 use_le = (dev_type == BT_DEVICE_TYPE_BLE);
853 }
854 return use_le;
855 }
856
857
858 /*******************************************************************************
859 **
860 ** Function BTM_SetBleDataLength
861 **
862 ** Description This function is to set maximum BLE transmission packet size
863 **
864 ** Returns BTM_SUCCESS if success; otherwise failed.
865 **
866 *******************************************************************************/
BTM_SetBleDataLength(BD_ADDR bd_addr,UINT16 tx_pdu_length)867 tBTM_STATUS BTM_SetBleDataLength(BD_ADDR bd_addr, UINT16 tx_pdu_length)
868 {
869 tACL_CONN *p_acl = btm_bda_to_acl(bd_addr, BT_TRANSPORT_LE);
870 BTM_TRACE_DEBUG("%s: tx_pdu_length =%d", __FUNCTION__, tx_pdu_length);
871
872 if (!controller_get_interface()->supports_ble_packet_extension()) {
873 BTM_TRACE_ERROR("%s failed, request not supported", __FUNCTION__);
874 return BTM_CONTROL_LE_DATA_LEN_UNSUPPORTED;
875 }
876
877 if (!HCI_LE_DATA_LEN_EXT_SUPPORTED(p_acl->peer_le_features)) {
878 BTM_TRACE_ERROR("%s failed, peer does not support request", __FUNCTION__);
879 return BTM_PEER_LE_DATA_LEN_UNSUPPORTED;
880 }
881
882 if (p_acl != NULL) {
883 if (tx_pdu_length > BTM_BLE_DATA_SIZE_MAX) {
884 tx_pdu_length = BTM_BLE_DATA_SIZE_MAX;
885 } else if (tx_pdu_length < BTM_BLE_DATA_SIZE_MIN) {
886 tx_pdu_length = BTM_BLE_DATA_SIZE_MIN;
887 }
888
889 /* always set the TxTime to be max, as controller does not care for now */
890 btsnd_hcic_ble_set_data_length(p_acl->hci_handle, tx_pdu_length,
891 BTM_BLE_DATA_TX_TIME_MAX);
892
893 return BTM_SUCCESS;
894 } else {
895 BTM_TRACE_ERROR("%s: Wrong mode: no LE link exist or LE not supported", __FUNCTION__);
896 return BTM_WRONG_MODE;
897 }
898 }
899
900 #if (SMP_INCLUDED == TRUE)
901 /*******************************************************************************
902 **
903 ** Function btm_ble_determine_security_act
904 **
905 ** Description This function checks the security of current LE link
906 ** and returns the appropriate action that needs to be
907 ** taken to achieve the required security.
908 **
909 ** Parameter is_originator - True if outgoing connection
910 ** bdaddr: remote device address
911 ** security_required: Security required for the service.
912 **
913 ** Returns The appropriate security action required.
914 **
915 *******************************************************************************/
btm_ble_determine_security_act(BOOLEAN is_originator,BD_ADDR bdaddr,UINT16 security_required)916 tBTM_SEC_ACTION btm_ble_determine_security_act(BOOLEAN is_originator, BD_ADDR bdaddr, UINT16 security_required)
917 {
918 tBTM_LE_AUTH_REQ auth_req = 0x00;
919
920 if (is_originator)
921 {
922 if ((security_required & BTM_SEC_OUT_FLAGS) == 0 &&
923 (security_required & BTM_SEC_OUT_MITM) == 0)
924 {
925 BTM_TRACE_DEBUG ("%s No security required for outgoing connection", __func__);
926 return BTM_SEC_OK;
927 }
928
929 if (security_required & BTM_SEC_OUT_MITM) {
930 auth_req |= BTM_LE_AUTH_REQ_MITM;
931 }
932 }
933 else
934 {
935 if ((security_required & BTM_SEC_IN_FLAGS) == 0&& (security_required & BTM_SEC_IN_MITM) == 0)
936 {
937 BTM_TRACE_DEBUG ("%s No security required for incoming connection", __func__);
938 return BTM_SEC_OK;
939 }
940
941 if (security_required & BTM_SEC_IN_MITM) {
942 auth_req |= BTM_LE_AUTH_REQ_MITM;
943 }
944 }
945
946 tBTM_BLE_SEC_REQ_ACT ble_sec_act = BTM_BLE_SEC_REQ_ACT_NONE;
947 btm_ble_link_sec_check(bdaddr, auth_req, &ble_sec_act);
948
949 BTM_TRACE_DEBUG ("%s ble_sec_act %d", __func__ , ble_sec_act);
950
951 if (ble_sec_act == BTM_BLE_SEC_REQ_ACT_DISCARD) {
952 return BTM_SEC_ENC_PENDING;
953 }
954
955 if (ble_sec_act == BTM_BLE_SEC_REQ_ACT_NONE) {
956 return BTM_SEC_OK;
957 }
958
959 UINT8 sec_flag = 0;
960 BTM_GetSecurityFlagsByTransport(bdaddr, &sec_flag, BT_TRANSPORT_LE);
961
962 BOOLEAN is_link_encrypted = FALSE;
963 BOOLEAN is_key_mitm = FALSE;
964 if (sec_flag & (BTM_SEC_FLAG_ENCRYPTED| BTM_SEC_FLAG_LKEY_KNOWN))
965 {
966 if (sec_flag & BTM_SEC_FLAG_ENCRYPTED) {
967 is_link_encrypted = TRUE;
968 }
969
970 if (sec_flag & BTM_SEC_FLAG_LKEY_AUTHED) {
971 is_key_mitm = TRUE;
972 }
973 }
974
975 if (auth_req & BTM_LE_AUTH_REQ_MITM)
976 {
977 if (!is_key_mitm)
978 {
979 return BTM_SEC_ENCRYPT_MITM;
980 } else {
981 if (is_link_encrypted) {
982 return BTM_SEC_OK;
983 } else {
984 return BTM_SEC_ENCRYPT;
985 }
986 }
987 } else {
988 if (is_link_encrypted) {
989 return BTM_SEC_OK;
990 } else {
991 return BTM_SEC_ENCRYPT_NO_MITM;
992 }
993 }
994
995 return BTM_SEC_OK;
996 }
997
998 /*******************************************************************************
999 **
1000 ** Function btm_ble_start_sec_check
1001 **
1002 ** Description This function is to check and set the security required for
1003 ** LE link for LE COC.
1004 **
1005 ** Parameter bdaddr: remote device address.
1006 ** psm : PSM of the LE COC sevice.
1007 ** is_originator: TRUE if outgoing connection.
1008 ** p_callback : Pointer to the callback function.
1009 ** p_ref_data : Pointer to be returned along with the callback.
1010 **
1011 ** Returns TRUE if link already meets the required security; otherwise FALSE.
1012 **
1013 *******************************************************************************/
btm_ble_start_sec_check(BD_ADDR bd_addr,UINT16 psm,BOOLEAN is_originator,tBTM_SEC_CALLBACK * p_callback,void * p_ref_data)1014 BOOLEAN btm_ble_start_sec_check(BD_ADDR bd_addr, UINT16 psm, BOOLEAN is_originator,
1015 tBTM_SEC_CALLBACK *p_callback, void *p_ref_data)
1016 {
1017 /* Find the service record for the PSM */
1018 tBTM_SEC_SERV_REC *p_serv_rec = btm_sec_find_first_serv (is_originator, psm);
1019
1020 /* If there is no application registered with this PSM do not allow connection */
1021 if (!p_serv_rec)
1022 {
1023 BTM_TRACE_WARNING ("%s PSM: %d no application registerd", __func__, psm);
1024 (*p_callback) (bd_addr, BT_TRANSPORT_LE, p_ref_data, BTM_MODE_UNSUPPORTED);
1025 return FALSE;
1026 }
1027
1028 tBTM_SEC_ACTION sec_act = btm_ble_determine_security_act(is_originator,
1029 bd_addr, p_serv_rec->security_flags);
1030
1031 tBTM_BLE_SEC_ACT ble_sec_act = BTM_BLE_SEC_NONE;
1032 BOOLEAN status = FALSE;
1033
1034 switch (sec_act)
1035 {
1036 case BTM_SEC_OK:
1037 BTM_TRACE_DEBUG ("%s Security met", __func__);
1038 p_callback(bd_addr, BT_TRANSPORT_LE, p_ref_data, BTM_SUCCESS);
1039 status = TRUE;
1040 break;
1041
1042 case BTM_SEC_ENCRYPT:
1043 BTM_TRACE_DEBUG ("%s Encryption needs to be done", __func__);
1044 ble_sec_act = BTM_BLE_SEC_ENCRYPT;
1045 break;
1046
1047 case BTM_SEC_ENCRYPT_MITM:
1048 BTM_TRACE_DEBUG ("%s Pairing with MITM needs to be done", __func__);
1049 ble_sec_act = BTM_BLE_SEC_ENCRYPT_MITM;
1050 break;
1051
1052 case BTM_SEC_ENCRYPT_NO_MITM:
1053 BTM_TRACE_DEBUG ("%s Pairing with No MITM needs to be done", __func__);
1054 ble_sec_act = BTM_BLE_SEC_ENCRYPT_NO_MITM;
1055 break;
1056
1057 case BTM_SEC_ENC_PENDING:
1058 BTM_TRACE_DEBUG ("%s Ecryption pending", __func__);
1059 break;
1060 }
1061
1062 if (ble_sec_act == BTM_BLE_SEC_NONE) {
1063 return status;
1064 }
1065
1066 tL2C_LCB *p_lcb = l2cu_find_lcb_by_bd_addr(bd_addr, BT_TRANSPORT_LE);
1067 p_lcb->sec_act = sec_act;
1068 BTM_SetEncryption(bd_addr, BT_TRANSPORT_LE, p_callback, p_ref_data);
1069
1070 return FALSE;
1071 }
1072
1073
1074 /*******************************************************************************
1075 **
1076 ** Function btm_ble_rand_enc_complete
1077 **
1078 ** Description This function is the callback functions for HCI_Rand command
1079 ** and HCI_Encrypt command is completed.
1080 ** This message is received from the HCI.
1081 **
1082 ** Returns void
1083 **
1084 *******************************************************************************/
btm_ble_rand_enc_complete(UINT8 * p,UINT16 op_code,tBTM_RAND_ENC_CB * p_enc_cplt_cback)1085 void btm_ble_rand_enc_complete (UINT8 *p, UINT16 op_code, tBTM_RAND_ENC_CB *p_enc_cplt_cback)
1086 {
1087 tBTM_RAND_ENC params;
1088 UINT8 *p_dest = params.param_buf;
1089
1090 BTM_TRACE_DEBUG ("btm_ble_rand_enc_complete");
1091
1092 memset(¶ms, 0, sizeof(tBTM_RAND_ENC));
1093
1094 /* If there was a callback address for vcs complete, call it */
1095 if (p_enc_cplt_cback && p) {
1096 /* Pass paramters to the callback function */
1097 STREAM_TO_UINT8(params.status, p); /* command status */
1098
1099 if (params.status == HCI_SUCCESS) {
1100 params.opcode = op_code;
1101
1102 if (op_code == HCI_BLE_RAND) {
1103 params.param_len = BT_OCTET8_LEN;
1104 } else {
1105 params.param_len = BT_OCTET16_LEN;
1106 }
1107
1108 memcpy(p_dest, p, params.param_len); /* Fetch return info from HCI event message */
1109 }
1110 if (p_enc_cplt_cback) {
1111 (*p_enc_cplt_cback)(¶ms); /* Call the Encryption complete callback function */
1112 }
1113 }
1114 }
1115 #endif ///SMP_INCLUDED == TRUE
1116
1117
1118 /*******************************************************************************
1119 **
1120 ** Function btm_ble_get_enc_key_type
1121 **
1122 ** Description This function is to increment local sign counter
1123 ** Returns None
1124 **
1125 *******************************************************************************/
1126 #if (SMP_INCLUDED == TRUE)
btm_ble_increment_sign_ctr(BD_ADDR bd_addr,BOOLEAN is_local)1127 void btm_ble_increment_sign_ctr(BD_ADDR bd_addr, BOOLEAN is_local )
1128 {
1129 tBTM_SEC_DEV_REC *p_dev_rec;
1130
1131 BTM_TRACE_DEBUG ("btm_ble_increment_sign_ctr is_local=%d", is_local);
1132
1133 if ((p_dev_rec = btm_find_dev (bd_addr)) != NULL) {
1134 if (is_local) {
1135 p_dev_rec->ble.keys.local_counter++;
1136 } else {
1137 p_dev_rec->ble.keys.counter++;
1138 }
1139 BTM_TRACE_DEBUG ("is_local=%d local sign counter=%d peer sign counter=%d",
1140 is_local,
1141 p_dev_rec->ble.keys.local_counter,
1142 p_dev_rec->ble.keys.counter);
1143 }
1144 }
1145 #endif ///SMP_INCLUDED == TRUE
1146 #endif ///BLE_INCLUDED == TRUE
1147
1148 /*******************************************************************************
1149 **
1150 ** Function btm_ble_get_enc_key_type
1151 **
1152 ** Description This function is to get the BLE key type that has been exchanged
1153 ** in betweem local device and peer device.
1154 **
1155 ** Returns p_key_type: output parameter to carry the key type value.
1156 **
1157 *******************************************************************************/
1158 #if (SMP_INCLUDED == TRUE)
1159 #if (BLE_INCLUDED == TRUE)
btm_ble_get_enc_key_type(BD_ADDR bd_addr,UINT8 * p_key_types)1160 BOOLEAN btm_ble_get_enc_key_type(BD_ADDR bd_addr, UINT8 *p_key_types)
1161 {
1162 tBTM_SEC_DEV_REC *p_dev_rec;
1163
1164 BTM_TRACE_DEBUG ("btm_ble_get_enc_key_type");
1165
1166 if ((p_dev_rec = btm_find_dev (bd_addr)) != NULL) {
1167 *p_key_types = p_dev_rec->ble.key_type;
1168 return TRUE;
1169 }
1170
1171 return FALSE;
1172 }
1173
1174 /*******************************************************************************
1175 **
1176 ** Function btm_get_local_div
1177 **
1178 ** Description This function is called to read the local DIV
1179 **
1180 ** Returns TRUE - if a valid DIV is availavle
1181 *******************************************************************************/
btm_get_local_div(BD_ADDR bd_addr,UINT16 * p_div)1182 BOOLEAN btm_get_local_div (BD_ADDR bd_addr, UINT16 *p_div)
1183 {
1184 tBTM_SEC_DEV_REC *p_dev_rec;
1185 BOOLEAN status = FALSE;
1186 BTM_TRACE_DEBUG ("btm_get_local_div");
1187
1188 BTM_TRACE_DEBUG("bd_addr:%02x-%02x-%02x-%02x-%02x-%02x",
1189 bd_addr[0], bd_addr[1],
1190 bd_addr[2], bd_addr[3],
1191 bd_addr[4], bd_addr[5]);
1192
1193 *p_div = 0;
1194 p_dev_rec = btm_find_dev (bd_addr);
1195
1196 if (p_dev_rec && p_dev_rec->ble.keys.div) {
1197 status = TRUE;
1198 *p_div = p_dev_rec->ble.keys.div;
1199 }
1200 BTM_TRACE_DEBUG ("btm_get_local_div status=%d (1-OK) DIV=0x%x", status, *p_div);
1201 return status;
1202 }
1203
1204 /*******************************************************************************
1205 **
1206 ** Function btm_sec_save_le_key
1207 **
1208 ** Description This function is called by the SMP to update
1209 ** an BLE key. SMP is internal, whereas all the keys shall
1210 ** be sent to the application. The function is also called
1211 ** when application passes ble key stored in NVRAM to the btm_sec.
1212 ** pass_to_application parameter is false in this case.
1213 **
1214 ** Returns void
1215 **
1216 *******************************************************************************/
btm_sec_save_le_key(BD_ADDR bd_addr,tBTM_LE_KEY_TYPE key_type,tBTM_LE_KEY_VALUE * p_keys,BOOLEAN pass_to_application)1217 void btm_sec_save_le_key(BD_ADDR bd_addr, tBTM_LE_KEY_TYPE key_type, tBTM_LE_KEY_VALUE *p_keys,
1218 BOOLEAN pass_to_application)
1219 {
1220 tBTM_SEC_DEV_REC *p_rec;
1221 tBTM_LE_EVT_DATA cb_data;
1222 UINT8 i;
1223
1224 BTM_TRACE_DEBUG ("btm_sec_save_le_key key_type=0x%x pass_to_application=%d", key_type, pass_to_application);
1225 /* Store the updated key in the device database */
1226
1227 BTM_TRACE_DEBUG("bd_addr:%02x-%02x-%02x-%02x-%02x-%02x",
1228 bd_addr[0], bd_addr[1],
1229 bd_addr[2], bd_addr[3],
1230 bd_addr[4], bd_addr[5]);
1231
1232 if ((p_rec = btm_find_dev (bd_addr)) != NULL && (p_keys || key_type == BTM_LE_KEY_LID)) {
1233 btm_ble_init_pseudo_addr (p_rec, bd_addr);
1234
1235 switch (key_type) {
1236 case BTM_LE_KEY_PENC:
1237 memcpy(p_rec->ble.keys.pltk, p_keys->penc_key.ltk, BT_OCTET16_LEN);
1238 memcpy(p_rec->ble.keys.rand, p_keys->penc_key.rand, BT_OCTET8_LEN);
1239 p_rec->ble.keys.sec_level = p_keys->penc_key.sec_level;
1240 p_rec->ble.keys.ediv = p_keys->penc_key.ediv;
1241 p_rec->ble.keys.key_size = p_keys->penc_key.key_size;
1242 p_rec->ble.key_type |= BTM_LE_KEY_PENC;
1243 p_rec->sec_flags |= BTM_SEC_LE_LINK_KEY_KNOWN;
1244 if (p_keys->penc_key.sec_level == SMP_SEC_AUTHENTICATED) {
1245 p_rec->sec_flags |= BTM_SEC_LE_LINK_KEY_AUTHED;
1246 } else {
1247 p_rec->sec_flags &= ~BTM_SEC_LE_LINK_KEY_AUTHED;
1248 }
1249 BTM_TRACE_DEBUG("BTM_LE_KEY_PENC key_type=0x%x sec_flags=0x%x sec_leve=0x%x",
1250 p_rec->ble.key_type,
1251 p_rec->sec_flags,
1252 p_rec->ble.keys.sec_level);
1253 break;
1254
1255 case BTM_LE_KEY_PID:
1256 for (i = 0; i < BT_OCTET16_LEN; i++) {
1257 p_rec->ble.keys.irk[i] = p_keys->pid_key.irk[i];
1258 }
1259
1260 //memcpy( p_rec->ble.keys.irk, p_keys->pid_key, BT_OCTET16_LEN); todo will crash the system
1261 memcpy(p_rec->ble.static_addr, p_keys->pid_key.static_addr, BD_ADDR_LEN);
1262 p_rec->ble.static_addr_type = p_keys->pid_key.addr_type;
1263 p_rec->ble.key_type |= BTM_LE_KEY_PID;
1264 BTM_TRACE_DEBUG("BTM_LE_KEY_PID key_type=0x%x save peer IRK", p_rec->ble.key_type);
1265 /* update device record address as static address */
1266 memcpy(p_rec->bd_addr, p_keys->pid_key.static_addr, BD_ADDR_LEN);
1267 /* combine DUMO device security record if needed */
1268 btm_consolidate_dev(p_rec);
1269 break;
1270
1271 case BTM_LE_KEY_PCSRK:
1272 memcpy(p_rec->ble.keys.pcsrk, p_keys->pcsrk_key.csrk, BT_OCTET16_LEN);
1273 p_rec->ble.keys.srk_sec_level = p_keys->pcsrk_key.sec_level;
1274 p_rec->ble.keys.counter = p_keys->pcsrk_key.counter;
1275 p_rec->ble.key_type |= BTM_LE_KEY_PCSRK;
1276 p_rec->sec_flags |= BTM_SEC_LE_LINK_KEY_KNOWN;
1277 if ( p_keys->pcsrk_key.sec_level == SMP_SEC_AUTHENTICATED) {
1278 p_rec->sec_flags |= BTM_SEC_LE_LINK_KEY_AUTHED;
1279 } else {
1280 p_rec->sec_flags &= ~BTM_SEC_LE_LINK_KEY_AUTHED;
1281 }
1282
1283 BTM_TRACE_DEBUG("BTM_LE_KEY_PCSRK key_type=0x%x sec_flags=0x%x sec_level=0x%x peer_counter=%d",
1284 p_rec->ble.key_type,
1285 p_rec->sec_flags,
1286 p_rec->ble.keys.srk_sec_level,
1287 p_rec->ble.keys.counter );
1288 break;
1289
1290 case BTM_LE_KEY_LENC:
1291 memcpy(p_rec->ble.keys.lltk, p_keys->lenc_key.ltk, BT_OCTET16_LEN);
1292 p_rec->ble.keys.div = p_keys->lenc_key.div; /* update DIV */
1293 p_rec->ble.keys.sec_level = p_keys->lenc_key.sec_level;
1294 p_rec->ble.keys.key_size = p_keys->lenc_key.key_size;
1295 p_rec->ble.key_type |= BTM_LE_KEY_LENC;
1296
1297 /* Set that link key is known since this shares field with BTM_SEC_FLAG_LKEY_KNOWN flag in stack/btm_api.h*/
1298 p_rec->sec_flags |= BTM_SEC_LE_LINK_KEY_KNOWN;
1299 if ( p_keys->lenc_key.sec_level == SMP_SEC_AUTHENTICATED) {
1300 p_rec->sec_flags |= BTM_SEC_LE_LINK_KEY_AUTHED;
1301 } else {
1302 p_rec->sec_flags &= ~BTM_SEC_LE_LINK_KEY_AUTHED;
1303 }
1304
1305 BTM_TRACE_DEBUG("BTM_LE_KEY_LENC key_type=0x%x DIV=0x%x key_size=0x%x sec_level=0x%x",
1306 p_rec->ble.key_type,
1307 p_rec->ble.keys.div,
1308 p_rec->ble.keys.key_size,
1309 p_rec->ble.keys.sec_level );
1310 break;
1311
1312 case BTM_LE_KEY_LCSRK:/* local CSRK has been delivered */
1313 memcpy (p_rec->ble.keys.lcsrk, p_keys->lcsrk_key.csrk, BT_OCTET16_LEN);
1314 p_rec->ble.keys.div = p_keys->lcsrk_key.div; /* update DIV */
1315 p_rec->ble.keys.local_csrk_sec_level = p_keys->lcsrk_key.sec_level;
1316 p_rec->ble.keys.local_counter = p_keys->lcsrk_key.counter;
1317 p_rec->ble.key_type |= BTM_LE_KEY_LCSRK;
1318 BTM_TRACE_DEBUG("BTM_LE_KEY_LCSRK key_type=0x%x DIV=0x%x scrk_sec_level=0x%x local_counter=%d",
1319 p_rec->ble.key_type,
1320 p_rec->ble.keys.div,
1321 p_rec->ble.keys.local_csrk_sec_level,
1322 p_rec->ble.keys.local_counter );
1323 break;
1324
1325 case BTM_LE_KEY_LID:
1326 p_rec->ble.key_type |= BTM_LE_KEY_LID;
1327 break;
1328 default:
1329 BTM_TRACE_WARNING("btm_sec_save_le_key (Bad key_type 0x%02x)", key_type);
1330 return;
1331 }
1332
1333 BTM_TRACE_DEBUG ("BLE key type 0x%02x updated for BDA: %08x%04x (btm_sec_save_le_key)", key_type,
1334 (bd_addr[0] << 24) + (bd_addr[1] << 16) + (bd_addr[2] << 8) + bd_addr[3],
1335 (bd_addr[4] << 8) + bd_addr[5]);
1336
1337 /* Notify the application that one of the BLE keys has been updated
1338 If link key is in progress, it will get sent later.*/
1339 if (pass_to_application && btm_cb.api.p_le_callback) {
1340 cb_data.key.p_key_value = p_keys;
1341 cb_data.key.key_type = key_type;
1342
1343 (*btm_cb.api.p_le_callback) (BTM_LE_KEY_EVT, bd_addr, &cb_data);
1344 }
1345 return;
1346 }
1347
1348 BTM_TRACE_WARNING ("BLE key type 0x%02x called for Unknown BDA or type: %08x%04x !! (btm_sec_save_le_key)", key_type,
1349 (bd_addr[0] << 24) + (bd_addr[1] << 16) + (bd_addr[2] << 8) + bd_addr[3],
1350 (bd_addr[4] << 8) + bd_addr[5]);
1351
1352 if (p_rec) {
1353 BTM_TRACE_DEBUG ("sec_flags=0x%x", p_rec->sec_flags);
1354 }
1355 }
1356
1357 /*******************************************************************************
1358 **
1359 ** Function btm_ble_update_sec_key_size
1360 **
1361 ** Description update the current lin kencryption key size
1362 **
1363 ** Returns void
1364 **
1365 *******************************************************************************/
btm_ble_update_sec_key_size(BD_ADDR bd_addr,UINT8 enc_key_size)1366 void btm_ble_update_sec_key_size(BD_ADDR bd_addr, UINT8 enc_key_size)
1367 {
1368 tBTM_SEC_DEV_REC *p_rec;
1369
1370 BTM_TRACE_DEBUG("btm_ble_update_sec_key_size enc_key_size = %d", enc_key_size);
1371
1372 if ((p_rec = btm_find_dev (bd_addr)) != NULL ) {
1373 p_rec->enc_key_size = enc_key_size;
1374 }
1375 }
1376
1377
1378 /*******************************************************************************
1379 **
1380 ** Function btm_ble_read_sec_key_size
1381 **
1382 ** Description update the current lin kencryption key size
1383 **
1384 ** Returns void
1385 **
1386 *******************************************************************************/
btm_ble_read_sec_key_size(BD_ADDR bd_addr)1387 UINT8 btm_ble_read_sec_key_size(BD_ADDR bd_addr)
1388 {
1389 tBTM_SEC_DEV_REC *p_rec;
1390
1391 if ((p_rec = btm_find_dev (bd_addr)) != NULL ) {
1392 return p_rec->enc_key_size;
1393 } else {
1394 return 0;
1395 }
1396 return 0;
1397 }
1398
1399 /*******************************************************************************
1400 **
1401 ** Function btm_ble_link_sec_check
1402 **
1403 ** Description Check BLE link security level match.
1404 **
1405 ** Returns TRUE: check is OK and the *p_sec_req_act contain the action
1406 **
1407 *******************************************************************************/
btm_ble_link_sec_check(BD_ADDR bd_addr,tBTM_LE_AUTH_REQ auth_req,tBTM_BLE_SEC_REQ_ACT * p_sec_req_act)1408 void btm_ble_link_sec_check(BD_ADDR bd_addr, tBTM_LE_AUTH_REQ auth_req, tBTM_BLE_SEC_REQ_ACT *p_sec_req_act)
1409 {
1410 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bd_addr);
1411 UINT8 req_sec_level = BTM_LE_SEC_NONE, cur_sec_level = BTM_LE_SEC_NONE;
1412
1413 BTM_TRACE_DEBUG ("btm_ble_link_sec_check auth_req =0x%x", auth_req);
1414
1415 if (p_dev_rec == NULL) {
1416 BTM_TRACE_ERROR ("btm_ble_link_sec_check received for unknown device");
1417 return;
1418 }
1419
1420 if (p_dev_rec->sec_state == BTM_SEC_STATE_ENCRYPTING ||
1421 p_dev_rec->sec_state == BTM_SEC_STATE_AUTHENTICATING) {
1422 /* race condition: discard the security request while master is encrypting the link */
1423 *p_sec_req_act = BTM_BLE_SEC_REQ_ACT_DISCARD;
1424 } else {
1425 req_sec_level = BTM_LE_SEC_UNAUTHENTICATE;
1426 if (auth_req & BTM_LE_AUTH_REQ_MITM) {
1427 req_sec_level = BTM_LE_SEC_AUTHENTICATED;
1428 }
1429
1430 BTM_TRACE_DEBUG ("dev_rec sec_flags=0x%x", p_dev_rec->sec_flags);
1431
1432 /* currently encrpted */
1433 if (p_dev_rec->sec_flags & BTM_SEC_LE_ENCRYPTED) {
1434 if (p_dev_rec->sec_flags & BTM_SEC_LE_AUTHENTICATED) {
1435 cur_sec_level = BTM_LE_SEC_AUTHENTICATED;
1436 } else {
1437 cur_sec_level = BTM_LE_SEC_UNAUTHENTICATE;
1438 }
1439 } else { /* unencrypted link */
1440 /* if bonded, get the key security level */
1441 if (p_dev_rec->ble.key_type & BTM_LE_KEY_PENC) {
1442 cur_sec_level = p_dev_rec->ble.keys.sec_level;
1443 } else {
1444 cur_sec_level = BTM_LE_SEC_NONE;
1445 }
1446 }
1447
1448 if (cur_sec_level >= req_sec_level) {
1449 /* To avoid re-encryption on an encrypted link for an equal condition encryption */
1450 *p_sec_req_act = BTM_BLE_SEC_REQ_ACT_ENCRYPT;
1451 } else {
1452 *p_sec_req_act = BTM_BLE_SEC_REQ_ACT_PAIR; /* start the pariring process to upgrade the keys*/
1453 }
1454 }
1455
1456 BTM_TRACE_DEBUG("cur_sec_level=%d req_sec_level=%d sec_req_act=%d",
1457 cur_sec_level,
1458 req_sec_level,
1459 *p_sec_req_act);
1460
1461
1462 }
1463 #endif ///BLE_INCLUDED == TRUE
1464 #endif ///SMP_INCLUDED == TRUE
1465
1466 #if (BLE_INCLUDED == TRUE)
1467 /*******************************************************************************
1468 **
1469 ** Function btm_ble_set_encryption
1470 **
1471 ** Description This function is called to ensure that LE connection is
1472 ** encrypted. Should be called only on an open connection.
1473 ** Typically only needed for connections that first want to
1474 ** bring up unencrypted links, then later encrypt them.
1475 **
1476 ** Returns void
1477 ** the local device ER is copied into er
1478 **
1479 *******************************************************************************/
btm_ble_set_encryption(BD_ADDR bd_addr,void * p_ref_data,UINT8 link_role)1480 tBTM_STATUS btm_ble_set_encryption (BD_ADDR bd_addr, void *p_ref_data, UINT8 link_role)
1481 {
1482 tBTM_STATUS cmd = BTM_NO_RESOURCES;
1483 #if (SMP_INCLUDED == TRUE)
1484 tBTM_BLE_SEC_ACT sec_act = *(tBTM_BLE_SEC_ACT *)p_ref_data ;
1485 tBTM_SEC_DEV_REC *p_rec = btm_find_dev (bd_addr);
1486 tBTM_BLE_SEC_REQ_ACT sec_req_act;
1487 tBTM_LE_AUTH_REQ auth_req;
1488
1489 if (p_rec == NULL) {
1490 BTM_TRACE_WARNING ("btm_ble_set_encryption (NULL device record!! sec_act=0x%x", sec_act);
1491 return (BTM_WRONG_MODE);
1492 }
1493
1494 BTM_TRACE_DEBUG ("btm_ble_set_encryption sec_act=0x%x role_master=%d", sec_act, p_rec->role_master);
1495
1496 if (sec_act == BTM_BLE_SEC_ENCRYPT_MITM) {
1497 p_rec->security_required |= BTM_SEC_IN_MITM;
1498 }
1499
1500 switch (sec_act) {
1501 case BTM_BLE_SEC_ENCRYPT:
1502 if (link_role == BTM_ROLE_MASTER && (p_rec->ble.key_type & BTM_LE_KEY_PENC)) {
1503 /* start link layer encryption using the security info stored */
1504 cmd = btm_ble_start_encrypt(bd_addr, FALSE, NULL);
1505 break;
1506 }
1507 /* if salve role then fall through to call SMP_Pair below which will send a
1508 sec_request to request the master to encrypt the link */
1509 case BTM_BLE_SEC_ENCRYPT_NO_MITM:
1510 case BTM_BLE_SEC_ENCRYPT_MITM:
1511 if ((link_role == BTM_ROLE_MASTER) && (sec_act != BTM_BLE_SEC_ENCRYPT)) {
1512 auth_req = (sec_act == BTM_BLE_SEC_ENCRYPT_NO_MITM)
1513 ? SMP_AUTH_GEN_BOND : (SMP_AUTH_GEN_BOND | SMP_AUTH_YN_BIT);
1514 btm_ble_link_sec_check (bd_addr, auth_req, &sec_req_act);
1515
1516 if (sec_req_act == BTM_BLE_SEC_REQ_ACT_ENCRYPT) {
1517 cmd = btm_ble_start_encrypt(bd_addr, FALSE, NULL);
1518 break;
1519 }
1520 }
1521 #if (SMP_SLAVE_CON_PARAMS_UPD_ENABLE == TRUE)
1522 // already have encrypted information, do not need to update connection parameters
1523 if(link_role == BTM_ROLE_SLAVE && (p_rec->ble.key_type & BTM_LE_KEY_PENC)) {
1524 p_rec->ble.skip_update_conn_param = true;
1525 } else {
1526 p_rec->ble.skip_update_conn_param = false;
1527 }
1528 #endif
1529 if (SMP_Pair(bd_addr) == SMP_STARTED) {
1530 cmd = BTM_CMD_STARTED;
1531 p_rec->sec_state = BTM_SEC_STATE_AUTHENTICATING;
1532 }
1533 break;
1534
1535 default:
1536 cmd = BTM_WRONG_MODE;
1537 break;
1538 }
1539 #endif ///SMP_INCLUDED == TRUE
1540 return cmd;
1541 }
1542
1543 /*******************************************************************************
1544 **
1545 ** Function btm_ble_ltk_request
1546 **
1547 ** Description This function is called when encryption request is received
1548 ** on a slave device.
1549 **
1550 **
1551 ** Returns void
1552 **
1553 *******************************************************************************/
1554 #if (SMP_INCLUDED == TRUE)
btm_ble_ltk_request(UINT16 handle,UINT8 rand[8],UINT16 ediv)1555 void btm_ble_ltk_request(UINT16 handle, UINT8 rand[8], UINT16 ediv)
1556 {
1557 tBTM_CB *p_cb = &btm_cb;
1558 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev_by_handle (handle);
1559 BT_OCTET8 dummy_stk = {0};
1560
1561 BTM_TRACE_DEBUG ("btm_ble_ltk_request");
1562
1563 p_cb->ediv = ediv;
1564
1565 memcpy(p_cb->enc_rand, rand, BT_OCTET8_LEN);
1566
1567 if (p_dev_rec != NULL) {
1568 if (!smp_proc_ltk_request(p_dev_rec->bd_addr)) {
1569 btm_ble_ltk_request_reply(p_dev_rec->bd_addr, FALSE, dummy_stk);
1570 }
1571 }
1572
1573 }
1574 #endif ///SMP_INCLUDED == TRUE
1575
1576
1577 /*******************************************************************************
1578 **
1579 ** Function btm_ble_start_encrypt
1580 **
1581 ** Description This function is called to start LE encryption.
1582 **
1583 **
1584 ** Returns BTM_SUCCESS if encryption was started successfully
1585 **
1586 *******************************************************************************/
btm_ble_start_encrypt(BD_ADDR bda,BOOLEAN use_stk,BT_OCTET16 stk)1587 tBTM_STATUS btm_ble_start_encrypt(BD_ADDR bda, BOOLEAN use_stk, BT_OCTET16 stk)
1588 {
1589 #if (SMP_INCLUDED == TRUE)
1590 tBTM_CB *p_cb = &btm_cb;
1591 tBTM_SEC_DEV_REC *p_rec = btm_find_dev (bda);
1592 BT_OCTET8 dummy_rand = {0};
1593 #endif ///SMP_INCLUDED == TRUE
1594
1595 tBTM_STATUS rt = BTM_NO_RESOURCES;
1596 #if (SMP_INCLUDED == TRUE)
1597 BTM_TRACE_DEBUG ("btm_ble_start_encrypt");
1598
1599 if (!p_rec ) {
1600 BTM_TRACE_ERROR("Link is not active, can not encrypt!");
1601 return BTM_WRONG_MODE;
1602 }
1603
1604 if (p_rec->sec_state == BTM_SEC_STATE_ENCRYPTING) {
1605 BTM_TRACE_WARNING("Link Encryption is active, Busy!");
1606 return BTM_BUSY;
1607 }
1608
1609 p_cb->enc_handle = p_rec->ble_hci_handle;
1610
1611 if (use_stk) {
1612 if (btsnd_hcic_ble_start_enc(p_rec->ble_hci_handle, dummy_rand, 0, stk)) {
1613 rt = BTM_CMD_STARTED;
1614 }
1615 } else if (p_rec->ble.key_type & BTM_LE_KEY_PENC) {
1616 if (btsnd_hcic_ble_start_enc(p_rec->ble_hci_handle, p_rec->ble.keys.rand,
1617 p_rec->ble.keys.ediv, p_rec->ble.keys.pltk)) {
1618 rt = BTM_CMD_STARTED;
1619 }
1620 } else {
1621 BTM_TRACE_ERROR("No key available to encrypt the link");
1622 }
1623 if (rt == BTM_CMD_STARTED) {
1624 if (p_rec->sec_state == BTM_SEC_STATE_IDLE) {
1625 p_rec->sec_state = BTM_SEC_STATE_ENCRYPTING;
1626 }
1627 }
1628 #endif ///SMP_INCLUDED == TRUE
1629 return rt;
1630 }
1631
1632 /*******************************************************************************
1633 **
1634 ** Function btm_ble_link_encrypted
1635 **
1636 ** Description This function is called when LE link encrption status is changed.
1637 **
1638 ** Returns void
1639 **
1640 *******************************************************************************/
1641 #if (SMP_INCLUDED == TRUE)
btm_ble_link_encrypted(BD_ADDR bd_addr,UINT8 encr_enable)1642 void btm_ble_link_encrypted(BD_ADDR bd_addr, UINT8 encr_enable)
1643 {
1644 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bd_addr);
1645 BOOLEAN enc_cback;
1646
1647 if (!p_dev_rec) {
1648 BTM_TRACE_WARNING ("btm_ble_link_encrypted (No Device Found!) encr_enable=%d", encr_enable);
1649 return;
1650 }
1651
1652 BTM_TRACE_DEBUG ("btm_ble_link_encrypted encr_enable=%d", encr_enable);
1653
1654 enc_cback = (p_dev_rec->sec_state == BTM_SEC_STATE_ENCRYPTING);
1655
1656 smp_link_encrypted(bd_addr, encr_enable);
1657
1658 BTM_TRACE_DEBUG(" p_dev_rec->sec_flags=0x%x", p_dev_rec->sec_flags);
1659
1660 if (encr_enable && p_dev_rec->enc_key_size == 0) {
1661 p_dev_rec->enc_key_size = p_dev_rec->ble.keys.key_size;
1662 }
1663
1664 p_dev_rec->sec_state = BTM_SEC_STATE_IDLE;
1665 if (p_dev_rec->p_callback && enc_cback) {
1666 if (encr_enable) {
1667 btm_sec_dev_rec_cback_event(p_dev_rec, BTM_SUCCESS, TRUE);
1668 } else if (p_dev_rec->role_master) {
1669 btm_sec_dev_rec_cback_event(p_dev_rec, BTM_ERR_PROCESSING, TRUE);
1670 }
1671
1672 }
1673 /* to notify GATT to send data if any request is pending */
1674 gatt_notify_enc_cmpl(p_dev_rec->ble.pseudo_addr);
1675 }
1676 #endif ///SMP_INCLUDED == TRUE
1677
1678
1679 /*******************************************************************************
1680 **
1681 ** Function btm_ble_ltk_request_reply
1682 **
1683 ** Description This function is called to send a LTK request reply on a slave
1684 ** device.
1685 **
1686 ** Returns void
1687 **
1688 *******************************************************************************/
1689 #if (SMP_INCLUDED == TRUE)
btm_ble_ltk_request_reply(BD_ADDR bda,BOOLEAN use_stk,BT_OCTET16 stk)1690 void btm_ble_ltk_request_reply(BD_ADDR bda, BOOLEAN use_stk, BT_OCTET16 stk)
1691 {
1692 tBTM_SEC_DEV_REC *p_rec = btm_find_dev (bda);
1693 tBTM_CB *p_cb = &btm_cb;
1694
1695 if (p_rec == NULL) {
1696 BTM_TRACE_ERROR("btm_ble_ltk_request_reply received for unknown device");
1697 return;
1698 }
1699
1700 BTM_TRACE_DEBUG ("btm_ble_ltk_request_reply");
1701 p_cb->enc_handle = p_rec->ble_hci_handle;
1702 p_cb->key_size = p_rec->ble.keys.key_size;
1703
1704 BTM_TRACE_DEBUG("key size = %d", p_rec->ble.keys.key_size);
1705 if (use_stk) {
1706 btsnd_hcic_ble_ltk_req_reply(btm_cb.enc_handle, stk);
1707 } else { /* calculate LTK using peer device */
1708 if (p_rec->ble.key_type & BTM_LE_KEY_LENC) {
1709 btsnd_hcic_ble_ltk_req_reply(btm_cb.enc_handle, p_rec->ble.keys.lltk);
1710 } else {
1711 btsnd_hcic_ble_ltk_req_neg_reply(btm_cb.enc_handle);
1712 }
1713 }
1714 }
1715
1716 /*******************************************************************************
1717 **
1718 ** Function btm_ble_io_capabilities_req
1719 **
1720 ** Description This function is called to handle SMP get IO capability request.
1721 **
1722 ** Returns void
1723 **
1724 *******************************************************************************/
btm_ble_io_capabilities_req(tBTM_SEC_DEV_REC * p_dev_rec,tBTM_LE_IO_REQ * p_data)1725 UINT8 btm_ble_io_capabilities_req(tBTM_SEC_DEV_REC *p_dev_rec, tBTM_LE_IO_REQ *p_data)
1726 {
1727 UINT8 callback_rc = BTM_SUCCESS;
1728 BTM_TRACE_DEBUG ("btm_ble_io_capabilities_req");
1729 if (btm_cb.api.p_le_callback) {
1730 /* the callback function implementation may change the IO capability... */
1731 callback_rc = (*btm_cb.api.p_le_callback) (BTM_LE_IO_REQ_EVT, p_dev_rec->bd_addr, (tBTM_LE_EVT_DATA *)p_data);
1732 }
1733 #if BTM_OOB_INCLUDED == TRUE
1734 if ((callback_rc == BTM_SUCCESS) || (BTM_OOB_UNKNOWN != p_data->oob_data))
1735 #else
1736 if (callback_rc == BTM_SUCCESS)
1737 #endif
1738 {
1739 #if BTM_BLE_CONFORMANCE_TESTING == TRUE
1740 if (btm_cb.devcb.keep_rfu_in_auth_req) {
1741 BTM_TRACE_DEBUG ("btm_ble_io_capabilities_req keep_rfu_in_auth_req = %u",
1742 btm_cb.devcb.keep_rfu_in_auth_req);
1743 p_data->auth_req &= BTM_LE_AUTH_REQ_MASK_KEEP_RFU;
1744 btm_cb.devcb.keep_rfu_in_auth_req = FALSE;
1745 } else {
1746 /* default */
1747 p_data->auth_req &= BTM_LE_AUTH_REQ_MASK;
1748 }
1749 #else
1750 p_data->auth_req &= BTM_LE_AUTH_REQ_MASK;
1751 #endif
1752
1753 BTM_TRACE_DEBUG ("btm_ble_io_capabilities_req 1: p_dev_rec->security_required = %d auth_req:%d",
1754 p_dev_rec->security_required, p_data->auth_req);
1755 BTM_TRACE_DEBUG ("btm_ble_io_capabilities_req 2: i_keys=0x%x r_keys=0x%x (bit 0-LTK 1-IRK 2-CSRK)",
1756 p_data->init_keys,
1757 p_data->resp_keys);
1758
1759 /* if authentication requires MITM protection, put on the mask */
1760 if (p_dev_rec->security_required & BTM_SEC_IN_MITM) {
1761 p_data->auth_req |= BTM_LE_AUTH_REQ_MITM;
1762 }
1763
1764 if (!(p_data->auth_req & SMP_AUTH_BOND)) {
1765 BTM_TRACE_DEBUG("Non bonding: No keys should be exchanged");
1766 p_data->init_keys = 0;
1767 p_data->resp_keys = 0;
1768 }
1769
1770 BTM_TRACE_DEBUG ("btm_ble_io_capabilities_req 3: auth_req:%d\n", p_data->auth_req);
1771 BTM_TRACE_DEBUG ("btm_ble_io_capabilities_req 4: i_keys=0x%x r_keys=0x%x\n",
1772 p_data->init_keys,
1773 p_data->resp_keys);
1774
1775 BTM_TRACE_DEBUG ("btm_ble_io_capabilities_req 5: p_data->io_cap = %d auth_req:%d\n",
1776 p_data->io_cap, p_data->auth_req);
1777
1778 /* remove MITM protection requirement if IO cap does not allow it */
1779 if ((p_data->io_cap == BTM_IO_CAP_NONE) && p_data->oob_data == SMP_OOB_NONE) {
1780 p_data->auth_req &= ~BTM_LE_AUTH_REQ_MITM;
1781 }
1782
1783 if (!(p_data->auth_req & SMP_SC_SUPPORT_BIT)) {
1784 /* if Secure Connections are not supported then remove LK derivation,
1785 ** and keypress notifications.
1786 */
1787 BTM_TRACE_DEBUG("%s-SC not supported -> No LK derivation, no keypress notifications",
1788 __func__);
1789 p_data->auth_req &= ~SMP_KP_SUPPORT_BIT;
1790 p_data->init_keys &= ~SMP_SEC_KEY_TYPE_LK;
1791 p_data->resp_keys &= ~SMP_SEC_KEY_TYPE_LK;
1792 }
1793
1794 BTM_TRACE_DEBUG ("btm_ble_io_capabilities_req 6: IO_CAP:%d oob_data:%d auth_req:0x%02x\n",
1795 p_data->io_cap, p_data->oob_data, p_data->auth_req);
1796 }
1797 return callback_rc;
1798 }
1799 #endif ///SMP_INCLUDED == TRUE
1800
1801
1802 /*******************************************************************************
1803 **
1804 ** Function btm_ble_br_keys_req
1805 **
1806 ** Description This function is called to handle SMP request for keys sent
1807 ** over BR/EDR.
1808 **
1809 ** Returns void
1810 **
1811 *******************************************************************************/
1812 #if (SMP_INCLUDED == TRUE)
btm_ble_br_keys_req(tBTM_SEC_DEV_REC * p_dev_rec,tBTM_LE_IO_REQ * p_data)1813 UINT8 btm_ble_br_keys_req(tBTM_SEC_DEV_REC *p_dev_rec, tBTM_LE_IO_REQ *p_data)
1814 {
1815 UINT8 callback_rc = BTM_SUCCESS;
1816 BTM_TRACE_DEBUG ("%s\n", __func__);
1817 if (btm_cb.api.p_le_callback) {
1818 /* the callback function implementation may change the IO capability... */
1819 callback_rc = (*btm_cb.api.p_le_callback) (BTM_LE_IO_REQ_EVT, p_dev_rec->bd_addr,
1820 (tBTM_LE_EVT_DATA *)p_data);
1821 }
1822 return callback_rc;
1823 }
1824 #endif ///SMP_INCLUDED
1825
1826
1827 #if (BLE_PRIVACY_SPT == TRUE )
1828 /*******************************************************************************
1829 **
1830 ** Function btm_ble_resolve_random_addr_on_conn_cmpl
1831 **
1832 ** Description resolve random address complete on connection complete event.
1833 **
1834 ** Returns void
1835 **
1836 *******************************************************************************/
btm_ble_resolve_random_addr_on_conn_cmpl(void * p_rec,void * p_data)1837 static void btm_ble_resolve_random_addr_on_conn_cmpl(void *p_rec, void *p_data)
1838 {
1839 UINT8 *p = (UINT8 *)p_data;
1840 tBTM_SEC_DEV_REC *match_rec = (tBTM_SEC_DEV_REC *) p_rec;
1841 UINT8 role, bda_type;
1842 UINT16 handle;
1843 BD_ADDR bda, local_rpa, peer_rpa;
1844 UINT16 conn_interval, conn_latency, conn_timeout;
1845 BOOLEAN match = FALSE;
1846
1847 ++p;
1848 STREAM_TO_UINT16 (handle, p);
1849 STREAM_TO_UINT8 (role, p);
1850 STREAM_TO_UINT8 (bda_type, p);
1851 STREAM_TO_BDADDR (bda, p);
1852 // if the enhanced is true, means the connection is enhanced connect,
1853 // so the packet should include the local Resolvable Private Address and Peer Resolvable Private Address
1854 if(temp_enhanced) {
1855 STREAM_TO_BDADDR(local_rpa, p);
1856 STREAM_TO_BDADDR(peer_rpa, p);
1857 }
1858 STREAM_TO_UINT16 (conn_interval, p);
1859 STREAM_TO_UINT16 (conn_latency, p);
1860 STREAM_TO_UINT16 (conn_timeout, p);
1861
1862 handle = HCID_GET_HANDLE (handle);
1863 BTM_TRACE_EVENT ("%s\n", __func__);
1864
1865 if (match_rec) {
1866 BTM_TRACE_DEBUG("%s matched and resolved random address", __func__);
1867 match = TRUE;
1868 match_rec->ble.active_addr_type = BTM_BLE_ADDR_RRA;
1869 memcpy(match_rec->ble.cur_rand_addr, bda, BD_ADDR_LEN);
1870 if (!btm_ble_init_pseudo_addr (match_rec, bda)) {
1871 /* assign the original address to be the current report address */
1872 memcpy(bda, match_rec->ble.pseudo_addr, BD_ADDR_LEN);
1873 } else {
1874 memcpy(bda, match_rec->bd_addr, BD_ADDR_LEN);
1875 }
1876 } else {
1877 BTM_TRACE_DEBUG("%s unable to match and resolve random address", __func__);
1878 }
1879
1880 btm_ble_connected(bda, handle, HCI_ENCRYPT_MODE_DISABLED, role, bda_type, match);
1881
1882 l2cble_conn_comp (handle, role, bda, bda_type, conn_interval,
1883 conn_latency, conn_timeout);
1884
1885 return;
1886 }
1887 #endif
1888
1889 /*******************************************************************************
1890 **
1891 ** Function btm_ble_connected
1892 **
1893 ** Description This function is when a LE connection to the peer device is
1894 ** establsihed
1895 **
1896 ** Returns void
1897 **
1898 *******************************************************************************/
btm_ble_connected(UINT8 * bda,UINT16 handle,UINT8 enc_mode,UINT8 role,tBLE_ADDR_TYPE addr_type,BOOLEAN addr_matched)1899 void btm_ble_connected (UINT8 *bda, UINT16 handle, UINT8 enc_mode, UINT8 role,
1900 tBLE_ADDR_TYPE addr_type, BOOLEAN addr_matched)
1901 {
1902 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bda);
1903 tBTM_BLE_CB *p_cb = &btm_cb.ble_ctr_cb;
1904 UNUSED(addr_matched);
1905
1906 BTM_TRACE_EVENT ("btm_ble_connected");
1907
1908 /* Commenting out trace due to obf/compilation problems.
1909 */
1910 #if (BT_USE_TRACES == TRUE)
1911 if (p_dev_rec) {
1912 BTM_TRACE_EVENT ("Security Manager: btm_ble_connected : handle:%d enc_mode:%d bda:%x RName:%s",
1913 handle, enc_mode,
1914 (bda[2] << 24) + (bda[3] << 16) + (bda[4] << 8) + bda[5],
1915 p_dev_rec->sec_bd_name);
1916
1917 BTM_TRACE_DEBUG ("btm_ble_connected sec_flags=0x%x", p_dev_rec->sec_flags);
1918 } else {
1919 BTM_TRACE_EVENT ("Security Manager: btm_ble_connected: handle:%d enc_mode:%d bda:%x ",
1920 handle, enc_mode,
1921 (bda[2] << 24) + (bda[3] << 16) + (bda[4] << 8) + bda[5]);
1922 }
1923 #endif
1924
1925 if (!p_dev_rec) {
1926 /* There is no device record for new connection. Allocate one */
1927 if ((p_dev_rec = btm_sec_alloc_dev (bda)) == NULL) {
1928 return;
1929 }
1930 } else { /* Update the timestamp for this device */
1931 p_dev_rec->timestamp = btm_cb.dev_rec_count++;
1932 }
1933
1934 /* update device information */
1935 p_dev_rec->device_type |= BT_DEVICE_TYPE_BLE;
1936 p_dev_rec->ble_hci_handle = handle;
1937 p_dev_rec->ble.ble_addr_type = addr_type;
1938 /* update pseudo address */
1939 memcpy(p_dev_rec->ble.pseudo_addr, bda, BD_ADDR_LEN);
1940
1941 p_dev_rec->role_master = FALSE;
1942 if (role == HCI_ROLE_MASTER) {
1943 p_dev_rec->role_master = TRUE;
1944 }
1945
1946 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
1947 if (!addr_matched) {
1948 p_dev_rec->ble.active_addr_type = BTM_BLE_ADDR_PSEUDO;
1949 }
1950
1951 if (p_dev_rec->ble.ble_addr_type == BLE_ADDR_RANDOM && !addr_matched) {
1952 memcpy(p_dev_rec->ble.cur_rand_addr, bda, BD_ADDR_LEN);
1953 }
1954 #endif
1955
1956 p_cb->inq_var.directed_conn = BTM_BLE_CONNECT_EVT;
1957
1958 return;
1959 }
1960
1961 /*****************************************************************************
1962 ** Function btm_ble_conn_complete
1963 **
1964 ** Description LE connection complete.
1965 **
1966 ******************************************************************************/
btm_ble_conn_complete(UINT8 * p,UINT16 evt_len,BOOLEAN enhanced)1967 void btm_ble_conn_complete(UINT8 *p, UINT16 evt_len, BOOLEAN enhanced)
1968 {
1969 #if (BLE_PRIVACY_SPT == TRUE )
1970 UINT8 *p_data = p, peer_addr_type;
1971 #endif ///BLE_PRIVACY_SPT == TRUE
1972 UINT8 role, status, bda_type;
1973 UINT16 handle;
1974 BD_ADDR bda;
1975 BD_ADDR local_rpa, peer_rpa;
1976 UINT16 conn_interval, conn_latency, conn_timeout;
1977 BOOLEAN match = FALSE;
1978 UNUSED(evt_len);
1979 STREAM_TO_UINT8 (status, p);
1980 STREAM_TO_UINT16 (handle, p);
1981 STREAM_TO_UINT8 (role, p);
1982 STREAM_TO_UINT8 (bda_type, p);
1983 STREAM_TO_BDADDR (bda, p);
1984 BTM_TRACE_DEBUG("status = %d, handle = %d, role = %d, bda_type = %d",status,handle,role,bda_type);
1985 if (status == 0) {
1986 if (enhanced) {
1987 STREAM_TO_BDADDR (local_rpa, p);
1988 STREAM_TO_BDADDR (peer_rpa, p);
1989 }
1990 #if (BLE_PRIVACY_SPT == TRUE )
1991 peer_addr_type = bda_type;
1992 match = btm_identity_addr_to_random_pseudo (bda, &bda_type, TRUE);
1993
1994 /* possiblly receive connection complete with resolvable random on
1995 slave role while the device has been paired */
1996
1997 /* It will cause that scanner doesn't send scan request to advertiser
1998 * which has sent IRK to us and we have stored the IRK in controller.
1999 * It is a hardware limitation. The preliminary solution is not to
2000 * send key to the controller, but to resolve the random address in host.
2001 * so we need send the real address information to controller to connect.
2002 * Once the connection is successful, resolve device address whether it is
2003 * slave or master*/
2004
2005 #if CONTROLLER_RPA_LIST_ENABLE
2006 if (!match && role == HCI_ROLE_SLAVE && bda_type != BLE_ADDR_PUBLIC && BTM_BLE_IS_RESOLVE_BDA(bda)) {
2007 #else
2008 if (!match && bda_type != BLE_ADDR_PUBLIC && BTM_BLE_IS_RESOLVE_BDA(bda)) {
2009 #endif
2010 // save the enhanced value to used in btm_ble_resolve_random_addr_on_conn_cmpl func.
2011 temp_enhanced = enhanced;
2012 btm_ble_resolve_random_addr(bda, btm_ble_resolve_random_addr_on_conn_cmpl, p_data);
2013 // set back the temp enhanced to default after used.
2014 temp_enhanced = FALSE;
2015 } else
2016 #endif
2017 {
2018 STREAM_TO_UINT16 (conn_interval, p);
2019 STREAM_TO_UINT16 (conn_latency, p);
2020 STREAM_TO_UINT16 (conn_timeout, p);
2021 handle = HCID_GET_HANDLE (handle);
2022
2023 btm_ble_connected(bda, handle, HCI_ENCRYPT_MODE_DISABLED, role, bda_type, match);
2024 l2cble_conn_comp (handle, role, bda, bda_type, conn_interval,
2025 conn_latency, conn_timeout);
2026
2027 #if (BLE_PRIVACY_SPT == TRUE)
2028 if (enhanced) {
2029 btm_ble_refresh_local_resolvable_private_addr(bda, local_rpa);
2030
2031 if (peer_addr_type & BLE_ADDR_TYPE_ID_BIT) {
2032 btm_ble_refresh_peer_resolvable_private_addr(bda, peer_rpa, BLE_ADDR_RANDOM);
2033 }
2034 }
2035 #endif
2036 }
2037 } else {
2038 role = HCI_ROLE_UNKNOWN;
2039 if (status != HCI_ERR_DIRECTED_ADVERTISING_TIMEOUT) {
2040 btm_ble_set_conn_st(BLE_CONN_IDLE);
2041 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
2042 btm_ble_disable_resolving_list(BTM_BLE_RL_INIT, TRUE);
2043 #endif
2044 } else {
2045 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
2046 btm_cb.ble_ctr_cb.inq_var.adv_mode = BTM_BLE_ADV_DISABLE;
2047 btm_ble_disable_resolving_list(BTM_BLE_RL_ADV, TRUE);
2048 #endif
2049 }
2050
2051 }
2052
2053 BOOLEAN bg_con = btm_ble_update_mode_operation(role, bda, status);
2054 if (status != HCI_SUCCESS && !bg_con) {
2055 // notify connection failed
2056 l2c_link_hci_disc_comp (handle, status);
2057 #if (SMP_INCLUDED == TRUE)
2058 /* Notify security manager */
2059 btm_sec_disconnected (handle, status);
2060 #endif ///SMP_INCLUDED == TRUE
2061 }
2062 }
2063
2064
2065
2066 /*****************************************************************************
2067 ** Function btm_ble_create_ll_conn_complete
2068 **
2069 ** Description LE connection complete.
2070 **
2071 ******************************************************************************/
2072 void btm_ble_create_ll_conn_complete (UINT8 status)
2073 {
2074 if (status != HCI_SUCCESS) {
2075 btm_ble_set_conn_st(BLE_CONN_IDLE);
2076 btm_ble_update_mode_operation(HCI_ROLE_UNKNOWN, NULL, status);
2077 }
2078 }
2079
2080 /*****************************************************************************
2081 ** Function btm_ble_create_conn_cancel_complete
2082 **
2083 ** Description LE connection cancel complete.
2084 **
2085 ******************************************************************************/
2086 void btm_ble_create_conn_cancel_complete (UINT8 *p)
2087 {
2088 UINT8 status;
2089
2090 STREAM_TO_UINT8 (status, p);
2091
2092 switch (status) {
2093 case HCI_SUCCESS:
2094 if (btm_ble_get_conn_st() == BLE_CONN_CANCEL) {
2095 btm_ble_set_conn_st (BLE_CONN_IDLE);
2096 }
2097 break;
2098 default:
2099 break;
2100 }
2101 }
2102
2103 /*****************************************************************************
2104 ** Function btm_proc_smp_cback
2105 **
2106 ** Description This function is the SMP callback handler.
2107 **
2108 ******************************************************************************/
2109 #if (SMP_INCLUDED == TRUE)
2110 UINT8 btm_proc_smp_cback(tSMP_EVT event, BD_ADDR bd_addr, tSMP_EVT_DATA *p_data)
2111 {
2112 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bd_addr);
2113 UINT8 res = 0;
2114
2115 BTM_TRACE_DEBUG ("btm_proc_smp_cback event = %d", event);
2116
2117 if (p_dev_rec != NULL) {
2118 switch (event) {
2119 case SMP_IO_CAP_REQ_EVT:
2120 btm_ble_io_capabilities_req(p_dev_rec, (tBTM_LE_IO_REQ *)&p_data->io_req);
2121 break;
2122
2123 case SMP_BR_KEYS_REQ_EVT:
2124 btm_ble_br_keys_req(p_dev_rec, (tBTM_LE_IO_REQ *)&p_data->io_req);
2125 break;
2126
2127 case SMP_PASSKEY_REQ_EVT:
2128 case SMP_PASSKEY_NOTIF_EVT:
2129 case SMP_OOB_REQ_EVT:
2130 case SMP_NC_REQ_EVT:
2131 case SMP_SC_OOB_REQ_EVT:
2132 /* fall through */
2133 p_dev_rec->sec_flags |= BTM_SEC_LE_AUTHENTICATED;
2134
2135 case SMP_SEC_REQUEST_EVT:
2136 if (event == SMP_SEC_REQUEST_EVT && btm_cb.pairing_state != BTM_PAIR_STATE_IDLE) {
2137 BTM_TRACE_DEBUG("%s: Ignoring SMP Security request", __func__);
2138 break;
2139 }
2140 memcpy (btm_cb.pairing_bda, bd_addr, BD_ADDR_LEN);
2141 p_dev_rec->sec_state = BTM_SEC_STATE_AUTHENTICATING;
2142 btm_cb.pairing_flags |= BTM_PAIR_FLAGS_LE_ACTIVE;
2143 /* fall through */
2144
2145 case SMP_COMPLT_EVT:
2146 if (btm_cb.api.p_le_callback) {
2147 /* the callback function implementation may change the IO capability... */
2148 BTM_TRACE_DEBUG ("btm_cb.api.p_le_callback=%p", btm_cb.api.p_le_callback );
2149 (*btm_cb.api.p_le_callback) (event, bd_addr, (tBTM_LE_EVT_DATA *)p_data);
2150 }
2151
2152 if (event == SMP_COMPLT_EVT) {
2153 BTM_TRACE_DEBUG ("evt=SMP_COMPLT_EVT before update sec_level=0x%x sec_flags=0x%x", p_data->cmplt.sec_level , p_dev_rec->sec_flags );
2154
2155 res = (p_data->cmplt.reason == SMP_SUCCESS) ? BTM_SUCCESS : BTM_ERR_PROCESSING;
2156
2157 BTM_TRACE_DEBUG ("after update result=%d sec_level=0x%x sec_flags=0x%x",
2158 res, p_data->cmplt.sec_level , p_dev_rec->sec_flags );
2159
2160 if (p_data->cmplt.is_pair_cancel && btm_cb.api.p_bond_cancel_cmpl_callback ) {
2161 BTM_TRACE_DEBUG ("Pairing Cancel completed");
2162 (*btm_cb.api.p_bond_cancel_cmpl_callback)(BTM_SUCCESS);
2163 }
2164 #if BTM_BLE_CONFORMANCE_TESTING == TRUE
2165 if (res != BTM_SUCCESS) {
2166 if (!btm_cb.devcb.no_disc_if_pair_fail && p_data->cmplt.reason != SMP_CONN_TOUT) {
2167 BTM_TRACE_DEBUG ("Pairing failed - prepare to remove ACL");
2168 l2cu_start_post_bond_timer(p_dev_rec->ble_hci_handle);
2169 } else {
2170 BTM_TRACE_DEBUG ("Pairing failed - Not Removing ACL");
2171 p_dev_rec->sec_state = BTM_SEC_STATE_IDLE;
2172 }
2173 }
2174 #else
2175 if (res != BTM_SUCCESS && p_data->cmplt.reason != SMP_CONN_TOUT) {
2176 BTM_TRACE_DEBUG ("Pairing failed - prepare to remove ACL");
2177 l2cu_start_post_bond_timer(p_dev_rec->ble_hci_handle);
2178 }
2179 #endif
2180
2181 BTM_TRACE_DEBUG ("btm_cb pairing_state=%x pairing_flags=%x",
2182 btm_cb.pairing_state,
2183 btm_cb.pairing_flags);
2184 BTM_TRACE_DEBUG ("btm_cb.pairing_bda %02x:%02x:%02x:%02x:%02x:%02x",
2185 btm_cb.pairing_bda[0], btm_cb.pairing_bda[1], btm_cb.pairing_bda[2],
2186 btm_cb.pairing_bda[3], btm_cb.pairing_bda[4], btm_cb.pairing_bda[5]);
2187
2188 /* Reset btm state only if the callback address matches pairing address*/
2189 if (memcmp(bd_addr, btm_cb.pairing_bda, BD_ADDR_LEN) == 0) {
2190 memset (btm_cb.pairing_bda, 0xff, BD_ADDR_LEN);
2191 btm_cb.pairing_state = BTM_PAIR_STATE_IDLE;
2192 btm_cb.pairing_flags = 0;
2193 }
2194
2195 if (res == BTM_SUCCESS) {
2196 p_dev_rec->sec_state = BTM_SEC_STATE_IDLE;
2197 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
2198 /* add all bonded device into resolving list if IRK is available*/
2199 btm_ble_resolving_list_load_dev(p_dev_rec);
2200 #endif
2201 }
2202
2203 btm_sec_dev_rec_cback_event(p_dev_rec, res, TRUE);
2204 }
2205 break;
2206
2207 default:
2208 BTM_TRACE_DEBUG ("unknown event = %d", event);
2209 break;
2210
2211
2212 }
2213 } else {
2214 BTM_TRACE_ERROR("btm_proc_smp_cback received for unknown device");
2215 }
2216 return 0;
2217 }
2218 #endif ///SMP_INCLUDED == TRUE
2219
2220
2221 /*******************************************************************************
2222 **
2223 ** Function BTM_BleDataSignature
2224 **
2225 ** Description This function is called to sign the data using AES128 CMAC
2226 ** algorith.
2227 **
2228 ** Parameter bd_addr: target device the data to be signed for.
2229 ** p_text: singing data
2230 ** len: length of the data to be signed.
2231 ** signature: output parameter where data signature is going to
2232 ** be stored.
2233 **
2234 ** Returns TRUE if signing sucessul, otherwise FALSE.
2235 **
2236 *******************************************************************************/
2237 #if (SMP_INCLUDED == TRUE)
2238 BOOLEAN BTM_BleDataSignature (BD_ADDR bd_addr, UINT8 *p_text, UINT16 len,
2239 BLE_SIGNATURE signature)
2240 {
2241 tBTM_SEC_DEV_REC *p_rec = btm_find_dev (bd_addr);
2242
2243 BTM_TRACE_DEBUG ("%s", __func__);
2244 #endif ///SMP_INCLUDED == TRUE
2245 BOOLEAN ret = FALSE;
2246 #if (SMP_INCLUDED == TRUE)
2247 if (p_rec == NULL) {
2248 BTM_TRACE_ERROR("%s-data signing can not be done from unknown device", __func__);
2249 } else {
2250 UINT8 *p_mac = (UINT8 *)signature;
2251 UINT8 *p_buf, *pp;
2252 if ((p_buf = (UINT8 *)osi_malloc((UINT16)(len + 4))) != NULL) {
2253 BTM_TRACE_DEBUG("%s-Start to generate Local CSRK", __func__);
2254 pp = p_buf;
2255 /* prepare plain text */
2256 if (p_text) {
2257 memcpy(p_buf, p_text, len);
2258 pp = (p_buf + len);
2259 }
2260
2261 UINT32_TO_STREAM(pp, p_rec->ble.keys.local_counter);
2262 UINT32_TO_STREAM(p_mac, p_rec->ble.keys.local_counter);
2263
2264 if ((ret = aes_cipher_msg_auth_code(p_rec->ble.keys.lcsrk, p_buf, (UINT16)(len + 4),
2265 BTM_CMAC_TLEN_SIZE, p_mac)) == TRUE) {
2266 btm_ble_increment_sign_ctr(bd_addr, TRUE);
2267 }
2268
2269 BTM_TRACE_DEBUG("%s p_mac = %p", __func__, p_mac);
2270 BTM_TRACE_DEBUG("p_mac[0] = 0x%02x p_mac[1] = 0x%02x p_mac[2] = 0x%02x p_mac[3] = 0x%02x",
2271 *p_mac, *(p_mac + 1), *(p_mac + 2), *(p_mac + 3));
2272 BTM_TRACE_DEBUG("p_mac[4] = 0x%02x p_mac[5] = 0x%02x p_mac[6] = 0x%02x p_mac[7] = 0x%02x",
2273 *(p_mac + 4), *(p_mac + 5), *(p_mac + 6), *(p_mac + 7));
2274 osi_free(p_buf);
2275 }
2276 }
2277 return ret;
2278 }
2279
2280 /*******************************************************************************
2281 **
2282 ** Function BTM_BleVerifySignature
2283 **
2284 ** Description This function is called to verify the data signature
2285 **
2286 ** Parameter bd_addr: target device the data to be signed for.
2287 ** p_orig: original data before signature.
2288 ** len: length of the signing data
2289 ** counter: counter used when doing data signing
2290 ** p_comp: signature to be compared against.
2291
2292 ** Returns TRUE if signature verified correctly; otherwise FALSE.
2293 **
2294 *******************************************************************************/
2295 BOOLEAN BTM_BleVerifySignature (BD_ADDR bd_addr, UINT8 *p_orig, UINT16 len, UINT32 counter,
2296 UINT8 *p_comp)
2297 {
2298 BOOLEAN verified = FALSE;
2299 tBTM_SEC_DEV_REC *p_rec = btm_find_dev (bd_addr);
2300 UINT8 p_mac[BTM_CMAC_TLEN_SIZE];
2301
2302 if (p_rec == NULL || (p_rec && !(p_rec->ble.key_type & BTM_LE_KEY_PCSRK))) {
2303 BTM_TRACE_ERROR("can not verify signature for unknown device");
2304 } else if (counter < p_rec->ble.keys.counter) {
2305 BTM_TRACE_ERROR("signature received with out dated sign counter");
2306 } else if (p_orig == NULL) {
2307 BTM_TRACE_ERROR("No signature to verify");
2308 } else {
2309 BTM_TRACE_DEBUG ("%s rcv_cnt=%d >= expected_cnt=%d", __func__, counter,
2310 p_rec->ble.keys.counter);
2311
2312 if (aes_cipher_msg_auth_code(p_rec->ble.keys.pcsrk, p_orig, len, BTM_CMAC_TLEN_SIZE, p_mac)) {
2313 if (memcmp(p_mac, p_comp, BTM_CMAC_TLEN_SIZE) == 0) {
2314 btm_ble_increment_sign_ctr(bd_addr, FALSE);
2315 verified = TRUE;
2316 }
2317 }
2318 }
2319 return verified;
2320 }
2321 #endif /* SMP_INCLUDED */
2322
2323
2324 /*******************************************************************************
2325 **
2326 ** Function BTM_GetLeSecurityState
2327 **
2328 ** Description This function is called to get security mode 1 flags and
2329 ** encryption key size for LE peer.
2330 **
2331 ** Returns BOOLEAN TRUE if LE device is found, FALSE otherwise.
2332 **
2333 *******************************************************************************/
2334 BOOLEAN BTM_GetLeSecurityState (BD_ADDR bd_addr, UINT8 *p_le_dev_sec_flags, UINT8 *p_le_key_size)
2335 {
2336 #if (BLE_INCLUDED == TRUE && SMP_INCLUDED == TRUE)
2337 tBTM_SEC_DEV_REC *p_dev_rec;
2338 UINT16 dev_rec_sec_flags;
2339 #endif
2340
2341 *p_le_dev_sec_flags = 0;
2342 *p_le_key_size = 0;
2343
2344 #if (BLE_INCLUDED == TRUE && SMP_INCLUDED == TRUE)
2345 if ((p_dev_rec = btm_find_dev (bd_addr)) == NULL) {
2346 BTM_TRACE_ERROR ("%s fails", __func__);
2347 return (FALSE);
2348 }
2349
2350 if (p_dev_rec->ble_hci_handle == BTM_SEC_INVALID_HANDLE) {
2351 BTM_TRACE_ERROR ("%s-this is not LE device", __func__);
2352 return (FALSE);
2353 }
2354
2355 dev_rec_sec_flags = p_dev_rec->sec_flags;
2356
2357 if (dev_rec_sec_flags & BTM_SEC_LE_ENCRYPTED) {
2358 /* link is encrypted with LTK or STK */
2359 *p_le_key_size = p_dev_rec->enc_key_size;
2360 *p_le_dev_sec_flags |= BTM_SEC_LE_LINK_ENCRYPTED;
2361
2362 *p_le_dev_sec_flags |= (dev_rec_sec_flags & BTM_SEC_LE_AUTHENTICATED)
2363 ? BTM_SEC_LE_LINK_PAIRED_WITH_MITM /* set auth LTK flag */
2364 : BTM_SEC_LE_LINK_PAIRED_WITHOUT_MITM; /* set unauth LTK flag */
2365 } else if (p_dev_rec->ble.key_type & BTM_LE_KEY_PENC) {
2366 /* link is unencrypted, still LTK is available */
2367 *p_le_key_size = p_dev_rec->ble.keys.key_size;
2368
2369 *p_le_dev_sec_flags |= (dev_rec_sec_flags & BTM_SEC_LE_LINK_KEY_AUTHED)
2370 ? BTM_SEC_LE_LINK_PAIRED_WITH_MITM /* set auth LTK flag */
2371 : BTM_SEC_LE_LINK_PAIRED_WITHOUT_MITM; /* set unauth LTK flag */
2372 }
2373
2374 BTM_TRACE_DEBUG ("%s - le_dev_sec_flags: 0x%02x, le_key_size: %d",
2375 __func__, *p_le_dev_sec_flags, *p_le_key_size);
2376
2377 return TRUE;
2378 #else
2379 return FALSE;
2380 #endif
2381 }
2382
2383 /*******************************************************************************
2384 **
2385 ** Function BTM_BleSecurityProcedureIsRunning
2386 **
2387 ** Description This function indicates if LE security procedure is
2388 ** currently running with the peer.
2389 **
2390 ** Returns BOOLEAN TRUE if security procedure is running, FALSE otherwise.
2391 **
2392 *******************************************************************************/
2393 BOOLEAN BTM_BleSecurityProcedureIsRunning(BD_ADDR bd_addr)
2394 {
2395 #if (BLE_INCLUDED == TRUE)
2396 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bd_addr);
2397
2398 if (p_dev_rec == NULL) {
2399 BTM_TRACE_ERROR ("%s device with BDA: %08x%04x is not found",
2400 __func__, (bd_addr[0] << 24) + (bd_addr[1] << 16) + (bd_addr[2] << 8) + bd_addr[3],
2401 (bd_addr[4] << 8) + bd_addr[5]);
2402 return FALSE;
2403 }
2404
2405 return (p_dev_rec->sec_state == BTM_SEC_STATE_ENCRYPTING ||
2406 p_dev_rec->sec_state == BTM_SEC_STATE_AUTHENTICATING);
2407 #else
2408 return FALSE;
2409 #endif
2410 }
2411
2412 /*******************************************************************************
2413 **
2414 ** Function BTM_BleGetSupportedKeySize
2415 **
2416 ** Description This function gets the maximum encryption key size in bytes
2417 ** the local device can suport.
2418 ** record.
2419 **
2420 ** Returns the key size or 0 if the size can't be retrieved.
2421 **
2422 *******************************************************************************/
2423 extern UINT8 BTM_BleGetSupportedKeySize (BD_ADDR bd_addr)
2424 {
2425 #ifndef L2CAP_LE_COC_INCLUDED
2426 #define L2CAP_LE_COC_INCLUDED FALSE
2427 #endif
2428 #if ((BLE_INCLUDED == TRUE) && (L2CAP_LE_COC_INCLUDED == TRUE))
2429 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bd_addr);
2430 tBTM_LE_IO_REQ dev_io_cfg;
2431 UINT8 callback_rc;
2432
2433 if (!p_dev_rec) {
2434 BTM_TRACE_ERROR ("%s device with BDA: %08x%04x is not found",
2435 __func__, (bd_addr[0] << 24) + (bd_addr[1] << 16) + (bd_addr[2] << 8) + bd_addr[3],
2436 (bd_addr[4] << 8) + bd_addr[5]);
2437 return 0;
2438 }
2439
2440 if (btm_cb.api.p_le_callback == NULL) {
2441 BTM_TRACE_ERROR ("%s can't access supported key size", __func__);
2442 return 0;
2443 }
2444
2445 callback_rc = (*btm_cb.api.p_le_callback) (BTM_LE_IO_REQ_EVT, p_dev_rec->bd_addr,
2446 (tBTM_LE_EVT_DATA *) &dev_io_cfg);
2447
2448 if (callback_rc != BTM_SUCCESS) {
2449 BTM_TRACE_ERROR ("%s can't access supported key size", __func__);
2450 return 0;
2451 }
2452
2453 BTM_TRACE_DEBUG ("%s device supports key size = %d", __func__, dev_io_cfg.max_key_size);
2454 return (dev_io_cfg.max_key_size);
2455 #else
2456 return 0;
2457 #endif
2458 }
2459
2460 /*******************************************************************************
2461 ** Utility functions for LE device IR/ER generation
2462 *******************************************************************************/
2463 /*******************************************************************************
2464 **
2465 ** Function btm_notify_new_key
2466 **
2467 ** Description This function is to notify application new keys have been
2468 ** generated.
2469 **
2470 ** Returns void
2471 **
2472 *******************************************************************************/
2473 #if (SMP_INCLUDED == TRUE)
2474 static void btm_notify_new_key(UINT8 key_type)
2475 {
2476 tBTM_BLE_LOCAL_KEYS *p_locak_keys = NULL;
2477
2478 BTM_TRACE_DEBUG ("btm_notify_new_key key_type=%d", key_type);
2479
2480 if (btm_cb.api.p_le_key_callback) {
2481 switch (key_type) {
2482 case BTM_BLE_KEY_TYPE_ID:
2483 BTM_TRACE_DEBUG ("BTM_BLE_KEY_TYPE_ID");
2484 p_locak_keys = (tBTM_BLE_LOCAL_KEYS *)&btm_cb.devcb.id_keys;
2485 break;
2486
2487 case BTM_BLE_KEY_TYPE_ER:
2488 BTM_TRACE_DEBUG ("BTM_BLE_KEY_TYPE_ER");
2489 p_locak_keys = (tBTM_BLE_LOCAL_KEYS *)&btm_cb.devcb.ble_encryption_key_value;
2490 break;
2491
2492 default:
2493 BTM_TRACE_ERROR("unknown key type: %d", key_type);
2494 break;
2495 }
2496 if (p_locak_keys != NULL) {
2497 (*btm_cb.api.p_le_key_callback) (key_type, p_locak_keys);
2498 }
2499 }
2500 }
2501
2502 /*******************************************************************************
2503 **
2504 ** Function btm_ble_process_er2
2505 **
2506 ** Description This function is called when ER is generated, store it in
2507 ** local control block.
2508 **
2509 ** Returns void
2510 **
2511 *******************************************************************************/
2512 static void btm_ble_process_er2(tBTM_RAND_ENC *p)
2513 {
2514 BTM_TRACE_DEBUG ("btm_ble_process_er2");
2515
2516 if (p && p->opcode == HCI_BLE_RAND) {
2517 memcpy(&btm_cb.devcb.ble_encryption_key_value[8], p->param_buf, BT_OCTET8_LEN);
2518 btm_notify_new_key(BTM_BLE_KEY_TYPE_ER);
2519 } else {
2520 BTM_TRACE_ERROR("Generating ER2 exception.");
2521 memset(&btm_cb.devcb.ble_encryption_key_value, 0, sizeof(BT_OCTET16));
2522 }
2523 }
2524
2525 /*******************************************************************************
2526 **
2527 ** Function btm_ble_process_er
2528 **
2529 ** Description This function is called when ER is generated, store it in
2530 ** local control block.
2531 **
2532 ** Returns void
2533 **
2534 *******************************************************************************/
2535 static void btm_ble_process_er(tBTM_RAND_ENC *p)
2536 {
2537 BTM_TRACE_DEBUG ("btm_ble_process_er");
2538
2539 if (p && p->opcode == HCI_BLE_RAND) {
2540 memcpy(&btm_cb.devcb.ble_encryption_key_value[0], p->param_buf, BT_OCTET8_LEN);
2541
2542 if (!btsnd_hcic_ble_rand((void *)btm_ble_process_er2)) {
2543 memset(&btm_cb.devcb.ble_encryption_key_value, 0, sizeof(BT_OCTET16));
2544 BTM_TRACE_ERROR("Generating ER2 failed.");
2545 }
2546 } else {
2547 BTM_TRACE_ERROR("Generating ER1 exception.");
2548 }
2549 }
2550
2551 /*******************************************************************************
2552 **
2553 ** Function btm_ble_process_irk
2554 **
2555 ** Description This function is called when IRK is generated, store it in
2556 ** local control block.
2557 **
2558 ** Returns void
2559 **
2560 *******************************************************************************/
2561 static void btm_ble_process_irk(tSMP_ENC *p)
2562 {
2563 BTM_TRACE_DEBUG ("btm_ble_process_irk");
2564 if (p && p->opcode == HCI_BLE_ENCRYPT) {
2565 memcpy(btm_cb.devcb.id_keys.irk, p->param_buf, BT_OCTET16_LEN);
2566 btm_notify_new_key(BTM_BLE_KEY_TYPE_ID);
2567
2568 #if BLE_PRIVACY_SPT == TRUE
2569 /* if privacy is enabled, new RPA should be calculated */
2570 if (btm_cb.ble_ctr_cb.privacy_mode != BTM_PRIVACY_NONE) {
2571 btm_gen_resolvable_private_addr((void *)btm_gen_resolve_paddr_low);
2572 }
2573 #endif
2574 } else {
2575 BTM_TRACE_ERROR("Generating IRK exception.");
2576 }
2577
2578 /* proceed generate ER */
2579 if (!btsnd_hcic_ble_rand((void *)btm_ble_process_er)) {
2580 BTM_TRACE_ERROR("Generating ER failed.");
2581 }
2582 }
2583
2584
2585 /*******************************************************************************
2586 **
2587 ** Function btm_ble_process_dhk
2588 **
2589 ** Description This function is called when DHK is calculated, store it in
2590 ** local control block, and proceed to generate ER, a 128-bits
2591 ** random number.
2592 **
2593 ** Returns void
2594 **
2595 *******************************************************************************/
2596 static void btm_ble_process_dhk(tSMP_ENC *p)
2597 {
2598 UINT8 btm_ble_irk_pt = 0x01;
2599 tSMP_ENC output;
2600
2601 BTM_TRACE_DEBUG ("btm_ble_process_dhk");
2602
2603 if (p && p->opcode == HCI_BLE_ENCRYPT) {
2604 memcpy(btm_cb.devcb.id_keys.dhk, p->param_buf, BT_OCTET16_LEN);
2605 BTM_TRACE_DEBUG("BLE DHK generated.");
2606
2607 /* IRK = D1(IR, 1) */
2608 if (!SMP_Encrypt(btm_cb.devcb.id_keys.ir, BT_OCTET16_LEN, &btm_ble_irk_pt,
2609 1, &output)) {
2610 /* reset all identity root related key */
2611 memset(&btm_cb.devcb.id_keys, 0, sizeof(tBTM_BLE_LOCAL_ID_KEYS));
2612 } else {
2613 btm_ble_process_irk(&output);
2614 }
2615 } else {
2616 /* reset all identity root related key */
2617 memset(&btm_cb.devcb.id_keys, 0, sizeof(tBTM_BLE_LOCAL_ID_KEYS));
2618 }
2619 }
2620
2621 /*******************************************************************************
2622 **
2623 ** Function btm_ble_process_ir2
2624 **
2625 ** Description This function is called when IR is generated, proceed to calculate
2626 ** DHK = Eir({0x03, 0, 0 ...})
2627 **
2628 **
2629 ** Returns void
2630 **
2631 *******************************************************************************/
2632 static void btm_ble_process_ir2(tBTM_RAND_ENC *p)
2633 {
2634 UINT8 btm_ble_dhk_pt = 0x03;
2635 tSMP_ENC output;
2636
2637 BTM_TRACE_DEBUG ("btm_ble_process_ir2");
2638
2639 if (p && p->opcode == HCI_BLE_RAND) {
2640 /* remembering in control block */
2641 memcpy(&btm_cb.devcb.id_keys.ir[8], p->param_buf, BT_OCTET8_LEN);
2642 /* generate DHK= Eir({0x03, 0x00, 0x00 ...}) */
2643
2644
2645 SMP_Encrypt(btm_cb.devcb.id_keys.ir, BT_OCTET16_LEN, &btm_ble_dhk_pt,
2646 1, &output);
2647 btm_ble_process_dhk(&output);
2648
2649 BTM_TRACE_DEBUG("BLE IR generated.");
2650 } else {
2651 memset(&btm_cb.devcb.id_keys, 0, sizeof(tBTM_BLE_LOCAL_ID_KEYS));
2652 }
2653 }
2654
2655 /*******************************************************************************
2656 **
2657 ** Function btm_ble_process_ir
2658 **
2659 ** Description This function is called when IR is generated, proceed to calculate
2660 ** DHK = Eir({0x02, 0, 0 ...})
2661 **
2662 **
2663 ** Returns void
2664 **
2665 *******************************************************************************/
2666 static void btm_ble_process_ir(tBTM_RAND_ENC *p)
2667 {
2668 BTM_TRACE_DEBUG ("btm_ble_process_ir");
2669
2670 if (p && p->opcode == HCI_BLE_RAND) {
2671 /* remembering in control block */
2672 memcpy(btm_cb.devcb.id_keys.ir, p->param_buf, BT_OCTET8_LEN);
2673
2674 if (!btsnd_hcic_ble_rand((void *)btm_ble_process_ir2)) {
2675 BTM_TRACE_ERROR("Generating IR2 failed.");
2676 memset(&btm_cb.devcb.id_keys, 0, sizeof(tBTM_BLE_LOCAL_ID_KEYS));
2677 }
2678 }
2679 }
2680
2681 /*******************************************************************************
2682 **
2683 ** Function btm_ble_reset_id
2684 **
2685 ** Description This function is called to reset LE device identity.
2686 **
2687 ** Returns void
2688 **
2689 *******************************************************************************/
2690 void btm_ble_reset_id( void )
2691 {
2692 BTM_TRACE_DEBUG ("btm_ble_reset_id");
2693
2694 /* regenrate Identity Root*/
2695 if (!btsnd_hcic_ble_rand((void *)btm_ble_process_ir)) {
2696 BTM_TRACE_DEBUG("Generating IR failed.");
2697 }
2698 }
2699 #endif ///SMP_INCLUDED == TRUE
2700
2701 #if BTM_BLE_CONFORMANCE_TESTING == TRUE
2702 /*******************************************************************************
2703 **
2704 ** Function btm_ble_set_no_disc_if_pair_fail
2705 **
2706 ** Description This function indicates that whether no disconnect of the ACL
2707 ** should be used if pairing failed
2708 **
2709 ** Returns void
2710 **
2711 *******************************************************************************/
2712 void btm_ble_set_no_disc_if_pair_fail(BOOLEAN disable_disc )
2713 {
2714 BTM_TRACE_DEBUG ("btm_ble_set_disc_enable_if_pair_fail disable_disc=%d", disable_disc);
2715 btm_cb.devcb.no_disc_if_pair_fail = disable_disc;
2716 }
2717
2718 /*******************************************************************************
2719 **
2720 ** Function btm_ble_set_test_mac_value
2721 **
2722 ** Description This function set test MAC value
2723 **
2724 ** Returns void
2725 **
2726 *******************************************************************************/
2727 void btm_ble_set_test_mac_value(BOOLEAN enable, UINT8 *p_test_mac_val )
2728 {
2729 BTM_TRACE_DEBUG ("btm_ble_set_test_mac_value enable=%d", enable);
2730 btm_cb.devcb.enable_test_mac_val = enable;
2731 memcpy(btm_cb.devcb.test_mac, p_test_mac_val, BT_OCTET8_LEN);
2732 }
2733
2734 /*******************************************************************************
2735 **
2736 ** Function btm_ble_set_test_local_sign_cntr_value
2737 **
2738 ** Description This function set test local sign counter value
2739 **
2740 ** Returns void
2741 **
2742 *******************************************************************************/
2743 void btm_ble_set_test_local_sign_cntr_value(BOOLEAN enable, UINT32 test_local_sign_cntr )
2744 {
2745 BTM_TRACE_DEBUG ("btm_ble_set_test_local_sign_cntr_value enable=%d local_sign_cntr=%d",
2746 enable, test_local_sign_cntr);
2747 btm_cb.devcb.enable_test_local_sign_cntr = enable;
2748 btm_cb.devcb.test_local_sign_cntr = test_local_sign_cntr;
2749 }
2750
2751 /*******************************************************************************
2752 **
2753 ** Function btm_set_random_address
2754 **
2755 ** Description This function set a random address to local controller.
2756 **
2757 ** Returns void
2758 **
2759 *******************************************************************************/
2760 void btm_set_random_address(BD_ADDR random_bda)
2761 {
2762 tBTM_LE_RANDOM_CB *p_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
2763 BOOLEAN adv_mode = btm_cb.ble_ctr_cb.inq_var.adv_mode ;
2764
2765 BTM_TRACE_DEBUG ("btm_set_random_address");
2766
2767 if (adv_mode == BTM_BLE_ADV_ENABLE) {
2768 btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_DISABLE);
2769 }
2770
2771 memcpy(p_cb->private_addr, random_bda, BD_ADDR_LEN);
2772 btsnd_hcic_ble_set_random_addr(p_cb->private_addr);
2773
2774 if (adv_mode == BTM_BLE_ADV_ENABLE) {
2775 btsnd_hcic_ble_set_adv_enable (BTM_BLE_ADV_ENABLE);
2776 }
2777
2778
2779 }
2780
2781 /*******************************************************************************
2782 **
2783 ** Function btm_ble_set_keep_rfu_in_auth_req
2784 **
2785 ** Description This function indicates if RFU bits have to be kept as is
2786 ** (by default they have to be set to 0 by the sender).
2787 **
2788 ** Returns void
2789 **
2790 *******************************************************************************/
2791 void btm_ble_set_keep_rfu_in_auth_req(BOOLEAN keep_rfu)
2792 {
2793 BTM_TRACE_DEBUG ("btm_ble_set_keep_rfu_in_auth_req keep_rfus=%d", keep_rfu);
2794 btm_cb.devcb.keep_rfu_in_auth_req = keep_rfu;
2795 }
2796
2797 #endif /* BTM_BLE_CONFORMANCE_TESTING */
2798
2799 /*******************************************************************************
2800 **
2801 ** Function btm_get_current_conn_params
2802 **
2803 ** Description This function is called to get current connection parameters
2804 ** information of the device
2805 **
2806 ** Returns TRUE if the information is geted, else FALSE
2807 **
2808 *******************************************************************************/
2809
2810 BOOLEAN btm_get_current_conn_params(BD_ADDR bda, UINT16 *interval, UINT16 *latency, UINT16 *timeout)
2811 {
2812 if( (interval == NULL) || (latency == NULL) || (timeout == NULL) ) {
2813 BTM_TRACE_ERROR("%s invalid parameters ", __func__);
2814 return FALSE;
2815 }
2816
2817 tL2C_LCB *p_lcb = l2cu_find_lcb_by_bd_addr(bda, BT_TRANSPORT_LE);
2818 if(p_lcb != NULL) {
2819 (*interval) = p_lcb->current_used_conn_interval;
2820 (*latency) = p_lcb->current_used_conn_latency;
2821 (*timeout) = p_lcb->current_used_conn_timeout;
2822 return TRUE;
2823 }
2824 BTM_TRACE_WARNING("%s Device is not connected", __func__);
2825
2826 return FALSE;
2827 }
2828
2829
2830 #endif /* BLE_INCLUDED */
2831
