btm_ble_privacy.c 37 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086
  1. /******************************************************************************
  2. *
  3. * Copyright (C) 1999-2012 Broadcom Corporation
  4. *
  5. * Licensed under the Apache License, Version 2.0 (the "License");
  6. * you may not use this file except in compliance with the License.
  7. * You may obtain a copy of the License at:
  8. *
  9. * http://www.apache.org/licenses/LICENSE-2.0
  10. *
  11. * Unless required by applicable law or agreed to in writing, software
  12. * distributed under the License is distributed on an "AS IS" BASIS,
  13. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14. * See the License for the specific language governing permissions and
  15. * limitations under the License.
  16. *
  17. ******************************************************************************/
  18. /******************************************************************************
  19. *
  20. * This file contains functions for BLE controller based privacy.
  21. *
  22. ******************************************************************************/
  23. #include <string.h>
  24. #include "common/bt_target.h"
  25. #if (BLE_INCLUDED == TRUE && BLE_PRIVACY_SPT == TRUE)
  26. #include "stack/bt_types.h"
  27. #include "stack/hcimsgs.h"
  28. #include "stack/btu.h"
  29. //#include "vendor_hcidefs.h"
  30. #include "btm_int.h"
  31. #include "device/controller.h"
  32. #include "stack/hcidefs.h"
  33. #define HCI_VENDOR_BLE_RPA_VSC (0x0155 | HCI_GRP_VENDOR_SPECIFIC)
  34. /* RPA offload VSC specifics */
  35. #define BTM_BLE_META_IRK_ENABLE 0x01
  36. #define BTM_BLE_META_ADD_IRK_ENTRY 0x02
  37. #define BTM_BLE_META_REMOVE_IRK_ENTRY 0x03
  38. #define BTM_BLE_META_CLEAR_IRK_LIST 0x04
  39. #define BTM_BLE_META_READ_IRK_ENTRY 0x05
  40. #define BTM_BLE_META_CS_RESOLVE_ADDR 0x00000001
  41. #define BTM_BLE_IRK_ENABLE_LEN 2
  42. #define BTM_BLE_META_ADD_IRK_LEN 24
  43. #define BTM_BLE_META_REMOVE_IRK_LEN 8
  44. #define BTM_BLE_META_CLEAR_IRK_LEN 1
  45. #define BTM_BLE_META_READ_IRK_LEN 2
  46. #define BTM_BLE_META_ADD_WL_ATTR_LEN 9
  47. /*******************************************************************************
  48. ** Functions implemented controller based privacy using Resolving List
  49. *******************************************************************************/
  50. /*******************************************************************************
  51. **
  52. ** Function btm_ble_enq_resolving_list_pending
  53. **
  54. ** Description add target address into resolving pending operation queue
  55. **
  56. ** Parameters target_bda: target device address
  57. ** add_entry: TRUE for add entry, FALSE for remove entry
  58. **
  59. ** Returns void
  60. **
  61. *******************************************************************************/
  62. void btm_ble_enq_resolving_list_pending(BD_ADDR pseudo_bda, UINT8 op_code)
  63. {
  64. tBTM_BLE_RESOLVE_Q *p_q = &btm_cb.ble_ctr_cb.resolving_list_pend_q;
  65. memcpy(p_q->resolve_q_random_pseudo[p_q->q_next], pseudo_bda, BD_ADDR_LEN);
  66. p_q->resolve_q_action[p_q->q_next] = op_code;
  67. p_q->q_next ++;
  68. p_q->q_next %= controller_get_interface()->get_ble_resolving_list_max_size();
  69. }
  70. /*******************************************************************************
  71. **
  72. ** Function btm_ble_brcm_find_resolving_pending_entry
  73. **
  74. ** Description check to see if the action is in pending list
  75. **
  76. ** Parameters TRUE: action pending;
  77. ** FALSE: new action
  78. **
  79. ** Returns void
  80. **
  81. *******************************************************************************/
  82. BOOLEAN btm_ble_brcm_find_resolving_pending_entry(BD_ADDR pseudo_addr, UINT8 action)
  83. {
  84. tBTM_BLE_RESOLVE_Q *p_q = &btm_cb.ble_ctr_cb.resolving_list_pend_q;
  85. for (UINT8 i = p_q->q_pending; i != p_q->q_next;) {
  86. if (memcmp(p_q->resolve_q_random_pseudo[i], pseudo_addr, BD_ADDR_LEN) == 0 &&
  87. action == p_q->resolve_q_action[i]) {
  88. return TRUE;
  89. }
  90. i ++;
  91. i %= controller_get_interface()->get_ble_resolving_list_max_size();
  92. }
  93. return FALSE;
  94. }
  95. /*******************************************************************************
  96. **
  97. ** Function btm_ble_deq_resolving_pending
  98. **
  99. ** Description dequeue target address from resolving pending operation queue
  100. **
  101. ** Parameters pseudo_addr: pseudo_addr device address
  102. **
  103. ** Returns void
  104. **
  105. *******************************************************************************/
  106. BOOLEAN btm_ble_deq_resolving_pending(BD_ADDR pseudo_addr)
  107. {
  108. tBTM_BLE_RESOLVE_Q *p_q = &btm_cb.ble_ctr_cb.resolving_list_pend_q;
  109. if (p_q->q_next != p_q->q_pending) {
  110. memcpy(pseudo_addr, p_q->resolve_q_random_pseudo[p_q->q_pending], BD_ADDR_LEN);
  111. memset(p_q->resolve_q_random_pseudo[p_q->q_pending], 0, BD_ADDR_LEN);
  112. p_q->q_pending ++;
  113. p_q->q_pending %= controller_get_interface()->get_ble_resolving_list_max_size();
  114. return TRUE;
  115. }
  116. return FALSE;
  117. }
  118. /*******************************************************************************
  119. **
  120. ** Function btm_ble_clear_irk_index
  121. **
  122. ** Description clear IRK list index mask for availability
  123. **
  124. ** Returns none
  125. **
  126. *******************************************************************************/
  127. void btm_ble_clear_irk_index(UINT8 index)
  128. {
  129. UINT8 byte;
  130. UINT8 bit;
  131. if (index < controller_get_interface()->get_ble_resolving_list_max_size()) {
  132. byte = index / 8;
  133. bit = index % 8;
  134. btm_cb.ble_ctr_cb.irk_list_mask[byte] &= (~(1 << bit));
  135. }
  136. }
  137. /*******************************************************************************
  138. **
  139. ** Function btm_ble_find_irk_index
  140. **
  141. ** Description find the first available IRK list index
  142. **
  143. ** Returns index from 0 ~ max (127 default)
  144. **
  145. *******************************************************************************/
  146. UINT8 btm_ble_find_irk_index(void)
  147. {
  148. UINT8 i = 0;
  149. UINT8 byte;
  150. UINT8 bit;
  151. while (i < controller_get_interface()->get_ble_resolving_list_max_size()) {
  152. byte = i / 8;
  153. bit = i % 8;
  154. if ((btm_cb.ble_ctr_cb.irk_list_mask[byte] & (1 << bit)) == 0) {
  155. btm_cb.ble_ctr_cb.irk_list_mask[byte] |= (1 << bit);
  156. return i;
  157. }
  158. i++;
  159. }
  160. BTM_TRACE_ERROR ("%s failed, list full", __func__);
  161. return i;
  162. }
  163. /*******************************************************************************
  164. **
  165. ** Function btm_ble_update_resolving_list
  166. **
  167. ** Description update resolving list entry in host maintained record
  168. **
  169. ** Returns void
  170. **
  171. *******************************************************************************/
  172. void btm_ble_update_resolving_list(BD_ADDR pseudo_bda, BOOLEAN add)
  173. {
  174. tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev(pseudo_bda);
  175. if (p_dev_rec == NULL) {
  176. return;
  177. }
  178. if (add) {
  179. p_dev_rec->ble.in_controller_list |= BTM_RESOLVING_LIST_BIT;
  180. if (!controller_get_interface()->supports_ble_privacy()) {
  181. p_dev_rec->ble.resolving_list_index = btm_ble_find_irk_index();
  182. }
  183. } else {
  184. p_dev_rec->ble.in_controller_list &= ~BTM_RESOLVING_LIST_BIT;
  185. if (!controller_get_interface()->supports_ble_privacy()) {
  186. /* clear IRK list index mask */
  187. btm_ble_clear_irk_index(p_dev_rec->ble.resolving_list_index);
  188. p_dev_rec->ble.resolving_list_index = 0;
  189. }
  190. }
  191. }
  192. /*******************************************************************************
  193. **
  194. ** Function btm_ble_clear_resolving_list_complete
  195. **
  196. ** Description This function is called when command complete for
  197. ** clear resolving list
  198. **
  199. ** Returns void
  200. **
  201. *******************************************************************************/
  202. void btm_ble_clear_resolving_list_complete(UINT8 *p, UINT16 evt_len)
  203. {
  204. UINT8 status = 0;
  205. STREAM_TO_UINT8(status, p);
  206. BTM_TRACE_DEBUG("%s status=%d", __func__, status);
  207. if (status == HCI_SUCCESS) {
  208. if (evt_len >= 3) {
  209. /* VSC complete has one extra byte for op code and list size, skip it here */
  210. p ++;
  211. /* updated the available list size, and current list size */
  212. uint8_t irk_list_sz_max = 0;
  213. STREAM_TO_UINT8(irk_list_sz_max, p);
  214. if (controller_get_interface()->get_ble_resolving_list_max_size() == 0) {
  215. btm_ble_resolving_list_init(irk_list_sz_max);
  216. }
  217. uint8_t irk_mask_size = (irk_list_sz_max % 8) ?
  218. (irk_list_sz_max / 8 + 1) : (irk_list_sz_max / 8);
  219. memset(btm_cb.ble_ctr_cb.irk_list_mask, 0, irk_mask_size);
  220. }
  221. btm_cb.ble_ctr_cb.resolving_list_avail_size =
  222. controller_get_interface()->get_ble_resolving_list_max_size();
  223. BTM_TRACE_DEBUG("%s resolving_list_avail_size=%d",
  224. __func__, btm_cb.ble_ctr_cb.resolving_list_avail_size);
  225. list_node_t *p_node = NULL;
  226. tBTM_SEC_DEV_REC *p_dev_rec = NULL;
  227. for (p_node = list_begin(btm_cb.p_sec_dev_rec_list); p_node; p_node = list_next(p_node)) {
  228. p_dev_rec = list_node(p_node);
  229. p_dev_rec->ble.in_controller_list &= ~BTM_RESOLVING_LIST_BIT;
  230. }
  231. }
  232. }
  233. /*******************************************************************************
  234. **
  235. ** Function btm_ble_add_resolving_list_entry_complete
  236. **
  237. ** Description This function is called when command complete for
  238. ** add resolving list entry
  239. **
  240. ** Returns void
  241. **
  242. *******************************************************************************/
  243. void btm_ble_add_resolving_list_entry_complete(UINT8 *p, UINT16 evt_len)
  244. {
  245. UINT8 status;
  246. STREAM_TO_UINT8(status, p);
  247. BTM_TRACE_DEBUG("%s status = %d", __func__, status);
  248. BD_ADDR pseudo_bda;
  249. if (!btm_ble_deq_resolving_pending(pseudo_bda)) {
  250. BTM_TRACE_DEBUG("no pending resolving list operation");
  251. return;
  252. }
  253. if (status == HCI_SUCCESS) {
  254. /* privacy 1.2 command complete does not have these extra byte */
  255. if (evt_len > 2) {
  256. /* VSC complete has one extra byte for op code, skip it here */
  257. p ++;
  258. STREAM_TO_UINT8(btm_cb.ble_ctr_cb.resolving_list_avail_size, p);
  259. } else {
  260. btm_cb.ble_ctr_cb.resolving_list_avail_size --;
  261. }
  262. } else if (status == HCI_ERR_MEMORY_FULL) { /* BT_ERROR_CODE_MEMORY_CAPACITY_EXCEEDED */
  263. btm_cb.ble_ctr_cb.resolving_list_avail_size = 0;
  264. BTM_TRACE_ERROR("%s Resolving list Full ", __func__);
  265. } else {
  266. BTM_TRACE_ERROR("%s Add resolving list error %d ", __func__, status);
  267. }
  268. }
  269. /*******************************************************************************
  270. **
  271. ** Function btm_ble_remove_resolving_list_entry_complete
  272. **
  273. ** Description This function is called when command complete for
  274. ** remove resolving list entry
  275. **
  276. ** Returns void
  277. **
  278. *******************************************************************************/
  279. void btm_ble_remove_resolving_list_entry_complete(UINT8 *p, UINT16 evt_len)
  280. {
  281. BD_ADDR pseudo_bda;
  282. UINT8 status;
  283. STREAM_TO_UINT8(status, p);
  284. BTM_TRACE_DEBUG("%s status = %d", __func__, status);
  285. if (!btm_ble_deq_resolving_pending(pseudo_bda)) {
  286. BTM_TRACE_ERROR("%s no pending resolving list operation", __func__);
  287. return;
  288. }
  289. if (status == HCI_SUCCESS) {
  290. /* proprietary: spec does not have these extra bytes */
  291. if (evt_len > 2) {
  292. p ++; /* skip opcode */
  293. STREAM_TO_UINT8(btm_cb.ble_ctr_cb.resolving_list_avail_size, p);
  294. } else {
  295. btm_cb.ble_ctr_cb.resolving_list_avail_size++;
  296. }
  297. } else {
  298. BTM_TRACE_ERROR("%s remove resolving list error 0x%x", __func__, status);
  299. }
  300. }
  301. /*******************************************************************************
  302. **
  303. ** Function btm_ble_read_resolving_list_entry_complete
  304. **
  305. ** Description This function is called when command complete for
  306. ** remove resolving list entry
  307. **
  308. ** Returns void
  309. **
  310. *******************************************************************************/
  311. void btm_ble_read_resolving_list_entry_complete(UINT8 *p, UINT16 evt_len)
  312. {
  313. UINT8 status, rra_type = BTM_BLE_ADDR_PSEUDO;
  314. BD_ADDR rra, pseudo_bda;
  315. STREAM_TO_UINT8 (status, p);
  316. BTM_TRACE_DEBUG("%s status = %d", __func__, status);
  317. if (!btm_ble_deq_resolving_pending(pseudo_bda)) {
  318. BTM_TRACE_ERROR("no pending resolving list operation");
  319. return;
  320. }
  321. if (status == HCI_SUCCESS) {
  322. /* proprietary spec has extra bytes */
  323. if (evt_len > 8) {
  324. p += (2 + 16 + 1 + 6); /* skip subcode, index, IRK value, address type, identity addr type */
  325. STREAM_TO_BDADDR(rra, p);
  326. BTM_TRACE_ERROR("%s peer_addr: %02x:%02x:%02x:%02x:%02x:%02x",
  327. __func__, rra[0], rra[1], rra[2], rra[3], rra[4], rra[5]);
  328. } else {
  329. STREAM_TO_BDADDR(rra, p);
  330. }
  331. btm_ble_refresh_peer_resolvable_private_addr(pseudo_bda, rra, rra_type);
  332. }
  333. }
  334. /*******************************************************************************
  335. **
  336. ** Function btm_ble_set_addr_resolution_enable_complete
  337. **
  338. ** Description This function is called when the command to set address
  339. ** resolution enable completes.
  340. **
  341. ** Parameters p: Pointer to the command complete event data.
  342. ** evt_len: Length of the event data.
  343. **
  344. ** Returns void
  345. **
  346. *******************************************************************************/
  347. void btm_ble_set_addr_resolution_enable_complete(UINT8 *p, UINT16 evt_len)
  348. {
  349. UINT8 status;
  350. STREAM_TO_UINT8(status, p);
  351. BTM_TRACE_DEBUG("%s status = %d", __func__, status);
  352. tBTM_LE_RANDOM_CB *random_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
  353. if (!(random_cb && random_cb->set_local_privacy_cback)) {
  354. return;
  355. }
  356. if (status == HCI_SUCCESS) {
  357. random_cb->set_local_privacy_cback(BTM_SUCCESS);
  358. return;
  359. } else if (status == HCI_ERR_COMMAND_DISALLOWED) {
  360. BTM_TRACE_ERROR("a non-connected activity is ongoing, such as advertising and scanning");
  361. } else {
  362. BTM_TRACE_ERROR("set local privacy failed");
  363. }
  364. random_cb->set_local_privacy_cback(BTM_ILLEGAL_VALUE);
  365. }
  366. /*******************************************************************************
  367. VSC that implement controller based privacy
  368. ********************************************************************************/
  369. /*******************************************************************************
  370. **
  371. ** Function btm_ble_resolving_list_vsc_op_cmpl
  372. **
  373. ** Description IRK operation VSC complete handler
  374. **
  375. ** Parameters
  376. **
  377. ** Returns void
  378. **
  379. *******************************************************************************/
  380. void btm_ble_resolving_list_vsc_op_cmpl (tBTM_VSC_CMPL *p_params)
  381. {
  382. UINT8 *p = p_params->p_param_buf, op_subcode;
  383. UINT16 evt_len = p_params->param_len;
  384. op_subcode = *(p + 1);
  385. BTM_TRACE_DEBUG("%s op_subcode = %d", __func__, op_subcode);
  386. if (op_subcode == BTM_BLE_META_CLEAR_IRK_LIST) {
  387. btm_ble_clear_resolving_list_complete(p, evt_len);
  388. } else if (op_subcode == BTM_BLE_META_ADD_IRK_ENTRY) {
  389. btm_ble_add_resolving_list_entry_complete(p, evt_len);
  390. } else if (op_subcode == BTM_BLE_META_REMOVE_IRK_ENTRY) {
  391. btm_ble_remove_resolving_list_entry_complete(p, evt_len);
  392. } else if (op_subcode == BTM_BLE_META_READ_IRK_ENTRY) {
  393. btm_ble_read_resolving_list_entry_complete(p, evt_len);
  394. } else if (op_subcode == BTM_BLE_META_IRK_ENABLE) {
  395. /* RPA offloading enable/disabled */
  396. }
  397. }
  398. /*******************************************************************************
  399. **
  400. ** Function btm_ble_remove_resolving_list_entry
  401. **
  402. ** Description This function to remove an IRK entry from the list
  403. **
  404. ** Parameters ble_addr_type: address type
  405. ** ble_addr: LE adddress
  406. **
  407. ** Returns status
  408. **
  409. *******************************************************************************/
  410. tBTM_STATUS btm_ble_remove_resolving_list_entry(tBTM_SEC_DEV_REC *p_dev_rec)
  411. {
  412. /* if controller does not support RPA offloading or privacy 1.2, skip */
  413. if (controller_get_interface()->get_ble_resolving_list_max_size() == 0) {
  414. return BTM_WRONG_MODE;
  415. }
  416. tBTM_STATUS st = BTM_NO_RESOURCES;
  417. if (controller_get_interface()->supports_ble_privacy()) {
  418. #if CONTROLLER_RPA_LIST_ENABLE
  419. if (btsnd_hcic_ble_rm_device_resolving_list(p_dev_rec->ble.static_addr_type,
  420. p_dev_rec->ble.static_addr)) {
  421. st = BTM_CMD_STARTED;
  422. }
  423. #else
  424. // do nothing
  425. /* It will cause that scanner doesn't send scan request to advertiser
  426. * which has sent IRK to us and we have stored the IRK in controller.
  427. * It is a hardware limitation. The preliminary solution is not to
  428. * send key to the controller, but to resolve the random address in host. */
  429. #endif
  430. } else {
  431. UINT8 param[20] = {0};
  432. UINT8 *p = param;
  433. UINT8_TO_STREAM(p, BTM_BLE_META_REMOVE_IRK_ENTRY);
  434. UINT8_TO_STREAM(p, p_dev_rec->ble.static_addr_type);
  435. BDADDR_TO_STREAM(p, p_dev_rec->ble.static_addr);
  436. st = BTM_VendorSpecificCommand(HCI_VENDOR_BLE_RPA_VSC,
  437. BTM_BLE_META_REMOVE_IRK_LEN,
  438. param,
  439. btm_ble_resolving_list_vsc_op_cmpl);
  440. }
  441. if (st == BTM_CMD_STARTED) {
  442. btm_ble_enq_resolving_list_pending( p_dev_rec->bd_addr, BTM_BLE_META_REMOVE_IRK_ENTRY);
  443. }
  444. return st;
  445. }
  446. /*******************************************************************************
  447. **
  448. ** Function btm_ble_clear_resolving_list
  449. **
  450. ** Description This function clears the resolving list
  451. **
  452. ** Parameters None.
  453. **
  454. ** Returns status
  455. **
  456. *******************************************************************************/
  457. tBTM_STATUS btm_ble_clear_resolving_list(void)
  458. {
  459. tBTM_STATUS st = BTM_NO_RESOURCES;
  460. if (controller_get_interface()->supports_ble_privacy()) {
  461. if (btsnd_hcic_ble_clear_resolving_list()) {
  462. st = BTM_SUCCESS;
  463. }
  464. } else {
  465. UINT8 param[20] = {0};
  466. UINT8 *p = param;
  467. UINT8_TO_STREAM(p, BTM_BLE_META_CLEAR_IRK_LIST);
  468. st = BTM_VendorSpecificCommand (HCI_VENDOR_BLE_RPA_VSC,
  469. BTM_BLE_META_CLEAR_IRK_LEN,
  470. param,
  471. btm_ble_resolving_list_vsc_op_cmpl);
  472. }
  473. return st;
  474. }
  475. /*******************************************************************************
  476. **
  477. ** Function btm_ble_read_resolving_list_entry
  478. **
  479. ** Description This function read an IRK entry by index
  480. **
  481. ** Parameters entry index.
  482. **
  483. ** Returns status
  484. **
  485. *******************************************************************************/
  486. tBTM_STATUS btm_ble_read_resolving_list_entry(tBTM_SEC_DEV_REC *p_dev_rec)
  487. {
  488. tBTM_STATUS st = BTM_NO_RESOURCES;
  489. if (!(p_dev_rec->ble.in_controller_list & BTM_RESOLVING_LIST_BIT)) {
  490. return BTM_WRONG_MODE;
  491. }
  492. if (controller_get_interface()->supports_ble_privacy()) {
  493. if (btsnd_hcic_ble_read_resolvable_addr_peer(p_dev_rec->ble.static_addr_type,
  494. p_dev_rec->ble.static_addr)) {
  495. st = BTM_CMD_STARTED;
  496. }
  497. } else {
  498. UINT8 param[20] = {0};
  499. UINT8 *p = param;
  500. UINT8_TO_STREAM(p, BTM_BLE_META_READ_IRK_ENTRY);
  501. UINT8_TO_STREAM(p, p_dev_rec->ble.resolving_list_index);
  502. st = BTM_VendorSpecificCommand (HCI_VENDOR_BLE_RPA_VSC,
  503. BTM_BLE_META_READ_IRK_LEN,
  504. param,
  505. btm_ble_resolving_list_vsc_op_cmpl);
  506. }
  507. if (st == BTM_CMD_STARTED) {
  508. btm_ble_enq_resolving_list_pending(p_dev_rec->bd_addr,
  509. BTM_BLE_META_READ_IRK_ENTRY);
  510. }
  511. return st;
  512. }
  513. /*******************************************************************************
  514. **
  515. ** Function btm_ble_suspend_resolving_list_activity
  516. **
  517. ** Description This function suspends all resolving list activity, including
  518. ** scan, initiating, and advertising, if resolving list is being
  519. ** enabled.
  520. **
  521. ** Parameters
  522. **
  523. ** Returns TRUE if suspended; FALSE otherwise
  524. **
  525. *******************************************************************************/
  526. BOOLEAN btm_ble_suspend_resolving_list_activity(void)
  527. {
  528. tBTM_BLE_CB *p_ble_cb = &btm_cb.ble_ctr_cb;
  529. /* if resolving list is not enabled, do not need to terminate any activity */
  530. /* if asking for stop all activity */
  531. /* if already suspended */
  532. if (p_ble_cb->suspended_rl_state != BTM_BLE_RL_IDLE) {
  533. return TRUE;
  534. }
  535. /* direct connection active, wait until it completed */
  536. if (btm_ble_get_conn_st() == BLE_DIR_CONN) {
  537. BTM_TRACE_ERROR("resolving list can not be edited, EnQ now");
  538. return FALSE;
  539. }
  540. p_ble_cb->suspended_rl_state = BTM_BLE_RL_IDLE;
  541. if (p_ble_cb->inq_var.adv_mode == BTM_BLE_ADV_ENABLE) {
  542. btm_ble_stop_adv();
  543. p_ble_cb->suspended_rl_state |= BTM_BLE_RL_ADV;
  544. }
  545. if (BTM_BLE_IS_SCAN_ACTIVE(p_ble_cb->scan_activity)) {
  546. btm_ble_stop_scan();
  547. p_ble_cb->suspended_rl_state |= BTM_BLE_RL_SCAN;
  548. }
  549. if (btm_ble_suspend_bg_conn()) {
  550. p_ble_cb->suspended_rl_state |= BTM_BLE_RL_INIT;
  551. }
  552. return TRUE;
  553. }
  554. /*******************************************************************************
  555. **
  556. ** Function btm_ble_resume_resolving_list_activity
  557. **
  558. ** Description This function resumes the resolving list activity, including
  559. ** scanning, initiating, and advertising, if any of these
  560. ** activities has been suspended earlier.
  561. **
  562. ** Returns none
  563. **
  564. *******************************************************************************/
  565. void btm_ble_resume_resolving_list_activity(void)
  566. {
  567. tBTM_BLE_CB *p_ble_cb = &btm_cb.ble_ctr_cb;
  568. if (p_ble_cb->suspended_rl_state & BTM_BLE_RL_ADV) {
  569. btm_ble_start_adv();
  570. }
  571. if (p_ble_cb->suspended_rl_state & BTM_BLE_RL_SCAN) {
  572. btm_ble_start_scan();
  573. }
  574. if (p_ble_cb->suspended_rl_state & BTM_BLE_RL_INIT) {
  575. btm_ble_resume_bg_conn();
  576. }
  577. p_ble_cb->suspended_rl_state = BTM_BLE_RL_IDLE;
  578. }
  579. /*******************************************************************************
  580. **
  581. ** Function btm_ble_vendor_enable_irk_feature
  582. **
  583. ** Description This function is called to enable or disable the RRA
  584. ** offloading feature.
  585. **
  586. ** Parameters enable: enable or disable the RRA offloading feature
  587. **
  588. ** Returns BTM_SUCCESS if successful
  589. **
  590. *******************************************************************************/
  591. tBTM_STATUS btm_ble_vendor_enable_irk_feature(BOOLEAN enable)
  592. {
  593. UINT8 param[20], *p;
  594. tBTM_STATUS st = BTM_MODE_UNSUPPORTED;
  595. p = param;
  596. memset(param, 0, 20);
  597. /* select feature based on control block settings */
  598. UINT8_TO_STREAM(p, BTM_BLE_META_IRK_ENABLE);
  599. UINT8_TO_STREAM(p, enable ? 0x01 : 0x00);
  600. st = BTM_VendorSpecificCommand (HCI_VENDOR_BLE_RPA_VSC, BTM_BLE_IRK_ENABLE_LEN,
  601. param, btm_ble_resolving_list_vsc_op_cmpl);
  602. return st;
  603. }
  604. /*******************************************************************************
  605. **
  606. ** Function btm_ble_exe_disable_resolving_list
  607. **
  608. ** Description execute resolving list disable
  609. **
  610. ** Returns none
  611. **
  612. *******************************************************************************/
  613. BOOLEAN btm_ble_exe_disable_resolving_list(void)
  614. {
  615. if (!btm_ble_suspend_resolving_list_activity()) {
  616. return FALSE;
  617. }
  618. if (!controller_get_interface()->supports_ble_privacy()) {
  619. btm_ble_vendor_enable_irk_feature(FALSE);
  620. } else {
  621. //btsnd_hcic_ble_set_addr_resolution_enable(FALSE);
  622. }
  623. return TRUE;
  624. }
  625. /*******************************************************************************
  626. **
  627. ** Function btm_ble_exe_enable_resolving_list
  628. **
  629. ** Description enable LE resolve address list
  630. **
  631. ** Returns none
  632. **
  633. *******************************************************************************/
  634. void btm_ble_exe_enable_resolving_list(void)
  635. {
  636. if (!btm_ble_suspend_resolving_list_activity()) {
  637. return;
  638. }
  639. if (!controller_get_interface()->supports_ble_privacy()) {
  640. btm_ble_vendor_enable_irk_feature(TRUE);
  641. } else {
  642. //btsnd_hcic_ble_set_addr_resolution_enable(TRUE);
  643. }
  644. }
  645. /*******************************************************************************
  646. **
  647. ** Function btm_ble_disable_resolving_list
  648. **
  649. ** Description Disable LE Address resolution
  650. **
  651. ** Returns none
  652. **
  653. *******************************************************************************/
  654. BOOLEAN btm_ble_disable_resolving_list(UINT8 rl_mask, BOOLEAN to_resume )
  655. {
  656. UINT8 rl_state = btm_cb.ble_ctr_cb.rl_state;
  657. /* if controller does not support RPA offloading or privacy 1.2, skip */
  658. if (controller_get_interface()->get_ble_resolving_list_max_size() == 0) {
  659. return FALSE;
  660. }
  661. btm_cb.ble_ctr_cb.rl_state &= ~rl_mask;
  662. if (rl_state != BTM_BLE_RL_IDLE && btm_cb.ble_ctr_cb.rl_state == BTM_BLE_RL_IDLE) {
  663. if (btm_ble_exe_disable_resolving_list()) {
  664. if (to_resume) {
  665. btm_ble_resume_resolving_list_activity();
  666. }
  667. return TRUE;
  668. } else {
  669. return FALSE;
  670. }
  671. }
  672. return TRUE;
  673. }
  674. /*******************************************************************************
  675. **
  676. ** Function btm_ble_resolving_list_load_dev
  677. **
  678. ** Description This function add a device which is using RPA into white list
  679. **
  680. ** Parameters pointer to device security record
  681. **
  682. ** Returns TRUE if device added, otherwise falase.
  683. **
  684. *******************************************************************************/
  685. BOOLEAN btm_ble_resolving_list_load_dev(tBTM_SEC_DEV_REC *p_dev_rec)
  686. {
  687. BOOLEAN rt = FALSE;
  688. #if (SMP_INCLUDED == TRUE)
  689. UINT8 rl_mask = btm_cb.ble_ctr_cb.rl_state;
  690. BTM_TRACE_DEBUG("%s btm_cb.ble_ctr_cb.privacy_mode = %d\n", __func__,
  691. btm_cb.ble_ctr_cb.privacy_mode);
  692. /* if controller does not support RPA offloading or privacy 1.2, skip */
  693. if (controller_get_interface()->get_ble_resolving_list_max_size() == 0) {
  694. return FALSE;
  695. }
  696. BTM_TRACE_DEBUG("%s btm_cb.ble_ctr_cb.privacy_mode = %d\n",
  697. __func__, btm_cb.ble_ctr_cb.privacy_mode);
  698. /* only add RPA enabled device into resolving list */
  699. if (p_dev_rec != NULL && /* RPA is being used and PID is known */
  700. (p_dev_rec->sec_flags & BTM_SEC_IN_USE) != 0 &&
  701. ((p_dev_rec->ble.key_type & BTM_LE_KEY_PID) != 0 ||
  702. (p_dev_rec->ble.key_type & BTM_LE_KEY_LID) != 0)) {
  703. if (!(p_dev_rec->ble.in_controller_list & BTM_RESOLVING_LIST_BIT) &&
  704. btm_ble_brcm_find_resolving_pending_entry(p_dev_rec->bd_addr,
  705. BTM_BLE_META_ADD_IRK_ENTRY) == FALSE) {
  706. if (btm_cb.ble_ctr_cb.resolving_list_avail_size > 0) {
  707. if (rl_mask) {
  708. if (!btm_ble_disable_resolving_list (rl_mask, FALSE)) {
  709. return FALSE;
  710. }
  711. }
  712. btm_ble_update_resolving_list(p_dev_rec->bd_addr, TRUE);
  713. if (controller_get_interface()->supports_ble_privacy()) {
  714. BD_ADDR dummy_bda = {0};
  715. if (memcmp(p_dev_rec->ble.static_addr, dummy_bda, BD_ADDR_LEN) == 0) {
  716. memcpy(p_dev_rec->ble.static_addr, p_dev_rec->bd_addr, BD_ADDR_LEN);
  717. p_dev_rec->ble.static_addr_type = p_dev_rec->ble.ble_addr_type;
  718. }
  719. #if CONTROLLER_RPA_LIST_ENABLE
  720. BTM_TRACE_DEBUG("%s:adding device to controller resolving list\n", __func__);
  721. UINT8 *peer_irk = p_dev_rec->ble.keys.irk;
  722. UINT8 *local_irk = btm_cb.devcb.id_keys.irk;
  723. //use identical IRK for now
  724. rt = btsnd_hcic_ble_add_device_resolving_list(p_dev_rec->ble.static_addr_type,
  725. p_dev_rec->ble.static_addr, peer_irk, local_irk);
  726. #else
  727. // do nothing
  728. /* It will cause that scanner doesn't send scan request to advertiser
  729. * which has sent IRK to us and we have stored the IRK in controller.
  730. * It is a hardware limitation. The preliminary solution is not to
  731. * send key to the controller, but to resolve the random address in host. */
  732. #endif
  733. } else {
  734. UINT8 param[40] = {0};
  735. UINT8 *p = param;
  736. UINT8_TO_STREAM(p, BTM_BLE_META_ADD_IRK_ENTRY);
  737. ARRAY_TO_STREAM(p, p_dev_rec->ble.keys.irk, BT_OCTET16_LEN);
  738. UINT8_TO_STREAM(p, p_dev_rec->ble.static_addr_type);
  739. BDADDR_TO_STREAM(p, p_dev_rec->ble.static_addr);
  740. if (BTM_VendorSpecificCommand (HCI_VENDOR_BLE_RPA_VSC,
  741. BTM_BLE_META_ADD_IRK_LEN,
  742. param,
  743. btm_ble_resolving_list_vsc_op_cmpl)
  744. == BTM_CMD_STARTED) {
  745. rt = TRUE;
  746. }
  747. }
  748. if (rt) {
  749. btm_ble_enq_resolving_list_pending(p_dev_rec->bd_addr,
  750. BTM_BLE_META_ADD_IRK_ENTRY);
  751. }
  752. /* if resolving list has been turned on, re-enable it */
  753. // if (rl_mask) {
  754. // btm_ble_enable_resolving_list(rl_mask);
  755. // } else {
  756. // btm_ble_enable_resolving_list(BTM_BLE_RL_INIT);
  757. // }
  758. } else {
  759. BTM_TRACE_WARNING("%s Resolving list full ", __func__);
  760. }
  761. } else {
  762. BTM_TRACE_DEBUG("Device already in Resolving list\n");
  763. rt = TRUE;
  764. }
  765. } else {
  766. BTM_TRACE_DEBUG("Device not a RPA enabled device\n");
  767. }
  768. #endif ///SMP_INCLUDED == TRUE
  769. return rt;
  770. }
  771. /*******************************************************************************
  772. **
  773. ** Function btm_ble_resolving_list_remove_dev
  774. **
  775. ** Description This function removes the device from resolving list
  776. **
  777. ** Parameters
  778. **
  779. ** Returns status
  780. **
  781. *******************************************************************************/
  782. void btm_ble_resolving_list_remove_dev(tBTM_SEC_DEV_REC *p_dev_rec)
  783. {
  784. UINT8 rl_mask = btm_cb.ble_ctr_cb.rl_state;
  785. BTM_TRACE_EVENT ("%s\n", __func__);
  786. if (rl_mask) {
  787. if (!btm_ble_disable_resolving_list (rl_mask, FALSE)) {
  788. return;
  789. }
  790. }
  791. if ((p_dev_rec->ble.in_controller_list & BTM_RESOLVING_LIST_BIT) &&
  792. btm_ble_brcm_find_resolving_pending_entry(p_dev_rec->bd_addr,
  793. BTM_BLE_META_REMOVE_IRK_ENTRY) == FALSE) {
  794. btm_ble_update_resolving_list( p_dev_rec->bd_addr, FALSE);
  795. btm_ble_remove_resolving_list_entry(p_dev_rec);
  796. } else {
  797. BTM_TRACE_DEBUG("Device not in resolving list\n");
  798. }
  799. /* if resolving list has been turned on, re-enable it */
  800. // if (rl_mask) {
  801. // btm_ble_enable_resolving_list(rl_mask);
  802. // }
  803. }
  804. /*******************************************************************************
  805. **
  806. ** Function btm_ble_enable_resolving_list
  807. **
  808. ** Description enable LE resolve address list
  809. **
  810. ** Returns none
  811. **
  812. *******************************************************************************/
  813. void btm_ble_enable_resolving_list(UINT8 rl_mask)
  814. {
  815. UINT8 rl_state = btm_cb.ble_ctr_cb.rl_state;
  816. btm_cb.ble_ctr_cb.rl_state |= rl_mask;
  817. if (rl_state == BTM_BLE_RL_IDLE &&
  818. btm_cb.ble_ctr_cb.rl_state != BTM_BLE_RL_IDLE &&
  819. controller_get_interface()->get_ble_resolving_list_max_size() != 0) {
  820. btm_ble_exe_enable_resolving_list();
  821. btm_ble_resume_resolving_list_activity();
  822. }
  823. }
  824. #if 0 //Unused
  825. /*******************************************************************************
  826. **
  827. ** Function btm_ble_resolving_list_empty
  828. **
  829. ** Description check to see if resoving list is empty or not
  830. **
  831. ** Returns TRUE: empty; FALSE non-empty
  832. **
  833. *******************************************************************************/
  834. BOOLEAN btm_ble_resolving_list_empty(void)
  835. {
  836. return (controller_get_interface()->get_ble_resolving_list_max_size() ==
  837. btm_cb.ble_ctr_cb.resolving_list_avail_size);
  838. }
  839. #endif
  840. /*******************************************************************************
  841. **
  842. ** Function btm_ble_enable_resolving_list_for_platform
  843. **
  844. ** Description enable/disable resolving list feature depending on if any
  845. ** resolving list is empty and whitelist is involoved in the
  846. ** operation.
  847. **
  848. ** Returns none
  849. **
  850. *******************************************************************************/
  851. void btm_ble_enable_resolving_list_for_platform (UINT8 rl_mask)
  852. {
  853. /* if controller does not support, skip */
  854. if (controller_get_interface()->get_ble_resolving_list_max_size() == 0) {
  855. return;
  856. }
  857. if (btm_cb.ble_ctr_cb.wl_state == BTM_BLE_WL_IDLE) {
  858. if (controller_get_interface()->get_ble_resolving_list_max_size() >
  859. btm_cb.ble_ctr_cb.resolving_list_avail_size) {
  860. btm_ble_enable_resolving_list(rl_mask);
  861. } else {
  862. btm_ble_disable_resolving_list(rl_mask, TRUE);
  863. }
  864. return;
  865. }
  866. tBTM_SEC_DEV_REC *p_dev = NULL;
  867. list_node_t *p_node = NULL;
  868. for (p_node = list_begin(btm_cb.p_sec_dev_rec_list); p_node; p_node = list_next(p_node)) {
  869. p_dev = list_node(p_node);
  870. if ((p_dev->ble.in_controller_list & BTM_RESOLVING_LIST_BIT) &&
  871. (p_dev->ble.in_controller_list & BTM_WHITE_LIST_BIT)) {
  872. btm_ble_enable_resolving_list(rl_mask);
  873. return;
  874. }
  875. }
  876. btm_ble_disable_resolving_list(rl_mask, TRUE);
  877. }
  878. /*******************************************************************************
  879. **
  880. ** Function btm_ble_resolving_list_init
  881. **
  882. ** Description Initialize resolving list in host stack
  883. **
  884. ** Parameters Max resolving list size
  885. **
  886. ** Returns void
  887. **
  888. *******************************************************************************/
  889. void btm_ble_resolving_list_init(UINT8 max_irk_list_sz)
  890. {
  891. tBTM_BLE_RESOLVE_Q *p_q = &btm_cb.ble_ctr_cb.resolving_list_pend_q;
  892. UINT8 irk_mask_size = (max_irk_list_sz % 8) ?
  893. (max_irk_list_sz / 8 + 1) : (max_irk_list_sz / 8);
  894. if (max_irk_list_sz > 0) {
  895. p_q->resolve_q_random_pseudo = (BD_ADDR *)osi_malloc(sizeof(BD_ADDR) * max_irk_list_sz);
  896. p_q->resolve_q_action = (UINT8 *)osi_malloc(max_irk_list_sz);
  897. /* RPA offloading feature */
  898. if (btm_cb.ble_ctr_cb.irk_list_mask == NULL) {
  899. btm_cb.ble_ctr_cb.irk_list_mask = (UINT8 *)osi_malloc(irk_mask_size);
  900. }
  901. BTM_TRACE_DEBUG ("%s max_irk_list_sz = %d", __func__, max_irk_list_sz);
  902. }
  903. controller_get_interface()->set_ble_resolving_list_max_size(max_irk_list_sz);
  904. btm_ble_clear_resolving_list();
  905. btm_cb.ble_ctr_cb.resolving_list_avail_size = max_irk_list_sz;
  906. }
  907. /*******************************************************************************
  908. **
  909. ** Function btm_ble_resolving_list_cleanup
  910. **
  911. ** Description Cleanup resolving list dynamic memory
  912. **
  913. ** Parameters
  914. **
  915. ** Returns void
  916. **
  917. *******************************************************************************/
  918. void btm_ble_resolving_list_cleanup(void)
  919. {
  920. tBTM_BLE_RESOLVE_Q *p_q = &btm_cb.ble_ctr_cb.resolving_list_pend_q;
  921. if (p_q->resolve_q_random_pseudo) {
  922. osi_free(p_q->resolve_q_random_pseudo);
  923. p_q->resolve_q_random_pseudo = NULL;
  924. }
  925. if (p_q->resolve_q_action) {
  926. osi_free(p_q->resolve_q_action);
  927. p_q->resolve_q_action = NULL;
  928. }
  929. controller_get_interface()->set_ble_resolving_list_max_size(0);
  930. if (btm_cb.ble_ctr_cb.irk_list_mask) {
  931. osi_free(btm_cb.ble_ctr_cb.irk_list_mask);
  932. btm_cb.ble_ctr_cb.irk_list_mask = NULL;
  933. }
  934. }
  935. void btm_ble_add_default_entry_to_resolving_list(void)
  936. {
  937. /*
  938. * Add local IRK entry with 00:00:00:00:00:00 address. This entry will
  939. * be used to generate RPA for non-directed advertising if own_addr_type
  940. * is set to rpa_pub since we use all-zero address as peer addres in
  941. * such case. Peer IRK should be left all-zero since this is not for an
  942. * actual peer.
  943. */
  944. BD_ADDR peer_addr = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
  945. BT_OCTET16 peer_irk = {0x0};
  946. btsnd_hcic_ble_add_device_resolving_list (BLE_ADDR_PUBLIC, peer_addr, peer_irk, btm_cb.devcb.id_keys.irk);
  947. }
  948. #endif