btif/src/btif_dm.c

   1 /******************************************************************************
   2  *
   3  *  Copyright (C) 2009-2012 Broadcom Corporation
   4  *
   5  *  Licensed under the Apache License, Version 2.0 (the "License");
   6  *  you may not use this file except in compliance with the License.
   7  *  You may obtain a copy of the License at:
   8  *
   9  *  http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  *  Unless required by applicable law or agreed to in writing, software
  12  *  distributed under the License is distributed on an "AS IS" BASIS,
  13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  *  See the License for the specific language governing permissions and
  15  *  limitations under the License.
  16  *
  17  ******************************************************************************/
  18
  19 /************************************************************************************
  20  *
  21  *  Filename:      btif_dm.c
  22  *
  23  *  Description:   Contains Device Management (DM) related functionality
  24  *
  25  *
  26  ***********************************************************************************/
  27
  28 #define LOG_TAG "bt_btif_dm"
  29
  30 #include "btif_dm.h"
  31
  32 #include <assert.h>
  33 #include <pthread.h>
  34 #include <signal.h>
  35 #include <stdio.h>
  36 #include <stdlib.h>
  37 #include <string.h>
  38 #include <sys/types.h>
  39 #include <time.h>
  40 #include <unistd.h>
  41
  42 #include <hardware/bluetooth.h>
  43
  44 #include "bdaddr.h"
  45 #include "bta_gatt_api.h"
  46 #include "btif_api.h"
  47 #include "btif_config.h"
  48 #include "btif_hh.h"
  49 #include "btif_sdp.h"
  50 #include "btif_storage.h"
  51 #include "btif_util.h"
  52 #include "btu.h"
  53 #include "bt_common.h"
  54 #include "bta_gatt_api.h"
  55 #include "device/include/interop.h"
  56 #include "include/stack_config.h"
  57 #include "osi/include/allocator.h"
  58 #include "osi/include/log.h"
  59 #include "osi/include/metrics.h"
  60 #include "osi/include/properties.h"
  61 #include "stack_config.h"
  62 #include "stack/btm/btm_int.h"
  63
  64 /******************************************************************************
  65 **  Constants & Macros
  66 ******************************************************************************/
  67
  68 #define COD_MASK                            0x07FF
  69
  70 #define COD_UNCLASSIFIED ((0x1F) << 8)
  71 #define COD_HID_KEYBOARD                    0x0540
  72 #define COD_HID_POINTING                    0x0580
  73 #define COD_HID_COMBO                       0x05C0
  74 #define COD_HID_MAJOR                       0x0500
  75 #define COD_HID_MASK                        0x0700
  76 #define COD_AV_HEADSETS                     0x0404
  77 #define COD_AV_HANDSFREE                    0x0408
  78 #define COD_AV_HEADPHONES                   0x0418
  79 #define COD_AV_PORTABLE_AUDIO               0x041C
  80 #define COD_AV_HIFI_AUDIO                   0x0428
  81
  82 #define BTIF_DM_DEFAULT_INQ_MAX_RESULTS     0
  83 #define BTIF_DM_DEFAULT_INQ_MAX_DURATION    10
  84 #define BTIF_DM_MAX_SDP_ATTEMPTS_AFTER_PAIRING 2
  85
  86 #define NUM_TIMEOUT_RETRIES                 5
  87
  88 #define PROPERTY_PRODUCT_MODEL "ro.product.model"
  89 #define DEFAULT_LOCAL_NAME_MAX  31
  90 #if (DEFAULT_LOCAL_NAME_MAX > BTM_MAX_LOC_BD_NAME_LEN)
  91     #error "default btif local name size exceeds stack supported length"
  92 #endif
  93
  94 #if (defined(BTA_HOST_INTERLEAVE_SEARCH) && BTA_HOST_INTERLEAVE_SEARCH == TRUE)
  95 #define BTIF_DM_INTERLEAVE_DURATION_BR_ONE    2
  96 #define BTIF_DM_INTERLEAVE_DURATION_LE_ONE    2
  97 #define BTIF_DM_INTERLEAVE_DURATION_BR_TWO    3
  98 #define BTIF_DM_INTERLEAVE_DURATION_LE_TWO    4
  99 #endif
 100
 101 #define ENCRYPTED_BREDR       2
 102 #define ENCRYPTED_LE          4
 103
 104 typedef struct
 105 {
 106     bt_bond_state_t state;
 107     bt_bdaddr_t static_bdaddr;
 108     BD_ADDR bd_addr;
 109     tBTM_BOND_TYPE bond_type;
 110     UINT8 pin_code_len;
 111     UINT8 is_ssp;
 112     UINT8 auth_req;
 113     UINT8 io_cap;
 114     UINT8 autopair_attempts;
 115     UINT8 timeout_retries;
 116     UINT8 is_local_initiated;
 117     UINT8 sdp_attempts;
 118 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
 119     BOOLEAN is_le_only;
 120     BOOLEAN is_le_nc; /* LE Numeric comparison */
 121     btif_dm_ble_cb_t ble;
 122 #endif
 123 } btif_dm_pairing_cb_t;
 124
 125 typedef struct
 126 {
 127     UINT8       ir[BT_OCTET16_LEN];
 128     UINT8       irk[BT_OCTET16_LEN];
 129     UINT8       dhk[BT_OCTET16_LEN];
 130 }btif_dm_local_key_id_t;
 131
 132 typedef struct
 133 {
 134     BOOLEAN                 is_er_rcvd;
 135     UINT8                   er[BT_OCTET16_LEN];
 136     BOOLEAN                 is_id_keys_rcvd;
 137     btif_dm_local_key_id_t  id_keys;  /* ID kyes */
 138
 139 }btif_dm_local_key_cb_t;
 140
 141 typedef struct
 142 {
 143     BD_ADDR bd_addr;
 144     BD_NAME bd_name;
 145 } btif_dm_remote_name_t;
 146
 147 /* this structure holds optional OOB data for remote device */
 148 typedef struct
 149 {
 150     BD_ADDR  bdaddr;    /* peer bdaddr */
 151     bt_out_of_band_data_t oob_data;
 152 } btif_dm_oob_cb_t;
 153
 154 typedef struct
 155 {
 156     bt_bdaddr_t  bdaddr;
 157     UINT8        transport; /* 0=Unknown, 1=BR/EDR, 2=LE */
 158 } btif_dm_create_bond_cb_t;
 159
 160 typedef struct
 161 {
 162     uint8_t  status;
 163     uint8_t  ctrl_state;
 164     uint64_t tx_time;
 165     uint64_t rx_time;
 166     uint64_t idle_time;
 167     uint64_t energy_used;
 168 } btif_activity_energy_info_cb_t;
 169
 170 typedef struct
 171 {
 172     unsigned int   manufact_id;
 173 }skip_sdp_entry_t;
 174
 175 typedef enum
 176 {
 177     BTIF_DM_FUNC_CREATE_BOND,
 178     BTIF_DM_FUNC_CANCEL_BOND,
 179     BTIF_DM_FUNC_REMOVE_BOND,
 180     BTIF_DM_FUNC_BOND_STATE_CHANGED,
 181 } bt_bond_function_t;
 182
 183 typedef struct
 184 {
 185     bt_bdaddr_t bd_addr;
 186     bt_bond_function_t function;
 187     bt_bond_state_t state;
 188     struct timespec timestamp;
 189 } btif_bond_event_t;
 190
 191 #define BTA_SERVICE_ID_TO_SERVICE_MASK(id)       (1 << (id))
 192
 193 #define UUID_HUMAN_INTERFACE_DEVICE "00001124-0000-1000-8000-00805f9b34fb"
 194
 195 #define MAX_BTIF_BOND_EVENT_ENTRIES 15
 196
 197 static skip_sdp_entry_t sdp_blacklist[] = {{76}}; //Apple Mouse and Keyboard
 198
 199 /* This flag will be true if HCI_Inquiry is in progress */
 200 static BOOLEAN btif_dm_inquiry_in_progress = FALSE;
 201
 202 /************************************************************************************
 203 **  Static variables
 204 ************************************************************************************/
 205 static char btif_default_local_name[DEFAULT_LOCAL_NAME_MAX+1] = {'\0'};
 206 static uid_set_t* uid_set = NULL;
 207
 208 /* A circular array to keep track of the most recent bond events */
 209 static btif_bond_event_t btif_dm_bond_events[MAX_BTIF_BOND_EVENT_ENTRIES + 1];
 210
 211 static pthread_mutex_t bond_event_lock;
 212
 213 /* |btif_num_bond_events| keeps track of the total number of events and can be
 214    greater than |MAX_BTIF_BOND_EVENT_ENTRIES| */
 215 static size_t btif_num_bond_events = 0;
 216 static size_t btif_events_start_index = 0;
 217 static size_t btif_events_end_index = 0;
 218
 219 /******************************************************************************
 220 **  Static functions
 221 ******************************************************************************/
 222 static btif_dm_pairing_cb_t pairing_cb;
 223 static btif_dm_oob_cb_t     oob_cb;
 224 static void btif_dm_generic_evt(UINT16 event, char* p_param);
 225 static void btif_dm_cb_create_bond(bt_bdaddr_t *bd_addr, tBTA_TRANSPORT transport);
 226 static void btif_dm_cb_hid_remote_name(tBTM_REMOTE_DEV_NAME *p_remote_name);
 227 static void btif_update_remote_properties(BD_ADDR bd_addr, BD_NAME bd_name,
 228                                           DEV_CLASS dev_class, tBT_DEVICE_TYPE dev_type);
 229 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
 230 static btif_dm_local_key_cb_t ble_local_key_cb;
 231 static void btif_dm_ble_key_notif_evt(tBTA_DM_SP_KEY_NOTIF *p_ssp_key_notif);
 232 static void btif_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl);
 233 static void btif_dm_ble_passkey_req_evt(tBTA_DM_PIN_REQ *p_pin_req);
 234 static void btif_dm_ble_key_nc_req_evt(tBTA_DM_SP_KEY_NOTIF *p_notif_req) ;
 235 static void btif_dm_ble_oob_req_evt(tBTA_DM_SP_RMT_OOB *req_oob_type);
 236 static void btif_dm_ble_sc_oob_req_evt(tBTA_DM_SP_RMT_OOB *req_oob_type);
 237 #endif
 238
 239 static void bte_scan_filt_param_cfg_evt(UINT8 action_type,
 240                                            tBTA_DM_BLE_PF_AVBL_SPACE avbl_space,
 241                                            tBTA_DM_BLE_REF_VALUE ref_value,
 242                                            tBTA_STATUS status);
 243
 244 static char* btif_get_default_local_name();
 245
 246 static void btif_stats_add_bond_event(const bt_bdaddr_t *bd_addr,
 247                                       bt_bond_function_t function,
 248                                       bt_bond_state_t state);
 249
 250 /******************************************************************************
 251 **  Externs
 252 ******************************************************************************/
 253 extern UINT16 bta_service_id_to_uuid_lkup_tbl [BTA_MAX_SERVICE_ID];
 254 extern bt_status_t btif_hf_execute_service(BOOLEAN b_enable);
 255 extern bt_status_t btif_av_execute_service(BOOLEAN b_enable);
 256 extern bt_status_t btif_av_sink_execute_service(BOOLEAN b_enable);
 257 extern bt_status_t btif_hh_execute_service(BOOLEAN b_enable);
 258 extern bt_status_t btif_hf_client_execute_service(BOOLEAN b_enable);
 259 extern bt_status_t btif_sdp_execute_service(BOOLEAN b_enable);
 260 extern int btif_hh_connect(bt_bdaddr_t *bd_addr);
 261 extern void bta_gatt_convert_uuid16_to_uuid128(UINT8 uuid_128[LEN_UUID_128], UINT16 uuid_16);
 262
 263 /******************************************************************************
 264 **  Functions
 265 ******************************************************************************/
 266
 267 static bool is_empty_128bit(uint8_t *data)
 268 {
 269     static const uint8_t zero[16] = { 0 };
 270     return !memcmp(zero, data, sizeof(zero));
 271 }
 272
 273 static void btif_dm_data_copy(uint16_t event, char *dst, char *src)
 274 {
 275     tBTA_DM_SEC *dst_dm_sec = (tBTA_DM_SEC*)dst;
 276     tBTA_DM_SEC *src_dm_sec = (tBTA_DM_SEC*)src;
 277
 278     if (!src_dm_sec)
 279         return;
 280
 281     assert(dst_dm_sec);
 282     maybe_non_aligned_memcpy(dst_dm_sec, src_dm_sec, sizeof(*src_dm_sec));
 283
 284     if (event == BTA_DM_BLE_KEY_EVT)
 285     {
 286         dst_dm_sec->ble_key.p_key_value = osi_malloc(sizeof(tBTM_LE_KEY_VALUE));
 287         assert(src_dm_sec->ble_key.p_key_value);
 288         memcpy(dst_dm_sec->ble_key.p_key_value, src_dm_sec->ble_key.p_key_value, sizeof(tBTM_LE_KEY_VALUE));
 289     }
 290 }
 291
 292 static void btif_dm_data_free(uint16_t event, tBTA_DM_SEC *dm_sec)
 293 {
 294     if (event == BTA_DM_BLE_KEY_EVT)
 295         osi_free_and_reset((void **)&dm_sec->ble_key.p_key_value);
 296 }
 297
 298 void btif_dm_init(uid_set_t* set)
 299 {
 300     uid_set = set;
 301     pthread_mutex_init(&bond_event_lock, NULL);
 302 }
 303
 304 void btif_dm_cleanup(void)
 305 {
 306     if (uid_set) {
 307         uid_set_destroy(uid_set);
 308         uid_set = NULL;
 309     }
 310     pthread_mutex_destroy(&bond_event_lock);
 311 }
 312
 313 bt_status_t btif_in_execute_service_request(tBTA_SERVICE_ID service_id,
 314                                                 BOOLEAN b_enable)
 315 {
 316     BTIF_TRACE_DEBUG("%s service_id: %d", __FUNCTION__, service_id);
 317     /* Check the service_ID and invoke the profile's BT state changed API */
 318     switch (service_id)
 319     {
 320          case BTA_HFP_SERVICE_ID:
 321          case BTA_HSP_SERVICE_ID:
 322          {
 323               btif_hf_execute_service(b_enable);
 324          }break;
 325          case BTA_A2DP_SOURCE_SERVICE_ID:
 326          {
 327               btif_av_execute_service(b_enable);
 328          }break;
 329          case BTA_A2DP_SINK_SERVICE_ID:
 330          {
 331             btif_av_sink_execute_service(b_enable);
 332          }break;
 333          case BTA_HID_SERVICE_ID:
 334          {
 335               btif_hh_execute_service(b_enable);
 336          }break;
 337          case BTA_HFP_HS_SERVICE_ID:
 338          {
 339              btif_hf_client_execute_service(b_enable);
 340          }break;
 341          case BTA_SDP_SERVICE_ID:
 342          {
 343              btif_sdp_execute_service(b_enable);
 344          }break;
 345          default:
 346            BTIF_TRACE_ERROR("%s: Unknown service %d being %s",
 347                             __func__, service_id,
 348                             (b_enable) ? "enabled" : "disabled");
 349               return BT_STATUS_FAIL;
 350     }
 351     return BT_STATUS_SUCCESS;
 352 }
 353
 354 /*******************************************************************************
 355 **
 356 ** Function         check_eir_remote_name
 357 **
 358 ** Description      Check if remote name is in the EIR data
 359 **
 360 ** Returns          TRUE if remote name found
 361 **                  Populate p_remote_name, if provided and remote name found
 362 **
 363 *******************************************************************************/
 364 static BOOLEAN check_eir_remote_name(tBTA_DM_SEARCH *p_search_data,
 365                             UINT8 *p_remote_name, UINT8 *p_remote_name_len)
 366 {
 367     UINT8 *p_eir_remote_name = NULL;
 368     UINT8 remote_name_len = 0;
 369
 370     /* Check EIR for remote name and services */
 371     if (p_search_data->inq_res.p_eir)
 372     {
 373         p_eir_remote_name = BTM_CheckEirData(p_search_data->inq_res.p_eir,
 374                 BTM_EIR_COMPLETE_LOCAL_NAME_TYPE, &remote_name_len);
 375         if (!p_eir_remote_name)
 376         {
 377             p_eir_remote_name = BTM_CheckEirData(p_search_data->inq_res.p_eir,
 378                     BTM_EIR_SHORTENED_LOCAL_NAME_TYPE, &remote_name_len);
 379         }
 380
 381         if (p_eir_remote_name)
 382         {
 383             if (remote_name_len > BD_NAME_LEN)
 384                 remote_name_len = BD_NAME_LEN;
 385
 386             if (p_remote_name && p_remote_name_len)
 387             {
 388                 memcpy(p_remote_name, p_eir_remote_name, remote_name_len);
 389                 *(p_remote_name + remote_name_len) = 0;
 390                 *p_remote_name_len = remote_name_len;
 391             }
 392
 393             return TRUE;
 394         }
 395     }
 396
 397     return FALSE;
 398
 399 }
 400
 401 /*******************************************************************************
 402 **
 403 ** Function         check_cached_remote_name
 404 **
 405 ** Description      Check if remote name is in the NVRAM cache
 406 **
 407 ** Returns          TRUE if remote name found
 408 **                  Populate p_remote_name, if provided and remote name found
 409 **
 410 *******************************************************************************/
 411 static BOOLEAN check_cached_remote_name(tBTA_DM_SEARCH *p_search_data,
 412                                 UINT8 *p_remote_name, UINT8 *p_remote_name_len)
 413 {
 414     bt_bdname_t bdname;
 415     bt_bdaddr_t remote_bdaddr;
 416     bt_property_t prop_name;
 417
 418     /* check if we already have it in our btif_storage cache */
 419     bdcpy(remote_bdaddr.address, p_search_data->inq_res.bd_addr);
 420     BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_BDNAME,
 421                                sizeof(bt_bdname_t), &bdname);
 422     if (btif_storage_get_remote_device_property(
 423         &remote_bdaddr, &prop_name) == BT_STATUS_SUCCESS)
 424     {
 425         if (p_remote_name && p_remote_name_len)
 426         {
 427             strcpy((char *)p_remote_name, (char *)bdname.name);
 428             *p_remote_name_len = strlen((char *)p_remote_name);
 429         }
 430         return TRUE;
 431     }
 432
 433     return FALSE;
 434 }
 435
 436 static uint32_t get_cod(const bt_bdaddr_t *remote_bdaddr) {
 437     uint32_t    remote_cod;
 438     bt_property_t prop_name;
 439
 440     /* check if we already have it in our btif_storage cache */
 441     BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_CLASS_OF_DEVICE,
 442                                sizeof(uint32_t), &remote_cod);
 443     if (btif_storage_get_remote_device_property((bt_bdaddr_t *)remote_bdaddr, &prop_name) == BT_STATUS_SUCCESS)
 444     {
 445         LOG_INFO(LOG_TAG, "%s remote_cod = 0x%08x", __func__, remote_cod);
 446         return remote_cod & COD_MASK;
 447     }
 448
 449     return 0;
 450 }
 451
 452 BOOLEAN check_cod(const bt_bdaddr_t *remote_bdaddr, uint32_t cod)
 453 {
 454     return get_cod(remote_bdaddr) == cod;
 455 }
 456
 457 BOOLEAN check_cod_hid(const bt_bdaddr_t *remote_bdaddr)
 458 {
 459     return (get_cod(remote_bdaddr) & COD_HID_MASK) == COD_HID_MAJOR;
 460 }
 461
 462 BOOLEAN check_hid_le(const bt_bdaddr_t *remote_bdaddr)
 463 {
 464     uint32_t    remote_dev_type;
 465     bt_property_t prop_name;
 466
 467     /* check if we already have it in our btif_storage cache */
 468     BTIF_STORAGE_FILL_PROPERTY(&prop_name,BT_PROPERTY_TYPE_OF_DEVICE,
 469                                sizeof(uint32_t), &remote_dev_type);
 470     if (btif_storage_get_remote_device_property((bt_bdaddr_t *)remote_bdaddr,
 471                                 &prop_name) == BT_STATUS_SUCCESS)
 472     {
 473         if (remote_dev_type == BT_DEVICE_DEVTYPE_BLE)
 474         {
 475             bdstr_t bdstr;
 476             bdaddr_to_string(remote_bdaddr, bdstr, sizeof(bdstr));
 477             if(btif_config_exist(bdstr, "HidAppId"))
 478                 return TRUE;
 479         }
 480     }
 481     return FALSE;
 482 }
 483
 484 /*****************************************************************************
 485 **
 486 ** Function        check_sdp_bl
 487 **
 488 ** Description     Checks if a given device is blacklisted to skip sdp
 489 **
 490 ** Parameters     skip_sdp_entry
 491 **
 492 ** Returns         TRUE if the device is present in blacklist, else FALSE
 493 **
 494 *******************************************************************************/
 495 BOOLEAN check_sdp_bl(const bt_bdaddr_t *remote_bdaddr)
 496 {
 497     UINT16 manufacturer = 0;
 498     UINT8 lmp_ver = 0;
 499     UINT16 lmp_subver = 0;
 500     bt_property_t prop_name;
 501     bt_remote_version_t info;
 502
 503     if (remote_bdaddr == NULL)
 504         return FALSE;
 505
 506 /* fetch additional info about remote device used in iop query */
 507     BTM_ReadRemoteVersion(*(BD_ADDR*)remote_bdaddr, &lmp_ver,
 508                     &manufacturer, &lmp_subver);
 509
 510  /* if not available yet, try fetching from config database */
 511     BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_REMOTE_VERSION_INFO,
 512                             sizeof(bt_remote_version_t), &info);
 513
 514     if (btif_storage_get_remote_device_property((bt_bdaddr_t *)remote_bdaddr,
 515                                               &prop_name) != BT_STATUS_SUCCESS)
 516     {
 517
 518         return FALSE;
 519     }
 520     manufacturer = info.manufacturer;
 521
 522     for (unsigned int i = 0; i < ARRAY_SIZE(sdp_blacklist); i++)
 523     {
 524         if (manufacturer == sdp_blacklist[i].manufact_id)
 525             return TRUE;
 526     }
 527     return FALSE;
 528 }
 529
 530 static void bond_state_changed(bt_status_t status, bt_bdaddr_t *bd_addr, bt_bond_state_t state)
 531 {
 532
 533     btif_stats_add_bond_event(bd_addr, BTIF_DM_FUNC_BOND_STATE_CHANGED, state);
 534
 535     // Send bonding state only once - based on outgoing/incoming we may receive duplicates
 536     if ((pairing_cb.state == state) && (state == BT_BOND_STATE_BONDING))
 537     {
 538         // Cross key pairing so send callback for static address
 539         if (!bdaddr_is_empty(&pairing_cb.static_bdaddr))
 540         {
 541             HAL_CBACK(bt_hal_cbacks, bond_state_changed_cb, status, bd_addr, state);
 542         }
 543         return;
 544     }
 545
 546     if (pairing_cb.bond_type == BOND_TYPE_TEMPORARY)
 547         state = BT_BOND_STATE_NONE;
 548
 549     BTIF_TRACE_DEBUG("%s: state=%d, prev_state=%d, sdp_attempts = %d", __func__,
 550                       state, pairing_cb.state, pairing_cb.sdp_attempts);
 551
 552     HAL_CBACK(bt_hal_cbacks, bond_state_changed_cb, status, bd_addr, state);
 553
 554     if (state == BT_BOND_STATE_BONDING)
 555     {
 556         pairing_cb.state = state;
 557         bdcpy(pairing_cb.bd_addr, bd_addr->address);
 558     } else {
 559         if (!pairing_cb.sdp_attempts)
 560             memset(&pairing_cb, 0, sizeof(pairing_cb));
 561         else
 562             BTIF_TRACE_DEBUG("%s: BR-EDR service discovery active", __func__);
 563     }
 564 }
 565
 566 /* store remote version in bt config to always have access
 567    to it post pairing*/
 568 static void btif_update_remote_version_property(bt_bdaddr_t *p_bd)
 569 {
 570     bt_property_t property;
 571     UINT8 lmp_ver = 0;
 572     UINT16 lmp_subver = 0;
 573     UINT16 mfct_set = 0;
 574     tBTM_STATUS btm_status;
 575     bt_remote_version_t info;
 576     bt_status_t status;
 577     bdstr_t bdstr;
 578
 579     btm_status = BTM_ReadRemoteVersion(*(BD_ADDR*)p_bd, &lmp_ver,
 580                           &mfct_set, &lmp_subver);
 581
 582     LOG_DEBUG(LOG_TAG, "remote version info [%s]: %x, %x, %x", bdaddr_to_string(p_bd, bdstr, sizeof(bdstr)),
 583                lmp_ver, mfct_set, lmp_subver);
 584
 585     if (btm_status == BTM_SUCCESS)
 586     {
 587         // Always update cache to ensure we have availability whenever BTM API is not populated
 588         info.manufacturer = mfct_set;
 589         info.sub_ver = lmp_subver;
 590         info.version = lmp_ver;
 591         BTIF_STORAGE_FILL_PROPERTY(&property,
 592                             BT_PROPERTY_REMOTE_VERSION_INFO, sizeof(bt_remote_version_t),
 593                             &info);
 594         status = btif_storage_set_remote_device_property(p_bd, &property);
 595         ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote version", status);
 596     }
 597 }
 598
 599 static void btif_update_remote_properties(BD_ADDR bd_addr, BD_NAME bd_name,
 600                                           DEV_CLASS dev_class, tBT_DEVICE_TYPE device_type)
 601 {
 602     int num_properties = 0;
 603     bt_property_t properties[3];
 604     bt_bdaddr_t bdaddr;
 605     bt_status_t status;
 606     UINT32 cod;
 607     bt_device_type_t dev_type;
 608
 609     memset(properties, 0, sizeof(properties));
 610     bdcpy(bdaddr.address, bd_addr);
 611
 612     /* remote name */
 613     if (strlen((const char *) bd_name))
 614     {
 615         BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
 616                             BT_PROPERTY_BDNAME, strlen((char *)bd_name), bd_name);
 617         status = btif_storage_set_remote_device_property(&bdaddr, &properties[num_properties]);
 618         ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device name", status);
 619         num_properties++;
 620     }
 621
 622     /* class of device */
 623     cod = devclass2uint(dev_class);
 624     BTIF_TRACE_DEBUG("%s cod is 0x%06x", __func__, cod);
 625     if ( cod == 0) {
 626        /* Try to retrieve cod from storage */
 627         BTIF_TRACE_DEBUG("%s cod is 0, checking cod from storage", __func__);
 628         BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
 629             BT_PROPERTY_CLASS_OF_DEVICE, sizeof(cod), &cod);
 630         status = btif_storage_get_remote_device_property(&bdaddr, &properties[num_properties]);
 631         BTIF_TRACE_DEBUG("%s cod retrieved from storage is 0x%06x", __func__, cod);
 632         if ( cod == 0) {
 633             BTIF_TRACE_DEBUG("%s cod is again 0, set as unclassified", __func__);
 634             cod = COD_UNCLASSIFIED;
 635         }
 636     }
 637
 638     BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
 639                         BT_PROPERTY_CLASS_OF_DEVICE, sizeof(cod), &cod);
 640     status = btif_storage_set_remote_device_property(&bdaddr, &properties[num_properties]);
 641     ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device class", status);
 642     num_properties++;
 643
 644     /* device type */
 645     bt_property_t prop_name;
 646     uint8_t remote_dev_type;
 647     BTIF_STORAGE_FILL_PROPERTY(&prop_name, BT_PROPERTY_TYPE_OF_DEVICE,
 648                                 sizeof(uint8_t), &remote_dev_type);
 649     if (btif_storage_get_remote_device_property(&bdaddr, &prop_name) == BT_STATUS_SUCCESS)
 650          dev_type = remote_dev_type | device_type;
 651     else
 652          dev_type = device_type;
 653
 654     BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
 655                         BT_PROPERTY_TYPE_OF_DEVICE, sizeof(dev_type), &dev_type);
 656     status = btif_storage_set_remote_device_property(&bdaddr, &properties[num_properties]);
 657     ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device type", status);
 658     num_properties++;
 659
 660     HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb,
 661                      status, &bdaddr, num_properties, properties);
 662 }
 663
 664 /*******************************************************************************
 665 **
 666 ** Function         btif_dm_cb_hid_remote_name
 667 **
 668 ** Description      Remote name callback for HID device. Called in btif context
 669 **                  Special handling for HID devices
 670 **
 671 ** Returns          void
 672 **
 673 *******************************************************************************/
 674 static void btif_dm_cb_hid_remote_name(tBTM_REMOTE_DEV_NAME *p_remote_name)
 675 {
 676     BTIF_TRACE_DEBUG("%s: status=%d pairing_cb.state=%d", __FUNCTION__, p_remote_name->status, pairing_cb.state);
 677     if (pairing_cb.state == BT_BOND_STATE_BONDING)
 678     {
 679         bt_bdaddr_t remote_bd;
 680
 681         bdcpy(remote_bd.address, pairing_cb.bd_addr);
 682
 683         if (p_remote_name->status == BTM_SUCCESS)
 684         {
 685             bond_state_changed(BT_STATUS_SUCCESS, &remote_bd, BT_BOND_STATE_BONDED);
 686         }
 687         else
 688             bond_state_changed(BT_STATUS_FAIL, &remote_bd, BT_BOND_STATE_NONE);
 689     }
 690 }
 691
 692 /*******************************************************************************
 693 **
 694 ** Function         btif_dm_cb_create_bond
 695 **
 696 ** Description      Create bond initiated from the BTIF thread context
 697 **                  Special handling for HID devices
 698 **
 699 ** Returns          void
 700 **
 701 *******************************************************************************/
 702 static void btif_dm_cb_create_bond(bt_bdaddr_t *bd_addr, tBTA_TRANSPORT transport)
 703 {
 704     BOOLEAN is_hid = check_cod(bd_addr, COD_HID_POINTING);
 705     bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
 706
 707 #if BLE_INCLUDED == TRUE
 708     int device_type;
 709     int addr_type;
 710     bdstr_t bdstr;
 711     bdaddr_to_string(bd_addr, bdstr, sizeof(bdstr));
 712     if (transport == BT_TRANSPORT_LE)
 713     {
 714         if (!btif_config_get_int((char const *)&bdstr,"DevType", &device_type))
 715         {
 716             btif_config_set_int(bdstr, "DevType", BT_DEVICE_TYPE_BLE);
 717         }
 718         if (btif_storage_get_remote_addr_type(bd_addr, &addr_type) != BT_STATUS_SUCCESS)
 719         {
 720
 721             // Try to read address type. OOB pairing might have set it earlier, but
 722             // didn't store it, it defaults to BLE_ADDR_PUBLIC
 723             uint8_t tmp_dev_type;
 724             uint8_t tmp_addr_type;
 725             BTM_ReadDevInfo(bd_addr->address, &tmp_dev_type, &tmp_addr_type);
 726             addr_type = tmp_addr_type;
 727
 728             btif_storage_set_remote_addr_type(bd_addr, addr_type);
 729         }
 730     }
 731     if((btif_config_get_int((char const *)&bdstr,"DevType", &device_type) &&
 732        (btif_storage_get_remote_addr_type(bd_addr, &addr_type) == BT_STATUS_SUCCESS) &&
 733        (device_type & BT_DEVICE_TYPE_BLE) == BT_DEVICE_TYPE_BLE) || (transport == BT_TRANSPORT_LE))
 734     {
 735         BTA_DmAddBleDevice(bd_addr->address, addr_type, device_type);
 736     }
 737 #endif
 738
 739 #if BLE_INCLUDED == TRUE
 740     if(is_hid && (device_type & BT_DEVICE_TYPE_BLE) == 0)
 741 #else
 742     if(is_hid)
 743 #endif
 744     {
 745         int status;
 746         status = btif_hh_connect(bd_addr);
 747         if(status != BT_STATUS_SUCCESS)
 748             bond_state_changed(status, bd_addr, BT_BOND_STATE_NONE);
 749     }
 750     else
 751     {
 752         BTA_DmBondByTransport((UINT8 *)bd_addr->address, transport);
 753     }
 754     /*  Track  originator of bond creation  */
 755     pairing_cb.is_local_initiated = TRUE;
 756
 757 }
 758
 759 /*******************************************************************************
 760 **
 761 ** Function         btif_dm_cb_remove_bond
 762 **
 763 ** Description      remove bond initiated from the BTIF thread context
 764 **                  Special handling for HID devices
 765 **
 766 ** Returns          void
 767 **
 768 *******************************************************************************/
 769 void btif_dm_cb_remove_bond(bt_bdaddr_t *bd_addr)
 770 {
 771      /*special handling for HID devices */
 772      /*  VUP needs to be sent if its a HID Device. The HID HOST module will check if there
 773      is a valid hid connection with this bd_addr. If yes VUP will be issued.*/
 774 #if (defined(BTA_HH_INCLUDED) && (BTA_HH_INCLUDED == TRUE))
 775     if (btif_hh_virtual_unplug(bd_addr) != BT_STATUS_SUCCESS)
 776 #endif
 777     {
 778          BTIF_TRACE_DEBUG("%s: Removing HH device", __func__);
 779          BTA_DmRemoveDevice((UINT8 *)bd_addr->address);
 780     }
 781 }
 782
 783 /*******************************************************************************
 784 **
 785 ** Function         btif_dm_get_connection_state
 786 **
 787 ** Description      Returns whether the remote device is currently connected
 788 **                  and whether encryption is active for the connection
 789 **
 790 ** Returns          0 if not connected; 1 if connected and > 1 if connection is
 791 **                  encrypted
 792 **
 793 *******************************************************************************/
 794 uint16_t btif_dm_get_connection_state(const bt_bdaddr_t *bd_addr)
 795 {
 796     uint8_t *bda = (uint8_t*)bd_addr->address;
 797     uint16_t rc = BTA_DmGetConnectionState(bda);
 798
 799     if (rc != 0)
 800     {
 801         uint8_t flags = 0;
 802
 803         BTM_GetSecurityFlagsByTransport(bda, &flags, BT_TRANSPORT_BR_EDR);
 804         BTIF_TRACE_DEBUG("%s: security flags (BR/EDR)=0x%02x", __FUNCTION__, flags);
 805         if (flags & BTM_SEC_FLAG_ENCRYPTED)
 806             rc |= ENCRYPTED_BREDR;
 807
 808         BTM_GetSecurityFlagsByTransport(bda, &flags, BT_TRANSPORT_LE);
 809         BTIF_TRACE_DEBUG("%s: security flags (LE)=0x%02x", __FUNCTION__, flags);
 810         if (flags & BTM_SEC_FLAG_ENCRYPTED)
 811             rc |= ENCRYPTED_LE;
 812     }
 813
 814     return rc;
 815 }
 816
 817 /*******************************************************************************
 818 **
 819 ** Function         search_devices_copy_cb
 820 **
 821 ** Description      Deep copy callback for search devices event
 822 **
 823 ** Returns          void
 824 **
 825 *******************************************************************************/
 826 static void search_devices_copy_cb(UINT16 event, char *p_dest, char *p_src)
 827 {
 828     tBTA_DM_SEARCH *p_dest_data =  (tBTA_DM_SEARCH *) p_dest;
 829     tBTA_DM_SEARCH *p_src_data =  (tBTA_DM_SEARCH *) p_src;
 830
 831     if (!p_src)
 832         return;
 833
 834     BTIF_TRACE_DEBUG("%s: event=%s", __FUNCTION__, dump_dm_search_event(event));
 835     maybe_non_aligned_memcpy(p_dest_data, p_src_data, sizeof(*p_src_data));
 836     switch (event)
 837     {
 838         case BTA_DM_INQ_RES_EVT:
 839         {
 840             if (p_src_data->inq_res.p_eir)
 841             {
 842                 p_dest_data->inq_res.p_eir = (UINT8 *)(p_dest + sizeof(tBTA_DM_SEARCH));
 843                 memcpy(p_dest_data->inq_res.p_eir, p_src_data->inq_res.p_eir, HCI_EXT_INQ_RESPONSE_LEN);
 844             }
 845         }
 846         break;
 847
 848         case BTA_DM_DISC_RES_EVT:
 849         {
 850             if (p_src_data->disc_res.raw_data_size && p_src_data->disc_res.p_raw_data)
 851             {
 852                 p_dest_data->disc_res.p_raw_data = (UINT8 *)(p_dest + sizeof(tBTA_DM_SEARCH));
 853                 memcpy(p_dest_data->disc_res.p_raw_data,
 854                     p_src_data->disc_res.p_raw_data, p_src_data->disc_res.raw_data_size);
 855             }
 856         }
 857         break;
 858     }
 859 }
 860
 861 static void search_services_copy_cb(UINT16 event, char *p_dest, char *p_src)
 862 {
 863     tBTA_DM_SEARCH *p_dest_data =  (tBTA_DM_SEARCH *) p_dest;
 864     tBTA_DM_SEARCH *p_src_data =  (tBTA_DM_SEARCH *) p_src;
 865
 866     if (!p_src)
 867         return;
 868     maybe_non_aligned_memcpy(p_dest_data, p_src_data, sizeof(*p_src_data));
 869     switch (event)
 870     {
 871          case BTA_DM_DISC_RES_EVT:
 872          {
 873               if (p_src_data->disc_res.result == BTA_SUCCESS)
 874               {
 875                   if (p_src_data->disc_res.num_uuids > 0)
 876                   {
 877                        p_dest_data->disc_res.p_uuid_list =
 878                                                         (UINT8*)(p_dest + sizeof(tBTA_DM_SEARCH));
 879                        memcpy(p_dest_data->disc_res.p_uuid_list, p_src_data->disc_res.p_uuid_list,
 880                               p_src_data->disc_res.num_uuids*MAX_UUID_SIZE);
 881                        osi_free_and_reset((void **)&p_src_data->disc_res.p_uuid_list);
 882                   }
 883                   osi_free_and_reset((void **)&p_src_data->disc_res.p_raw_data);
 884               }
 885          } break;
 886     }
 887 }
 888 /******************************************************************************
 889 **
 890 **  BTIF DM callback events
 891 **
 892 *****************************************************************************/
 893
 894 /*******************************************************************************
 895 **
 896 ** Function         btif_dm_pin_req_evt
 897 **
 898 ** Description      Executes pin request event in btif context
 899 **
 900 ** Returns          void
 901 **
 902 *******************************************************************************/
 903 static void btif_dm_pin_req_evt(tBTA_DM_PIN_REQ *p_pin_req)
 904 {
 905     bt_bdaddr_t bd_addr;
 906     bt_bdname_t bd_name;
 907     UINT32 cod;
 908     bt_pin_code_t pin_code;
 909     int dev_type;
 910
 911     /* Remote properties update */
 912     if (!btif_get_device_type(p_pin_req->bd_addr, &dev_type))
 913     {
 914         dev_type = BT_DEVICE_TYPE_BREDR;
 915     }
 916     btif_update_remote_properties(p_pin_req->bd_addr, p_pin_req->bd_name,
 917                                   p_pin_req->dev_class, (tBT_DEVICE_TYPE) dev_type);
 918
 919     bdcpy(bd_addr.address, p_pin_req->bd_addr);
 920     memcpy(bd_name.name, p_pin_req->bd_name, BD_NAME_LEN);
 921
 922     bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
 923
 924     cod = devclass2uint(p_pin_req->dev_class);
 925
 926     if (cod == 0) {
 927         BTIF_TRACE_DEBUG("%s cod is 0, set as unclassified", __func__);
 928         cod = COD_UNCLASSIFIED;
 929     }
 930
 931     /* check for auto pair possiblity only if bond was initiated by local device */
 932     if (pairing_cb.is_local_initiated && (p_pin_req->min_16_digit == FALSE))
 933     {
 934         if (check_cod(&bd_addr, COD_AV_HEADSETS) ||
 935             check_cod(&bd_addr, COD_AV_HEADPHONES) ||
 936             check_cod(&bd_addr, COD_AV_PORTABLE_AUDIO) ||
 937             check_cod(&bd_addr, COD_AV_HIFI_AUDIO) ||
 938             check_cod(&bd_addr, COD_HID_POINTING))
 939         {
 940             /*  Check if this device can be auto paired  */
 941             if (!interop_match_addr(INTEROP_DISABLE_AUTO_PAIRING, &bd_addr) &&
 942                 !interop_match_name(INTEROP_DISABLE_AUTO_PAIRING, (const char *)bd_name.name) &&
 943                 (pairing_cb.autopair_attempts == 0))
 944             {
 945                 BTIF_TRACE_DEBUG("%s() Attempting auto pair", __FUNCTION__);
 946                 pin_code.pin[0] = 0x30;
 947                 pin_code.pin[1] = 0x30;
 948                 pin_code.pin[2] = 0x30;
 949                 pin_code.pin[3] = 0x30;
 950
 951                 pairing_cb.autopair_attempts++;
 952                 BTA_DmPinReply( (UINT8*)bd_addr.address, TRUE, 4, pin_code.pin);
 953                 return;
 954             }
 955         }
 956         else if (check_cod(&bd_addr, COD_HID_KEYBOARD) ||
 957                  check_cod(&bd_addr, COD_HID_COMBO))
 958         {
 959             if ((interop_match_addr(INTEROP_KEYBOARD_REQUIRES_FIXED_PIN, &bd_addr) == TRUE) &&
 960                 (pairing_cb.autopair_attempts == 0))
 961             {
 962                 BTIF_TRACE_DEBUG("%s() Attempting auto pair", __FUNCTION__);
 963                 pin_code.pin[0] = 0x30;
 964                 pin_code.pin[1] = 0x30;
 965                 pin_code.pin[2] = 0x30;
 966                 pin_code.pin[3] = 0x30;
 967
 968                 pairing_cb.autopair_attempts++;
 969                 BTA_DmPinReply( (UINT8*)bd_addr.address, TRUE, 4, pin_code.pin);
 970                 return;
 971             }
 972         }
 973     }
 974     HAL_CBACK(bt_hal_cbacks, pin_request_cb,
 975                      &bd_addr, &bd_name, cod, p_pin_req->min_16_digit);
 976 }
 977
 978 /*******************************************************************************
 979 **
 980 ** Function         btif_dm_ssp_cfm_req_evt
 981 **
 982 ** Description      Executes SSP confirm request event in btif context
 983 **
 984 ** Returns          void
 985 **
 986 *******************************************************************************/
 987 static void btif_dm_ssp_cfm_req_evt(tBTA_DM_SP_CFM_REQ *p_ssp_cfm_req)
 988 {
 989     bt_bdaddr_t bd_addr;
 990     bt_bdname_t bd_name;
 991     UINT32 cod;
 992     BOOLEAN is_incoming = !(pairing_cb.state == BT_BOND_STATE_BONDING);
 993     int dev_type;
 994
 995     BTIF_TRACE_DEBUG("%s", __FUNCTION__);
 996
 997     /* Remote properties update */
 998     if (!btif_get_device_type(p_ssp_cfm_req->bd_addr, &dev_type))
 999     {
1000         dev_type = BT_DEVICE_TYPE_BREDR;
1001     }
1002     btif_update_remote_properties(p_ssp_cfm_req->bd_addr, p_ssp_cfm_req->bd_name,
1003                                   p_ssp_cfm_req->dev_class, (tBT_DEVICE_TYPE) dev_type);
1004
1005     bdcpy(bd_addr.address, p_ssp_cfm_req->bd_addr);
1006     memcpy(bd_name.name, p_ssp_cfm_req->bd_name, BD_NAME_LEN);
1007
1008     /* Set the pairing_cb based on the local & remote authentication requirements */
1009     bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
1010
1011     /* if just_works and bonding bit is not set treat this as temporary */
1012     if (p_ssp_cfm_req->just_works && !(p_ssp_cfm_req->loc_auth_req & BTM_AUTH_BONDS) &&
1013         !(p_ssp_cfm_req->rmt_auth_req & BTM_AUTH_BONDS) &&
1014         !(check_cod((bt_bdaddr_t*)&p_ssp_cfm_req->bd_addr, COD_HID_POINTING)))
1015         pairing_cb.bond_type = BOND_TYPE_TEMPORARY;
1016     else
1017         pairing_cb.bond_type = BOND_TYPE_PERSISTENT;
1018
1019     btm_set_bond_type_dev(p_ssp_cfm_req->bd_addr, pairing_cb.bond_type);
1020
1021     pairing_cb.is_ssp = TRUE;
1022
1023     /* If JustWorks auto-accept */
1024     if (p_ssp_cfm_req->just_works)
1025     {
1026         /* Pairing consent for JustWorks needed if:
1027          * 1. Incoming (non-temporary) pairing is detected AND
1028          * 2. local IO capabilities are DisplayYesNo AND
1029          * 3. remote IO capabiltiies are DisplayOnly or NoInputNoOutput;
1030          */
1031         if (is_incoming && pairing_cb.bond_type != BOND_TYPE_TEMPORARY &&
1032                ((p_ssp_cfm_req->loc_io_caps == HCI_IO_CAP_DISPLAY_YESNO) &&
1033                 (p_ssp_cfm_req->rmt_io_caps == HCI_IO_CAP_DISPLAY_ONLY ||
1034                  p_ssp_cfm_req->rmt_io_caps == HCI_IO_CAP_NO_IO)))
1035         {
1036             BTIF_TRACE_EVENT("%s: User consent needed for incoming pairing request. loc_io_caps: %d, rmt_io_caps: %d",
1037                 __FUNCTION__, p_ssp_cfm_req->loc_io_caps, p_ssp_cfm_req->rmt_io_caps);
1038         }
1039         else
1040         {
1041             BTIF_TRACE_EVENT("%s: Auto-accept JustWorks pairing", __FUNCTION__);
1042             btif_dm_ssp_reply(&bd_addr, BT_SSP_VARIANT_CONSENT, TRUE, 0);
1043             return;
1044         }
1045     }
1046
1047     cod = devclass2uint(p_ssp_cfm_req->dev_class);
1048
1049     if (cod == 0) {
1050         LOG_DEBUG(LOG_TAG, "%s cod is 0, set as unclassified", __func__);
1051         cod = COD_UNCLASSIFIED;
1052     }
1053
1054     pairing_cb.sdp_attempts = 0;
1055     HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
1056                      (p_ssp_cfm_req->just_works ? BT_SSP_VARIANT_CONSENT : BT_SSP_VARIANT_PASSKEY_CONFIRMATION),
1057                      p_ssp_cfm_req->num_val);
1058 }
1059
1060 static void btif_dm_ssp_key_notif_evt(tBTA_DM_SP_KEY_NOTIF *p_ssp_key_notif)
1061 {
1062     bt_bdaddr_t bd_addr;
1063     bt_bdname_t bd_name;
1064     UINT32 cod;
1065     int dev_type;
1066
1067     BTIF_TRACE_DEBUG("%s", __FUNCTION__);
1068
1069     /* Remote properties update */
1070     if (!btif_get_device_type(p_ssp_key_notif->bd_addr, &dev_type))
1071     {
1072         dev_type = BT_DEVICE_TYPE_BREDR;
1073     }
1074     btif_update_remote_properties(p_ssp_key_notif->bd_addr, p_ssp_key_notif->bd_name,
1075                                   p_ssp_key_notif->dev_class, (tBT_DEVICE_TYPE) dev_type);
1076
1077     bdcpy(bd_addr.address, p_ssp_key_notif->bd_addr);
1078     memcpy(bd_name.name, p_ssp_key_notif->bd_name, BD_NAME_LEN);
1079
1080     bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
1081     pairing_cb.is_ssp = TRUE;
1082     cod = devclass2uint(p_ssp_key_notif->dev_class);
1083
1084     if (cod == 0) {
1085         LOG_DEBUG(LOG_TAG, "%s cod is 0, set as unclassified", __func__);
1086         cod = COD_UNCLASSIFIED;
1087     }
1088
1089     HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name,
1090                      cod, BT_SSP_VARIANT_PASSKEY_NOTIFICATION,
1091                      p_ssp_key_notif->passkey);
1092 }
1093 /*******************************************************************************
1094 **
1095 ** Function         btif_dm_auth_cmpl_evt
1096 **
1097 ** Description      Executes authentication complete event in btif context
1098 **
1099 ** Returns          void
1100 **
1101 *******************************************************************************/
1102 static void btif_dm_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
1103 {
1104     /* Save link key, if not temporary */
1105     bt_bdaddr_t bd_addr;
1106     bt_status_t status = BT_STATUS_FAIL;
1107     bt_bond_state_t state = BT_BOND_STATE_NONE;
1108     BOOLEAN skip_sdp = FALSE;
1109
1110     BTIF_TRACE_DEBUG("%s: bond state=%d", __func__, pairing_cb.state);
1111
1112     bdcpy(bd_addr.address, p_auth_cmpl->bd_addr);
1113     if ( (p_auth_cmpl->success == TRUE) && (p_auth_cmpl->key_present) )
1114     {
1115         if ((p_auth_cmpl->key_type < HCI_LKEY_TYPE_DEBUG_COMB) ||
1116             (p_auth_cmpl->key_type == HCI_LKEY_TYPE_AUTH_COMB) ||
1117             (p_auth_cmpl->key_type == HCI_LKEY_TYPE_CHANGED_COMB) ||
1118             (p_auth_cmpl->key_type == HCI_LKEY_TYPE_AUTH_COMB_P_256) ||
1119             pairing_cb.bond_type == BOND_TYPE_PERSISTENT)
1120         {
1121             bt_status_t ret;
1122             BTIF_TRACE_DEBUG("%s: Storing link key. key_type=0x%x, bond_type=%d",
1123                 __FUNCTION__, p_auth_cmpl->key_type, pairing_cb.bond_type);
1124             ret = btif_storage_add_bonded_device(&bd_addr,
1125                                 p_auth_cmpl->key, p_auth_cmpl->key_type,
1126                                 pairing_cb.pin_code_len);
1127             ASSERTC(ret == BT_STATUS_SUCCESS, "storing link key failed", ret);
1128         }
1129         else
1130         {
1131             BTIF_TRACE_DEBUG("%s: Temporary key. Not storing. key_type=0x%x, bond_type=%d",
1132                 __FUNCTION__, p_auth_cmpl->key_type, pairing_cb.bond_type);
1133             if(pairing_cb.bond_type == BOND_TYPE_TEMPORARY)
1134             {
1135                 BTIF_TRACE_DEBUG("%s: sending BT_BOND_STATE_NONE for Temp pairing",
1136                         __FUNCTION__);
1137                 btif_storage_remove_bonded_device(&bd_addr);
1138                 bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_NONE);
1139                 return;
1140             }
1141         }
1142     }
1143
1144     // We could have received a new link key without going through the pairing flow.
1145     // If so, we don't want to perform SDP or any other operations on the authenticated
1146     // device.
1147     if (bdcmp(p_auth_cmpl->bd_addr, pairing_cb.bd_addr) != 0) {
1148       char address[32];
1149       bt_bdaddr_t bt_bdaddr;
1150
1151       memcpy(bt_bdaddr.address, p_auth_cmpl->bd_addr,
1152              sizeof(bt_bdaddr.address));
1153       bdaddr_to_string(&bt_bdaddr, address, sizeof(address));
1154       LOG_INFO(LOG_TAG, "%s skipping SDP since we did not initiate pairing to %s.", __func__, address);
1155       return;
1156     }
1157
1158     // Skip SDP for certain  HID Devices
1159     if (p_auth_cmpl->success)
1160     {
1161 #if BLE_INCLUDED == TRUE
1162         btif_storage_set_remote_addr_type(&bd_addr, p_auth_cmpl->addr_type);
1163 #endif
1164         btif_update_remote_properties(p_auth_cmpl->bd_addr,
1165                                       p_auth_cmpl->bd_name, NULL, p_auth_cmpl->dev_type);
1166         pairing_cb.timeout_retries = 0;
1167         status = BT_STATUS_SUCCESS;
1168         state = BT_BOND_STATE_BONDED;
1169         bdcpy(bd_addr.address, p_auth_cmpl->bd_addr);
1170
1171         if (check_sdp_bl(&bd_addr) && check_cod_hid(&bd_addr))
1172         {
1173             LOG_WARN(LOG_TAG, "%s:skip SDP", __FUNCTION__);
1174             skip_sdp = TRUE;
1175         }
1176         if(!pairing_cb.is_local_initiated && skip_sdp)
1177         {
1178             bond_state_changed(status, &bd_addr, state);
1179
1180             LOG_WARN(LOG_TAG, "%s: Incoming HID Connection",__FUNCTION__);
1181             bt_property_t prop;
1182             bt_bdaddr_t bd_addr;
1183             bt_uuid_t  uuid;
1184             char uuid_str[128] = UUID_HUMAN_INTERFACE_DEVICE;
1185
1186             string_to_uuid(uuid_str, &uuid);
1187
1188             prop.type = BT_PROPERTY_UUIDS;
1189             prop.val = uuid.uu;
1190             prop.len = MAX_UUID_SIZE;
1191
1192             /* Send the event to the BTIF */
1193             HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb,
1194                              BT_STATUS_SUCCESS, &bd_addr, 1, &prop);
1195         }
1196         else
1197         {
1198 #if BLE_INCLUDED == TRUE
1199             BOOLEAN is_crosskey = FALSE;
1200             /* If bonded due to cross-key, save the static address too*/
1201             if(pairing_cb.state == BT_BOND_STATE_BONDING &&
1202               (bdcmp(p_auth_cmpl->bd_addr, pairing_cb.bd_addr) != 0))
1203             {
1204                 BTIF_TRACE_DEBUG("%s: bonding initiated due to cross key, adding static address",
1205                                  __func__);
1206                 bdcpy(pairing_cb.static_bdaddr.address, p_auth_cmpl->bd_addr);
1207                 is_crosskey = TRUE;
1208             }
1209             if (!is_crosskey || !(stack_config_get_interface()->get_pts_crosskey_sdp_disable()))
1210             {
1211 #endif
1212
1213                 // Ensure inquiry is stopped before attempting service discovery
1214                 btif_dm_cancel_discovery();
1215
1216                 /* Trigger SDP on the device */
1217                 pairing_cb.sdp_attempts = 1;
1218                 btif_dm_get_remote_services(&bd_addr);
1219 #if BLE_INCLUDED == TRUE
1220             }
1221 #endif
1222         }
1223         // Do not call bond_state_changed_cb yet. Wait until remote service discovery is complete
1224     }
1225     else
1226     {
1227         // Map the HCI fail reason  to  bt status
1228         switch(p_auth_cmpl->fail_reason)
1229         {
1230             case HCI_ERR_PAGE_TIMEOUT:
1231                 if (interop_match_addr(INTEROP_AUTO_RETRY_PAIRING, &bd_addr)
1232                     && pairing_cb.timeout_retries)
1233                 {
1234                     BTIF_TRACE_WARNING("%s() - Pairing timeout; retrying (%d) ...", __FUNCTION__, pairing_cb.timeout_retries);
1235                     --pairing_cb.timeout_retries;
1236                     btif_dm_cb_create_bond (&bd_addr, BTA_TRANSPORT_UNKNOWN);
1237                     return;
1238                 }
1239                 /* Fall-through */
1240             case HCI_ERR_CONNECTION_TOUT:
1241                 status =  BT_STATUS_RMT_DEV_DOWN;
1242                 break;
1243
1244             case HCI_ERR_PAIRING_NOT_ALLOWED:
1245                 status = BT_STATUS_AUTH_REJECTED;
1246                 break;
1247
1248             case HCI_ERR_LMP_RESPONSE_TIMEOUT:
1249                 status =  BT_STATUS_AUTH_FAILURE;
1250                 break;
1251
1252             /* map the auth failure codes, so we can retry pairing if necessary */
1253             case HCI_ERR_AUTH_FAILURE:
1254             case HCI_ERR_KEY_MISSING:
1255                 btif_storage_remove_bonded_device(&bd_addr);
1256             case HCI_ERR_HOST_REJECT_SECURITY:
1257             case HCI_ERR_ENCRY_MODE_NOT_ACCEPTABLE:
1258             case HCI_ERR_UNIT_KEY_USED:
1259             case HCI_ERR_PAIRING_WITH_UNIT_KEY_NOT_SUPPORTED:
1260             case HCI_ERR_INSUFFCIENT_SECURITY:
1261             case HCI_ERR_PEER_USER:
1262             case HCI_ERR_UNSPECIFIED:
1263                 BTIF_TRACE_DEBUG(" %s() Authentication fail reason %d",
1264                     __FUNCTION__, p_auth_cmpl->fail_reason);
1265                 if (pairing_cb.autopair_attempts  == 1)
1266                 {
1267                     /* Create the Bond once again */
1268                     BTIF_TRACE_WARNING("%s() auto pair failed. Reinitiate Bond", __FUNCTION__);
1269                     btif_dm_cb_create_bond (&bd_addr, BTA_TRANSPORT_UNKNOWN);
1270                     return;
1271                 }
1272                 else
1273                 {
1274                     /* if autopair attempts are more than 1, or not attempted */
1275                     status =  BT_STATUS_AUTH_FAILURE;
1276                 }
1277                 break;
1278
1279             default:
1280                 status =  BT_STATUS_FAIL;
1281         }
1282         /* Special Handling for HID Devices */
1283         if (check_cod(&bd_addr, COD_HID_POINTING)) {
1284             /* Remove Device as bonded in nvram as authentication failed */
1285             BTIF_TRACE_DEBUG("%s(): removing hid pointing device from nvram", __FUNCTION__);
1286             btif_storage_remove_bonded_device(&bd_addr);
1287         }
1288         bond_state_changed(status, &bd_addr, state);
1289     }
1290 }
1291
1292 /******************************************************************************
1293 **
1294 ** Function         btif_dm_search_devices_evt
1295 **
1296 ** Description      Executes search devices callback events in btif context
1297 **
1298 ** Returns          void
1299 **
1300 ******************************************************************************/
1301 static void btif_dm_search_devices_evt (UINT16 event, char *p_param)
1302 {
1303     tBTA_DM_SEARCH *p_search_data;
1304     BTIF_TRACE_EVENT("%s event=%s", __FUNCTION__, dump_dm_search_event(event));
1305
1306     switch (event)
1307     {
1308         case BTA_DM_DISC_RES_EVT:
1309         {
1310             p_search_data = (tBTA_DM_SEARCH *)p_param;
1311             /* Remote name update */
1312             if (strlen((const char *) p_search_data->disc_res.bd_name))
1313             {
1314                 bt_property_t properties[1];
1315                 bt_bdaddr_t bdaddr;
1316                 bt_status_t status;
1317
1318                 properties[0].type = BT_PROPERTY_BDNAME;
1319                 properties[0].val = p_search_data->disc_res.bd_name;
1320                 properties[0].len = strlen((char *)p_search_data->disc_res.bd_name);
1321                 bdcpy(bdaddr.address, p_search_data->disc_res.bd_addr);
1322
1323                 status = btif_storage_set_remote_device_property(&bdaddr, &properties[0]);
1324                 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device property", status);
1325                 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb,
1326                                  status, &bdaddr, 1, properties);
1327             }
1328             /* TODO: Services? */
1329         }
1330         break;
1331
1332         case BTA_DM_INQ_RES_EVT:
1333         {
1334             /* inquiry result */
1335             UINT32 cod;
1336             bt_bdname_t bdname;
1337             bt_bdaddr_t bdaddr;
1338             UINT8 remote_name_len;
1339             tBTA_SERVICE_MASK services = 0;
1340             bdstr_t bdstr;
1341
1342             p_search_data = (tBTA_DM_SEARCH *)p_param;
1343             bdcpy(bdaddr.address, p_search_data->inq_res.bd_addr);
1344
1345             BTIF_TRACE_DEBUG("%s() %s device_type = 0x%x\n", __FUNCTION__, bdaddr_to_string(&bdaddr, bdstr, sizeof(bdstr)),
1346 #if (BLE_INCLUDED == TRUE)
1347                     p_search_data->inq_res.device_type);
1348 #else
1349                     BT_DEVICE_TYPE_BREDR);
1350 #endif
1351             bdname.name[0] = 0;
1352
1353             cod = devclass2uint (p_search_data->inq_res.dev_class);
1354
1355             if (cod == 0) {
1356                 LOG_DEBUG(LOG_TAG, "%s cod is 0, set as unclassified", __func__);
1357                 cod = COD_UNCLASSIFIED;
1358             }
1359
1360             if (!check_eir_remote_name(p_search_data, bdname.name, &remote_name_len))
1361                 check_cached_remote_name(p_search_data, bdname.name, &remote_name_len);
1362
1363             /* Check EIR for remote name and services */
1364             if (p_search_data->inq_res.p_eir)
1365             {
1366                 BTA_GetEirService(p_search_data->inq_res.p_eir, &services);
1367                 BTIF_TRACE_DEBUG("%s()EIR BTA services = %08X", __FUNCTION__, (UINT32)services);
1368                 /* TODO:  Get the service list and check to see which uuids we got and send it back to the client. */
1369             }
1370
1371             {
1372                 bt_property_t properties[5];
1373                 bt_device_type_t dev_type;
1374                 uint32_t num_properties = 0;
1375                 bt_status_t status;
1376                 int addr_type = 0;
1377
1378                 memset(properties, 0, sizeof(properties));
1379                 /* BD_ADDR */
1380                 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1381                                     BT_PROPERTY_BDADDR, sizeof(bdaddr), &bdaddr);
1382                 num_properties++;
1383                 /* BD_NAME */
1384                 /* Don't send BDNAME if it is empty */
1385                 if (bdname.name[0])
1386                 {
1387                     BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1388                                                BT_PROPERTY_BDNAME,
1389                                                strlen((char *)bdname.name), &bdname);
1390                     num_properties++;
1391                 }
1392
1393                 /* DEV_CLASS */
1394                 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1395                                     BT_PROPERTY_CLASS_OF_DEVICE, sizeof(cod), &cod);
1396                 num_properties++;
1397                 /* DEV_TYPE */
1398 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
1399                 /* FixMe: Assumption is that bluetooth.h and BTE enums match */
1400
1401                 /* Verify if the device is dual mode in NVRAM */
1402                 int stored_device_type = 0;
1403                 if (btif_get_device_type(bdaddr.address, &stored_device_type) &&
1404                     ((stored_device_type != BT_DEVICE_TYPE_BREDR &&
1405                         p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BREDR) ||
1406                      (stored_device_type != BT_DEVICE_TYPE_BLE &&
1407                         p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BLE))) {
1408                     dev_type = BT_DEVICE_TYPE_DUMO;
1409                 } else {
1410                     dev_type = p_search_data->inq_res.device_type;
1411                 }
1412
1413                 if (p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BLE)
1414                     addr_type = p_search_data->inq_res.ble_addr_type;
1415 #else
1416                 dev_type = BT_DEVICE_TYPE_BREDR;
1417 #endif
1418                 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1419                                     BT_PROPERTY_TYPE_OF_DEVICE, sizeof(dev_type), &dev_type);
1420                 num_properties++;
1421                 /* RSSI */
1422                 BTIF_STORAGE_FILL_PROPERTY(&properties[num_properties],
1423                                     BT_PROPERTY_REMOTE_RSSI, sizeof(int8_t),
1424                                     &(p_search_data->inq_res.rssi));
1425                 num_properties++;
1426
1427                 status = btif_storage_add_remote_device(&bdaddr, num_properties, properties);
1428                 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote device (inquiry)", status);
1429 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
1430                 status = btif_storage_set_remote_addr_type(&bdaddr, addr_type);
1431                 ASSERTC(status == BT_STATUS_SUCCESS, "failed to save remote addr type (inquiry)", status);
1432 #endif
1433                 /* Callback to notify upper layer of device */
1434                 HAL_CBACK(bt_hal_cbacks, device_found_cb,
1435                                  num_properties, properties);
1436             }
1437         }
1438         break;
1439
1440         case BTA_DM_INQ_CMPL_EVT:
1441         {
1442 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
1443             tBTA_DM_BLE_PF_FILT_PARAMS adv_filt_param;
1444             memset(&adv_filt_param, 0, sizeof(tBTA_DM_BLE_PF_FILT_PARAMS));
1445             BTA_DmBleScanFilterSetup(BTA_DM_BLE_SCAN_COND_DELETE, 0, &adv_filt_param, NULL,
1446                                      bte_scan_filt_param_cfg_evt, 0);
1447 #endif
1448         }
1449         break;
1450         case BTA_DM_DISC_CMPL_EVT:
1451         {
1452             HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb, BT_DISCOVERY_STOPPED);
1453         }
1454         break;
1455         case BTA_DM_SEARCH_CANCEL_CMPL_EVT:
1456         {
1457            /* if inquiry is not in progress and we get a cancel event, then
1458             * it means we are done with inquiry, but remote_name fetches are in
1459             * progress
1460             *
1461             * if inquiry  is in progress, then we don't want to act on this cancel_cmpl_evt
1462             * but instead wait for the cancel_cmpl_evt via the Busy Level
1463             *
1464             */
1465            if (btif_dm_inquiry_in_progress == FALSE)
1466            {
1467 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
1468                tBTA_DM_BLE_PF_FILT_PARAMS adv_filt_param;
1469                memset(&adv_filt_param, 0, sizeof(tBTA_DM_BLE_PF_FILT_PARAMS));
1470                BTA_DmBleScanFilterSetup(BTA_DM_BLE_SCAN_COND_DELETE, 0, &adv_filt_param, NULL,
1471                                         bte_scan_filt_param_cfg_evt, 0);
1472 #endif
1473                HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb, BT_DISCOVERY_STOPPED);
1474            }
1475         }
1476         break;
1477     }
1478 }
1479
1480 /*******************************************************************************
1481 **
1482 ** Function         btif_dm_search_services_evt
1483 **
1484 ** Description      Executes search services event in btif context
1485 **
1486 ** Returns          void
1487 **
1488 *******************************************************************************/
1489 static void btif_dm_search_services_evt(UINT16 event, char *p_param)
1490 {
1491     tBTA_DM_SEARCH *p_data = (tBTA_DM_SEARCH*)p_param;
1492
1493     BTIF_TRACE_EVENT("%s:  event = %d", __FUNCTION__, event);
1494     switch (event)
1495     {
1496         case BTA_DM_DISC_RES_EVT:
1497         {
1498             bt_property_t prop;
1499             uint32_t i = 0;
1500             bt_bdaddr_t bd_addr;
1501             bt_status_t ret;
1502
1503             bdcpy(bd_addr.address, p_data->disc_res.bd_addr);
1504
1505             BTIF_TRACE_DEBUG("%s:(result=0x%x, services 0x%x)", __FUNCTION__,
1506                     p_data->disc_res.result, p_data->disc_res.services);
1507             if  ((p_data->disc_res.result != BTA_SUCCESS) &&
1508                  (pairing_cb.state == BT_BOND_STATE_BONDING ) &&
1509                  (pairing_cb.sdp_attempts < BTIF_DM_MAX_SDP_ATTEMPTS_AFTER_PAIRING))
1510             {
1511                 BTIF_TRACE_WARNING("%s:SDP failed after bonding re-attempting", __FUNCTION__);
1512                 pairing_cb.sdp_attempts++;
1513                 btif_dm_get_remote_services(&bd_addr);
1514                 return;
1515             }
1516             prop.type = BT_PROPERTY_UUIDS;
1517             prop.len = 0;
1518             if ((p_data->disc_res.result == BTA_SUCCESS) && (p_data->disc_res.num_uuids > 0))
1519             {
1520                  prop.val = p_data->disc_res.p_uuid_list;
1521                  prop.len = p_data->disc_res.num_uuids * MAX_UUID_SIZE;
1522                  for (i=0; i < p_data->disc_res.num_uuids; i++)
1523                  {
1524                       char temp[256];
1525                       uuid_to_string_legacy((bt_uuid_t*)(p_data->disc_res.p_uuid_list + (i*MAX_UUID_SIZE)), temp);
1526                       LOG_INFO(LOG_TAG, "%s index:%d uuid:%s", __func__, i, temp);
1527                  }
1528             }
1529
1530             /* onUuidChanged requires getBondedDevices to be populated.
1531             ** bond_state_changed needs to be sent prior to remote_device_property
1532             */
1533             if ((pairing_cb.state == BT_BOND_STATE_BONDING) &&
1534                 ((bdcmp(p_data->disc_res.bd_addr, pairing_cb.bd_addr) == 0) ||
1535                  (bdcmp(p_data->disc_res.bd_addr, pairing_cb.static_bdaddr.address) == 0)) &&
1536                   pairing_cb.sdp_attempts > 0)
1537             {
1538                  BTIF_TRACE_DEBUG("%s Remote Service SDP done. Call bond_state_changed_cb BONDED",
1539                                    __FUNCTION__);
1540                  pairing_cb.sdp_attempts  = 0;
1541
1542                  // If bonding occured due to cross-key pairing, send bonding callback
1543                  // for static address now
1544                  if (bdcmp(p_data->disc_res.bd_addr, pairing_cb.static_bdaddr.address) == 0)
1545                     bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
1546
1547                  bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDED);
1548             }
1549
1550             if (p_data->disc_res.num_uuids != 0)
1551             {
1552                 /* Also write this to the NVRAM */
1553                 ret = btif_storage_set_remote_device_property(&bd_addr, &prop);
1554                 ASSERTC(ret == BT_STATUS_SUCCESS, "storing remote services failed", ret);
1555                 /* Send the event to the BTIF */
1556                 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb,
1557                                  BT_STATUS_SUCCESS, &bd_addr, 1, &prop);
1558             }
1559         }
1560         break;
1561
1562         case BTA_DM_DISC_CMPL_EVT:
1563             /* fixme */
1564         break;
1565
1566         case BTA_DM_SEARCH_CANCEL_CMPL_EVT:
1567             /* no-op */
1568         break;
1569
1570 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
1571         case BTA_DM_DISC_BLE_RES_EVT:
1572              BTIF_TRACE_DEBUG("%s:, services 0x%x)", __FUNCTION__,
1573                                 p_data->disc_ble_res.service.uu.uuid16);
1574              bt_uuid_t  uuid;
1575              int i = 0;
1576              int j = 15;
1577              if (p_data->disc_ble_res.service.uu.uuid16 == UUID_SERVCLASS_LE_HID)
1578              {
1579                 BTIF_TRACE_DEBUG("%s: Found HOGP UUID",__FUNCTION__);
1580                 bt_property_t prop;
1581                 bt_bdaddr_t bd_addr;
1582                 char temp[256];
1583                 bt_status_t ret;
1584
1585                 bta_gatt_convert_uuid16_to_uuid128(uuid.uu,p_data->disc_ble_res.service.uu.uuid16);
1586
1587                 while(i < j )
1588                 {
1589                     unsigned char c = uuid.uu[j];
1590                     uuid.uu[j] = uuid.uu[i];
1591                     uuid.uu[i] = c;
1592                     i++;
1593                     j--;
1594                 }
1595
1596                 uuid_to_string_legacy(&uuid, temp);
1597                 LOG_INFO(LOG_TAG, "%s uuid:%s", __func__, temp);
1598
1599                 bdcpy(bd_addr.address, p_data->disc_ble_res.bd_addr);
1600                 prop.type = BT_PROPERTY_UUIDS;
1601                 prop.val = uuid.uu;
1602                 prop.len = MAX_UUID_SIZE;
1603
1604                 /* Also write this to the NVRAM */
1605                 ret = btif_storage_set_remote_device_property(&bd_addr, &prop);
1606                 ASSERTC(ret == BT_STATUS_SUCCESS, "storing remote services failed", ret);
1607
1608                 /* Send the event to the BTIF */
1609                 HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb,
1610                                  BT_STATUS_SUCCESS, &bd_addr, 1, &prop);
1611
1612             }
1613         break;
1614 #endif /* BLE_INCLUDED */
1615
1616         default:
1617         {
1618             ASSERTC(0, "unhandled search services event", event);
1619         }
1620         break;
1621     }
1622 }
1623
1624 /*******************************************************************************
1625 **
1626 ** Function         btif_dm_remote_service_record_evt
1627 **
1628 ** Description      Executes search service record event in btif context
1629 **
1630 ** Returns          void
1631 **
1632 *******************************************************************************/
1633 static void btif_dm_remote_service_record_evt(UINT16 event, char *p_param)
1634 {
1635     tBTA_DM_SEARCH *p_data = (tBTA_DM_SEARCH*)p_param;
1636
1637     BTIF_TRACE_EVENT("%s:  event = %d", __FUNCTION__, event);
1638     switch (event)
1639     {
1640         case BTA_DM_DISC_RES_EVT:
1641         {
1642             bt_service_record_t rec;
1643             bt_property_t prop;
1644             bt_bdaddr_t bd_addr;
1645
1646             memset(&rec, 0, sizeof(bt_service_record_t));
1647             bdcpy(bd_addr.address, p_data->disc_res.bd_addr);
1648
1649             BTIF_TRACE_DEBUG("%s:(result=0x%x, services 0x%x)", __FUNCTION__,
1650                     p_data->disc_res.result, p_data->disc_res.services);
1651             prop.type = BT_PROPERTY_SERVICE_RECORD;
1652             prop.val = (void*)&rec;
1653             prop.len = sizeof(rec);
1654
1655             /* disc_res.result is overloaded with SCN. Cannot check result */
1656             p_data->disc_res.services &= ~BTA_USER_SERVICE_MASK;
1657             /* TODO: Get the UUID as well */
1658             rec.channel = p_data->disc_res.result - 3;
1659             /* TODO: Need to get the service name using p_raw_data */
1660             rec.name[0] = 0;
1661
1662             HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb,
1663                              BT_STATUS_SUCCESS, &bd_addr, 1, &prop);
1664         }
1665         break;
1666
1667         default:
1668         {
1669            ASSERTC(0, "unhandled remote service record event", event);
1670         }
1671         break;
1672     }
1673 }
1674
1675 /*******************************************************************************
1676 **
1677 ** Function         btif_dm_upstreams_cback
1678 **
1679 ** Description      Executes UPSTREAMS events in btif context
1680 **
1681 ** Returns          void
1682 **
1683 *******************************************************************************/
1684 static void btif_dm_upstreams_evt(UINT16 event, char* p_param)
1685 {
1686     tBTA_DM_SEC *p_data = (tBTA_DM_SEC*)p_param;
1687     tBTA_SERVICE_MASK service_mask;
1688     uint32_t i;
1689     bt_bdaddr_t bd_addr;
1690
1691     BTIF_TRACE_EVENT("%s: ev: %s", __func__, dump_dm_event(event));
1692
1693     switch (event)
1694     {
1695         case BTA_DM_ENABLE_EVT:
1696         {
1697              BD_NAME bdname;
1698              bt_status_t status;
1699              bt_property_t prop;
1700              prop.type = BT_PROPERTY_BDNAME;
1701              prop.len = BD_NAME_LEN;
1702              prop.val = (void*)bdname;
1703
1704              status = btif_storage_get_adapter_property(&prop);
1705              if (status == BT_STATUS_SUCCESS)
1706              {
1707                  /* A name exists in the storage. Make this the device name */
1708                  BTA_DmSetDeviceName((char*)prop.val);
1709              }
1710              else
1711              {
1712                  /* Storage does not have a name yet.
1713                   * Use the default name and write it to the chip
1714                   */
1715                  BTA_DmSetDeviceName(btif_get_default_local_name());
1716              }
1717
1718 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
1719              /* Enable local privacy */
1720              BTA_DmBleConfigLocalPrivacy(BLE_LOCAL_PRIVACY_ENABLED);
1721 #endif
1722
1723              /* for each of the enabled services in the mask, trigger the profile
1724               * enable */
1725              service_mask = btif_get_enabled_services_mask();
1726              for (i=0; i <= BTA_MAX_SERVICE_ID; i++)
1727              {
1728                  if (service_mask &
1729                      (tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(i)))
1730                  {
1731                      btif_in_execute_service_request(i, TRUE);
1732                  }
1733              }
1734              /* clear control blocks */
1735              memset(&pairing_cb, 0, sizeof(btif_dm_pairing_cb_t));
1736              pairing_cb.bond_type = BOND_TYPE_PERSISTENT;
1737
1738              /* This function will also trigger the adapter_properties_cb
1739              ** and bonded_devices_info_cb
1740              */
1741              btif_storage_load_bonded_devices();
1742
1743              btif_enable_bluetooth_evt(p_data->enable.status);
1744         }
1745         break;
1746
1747         case BTA_DM_DISABLE_EVT:
1748             /* for each of the enabled services in the mask, trigger the profile
1749              * disable */
1750             service_mask = btif_get_enabled_services_mask();
1751             for (i=0; i <= BTA_MAX_SERVICE_ID; i++)
1752             {
1753                 if (service_mask &
1754                     (tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(i)))
1755                 {
1756                     btif_in_execute_service_request(i, FALSE);
1757                 }
1758             }
1759             btif_disable_bluetooth_evt();
1760             break;
1761
1762         case BTA_DM_PIN_REQ_EVT:
1763             btif_dm_pin_req_evt(&p_data->pin_req);
1764             break;
1765
1766         case BTA_DM_AUTH_CMPL_EVT:
1767             btif_dm_auth_cmpl_evt(&p_data->auth_cmpl);
1768             break;
1769
1770         case BTA_DM_BOND_CANCEL_CMPL_EVT:
1771             if (pairing_cb.state == BT_BOND_STATE_BONDING)
1772             {
1773                 bdcpy(bd_addr.address, pairing_cb.bd_addr);
1774                 btm_set_bond_type_dev(pairing_cb.bd_addr, BOND_TYPE_UNKNOWN);
1775                 bond_state_changed(p_data->bond_cancel_cmpl.result, &bd_addr, BT_BOND_STATE_NONE);
1776             }
1777             break;
1778
1779         case BTA_DM_SP_CFM_REQ_EVT:
1780             btif_dm_ssp_cfm_req_evt(&p_data->cfm_req);
1781             break;
1782         case BTA_DM_SP_KEY_NOTIF_EVT:
1783             btif_dm_ssp_key_notif_evt(&p_data->key_notif);
1784             break;
1785
1786         case BTA_DM_DEV_UNPAIRED_EVT:
1787             bdcpy(bd_addr.address, p_data->link_down.bd_addr);
1788             btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
1789
1790             /*special handling for HID devices */
1791             #if (defined(BTA_HH_INCLUDED) && (BTA_HH_INCLUDED == TRUE))
1792             btif_hh_remove_device(bd_addr);
1793             #endif
1794             btif_storage_remove_bonded_device(&bd_addr);
1795             bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_NONE);
1796             break;
1797
1798         case BTA_DM_BUSY_LEVEL_EVT:
1799         {
1800
1801             if (p_data->busy_level.level_flags & BTM_BL_INQUIRY_PAGING_MASK)
1802             {
1803                 if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_STARTED)
1804                 {
1805                        HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1806                                                 BT_DISCOVERY_STARTED);
1807                        btif_dm_inquiry_in_progress = TRUE;
1808                 }
1809                 else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_CANCELLED)
1810                 {
1811                        HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb,
1812                                                 BT_DISCOVERY_STOPPED);
1813                        btif_dm_inquiry_in_progress = FALSE;
1814                 }
1815                 else if (p_data->busy_level.level_flags == BTM_BL_INQUIRY_COMPLETE)
1816                 {
1817                        btif_dm_inquiry_in_progress = FALSE;
1818                 }
1819             }
1820         }break;
1821
1822         case BTA_DM_LINK_UP_EVT:
1823             bdcpy(bd_addr.address, p_data->link_up.bd_addr);
1824             BTIF_TRACE_DEBUG("BTA_DM_LINK_UP_EVT. Sending BT_ACL_STATE_CONNECTED");
1825
1826             btif_update_remote_version_property(&bd_addr);
1827
1828             HAL_CBACK(bt_hal_cbacks, acl_state_changed_cb, BT_STATUS_SUCCESS,
1829                       &bd_addr, BT_ACL_STATE_CONNECTED);
1830             break;
1831
1832         case BTA_DM_LINK_DOWN_EVT:
1833             bdcpy(bd_addr.address, p_data->link_down.bd_addr);
1834             btm_set_bond_type_dev(p_data->link_down.bd_addr, BOND_TYPE_UNKNOWN);
1835             BTIF_TRACE_DEBUG("BTA_DM_LINK_DOWN_EVT. Sending BT_ACL_STATE_DISCONNECTED");
1836             HAL_CBACK(bt_hal_cbacks, acl_state_changed_cb, BT_STATUS_SUCCESS,
1837                       &bd_addr, BT_ACL_STATE_DISCONNECTED);
1838             break;
1839
1840         case BTA_DM_HW_ERROR_EVT:
1841             BTIF_TRACE_ERROR("Received H/W Error. ");
1842             /* Flush storage data */
1843             btif_config_flush();
1844             usleep(100000); /* 100milliseconds */
1845             /* Killing the process to force a restart as part of fault tolerance */
1846             kill(getpid(), SIGKILL);
1847             break;
1848
1849 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
1850         case BTA_DM_BLE_KEY_EVT:
1851             BTIF_TRACE_DEBUG("BTA_DM_BLE_KEY_EVT key_type=0x%02x ", p_data->ble_key.key_type);
1852
1853             /* If this pairing is by-product of local initiated GATT client Read or Write,
1854             BTA would not have sent BTA_DM_BLE_SEC_REQ_EVT event and Bond state would not
1855             have setup properly. Setup pairing_cb and notify App about Bonding state now*/
1856             if (pairing_cb.state != BT_BOND_STATE_BONDING)
1857             {
1858                 BTIF_TRACE_DEBUG("Bond state not sent to App so far.Notify the app now");
1859                 bond_state_changed(BT_STATUS_SUCCESS, (bt_bdaddr_t*)p_data->ble_key.bd_addr,
1860                                    BT_BOND_STATE_BONDING);
1861             }
1862             else if (memcmp (pairing_cb.bd_addr, p_data->ble_key.bd_addr, BD_ADDR_LEN)!=0)
1863             {
1864                 BTIF_TRACE_ERROR("BD mismatch discard BLE key_type=%d ",p_data->ble_key.key_type);
1865                 break;
1866             }
1867
1868             switch (p_data->ble_key.key_type)
1869             {
1870                 case BTA_LE_KEY_PENC:
1871                     BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_PENC");
1872                     pairing_cb.ble.is_penc_key_rcvd = TRUE;
1873                     pairing_cb.ble.penc_key = p_data->ble_key.p_key_value->penc_key;
1874                     break;
1875
1876                 case BTA_LE_KEY_PID:
1877                     BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_PID");
1878                     pairing_cb.ble.is_pid_key_rcvd = TRUE;
1879                     pairing_cb.ble.pid_key = p_data->ble_key.p_key_value->pid_key;
1880                     break;
1881
1882                 case BTA_LE_KEY_PCSRK:
1883                     BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_PCSRK");
1884                     pairing_cb.ble.is_pcsrk_key_rcvd = TRUE;
1885                     pairing_cb.ble.pcsrk_key = p_data->ble_key.p_key_value->pcsrk_key;
1886                     break;
1887
1888                 case BTA_LE_KEY_LENC:
1889                     BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_LENC");
1890                     pairing_cb.ble.is_lenc_key_rcvd = TRUE;
1891                     pairing_cb.ble.lenc_key = p_data->ble_key.p_key_value->lenc_key;
1892                     break;
1893
1894                 case BTA_LE_KEY_LCSRK:
1895                     BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_LCSRK");
1896                     pairing_cb.ble.is_lcsrk_key_rcvd = TRUE;
1897                     pairing_cb.ble.lcsrk_key = p_data->ble_key.p_key_value->lcsrk_key;
1898                     break;
1899
1900                 case BTA_LE_KEY_LID:
1901                     BTIF_TRACE_DEBUG("Rcv BTA_LE_KEY_LID");
1902                     pairing_cb.ble.is_lidk_key_rcvd =  TRUE;
1903                     break;
1904
1905                 default:
1906                     BTIF_TRACE_ERROR("unknown BLE key type (0x%02x)", p_data->ble_key.key_type);
1907                     break;
1908             }
1909             break;
1910         case BTA_DM_BLE_SEC_REQ_EVT:
1911             BTIF_TRACE_DEBUG("BTA_DM_BLE_SEC_REQ_EVT. ");
1912             btif_dm_ble_sec_req_evt(&p_data->ble_req);
1913             break;
1914         case BTA_DM_BLE_PASSKEY_NOTIF_EVT:
1915             BTIF_TRACE_DEBUG("BTA_DM_BLE_PASSKEY_NOTIF_EVT. ");
1916             btif_dm_ble_key_notif_evt(&p_data->key_notif);
1917             break;
1918         case BTA_DM_BLE_PASSKEY_REQ_EVT:
1919             BTIF_TRACE_DEBUG("BTA_DM_BLE_PASSKEY_REQ_EVT. ");
1920             btif_dm_ble_passkey_req_evt(&p_data->pin_req);
1921             break;
1922         case BTA_DM_BLE_NC_REQ_EVT:
1923             BTIF_TRACE_DEBUG("BTA_DM_BLE_PASSKEY_REQ_EVT. ");
1924             btif_dm_ble_key_nc_req_evt(&p_data->key_notif);
1925             break;
1926         case BTA_DM_BLE_OOB_REQ_EVT:
1927             BTIF_TRACE_DEBUG("BTA_DM_BLE_OOB_REQ_EVT. ");
1928             btif_dm_ble_oob_req_evt(&p_data->rmt_oob);
1929             break;
1930         case BTA_DM_BLE_SC_OOB_REQ_EVT:
1931             BTIF_TRACE_DEBUG("BTA_DM_BLE_SC_OOB_REQ_EVT. ");
1932             btif_dm_ble_sc_oob_req_evt(&p_data->rmt_oob);
1933             break;
1934         case BTA_DM_BLE_LOCAL_IR_EVT:
1935             BTIF_TRACE_DEBUG("BTA_DM_BLE_LOCAL_IR_EVT. ");
1936             ble_local_key_cb.is_id_keys_rcvd = TRUE;
1937             memcpy(&ble_local_key_cb.id_keys.irk[0],
1938                    &p_data->ble_id_keys.irk[0], sizeof(BT_OCTET16));
1939             memcpy(&ble_local_key_cb.id_keys.ir[0],
1940                    &p_data->ble_id_keys.ir[0], sizeof(BT_OCTET16));
1941             memcpy(&ble_local_key_cb.id_keys.dhk[0],
1942                    &p_data->ble_id_keys.dhk[0], sizeof(BT_OCTET16));
1943             btif_storage_add_ble_local_key( (char *)&ble_local_key_cb.id_keys.irk[0],
1944                                             BTIF_DM_LE_LOCAL_KEY_IRK,
1945                                             BT_OCTET16_LEN);
1946             btif_storage_add_ble_local_key( (char *)&ble_local_key_cb.id_keys.ir[0],
1947                                             BTIF_DM_LE_LOCAL_KEY_IR,
1948                                             BT_OCTET16_LEN);
1949             btif_storage_add_ble_local_key( (char *)&ble_local_key_cb.id_keys.dhk[0],
1950                                             BTIF_DM_LE_LOCAL_KEY_DHK,
1951                                             BT_OCTET16_LEN);
1952             break;
1953         case BTA_DM_BLE_LOCAL_ER_EVT:
1954             BTIF_TRACE_DEBUG("BTA_DM_BLE_LOCAL_ER_EVT. ");
1955             ble_local_key_cb.is_er_rcvd = TRUE;
1956             memcpy(&ble_local_key_cb.er[0], &p_data->ble_er[0], sizeof(BT_OCTET16));
1957             btif_storage_add_ble_local_key( (char *)&ble_local_key_cb.er[0],
1958                                             BTIF_DM_LE_LOCAL_KEY_ER,
1959                                             BT_OCTET16_LEN);
1960             break;
1961
1962         case BTA_DM_BLE_AUTH_CMPL_EVT:
1963             BTIF_TRACE_DEBUG("BTA_DM_BLE_AUTH_CMPL_EVT. ");
1964             btif_dm_ble_auth_cmpl_evt(&p_data->auth_cmpl);
1965             break;
1966
1967         case BTA_DM_LE_FEATURES_READ:
1968         {
1969             tBTM_BLE_VSC_CB cmn_vsc_cb;
1970             bt_local_le_features_t local_le_features;
1971             char buf[512];
1972             bt_property_t prop;
1973             prop.type = BT_PROPERTY_LOCAL_LE_FEATURES;
1974             prop.val = (void*)buf;
1975             prop.len = sizeof(buf);
1976
1977            /* LE features are not stored in storage. Should be retrived from stack */
1978             BTM_BleGetVendorCapabilities(&cmn_vsc_cb);
1979             local_le_features.local_privacy_enabled = BTM_BleLocalPrivacyEnabled();
1980
1981             prop.len = sizeof (bt_local_le_features_t);
1982             if (cmn_vsc_cb.filter_support == 1)
1983                 local_le_features.max_adv_filter_supported = cmn_vsc_cb.max_filter;
1984              else
1985                 local_le_features.max_adv_filter_supported = 0;
1986             local_le_features.max_adv_instance = cmn_vsc_cb.adv_inst_max;
1987             local_le_features.max_irk_list_size = cmn_vsc_cb.max_irk_list_sz;
1988             local_le_features.rpa_offload_supported = cmn_vsc_cb.rpa_offloading;
1989             local_le_features.activity_energy_info_supported = cmn_vsc_cb.energy_support;
1990             local_le_features.scan_result_storage_size = cmn_vsc_cb.tot_scan_results_strg;
1991             local_le_features.version_supported = cmn_vsc_cb.version_supported;
1992             local_le_features.total_trackable_advertisers =
1993                         cmn_vsc_cb.total_trackable_advertisers;
1994
1995             local_le_features.extended_scan_support = cmn_vsc_cb.extended_scan_support > 0;
1996             local_le_features.debug_logging_supported = cmn_vsc_cb.debug_logging_supported > 0;
1997
1998             memcpy(prop.val, &local_le_features, prop.len);
1999             HAL_CBACK(bt_hal_cbacks, adapter_properties_cb, BT_STATUS_SUCCESS, 1, &prop);
2000             break;
2001          }
2002
2003         case BTA_DM_ENER_INFO_READ:
2004         {
2005             btif_activity_energy_info_cb_t *p_ener_data = (btif_activity_energy_info_cb_t*) p_param;
2006             bt_activity_energy_info energy_info;
2007             energy_info.status = p_ener_data->status;
2008             energy_info.ctrl_state = p_ener_data->ctrl_state;
2009             energy_info.rx_time = p_ener_data->rx_time;
2010             energy_info.tx_time = p_ener_data->tx_time;
2011             energy_info.idle_time = p_ener_data->idle_time;
2012             energy_info.energy_used = p_ener_data->energy_used;
2013
2014             bt_uid_traffic_t* data = uid_set_read_and_clear(uid_set);
2015             HAL_CBACK(bt_hal_cbacks, energy_info_cb, &energy_info, data);
2016             osi_free(data);
2017             break;
2018         }
2019 #endif
2020
2021         case BTA_DM_AUTHORIZE_EVT:
2022         case BTA_DM_SIG_STRENGTH_EVT:
2023         case BTA_DM_SP_RMT_OOB_EVT:
2024         case BTA_DM_SP_KEYPRESS_EVT:
2025         case BTA_DM_ROLE_CHG_EVT:
2026
2027         default:
2028             BTIF_TRACE_WARNING( "btif_dm_cback : unhandled event (%d)", event );
2029             break;
2030     }
2031
2032     btif_dm_data_free(event, p_data);
2033 }
2034
2035 /*******************************************************************************
2036 **
2037 ** Function         btif_dm_generic_evt
2038 **
2039 ** Description      Executes non-BTA upstream events in BTIF context
2040 **
2041 ** Returns          void
2042 **
2043 *******************************************************************************/
2044 static void btif_dm_generic_evt(UINT16 event, char* p_param)
2045 {
2046     BTIF_TRACE_EVENT("%s: event=%d", __FUNCTION__, event);
2047     switch(event)
2048     {
2049         case BTIF_DM_CB_DISCOVERY_STARTED:
2050         {
2051             HAL_CBACK(bt_hal_cbacks, discovery_state_changed_cb, BT_DISCOVERY_STARTED);
2052         }
2053         break;
2054
2055         case BTIF_DM_CB_CREATE_BOND:
2056         {
2057             pairing_cb.timeout_retries = NUM_TIMEOUT_RETRIES;
2058             btif_dm_create_bond_cb_t *create_bond_cb = (btif_dm_create_bond_cb_t*)p_param;
2059             btif_dm_cb_create_bond(&create_bond_cb->bdaddr, create_bond_cb->transport);
2060         }
2061         break;
2062
2063         case BTIF_DM_CB_REMOVE_BOND:
2064         {
2065             btif_dm_cb_remove_bond((bt_bdaddr_t *)p_param);
2066         }
2067         break;
2068
2069         case BTIF_DM_CB_HID_REMOTE_NAME:
2070         {
2071             btif_dm_cb_hid_remote_name((tBTM_REMOTE_DEV_NAME *)p_param);
2072         }
2073         break;
2074
2075         case BTIF_DM_CB_BOND_STATE_BONDING:
2076             {
2077                 bond_state_changed(BT_STATUS_SUCCESS, (bt_bdaddr_t *)p_param, BT_BOND_STATE_BONDING);
2078             }
2079             break;
2080         case BTIF_DM_CB_LE_TX_TEST:
2081         case BTIF_DM_CB_LE_RX_TEST:
2082             {
2083                 uint8_t status;
2084                 STREAM_TO_UINT8(status, p_param);
2085                 HAL_CBACK(bt_hal_cbacks, le_test_mode_cb,
2086                       (status == 0) ? BT_STATUS_SUCCESS : BT_STATUS_FAIL, 0);
2087             }
2088             break;
2089         case BTIF_DM_CB_LE_TEST_END:
2090             {
2091                 uint8_t status;
2092                 uint16_t count = 0;
2093                 STREAM_TO_UINT8(status, p_param);
2094                 if (status == 0)
2095                     STREAM_TO_UINT16(count, p_param);
2096                 HAL_CBACK(bt_hal_cbacks, le_test_mode_cb,
2097                       (status == 0) ? BT_STATUS_SUCCESS : BT_STATUS_FAIL, count);
2098             }
2099             break;
2100         default:
2101         {
2102             BTIF_TRACE_WARNING("%s : Unknown event 0x%x", __FUNCTION__, event);
2103         }
2104         break;
2105     }
2106 }
2107
2108 /*******************************************************************************
2109 **
2110 ** Function         bte_dm_evt
2111 **
2112 ** Description      Switches context from BTE to BTIF for all DM events
2113 **
2114 ** Returns          void
2115 **
2116 *******************************************************************************/
2117
2118 void bte_dm_evt(tBTA_DM_SEC_EVT event, tBTA_DM_SEC *p_data)
2119 {
2120     /* switch context to btif task context (copy full union size for convenience) */
2121     bt_status_t status = btif_transfer_context(btif_dm_upstreams_evt, (uint16_t)event,
2122                                 (void*)p_data, sizeof(tBTA_DM_SEC), btif_dm_data_copy);
2123
2124     /* catch any failed context transfers */
2125     ASSERTC(status == BT_STATUS_SUCCESS, "context transfer failed", status);
2126 }
2127
2128 /*******************************************************************************
2129 **
2130 ** Function         bte_search_devices_evt
2131 **
2132 ** Description      Switches context from BTE to BTIF for DM search events
2133 **
2134 ** Returns          void
2135 **
2136 *******************************************************************************/
2137 static void bte_search_devices_evt(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data)
2138 {
2139     UINT16 param_len = 0;
2140
2141     if (p_data)
2142         param_len += sizeof(tBTA_DM_SEARCH);
2143     /* Allocate buffer to hold the pointers (deep copy). The pointers will point to the end of the tBTA_DM_SEARCH */
2144     switch (event)
2145     {
2146         case BTA_DM_INQ_RES_EVT:
2147         {
2148             if (p_data->inq_res.p_eir)
2149                 param_len += HCI_EXT_INQ_RESPONSE_LEN;
2150         }
2151         break;
2152
2153         case BTA_DM_DISC_RES_EVT:
2154         {
2155             if (p_data->disc_res.raw_data_size && p_data->disc_res.p_raw_data)
2156                 param_len += p_data->disc_res.raw_data_size;
2157         }
2158         break;
2159     }
2160     BTIF_TRACE_DEBUG("%s event=%s param_len=%d", __FUNCTION__, dump_dm_search_event(event), param_len);
2161
2162     /* if remote name is available in EIR, set teh flag so that stack doesnt trigger RNR */
2163     if (event == BTA_DM_INQ_RES_EVT)
2164         p_data->inq_res.remt_name_not_required = check_eir_remote_name(p_data, NULL, NULL);
2165
2166     btif_transfer_context (btif_dm_search_devices_evt , (UINT16) event, (void *)p_data, param_len,
2167         (param_len > sizeof(tBTA_DM_SEARCH)) ? search_devices_copy_cb : NULL);
2168 }
2169
2170 /*******************************************************************************
2171 **
2172 ** Function         bte_dm_search_services_evt
2173 **
2174 ** Description      Switches context from BTE to BTIF for DM search services
2175 **                  event
2176 **
2177 ** Returns          void
2178 **
2179 *******************************************************************************/
2180 static void bte_dm_search_services_evt(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data)
2181 {
2182     UINT16 param_len = 0;
2183    if (p_data)
2184        param_len += sizeof(tBTA_DM_SEARCH);
2185    switch (event)
2186    {
2187          case BTA_DM_DISC_RES_EVT:
2188          {
2189              if ((p_data->disc_res.result == BTA_SUCCESS) && (p_data->disc_res.num_uuids > 0)) {
2190                   param_len += (p_data->disc_res.num_uuids * MAX_UUID_SIZE);
2191              }
2192          } break;
2193    }
2194    /* TODO: The only other member that needs a deep copy is the p_raw_data. But not sure
2195     * if raw_data is needed. */
2196    btif_transfer_context(btif_dm_search_services_evt, event, (char*)p_data, param_len,
2197          (param_len > sizeof(tBTA_DM_SEARCH)) ? search_services_copy_cb : NULL);
2198 }
2199
2200 /*******************************************************************************
2201 **
2202 ** Function         bte_dm_remote_service_record_evt
2203 **
2204 ** Description      Switches context from BTE to BTIF for DM search service
2205 **                  record event
2206 **
2207 ** Returns          void
2208 **
2209 *******************************************************************************/
2210 static void bte_dm_remote_service_record_evt(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_data)
2211 {
2212    /* TODO: The only member that needs a deep copy is the p_raw_data. But not sure yet if this is needed. */
2213    btif_transfer_context(btif_dm_remote_service_record_evt, event, (char*)p_data, sizeof(tBTA_DM_SEARCH), NULL);
2214 }
2215
2216 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
2217 /*******************************************************************************
2218 **
2219 ** Function         bta_energy_info_cb
2220 **
2221 ** Description      Switches context from BTE to BTIF for DM energy info event
2222 **
2223 ** Returns          void
2224 **
2225 *******************************************************************************/
2226 static void bta_energy_info_cb(tBTA_DM_BLE_TX_TIME_MS tx_time, tBTA_DM_BLE_RX_TIME_MS rx_time,
2227                                     tBTA_DM_BLE_IDLE_TIME_MS idle_time,
2228                                     tBTA_DM_BLE_ENERGY_USED energy_used,
2229                                     tBTA_DM_CONTRL_STATE ctrl_state, tBTA_STATUS status)
2230 {
2231     BTIF_TRACE_DEBUG("energy_info_cb-Status:%d,state=%d,tx_t=%ld, rx_t=%ld, idle_time=%ld,used=%ld",
2232         status, ctrl_state, tx_time, rx_time, idle_time, energy_used);
2233
2234     btif_activity_energy_info_cb_t btif_cb;
2235     btif_cb.status = status;
2236     btif_cb.ctrl_state = ctrl_state;
2237     btif_cb.tx_time = (uint64_t) tx_time;
2238     btif_cb.rx_time = (uint64_t) rx_time;
2239     btif_cb.idle_time =(uint64_t) idle_time;
2240     btif_cb.energy_used =(uint64_t) energy_used;
2241     btif_transfer_context(btif_dm_upstreams_evt, BTA_DM_ENER_INFO_READ,
2242                           (char*) &btif_cb, sizeof(btif_activity_energy_info_cb_t), NULL);
2243 }
2244 #endif
2245
2246 /*******************************************************************************
2247 **
2248 ** Function         bte_scan_filt_param_cfg_evt
2249 **
2250 ** Description      Scan filter param config event
2251 **
2252 ** Returns          void
2253 **
2254 *******************************************************************************/
2255 static void bte_scan_filt_param_cfg_evt(UINT8 action_type,
2256                                         tBTA_DM_BLE_PF_AVBL_SPACE avbl_space,
2257                                         tBTA_DM_BLE_REF_VALUE ref_value, tBTA_STATUS status)
2258 {
2259     /* This event occurs on calling BTA_DmBleCfgFilterCondition internally,
2260     ** and that is why there is no HAL callback
2261     */
2262     if(BTA_SUCCESS != status)
2263     {
2264         BTIF_TRACE_ERROR("%s, %d", __FUNCTION__, status);
2265     }
2266     else
2267     {
2268         BTIF_TRACE_DEBUG("%s", __FUNCTION__);
2269     }
2270 }
2271
2272 /*****************************************************************************
2273 **
2274 **   btif api functions (no context switch)
2275 **
2276 *****************************************************************************/
2277
2278 /*******************************************************************************
2279 **
2280 ** Function         btif_dm_start_discovery
2281 **
2282 ** Description      Start device discovery/inquiry
2283 **
2284 ** Returns          bt_status_t
2285 **
2286 *******************************************************************************/
2287 bt_status_t btif_dm_start_discovery(void)
2288 {
2289     tBTA_DM_INQ inq_params;
2290     tBTA_SERVICE_MASK services = 0;
2291     tBTA_DM_BLE_PF_FILT_PARAMS adv_filt_param;
2292
2293     BTIF_TRACE_EVENT("%s", __FUNCTION__);
2294
2295 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
2296     memset(&adv_filt_param, 0, sizeof(tBTA_DM_BLE_PF_FILT_PARAMS));
2297     /* Cleanup anything remaining on index 0 */
2298     BTA_DmBleScanFilterSetup(BTA_DM_BLE_SCAN_COND_DELETE, 0, &adv_filt_param, NULL,
2299                              bte_scan_filt_param_cfg_evt, 0);
2300
2301     /* Add an allow-all filter on index 0*/
2302     adv_filt_param.dely_mode = IMMEDIATE_DELY_MODE;
2303     adv_filt_param.feat_seln = ALLOW_ALL_FILTER;
2304     adv_filt_param.filt_logic_type = BTA_DM_BLE_PF_FILT_LOGIC_OR;
2305     adv_filt_param.list_logic_type = BTA_DM_BLE_PF_LIST_LOGIC_OR;
2306     adv_filt_param.rssi_low_thres = LOWEST_RSSI_VALUE;
2307     adv_filt_param.rssi_high_thres = LOWEST_RSSI_VALUE;
2308     BTA_DmBleScanFilterSetup(BTA_DM_BLE_SCAN_COND_ADD, 0, &adv_filt_param, NULL,
2309                              bte_scan_filt_param_cfg_evt, 0);
2310
2311     /* TODO: Do we need to handle multiple inquiries at the same time? */
2312
2313     /* Set inquiry params and call API */
2314     inq_params.mode = BTA_DM_GENERAL_INQUIRY|BTA_BLE_GENERAL_INQUIRY;
2315 #if (defined(BTA_HOST_INTERLEAVE_SEARCH) && BTA_HOST_INTERLEAVE_SEARCH == TRUE)
2316     inq_params.intl_duration[0]= BTIF_DM_INTERLEAVE_DURATION_BR_ONE;
2317     inq_params.intl_duration[1]= BTIF_DM_INTERLEAVE_DURATION_LE_ONE;
2318     inq_params.intl_duration[2]= BTIF_DM_INTERLEAVE_DURATION_BR_TWO;
2319     inq_params.intl_duration[3]= BTIF_DM_INTERLEAVE_DURATION_LE_TWO;
2320 #endif
2321 #else
2322     inq_params.mode = BTA_DM_GENERAL_INQUIRY;
2323 #endif
2324     inq_params.duration = BTIF_DM_DEFAULT_INQ_MAX_DURATION;
2325
2326     inq_params.max_resps = BTIF_DM_DEFAULT_INQ_MAX_RESULTS;
2327     inq_params.report_dup = TRUE;
2328
2329     inq_params.filter_type = BTA_DM_INQ_CLR;
2330     /* TODO: Filter device by BDA needs to be implemented here */
2331
2332     /* Will be enabled to TRUE once inquiry busy level has been received */
2333     btif_dm_inquiry_in_progress = FALSE;
2334     /* find nearby devices */
2335     BTA_DmSearch(&inq_params, services, bte_search_devices_evt);
2336
2337     return BT_STATUS_SUCCESS;
2338 }
2339
2340 /*******************************************************************************
2341 **
2342 ** Function         btif_dm_cancel_discovery
2343 **
2344 ** Description      Cancels search
2345 **
2346 ** Returns          bt_status_t
2347 **
2348 *******************************************************************************/
2349 bt_status_t btif_dm_cancel_discovery(void)
2350 {
2351     BTIF_TRACE_EVENT("%s", __FUNCTION__);
2352     BTA_DmSearchCancel();
2353     return BT_STATUS_SUCCESS;
2354 }
2355
2356 /*******************************************************************************
2357 **
2358 ** Function         btif_dm_create_bond
2359 **
2360 ** Description      Initiate bonding with the specified device
2361 **
2362 ** Returns          bt_status_t
2363 **
2364 *******************************************************************************/
2365 bt_status_t btif_dm_create_bond(const bt_bdaddr_t *bd_addr, int transport)
2366 {
2367     btif_dm_create_bond_cb_t create_bond_cb;
2368     create_bond_cb.transport = transport;
2369     bdcpy(create_bond_cb.bdaddr.address, bd_addr->address);
2370
2371     bdstr_t bdstr;
2372     BTIF_TRACE_EVENT("%s: bd_addr=%s, transport=%d", __FUNCTION__, bdaddr_to_string(bd_addr, bdstr, sizeof(bdstr)), transport);
2373     if (pairing_cb.state != BT_BOND_STATE_NONE)
2374         return BT_STATUS_BUSY;
2375
2376     btif_stats_add_bond_event(bd_addr, BTIF_DM_FUNC_CREATE_BOND, pairing_cb.state);
2377
2378     btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_CREATE_BOND,
2379                           (char *)&create_bond_cb, sizeof(btif_dm_create_bond_cb_t), NULL);
2380
2381     return BT_STATUS_SUCCESS;
2382 }
2383
2384 /*******************************************************************************
2385 **
2386 ** Function         btif_dm_create_bond_out_of_band
2387 **
2388 ** Description      Initiate bonding with the specified device using out of band data
2389 **
2390 ** Returns          bt_status_t
2391 **
2392 *******************************************************************************/
2393 bt_status_t btif_dm_create_bond_out_of_band(const bt_bdaddr_t *bd_addr, int transport, const bt_out_of_band_data_t *oob_data)
2394 {
2395     bdcpy(oob_cb.bdaddr, bd_addr->address);
2396     memcpy(&oob_cb.oob_data, oob_data, sizeof(bt_out_of_band_data_t));
2397
2398     uint8_t empty[] = {0, 0, 0, 0, 0, 0, 0};
2399     // If LE Bluetooth Device Address is provided, use provided address type
2400     // value.
2401     if (memcmp(oob_data->le_bt_dev_addr, empty, 7) != 0) {
2402         /* byte no 7 is address type in LE Bluetooth Address OOB data */
2403         uint8_t address_type = oob_data->le_bt_dev_addr[6];
2404         if (address_type == BLE_ADDR_PUBLIC || address_type == BLE_ADDR_RANDOM) {
2405             // bd_addr->address is already reversed, so use it instead of
2406             // oob_data->le_bt_dev_addr
2407             BTM_SecAddBleDevice(bd_addr->address, NULL, BT_DEVICE_TYPE_BLE, address_type);
2408         }
2409     }
2410
2411     bdstr_t bdstr;
2412     BTIF_TRACE_EVENT("%s: bd_addr=%s, transport=%d", __FUNCTION__, bdaddr_to_string(bd_addr, bdstr, sizeof(bdstr)), transport);
2413     return btif_dm_create_bond(bd_addr, transport);
2414 }
2415
2416 /*******************************************************************************
2417 **
2418 ** Function         btif_dm_cancel_bond
2419 **
2420 ** Description      Initiate bonding with the specified device
2421 **
2422 ** Returns          bt_status_t
2423 **
2424 *******************************************************************************/
2425
2426 bt_status_t btif_dm_cancel_bond(const bt_bdaddr_t *bd_addr)
2427 {
2428     bdstr_t bdstr;
2429
2430     BTIF_TRACE_EVENT("%s: bd_addr=%s", __FUNCTION__, bdaddr_to_string(bd_addr, bdstr, sizeof(bdstr)));
2431
2432     btif_stats_add_bond_event(bd_addr, BTIF_DM_FUNC_CANCEL_BOND, pairing_cb.state);
2433
2434     /* TODO:
2435     **  1. Restore scan modes
2436     **  2. special handling for HID devices
2437     */
2438     if (pairing_cb.state == BT_BOND_STATE_BONDING)
2439     {
2440
2441 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
2442
2443         if (pairing_cb.is_ssp)
2444         {
2445             if (pairing_cb.is_le_only)
2446             {
2447                 BTA_DmBleSecurityGrant((UINT8 *)bd_addr->address,BTA_DM_SEC_PAIR_NOT_SPT);
2448             }
2449             else
2450             {
2451                 BTA_DmConfirm( (UINT8 *)bd_addr->address, FALSE);
2452                 BTA_DmBondCancel ((UINT8 *)bd_addr->address);
2453                 btif_storage_remove_bonded_device((bt_bdaddr_t *)bd_addr);
2454             }
2455         }
2456         else
2457         {
2458             if (pairing_cb.is_le_only)
2459             {
2460                 BTA_DmBondCancel ((UINT8 *)bd_addr->address);
2461             }
2462             else
2463             {
2464                 BTA_DmPinReply( (UINT8 *)bd_addr->address, FALSE, 0, NULL);
2465             }
2466         /* Cancel bonding, in case it is in ACL connection setup state */
2467         BTA_DmBondCancel ((UINT8 *)bd_addr->address);
2468         }
2469
2470 #else
2471         if (pairing_cb.is_ssp)
2472         {
2473             BTA_DmConfirm( (UINT8 *)bd_addr->address, FALSE);
2474         }
2475         else
2476         {
2477             BTA_DmPinReply( (UINT8 *)bd_addr->address, FALSE, 0, NULL);
2478         }
2479         /* Cancel bonding, in case it is in ACL connection setup state */
2480         BTA_DmBondCancel ((UINT8 *)bd_addr->address);
2481         btif_storage_remove_bonded_device((bt_bdaddr_t *)bd_addr);
2482 #endif
2483     }
2484
2485     return BT_STATUS_SUCCESS;
2486 }
2487
2488 /*******************************************************************************
2489 **
2490 ** Function         btif_dm_hh_open_failed
2491 **
2492 ** Description      informs the upper layers if the HH have failed during bonding
2493 **
2494 ** Returns          none
2495 **
2496 *******************************************************************************/
2497
2498 void btif_dm_hh_open_failed(bt_bdaddr_t *bdaddr)
2499 {
2500     if (pairing_cb.state == BT_BOND_STATE_BONDING &&
2501             bdcmp(bdaddr->address, pairing_cb.bd_addr) == 0)
2502     {
2503         bond_state_changed(BT_STATUS_FAIL, bdaddr, BT_BOND_STATE_NONE);
2504     }
2505 }
2506
2507 /*******************************************************************************
2508 **
2509 ** Function         btif_dm_remove_bond
2510 **
2511 ** Description      Removes bonding with the specified device
2512 **
2513 ** Returns          bt_status_t
2514 **
2515 *******************************************************************************/
2516
2517 bt_status_t btif_dm_remove_bond(const bt_bdaddr_t *bd_addr)
2518 {
2519     bdstr_t bdstr;
2520
2521     BTIF_TRACE_EVENT("%s: bd_addr=%s", __FUNCTION__, bdaddr_to_string(bd_addr, bdstr, sizeof(bdstr)));
2522
2523     btif_stats_add_bond_event(bd_addr, BTIF_DM_FUNC_REMOVE_BOND, pairing_cb.state);
2524
2525     btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_REMOVE_BOND,
2526                           (char *)bd_addr, sizeof(bt_bdaddr_t), NULL);
2527
2528     return BT_STATUS_SUCCESS;
2529 }
2530
2531 /*******************************************************************************
2532 **
2533 ** Function         btif_dm_pin_reply
2534 **
2535 ** Description      BT legacy pairing - PIN code reply
2536 **
2537 ** Returns          bt_status_t
2538 **
2539 *******************************************************************************/
2540
2541 bt_status_t btif_dm_pin_reply( const bt_bdaddr_t *bd_addr, uint8_t accept,
2542                                uint8_t pin_len, bt_pin_code_t *pin_code)
2543 {
2544     BTIF_TRACE_EVENT("%s: accept=%d", __FUNCTION__, accept);
2545     if (pin_code == NULL || pin_len > PIN_CODE_LEN)
2546         return BT_STATUS_FAIL;
2547 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
2548
2549     if (pairing_cb.is_le_only)
2550     {
2551         int i;
2552         UINT32 passkey = 0;
2553         int multi[] = {100000, 10000, 1000, 100, 10,1};
2554         BD_ADDR remote_bd_addr;
2555         bdcpy(remote_bd_addr, bd_addr->address);
2556         for (i = 0; i < 6; i++)
2557         {
2558             passkey += (multi[i] * (pin_code->pin[i] - '0'));
2559         }
2560         BTIF_TRACE_DEBUG("btif_dm_pin_reply: passkey: %d", passkey);
2561         BTA_DmBlePasskeyReply(remote_bd_addr, accept, passkey);
2562
2563     }
2564     else
2565     {
2566         BTA_DmPinReply( (UINT8 *)bd_addr->address, accept, pin_len, pin_code->pin);
2567         if (accept)
2568             pairing_cb.pin_code_len = pin_len;
2569     }
2570 #else
2571     BTA_DmPinReply( (UINT8 *)bd_addr->address, accept, pin_len, pin_code->pin);
2572
2573     if (accept)
2574         pairing_cb.pin_code_len = pin_len;
2575 #endif
2576     return BT_STATUS_SUCCESS;
2577 }
2578
2579 /*******************************************************************************
2580 **
2581 ** Function         btif_dm_ssp_reply
2582 **
2583 ** Description      BT SSP Reply - Just Works, Numeric Comparison & Passkey Entry
2584 **
2585 ** Returns          bt_status_t
2586 **
2587 *******************************************************************************/
2588 bt_status_t btif_dm_ssp_reply(const bt_bdaddr_t *bd_addr,
2589                                  bt_ssp_variant_t variant, uint8_t accept,
2590                                  uint32_t passkey)
2591 {
2592     UNUSED(passkey);
2593
2594     if (variant == BT_SSP_VARIANT_PASSKEY_ENTRY)
2595     {
2596         /* This is not implemented in the stack.
2597          * For devices with display, this is not needed
2598         */
2599         BTIF_TRACE_WARNING("%s: Not implemented", __FUNCTION__);
2600         return BT_STATUS_FAIL;
2601     }
2602     /* BT_SSP_VARIANT_CONSENT & BT_SSP_VARIANT_PASSKEY_CONFIRMATION supported */
2603     BTIF_TRACE_EVENT("%s: accept=%d", __FUNCTION__, accept);
2604 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
2605     if (pairing_cb.is_le_only)
2606     {
2607         if(pairing_cb.is_le_nc)
2608         {
2609             BTA_DmBleConfirmReply((UINT8 *)bd_addr->address,accept);
2610         } else {
2611             if (accept)
2612                 BTA_DmBleSecurityGrant((UINT8 *)bd_addr->address,BTA_DM_SEC_GRANTED);
2613             else
2614                 BTA_DmBleSecurityGrant((UINT8 *)bd_addr->address,BTA_DM_SEC_PAIR_NOT_SPT);
2615         }
2616     } else {
2617         BTA_DmConfirm( (UINT8 *)bd_addr->address, accept);
2618     }
2619 #else
2620     BTA_DmConfirm( (UINT8 *)bd_addr->address, accept);
2621 #endif
2622     return BT_STATUS_SUCCESS;
2623 }
2624
2625 /*******************************************************************************
2626 **
2627 ** Function         btif_dm_get_adapter_property
2628 **
2629 ** Description     Queries the BTA for the adapter property
2630 **
2631 ** Returns          bt_status_t
2632 **
2633 *******************************************************************************/
2634 bt_status_t btif_dm_get_adapter_property(bt_property_t *prop)
2635 {
2636     BTIF_TRACE_EVENT("%s: type=0x%x", __FUNCTION__, prop->type);
2637     switch (prop->type)
2638     {
2639         case BT_PROPERTY_BDNAME:
2640         {
2641             bt_bdname_t *bd_name = (bt_bdname_t*)prop->val;
2642             strncpy((char *)bd_name->name, (char *)btif_get_default_local_name(),
2643                    sizeof(bd_name->name) - 1);
2644             bd_name->name[sizeof(bd_name->name) - 1] = 0;
2645             prop->len = strlen((char *)bd_name->name);
2646         }
2647         break;
2648
2649         case BT_PROPERTY_ADAPTER_SCAN_MODE:
2650         {
2651             /* if the storage does not have it. Most likely app never set it. Default is NONE */
2652             bt_scan_mode_t *mode = (bt_scan_mode_t*)prop->val;
2653             *mode = BT_SCAN_MODE_NONE;
2654             prop->len = sizeof(bt_scan_mode_t);
2655         }
2656         break;
2657
2658         case BT_PROPERTY_ADAPTER_DISCOVERY_TIMEOUT:
2659         {
2660             uint32_t *tmt = (uint32_t*)prop->val;
2661             *tmt = 120; /* default to 120s, if not found in NV */
2662             prop->len = sizeof(uint32_t);
2663         }
2664         break;
2665
2666         default:
2667             prop->len = 0;
2668             return BT_STATUS_FAIL;
2669     }
2670     return BT_STATUS_SUCCESS;
2671 }
2672
2673 /*******************************************************************************
2674 **
2675 ** Function         btif_dm_get_remote_services
2676 **
2677 ** Description      Start SDP to get remote services
2678 **
2679 ** Returns          bt_status_t
2680 **
2681 *******************************************************************************/
2682 bt_status_t btif_dm_get_remote_services(bt_bdaddr_t *remote_addr)
2683 {
2684     bdstr_t bdstr;
2685
2686     BTIF_TRACE_EVENT("%s: remote_addr=%s", __FUNCTION__, bdaddr_to_string(remote_addr, bdstr, sizeof(bdstr)));
2687
2688     BTA_DmDiscover(remote_addr->address, BTA_ALL_SERVICE_MASK,
2689                    bte_dm_search_services_evt, TRUE);
2690
2691     return BT_STATUS_SUCCESS;
2692 }
2693
2694 /*******************************************************************************
2695 **
2696 ** Function         btif_dm_get_remote_services_transport
2697 **
2698 ** Description      Start SDP to get remote services by transport
2699 **
2700 ** Returns          bt_status_t
2701 **
2702 *******************************************************************************/
2703 bt_status_t btif_dm_get_remote_services_by_transport(bt_bdaddr_t *remote_addr, const int transport)
2704 {
2705     BTIF_TRACE_EVENT("%s", __func__);
2706
2707     /* Set the mask extension */
2708     tBTA_SERVICE_MASK_EXT mask_ext;
2709     mask_ext.num_uuid = 0;
2710     mask_ext.p_uuid = NULL;
2711     mask_ext.srvc_mask = BTA_ALL_SERVICE_MASK;
2712
2713     BTA_DmDiscoverByTransport(remote_addr->address, &mask_ext,
2714                    bte_dm_search_services_evt, TRUE, transport);
2715
2716     return BT_STATUS_SUCCESS;
2717 }
2718
2719 /*******************************************************************************
2720 **
2721 ** Function         btif_dm_get_remote_service_record
2722 **
2723 ** Description      Start SDP to get remote service record
2724 **
2725 **
2726 ** Returns          bt_status_t
2727 *******************************************************************************/
2728 bt_status_t btif_dm_get_remote_service_record(bt_bdaddr_t *remote_addr,
2729                                                     bt_uuid_t *uuid)
2730 {
2731     tSDP_UUID sdp_uuid;
2732     bdstr_t bdstr;
2733
2734     BTIF_TRACE_EVENT("%s: remote_addr=%s", __FUNCTION__, bdaddr_to_string(remote_addr, bdstr, sizeof(bdstr)));
2735
2736     sdp_uuid.len = MAX_UUID_SIZE;
2737     memcpy(sdp_uuid.uu.uuid128, uuid->uu, MAX_UUID_SIZE);
2738
2739     BTA_DmDiscoverUUID(remote_addr->address, &sdp_uuid,
2740                        bte_dm_remote_service_record_evt, TRUE);
2741
2742     return BT_STATUS_SUCCESS;
2743 }
2744
2745 void btif_dm_execute_service_request(UINT16 event, char *p_param)
2746 {
2747     BOOLEAN b_enable = FALSE;
2748     bt_status_t status;
2749     if (event == BTIF_DM_ENABLE_SERVICE)
2750     {
2751         b_enable = TRUE;
2752     }
2753     status = btif_in_execute_service_request(*((tBTA_SERVICE_ID*)p_param), b_enable);
2754     if (status == BT_STATUS_SUCCESS)
2755     {
2756         bt_property_t property;
2757         bt_uuid_t local_uuids[BT_MAX_NUM_UUIDS];
2758
2759         /* Now send the UUID_PROPERTY_CHANGED event to the upper layer */
2760         BTIF_STORAGE_FILL_PROPERTY(&property, BT_PROPERTY_UUIDS,
2761                                     sizeof(local_uuids), local_uuids);
2762         btif_storage_get_adapter_property(&property);
2763         HAL_CBACK(bt_hal_cbacks, adapter_properties_cb,
2764                           BT_STATUS_SUCCESS, 1, &property);
2765     }
2766     return;
2767 }
2768
2769 void btif_dm_proc_io_req(BD_ADDR bd_addr, tBTA_IO_CAP *p_io_cap, tBTA_OOB_DATA *p_oob_data,
2770                       tBTA_AUTH_REQ *p_auth_req, BOOLEAN is_orig)
2771 {
2772     UINT8   yes_no_bit = BTA_AUTH_SP_YES & *p_auth_req;
2773     /* if local initiated:
2774     **      1. set DD + MITM
2775     ** if remote initiated:
2776     **      1. Copy over the auth_req from peer's io_rsp
2777     **      2. Set the MITM if peer has it set or if peer has DisplayYesNo (iPhone)
2778     ** as a fallback set MITM+GB if peer had MITM set
2779     */
2780     UNUSED (bd_addr);
2781     UNUSED (p_io_cap);
2782     UNUSED (p_oob_data);
2783
2784     BTIF_TRACE_DEBUG("+%s: p_auth_req=%d", __FUNCTION__, *p_auth_req);
2785     if(pairing_cb.is_local_initiated)
2786     {
2787         /* if initing/responding to a dedicated bonding, use dedicate bonding bit */
2788         *p_auth_req = BTA_AUTH_DD_BOND | BTA_AUTH_SP_YES;
2789     }
2790     else if (!is_orig)
2791     {
2792         /* peer initiated paring. They probably know what they want.
2793         ** Copy the mitm from peer device.
2794         */
2795         BTIF_TRACE_DEBUG("%s: setting p_auth_req to peer's: %d",
2796                 __FUNCTION__, pairing_cb.auth_req);
2797         *p_auth_req = (pairing_cb.auth_req & BTA_AUTH_BONDS);
2798
2799         /* copy over the MITM bit as well. In addition if the peer has DisplayYesNo, force MITM */
2800         if ((yes_no_bit) || (pairing_cb.io_cap & BTM_IO_CAP_IO) )
2801             *p_auth_req |= BTA_AUTH_SP_YES;
2802     }
2803     else if (yes_no_bit)
2804     {
2805         /* set the general bonding bit for stored device */
2806         *p_auth_req = BTA_AUTH_GEN_BOND | yes_no_bit;
2807     }
2808     BTIF_TRACE_DEBUG("-%s: p_auth_req=%d", __FUNCTION__, *p_auth_req);
2809 }
2810
2811 void btif_dm_proc_io_rsp(BD_ADDR bd_addr, tBTA_IO_CAP io_cap,
2812                       tBTA_OOB_DATA oob_data, tBTA_AUTH_REQ auth_req)
2813 {
2814     UNUSED (bd_addr);
2815     UNUSED (oob_data);
2816
2817     if(auth_req & BTA_AUTH_BONDS)
2818     {
2819         BTIF_TRACE_DEBUG("%s auth_req:%d", __FUNCTION__, auth_req);
2820         pairing_cb.auth_req = auth_req;
2821         pairing_cb.io_cap = io_cap;
2822     }
2823 }
2824
2825 void btif_dm_set_oob_for_io_req(tBTA_OOB_DATA  *p_has_oob_data)
2826 {
2827     if (is_empty_128bit(oob_cb.oob_data.c192))
2828     {
2829         *p_has_oob_data = FALSE;
2830     }
2831     else
2832     {
2833         *p_has_oob_data = TRUE;
2834     }
2835     BTIF_TRACE_DEBUG("%s: *p_has_oob_data=%d", __func__, *p_has_oob_data);
2836 }
2837
2838 void btif_dm_set_oob_for_le_io_req(BD_ADDR bd_addr, tBTA_OOB_DATA  *p_has_oob_data,
2839                                    tBTA_LE_AUTH_REQ *p_auth_req)
2840 {
2841
2842     if (!is_empty_128bit(oob_cb.oob_data.le_sc_c) &&
2843         !is_empty_128bit(oob_cb.oob_data.le_sc_r)) {
2844         /* We have LE SC OOB data */
2845
2846         /* make sure OOB data is for this particular device */
2847         if (memcmp(bd_addr, oob_cb.bdaddr, BD_ADDR_LEN) == 0) {
2848             *p_auth_req = ((*p_auth_req) | BTM_LE_AUTH_REQ_SC_ONLY);
2849             *p_has_oob_data = true;
2850         } else {
2851             *p_has_oob_data = false;
2852             BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
2853                                __func__);
2854         }
2855     } else if (!is_empty_128bit(oob_cb.oob_data.sm_tk)) {
2856         /* We have security manager TK */
2857
2858         /* make sure OOB data is for this particular device */
2859         if (memcmp(bd_addr, oob_cb.bdaddr, BD_ADDR_LEN) == 0) {
2860             // When using OOB with TK, SC Secure Connections bit must be disabled.
2861             tBTA_LE_AUTH_REQ mask = ~BTM_LE_AUTH_REQ_SC_ONLY;
2862             *p_auth_req = ((*p_auth_req) & mask);
2863
2864             *p_has_oob_data = true;
2865         } else {
2866             *p_has_oob_data = false;
2867             BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address",
2868                                __func__);
2869         }
2870     } else {
2871         *p_has_oob_data = false;
2872     }
2873     BTIF_TRACE_DEBUG("%s *p_has_oob_data=%d", __func__, *p_has_oob_data);
2874 }
2875
2876 #ifdef BTIF_DM_OOB_TEST
2877 void btif_dm_load_local_oob(void)
2878 {
2879     char prop_oob[PROPERTY_VALUE_MAX];
2880     osi_property_get("service.brcm.bt.oob", prop_oob, "3");
2881     BTIF_TRACE_DEBUG("%s: prop_oob = %s", __func__, prop_oob);
2882     if (prop_oob[0] != '3')
2883     {
2884         if (is_empty_128bit(oob_cb.oob_data.c192))
2885         {
2886             BTIF_TRACE_DEBUG("%s: read OOB, call BTA_DmLocalOob()", __func__);
2887             BTA_DmLocalOob();
2888         }
2889     }
2890 }
2891
2892 void btif_dm_proc_loc_oob(BOOLEAN valid, BT_OCTET16 c, BT_OCTET16 r)
2893 {
2894     FILE *fp;
2895     char *path_a = "/data/misc/bluedroid/LOCAL/a.key";
2896     char *path_b = "/data/misc/bluedroid/LOCAL/b.key";
2897     char *path = NULL;
2898     char prop_oob[PROPERTY_VALUE_MAX];
2899     BTIF_TRACE_DEBUG("%s: valid=%d", __func__, valid);
2900     if (is_empty_128bit(oob_cb.oob_data.c192) && valid)
2901     {
2902         BTIF_TRACE_DEBUG("save local OOB data in memory");
2903         memcpy(oob_cb.oob_data.c192, c, BT_OCTET16_LEN);
2904         memcpy(oob_cb.oob_data.r192, r, BT_OCTET16_LEN);
2905         osi_property_get("service.brcm.bt.oob", prop_oob, "3");
2906         BTIF_TRACE_DEBUG("%s: prop_oob = %s", __func__, prop_oob);
2907         if (prop_oob[0] == '1')
2908             path = path_a;
2909         else if (prop_oob[0] == '2')
2910             path = path_b;
2911         if (path)
2912         {
2913             fp = fopen(path, "wb+");
2914             if (fp == NULL)
2915             {
2916                 BTIF_TRACE_DEBUG("%s: failed to save local OOB data to %s", __func__, path);
2917             }
2918             else
2919             {
2920                 BTIF_TRACE_DEBUG("%s: save local OOB data into file %s", __func__, path);
2921                 fwrite (c , 1 , BT_OCTET16_LEN , fp );
2922                 fwrite (r , 1 , BT_OCTET16_LEN , fp );
2923                 fclose(fp);
2924             }
2925         }
2926     }
2927 }
2928
2929 /*******************************************************************************
2930 **
2931 ** Function         btif_dm_get_smp_config
2932 **
2933 ** Description      Retrieve the SMP pairing options from the bt_stack.conf
2934 **                  file. To provide specific pairing options for the host
2935 **                  add a node with label "SmpOptions" to the config file
2936 **                  and assign it a comma separated list of 5 values in the
2937 **                  format: auth, io, ikey, rkey, ksize, oob
2938 **                  eg: PTS_SmpOptions=0xD,0x4,0xf,0xf,0x10
2939 **
2940 ** Parameters:      tBTE_APPL_CFG*: pointer to struct defining pairing options
2941 **
2942 ** Returns          TRUE if the options were successfully read, else FALSE
2943 **
2944 *******************************************************************************/
2945 BOOLEAN btif_dm_get_smp_config(tBTE_APPL_CFG* p_cfg) {
2946
2947     if(!stack_config_get_interface()->get_pts_smp_options()) {
2948         BTIF_TRACE_DEBUG ("%s: SMP options not found in configuration", __func__);
2949         return FALSE;
2950     }
2951
2952     char conf[64];
2953     const char* recv = stack_config_get_interface()->get_pts_smp_options();
2954     char* pch;
2955     char* endptr;
2956
2957     strncpy(conf, recv, 64);
2958     conf[63] = 0; // null terminate
2959
2960     if ((pch = strtok(conf, ",")) != NULL)
2961         p_cfg->ble_auth_req = (UINT8) strtoul(pch, &endptr, 16);
2962     else
2963         return FALSE;
2964
2965     if ((pch = strtok(NULL, ",")) != NULL)
2966         p_cfg->ble_io_cap =  (UINT8) strtoul(pch, &endptr, 16);
2967     else
2968         return FALSE;
2969
2970     if ((pch = strtok(NULL, ",")) != NULL)
2971         p_cfg->ble_init_key =  (UINT8) strtoul(pch, &endptr, 16);
2972     else
2973         return FALSE;
2974
2975     if ((pch = strtok(NULL, ",")) != NULL)
2976         p_cfg->ble_resp_key =  (UINT8) strtoul(pch, &endptr, 16);
2977     else
2978         return FALSE;
2979
2980     if ((pch = strtok(NULL, ",")) != NULL)
2981         p_cfg->ble_max_key_size =  (UINT8) strtoul(pch, &endptr, 16);
2982     else
2983         return FALSE;
2984
2985     return TRUE;
2986 }
2987
2988 BOOLEAN btif_dm_proc_rmt_oob(BD_ADDR bd_addr,  BT_OCTET16 p_c, BT_OCTET16 p_r)
2989 {
2990     char t[128];
2991     FILE *fp;
2992     char *path_a = "/data/misc/bluedroid/LOCAL/a.key";
2993     char *path_b = "/data/misc/bluedroid/LOCAL/b.key";
2994     char *path = NULL;
2995     char prop_oob[PROPERTY_VALUE_MAX];
2996     BOOLEAN result = FALSE;
2997     bt_bdaddr_t bt_bd_addr;
2998     bdcpy(oob_cb.bdaddr, bd_addr);
2999     osi_property_get("service.brcm.bt.oob", prop_oob, "3");
3000     BTIF_TRACE_DEBUG("%s: prop_oob = %s", __func__, prop_oob);
3001     if (prop_oob[0] == '1')
3002         path = path_b;
3003     else if (prop_oob[0] == '2')
3004         path = path_a;
3005     if (path)
3006     {
3007         fp = fopen(path, "rb");
3008         if (fp == NULL)
3009         {
3010             BTIF_TRACE_DEBUG("%s: failed to read OOB keys from %s", __func__, path);
3011             return FALSE;
3012         }
3013         else
3014         {
3015             BTIF_TRACE_DEBUG("%s: read OOB data from %s", __func__, path);
3016             fread (p_c , 1 , BT_OCTET16_LEN , fp );
3017             fread (p_r , 1 , BT_OCTET16_LEN , fp );
3018             fclose(fp);
3019         }
3020         BTIF_TRACE_DEBUG("----%s: TRUE", __func__);
3021         sprintf(t, "%02x:%02x:%02x:%02x:%02x:%02x",
3022                 oob_cb.bdaddr[0], oob_cb.bdaddr[1], oob_cb.bdaddr[2],
3023                 oob_cb.bdaddr[3], oob_cb.bdaddr[4], oob_cb.bdaddr[5]);
3024         BTIF_TRACE_DEBUG("----%s: peer_bdaddr = %s", __func__, t);
3025         sprintf(t, "%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
3026                 p_c[0], p_c[1], p_c[2],  p_c[3],  p_c[4],  p_c[5],  p_c[6],  p_c[7],
3027                 p_c[8], p_c[9], p_c[10], p_c[11], p_c[12], p_c[13], p_c[14], p_c[15]);
3028         BTIF_TRACE_DEBUG("----%s: c = %s", __func__, t);
3029         sprintf(t, "%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
3030                 p_r[0], p_r[1], p_r[2],  p_r[3],  p_r[4],  p_r[5],  p_r[6],  p_r[7],
3031                 p_r[8], p_r[9], p_r[10], p_r[11], p_r[12], p_r[13], p_r[14], p_r[15]);
3032         BTIF_TRACE_DEBUG("----%s: r = %s", __func__, t);
3033         bdcpy(bt_bd_addr.address, bd_addr);
3034         btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_BOND_STATE_BONDING,
3035                               (char *)&bt_bd_addr, sizeof(bt_bdaddr_t), NULL);
3036         result = TRUE;
3037     }
3038     BTIF_TRACE_DEBUG("%s: result=%d", __func__, result);
3039     return result;
3040 }
3041 #endif /*  BTIF_DM_OOB_TEST */
3042 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
3043
3044 static void btif_dm_ble_key_notif_evt(tBTA_DM_SP_KEY_NOTIF *p_ssp_key_notif)
3045 {
3046     bt_bdaddr_t bd_addr;
3047     bt_bdname_t bd_name;
3048     UINT32 cod;
3049     int dev_type;
3050
3051     BTIF_TRACE_DEBUG("%s", __FUNCTION__);
3052
3053     /* Remote name update */
3054     if (!btif_get_device_type(p_ssp_key_notif->bd_addr, &dev_type))
3055     {
3056         dev_type = BT_DEVICE_TYPE_BLE;
3057     }
3058     btif_dm_update_ble_remote_properties(p_ssp_key_notif->bd_addr , p_ssp_key_notif->bd_name,
3059                                          (tBT_DEVICE_TYPE) dev_type);
3060     bdcpy(bd_addr.address, p_ssp_key_notif->bd_addr);
3061     memcpy(bd_name.name, p_ssp_key_notif->bd_name, BD_NAME_LEN);
3062
3063     bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
3064     pairing_cb.is_ssp = FALSE;
3065     cod = COD_UNCLASSIFIED;
3066
3067     HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name,
3068               cod, BT_SSP_VARIANT_PASSKEY_NOTIFICATION,
3069               p_ssp_key_notif->passkey);
3070 }
3071
3072 /*******************************************************************************
3073 **
3074 ** Function         btif_dm_ble_auth_cmpl_evt
3075 **
3076 ** Description      Executes authentication complete event in btif context
3077 **
3078 ** Returns          void
3079 **
3080 *******************************************************************************/
3081 static void btif_dm_ble_auth_cmpl_evt (tBTA_DM_AUTH_CMPL *p_auth_cmpl)
3082 {
3083     /* Save link key, if not temporary */
3084     bt_bdaddr_t bd_addr;
3085     bt_status_t status = BT_STATUS_FAIL;
3086     bt_bond_state_t state = BT_BOND_STATE_NONE;
3087
3088     bdcpy(bd_addr.address, p_auth_cmpl->bd_addr);
3089
3090     /* Clear OOB data */
3091     memset(&oob_cb, 0, sizeof(oob_cb));
3092
3093     if ( (p_auth_cmpl->success == TRUE) && (p_auth_cmpl->key_present) )
3094     {
3095         /* store keys */
3096     }
3097     if (p_auth_cmpl->success)
3098     {
3099         status = BT_STATUS_SUCCESS;
3100         state = BT_BOND_STATE_BONDED;
3101         int addr_type;
3102         bt_bdaddr_t bdaddr;
3103         bdcpy(bdaddr.address, p_auth_cmpl->bd_addr);
3104         if (btif_storage_get_remote_addr_type(&bdaddr, &addr_type) != BT_STATUS_SUCCESS)
3105             btif_storage_set_remote_addr_type(&bdaddr, p_auth_cmpl->addr_type);
3106
3107         /* Test for temporary bonding */
3108         if (btm_get_bond_type_dev(p_auth_cmpl->bd_addr) == BOND_TYPE_TEMPORARY) {
3109             BTIF_TRACE_DEBUG("%s: sending BT_BOND_STATE_NONE for Temp pairing",
3110                              __func__);
3111             btif_storage_remove_bonded_device(&bdaddr);
3112             state = BT_BOND_STATE_NONE;
3113         } else {
3114             btif_dm_save_ble_bonding_keys();
3115             BTA_GATTC_Refresh(bd_addr.address);
3116             btif_dm_get_remote_services_by_transport(&bd_addr, BTA_GATT_TRANSPORT_LE);
3117         }
3118     }
3119     else
3120     {
3121         /*Map the HCI fail reason  to  bt status  */
3122         switch (p_auth_cmpl->fail_reason)
3123         {
3124             case BTA_DM_AUTH_SMP_PAIR_AUTH_FAIL:
3125             case BTA_DM_AUTH_SMP_CONFIRM_VALUE_FAIL:
3126             case BTA_DM_AUTH_SMP_UNKNOWN_ERR:
3127             case BTA_DM_AUTH_SMP_CONN_TOUT:
3128                 btif_dm_remove_ble_bonding_keys();
3129                 status = BT_STATUS_AUTH_FAILURE;
3130                 break;
3131             case BTA_DM_AUTH_SMP_PAIR_NOT_SUPPORT:
3132                 status = BT_STATUS_AUTH_REJECTED;
3133                 break;
3134             default:
3135                 btif_dm_remove_ble_bonding_keys();
3136                 status =  BT_STATUS_FAIL;
3137                 break;
3138         }
3139     }
3140     bond_state_changed(status, &bd_addr, state);
3141 }
3142
3143 void    btif_dm_load_ble_local_keys(void)
3144 {
3145     memset(&ble_local_key_cb, 0, sizeof(btif_dm_local_key_cb_t));
3146
3147     if (btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_ER,(char*)&ble_local_key_cb.er[0],
3148                                        BT_OCTET16_LEN)== BT_STATUS_SUCCESS)
3149     {
3150         ble_local_key_cb.is_er_rcvd = TRUE;
3151         BTIF_TRACE_DEBUG("%s BLE ER key loaded",__FUNCTION__ );
3152     }
3153
3154     if ((btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_IR,(char*)&ble_local_key_cb.id_keys.ir[0],
3155                                         BT_OCTET16_LEN)== BT_STATUS_SUCCESS )&&
3156         (btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_IRK, (char*)&ble_local_key_cb.id_keys.irk[0],
3157                                         BT_OCTET16_LEN)== BT_STATUS_SUCCESS)&&
3158         (btif_storage_get_ble_local_key(BTIF_DM_LE_LOCAL_KEY_DHK,(char*)&ble_local_key_cb.id_keys.dhk[0],
3159                                         BT_OCTET16_LEN)== BT_STATUS_SUCCESS))
3160     {
3161         ble_local_key_cb.is_id_keys_rcvd = TRUE;
3162         BTIF_TRACE_DEBUG("%s BLE ID keys loaded",__FUNCTION__ );
3163     }
3164
3165 }
3166 void    btif_dm_get_ble_local_keys(tBTA_DM_BLE_LOCAL_KEY_MASK *p_key_mask, BT_OCTET16 er,
3167                                    tBTA_BLE_LOCAL_ID_KEYS *p_id_keys)
3168 {
3169     if (ble_local_key_cb.is_er_rcvd )
3170     {
3171         memcpy(&er[0], &ble_local_key_cb.er[0], sizeof(BT_OCTET16));
3172         *p_key_mask |= BTA_BLE_LOCAL_KEY_TYPE_ER;
3173     }
3174
3175     if (ble_local_key_cb.is_id_keys_rcvd)
3176     {
3177         memcpy(&p_id_keys->ir[0], &ble_local_key_cb.id_keys.ir[0], sizeof(BT_OCTET16));
3178         memcpy(&p_id_keys->irk[0],  &ble_local_key_cb.id_keys.irk[0], sizeof(BT_OCTET16));
3179         memcpy(&p_id_keys->dhk[0],  &ble_local_key_cb.id_keys.dhk[0], sizeof(BT_OCTET16));
3180         *p_key_mask |= BTA_BLE_LOCAL_KEY_TYPE_ID;
3181     }
3182     BTIF_TRACE_DEBUG("%s  *p_key_mask=0x%02x",__FUNCTION__,   *p_key_mask);
3183 }
3184
3185 void btif_dm_save_ble_bonding_keys(void)
3186 {
3187
3188     bt_bdaddr_t bd_addr;
3189
3190     BTIF_TRACE_DEBUG("%s",__FUNCTION__ );
3191
3192     bdcpy(bd_addr.address, pairing_cb.bd_addr);
3193
3194     if (pairing_cb.ble.is_penc_key_rcvd)
3195     {
3196         btif_storage_add_ble_bonding_key(&bd_addr,
3197                                          (char *) &pairing_cb.ble.penc_key,
3198                                          BTIF_DM_LE_KEY_PENC,
3199                                          sizeof(tBTM_LE_PENC_KEYS));
3200     }
3201
3202     if (pairing_cb.ble.is_pid_key_rcvd)
3203     {
3204         btif_storage_add_ble_bonding_key(&bd_addr,
3205                                          (char *) &pairing_cb.ble.pid_key,
3206                                          BTIF_DM_LE_KEY_PID,
3207                                          sizeof(tBTM_LE_PID_KEYS));
3208     }
3209
3210     if (pairing_cb.ble.is_pcsrk_key_rcvd)
3211     {
3212         btif_storage_add_ble_bonding_key(&bd_addr,
3213                                          (char *) &pairing_cb.ble.pcsrk_key,
3214                                          BTIF_DM_LE_KEY_PCSRK,
3215                                          sizeof(tBTM_LE_PCSRK_KEYS));
3216     }
3217
3218     if (pairing_cb.ble.is_lenc_key_rcvd)
3219     {
3220         btif_storage_add_ble_bonding_key(&bd_addr,
3221                                          (char *) &pairing_cb.ble.lenc_key,
3222                                          BTIF_DM_LE_KEY_LENC,
3223                                          sizeof(tBTM_LE_LENC_KEYS));
3224     }
3225
3226     if (pairing_cb.ble.is_lcsrk_key_rcvd)
3227     {
3228         btif_storage_add_ble_bonding_key(&bd_addr,
3229                                          (char *) &pairing_cb.ble.lcsrk_key,
3230                                          BTIF_DM_LE_KEY_LCSRK,
3231                                          sizeof(tBTM_LE_LCSRK_KEYS));
3232     }
3233
3234     if (pairing_cb.ble.is_lidk_key_rcvd)
3235     {
3236         btif_storage_add_ble_bonding_key(&bd_addr,
3237                                          NULL,
3238                                          BTIF_DM_LE_KEY_LID,
3239                                          0);
3240     }
3241
3242 }
3243
3244 void btif_dm_remove_ble_bonding_keys(void)
3245 {
3246     bt_bdaddr_t bd_addr;
3247
3248     BTIF_TRACE_DEBUG("%s",__FUNCTION__ );
3249
3250     bdcpy(bd_addr.address, pairing_cb.bd_addr);
3251     btif_storage_remove_ble_bonding_keys(&bd_addr);
3252 }
3253
3254 /*******************************************************************************
3255 **
3256 ** Function         btif_dm_ble_sec_req_evt
3257 **
3258 ** Description      Eprocess security request event in btif context
3259 **
3260 ** Returns          void
3261 **
3262 *******************************************************************************/
3263 void btif_dm_ble_sec_req_evt(tBTA_DM_BLE_SEC_REQ *p_ble_req)
3264 {
3265     bt_bdaddr_t bd_addr;
3266     bt_bdname_t bd_name;
3267     UINT32 cod;
3268     int dev_type;
3269
3270     BTIF_TRACE_DEBUG("%s", __FUNCTION__);
3271
3272     if (pairing_cb.state == BT_BOND_STATE_BONDING)
3273     {
3274         BTIF_TRACE_DEBUG("%s Discard security request", __FUNCTION__);
3275         return;
3276     }
3277
3278     /* Remote name update */
3279     if (!btif_get_device_type(p_ble_req->bd_addr, &dev_type))
3280     {
3281         dev_type = BT_DEVICE_TYPE_BLE;
3282     }
3283     btif_dm_update_ble_remote_properties(p_ble_req->bd_addr, p_ble_req->bd_name,
3284                                          (tBT_DEVICE_TYPE) dev_type);
3285
3286     bdcpy(bd_addr.address, p_ble_req->bd_addr);
3287     memcpy(bd_name.name, p_ble_req->bd_name, BD_NAME_LEN);
3288
3289     bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
3290
3291     pairing_cb.bond_type = BOND_TYPE_PERSISTENT;
3292     pairing_cb.is_le_only = TRUE;
3293     pairing_cb.is_le_nc = FALSE;
3294     pairing_cb.is_ssp = TRUE;
3295     btm_set_bond_type_dev(p_ble_req->bd_addr, pairing_cb.bond_type);
3296
3297     cod = COD_UNCLASSIFIED;
3298
3299     HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name, cod,
3300               BT_SSP_VARIANT_CONSENT, 0);
3301 }
3302
3303 /*******************************************************************************
3304 **
3305 ** Function         btif_dm_ble_passkey_req_evt
3306 **
3307 ** Description      Executes pin request event in btif context
3308 **
3309 ** Returns          void
3310 **
3311 *******************************************************************************/
3312 static void btif_dm_ble_passkey_req_evt(tBTA_DM_PIN_REQ *p_pin_req)
3313 {
3314     bt_bdaddr_t bd_addr;
3315     bt_bdname_t bd_name;
3316     UINT32 cod;
3317     int dev_type;
3318
3319     /* Remote name update */
3320     if (!btif_get_device_type(p_pin_req->bd_addr, &dev_type))
3321     {
3322         dev_type = BT_DEVICE_TYPE_BLE;
3323     }
3324     btif_dm_update_ble_remote_properties(p_pin_req->bd_addr,p_pin_req->bd_name,
3325                                          (tBT_DEVICE_TYPE) dev_type);
3326
3327     bdcpy(bd_addr.address, p_pin_req->bd_addr);
3328     memcpy(bd_name.name, p_pin_req->bd_name, BD_NAME_LEN);
3329
3330     bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
3331     pairing_cb.is_le_only = TRUE;
3332
3333     cod = COD_UNCLASSIFIED;
3334
3335     HAL_CBACK(bt_hal_cbacks, pin_request_cb,
3336               &bd_addr, &bd_name, cod, FALSE);
3337 }
3338 static void btif_dm_ble_key_nc_req_evt(tBTA_DM_SP_KEY_NOTIF *p_notif_req)
3339 {
3340     /* TODO implement key notification for numeric comparison */
3341     BTIF_TRACE_DEBUG("%s", __FUNCTION__);
3342
3343     /* Remote name update */
3344     btif_update_remote_properties(p_notif_req->bd_addr , p_notif_req->bd_name,
3345                                           NULL, BT_DEVICE_TYPE_BLE);
3346
3347     bt_bdaddr_t bd_addr;
3348     bdcpy(bd_addr.address, p_notif_req->bd_addr);
3349
3350     bt_bdname_t bd_name;
3351     memcpy(bd_name.name, p_notif_req->bd_name, BD_NAME_LEN);
3352
3353     bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
3354     pairing_cb.is_ssp = FALSE;
3355     pairing_cb.is_le_only = TRUE;
3356     pairing_cb.is_le_nc = TRUE;
3357
3358     HAL_CBACK(bt_hal_cbacks, ssp_request_cb, &bd_addr, &bd_name,
3359               COD_UNCLASSIFIED, BT_SSP_VARIANT_PASSKEY_CONFIRMATION,
3360               p_notif_req->passkey);
3361 }
3362
3363 static void btif_dm_ble_oob_req_evt(tBTA_DM_SP_RMT_OOB *req_oob_type)
3364 {
3365     BTIF_TRACE_DEBUG("%s", __FUNCTION__);
3366
3367     bt_bdaddr_t bd_addr;
3368     bdcpy(bd_addr.address, req_oob_type->bd_addr);
3369     /* We already checked if OOB data is present in
3370      * btif_dm_set_oob_for_le_io_req, but check here again. If it's not present
3371      * do nothing, pairing will timeout.
3372      */
3373     if (is_empty_128bit(oob_cb.oob_data.sm_tk)) {
3374         return;
3375     }
3376
3377     /* make sure OOB data is for this particular device */
3378     if (memcmp(req_oob_type->bd_addr, oob_cb.bdaddr, BD_ADDR_LEN) != 0) {
3379         BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address", __func__);
3380         return;
3381     }
3382
3383     /* Remote name update */
3384     btif_update_remote_properties(req_oob_type->bd_addr , req_oob_type->bd_name,
3385                                           NULL, BT_DEVICE_TYPE_BLE);
3386
3387     bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
3388     pairing_cb.is_ssp = FALSE;
3389     pairing_cb.is_le_only = TRUE;
3390     pairing_cb.is_le_nc = FALSE;
3391
3392     BTM_BleOobDataReply(req_oob_type->bd_addr, 0, 16, oob_cb.oob_data.sm_tk);
3393 }
3394
3395
3396 static void btif_dm_ble_sc_oob_req_evt(tBTA_DM_SP_RMT_OOB *req_oob_type)
3397 {
3398     BTIF_TRACE_DEBUG("%s", __func__);
3399
3400     bt_bdaddr_t bd_addr;
3401     bdcpy(bd_addr.address, req_oob_type->bd_addr);
3402
3403     /* We already checked if OOB data is present in
3404      * btif_dm_set_oob_for_le_io_req, but check here again. If it's not present
3405      * do nothing, pairing will timeout.
3406      */
3407     if (is_empty_128bit(oob_cb.oob_data.le_sc_c) &&
3408         is_empty_128bit(oob_cb.oob_data.le_sc_r)) {
3409         BTIF_TRACE_WARNING("%s: LE SC OOB data is empty", __func__);
3410         return;
3411     }
3412
3413     /* make sure OOB data is for this particular device */
3414     if (memcmp(req_oob_type->bd_addr, oob_cb.bdaddr, BD_ADDR_LEN) != 0) {
3415         BTIF_TRACE_WARNING("%s: remote address didn't match OOB data address", __func__);
3416         return;
3417     }
3418
3419     /* Remote name update */
3420     btif_update_remote_properties(req_oob_type->bd_addr , req_oob_type->bd_name,
3421                                           NULL, BT_DEVICE_TYPE_BLE);
3422
3423     bond_state_changed(BT_STATUS_SUCCESS, &bd_addr, BT_BOND_STATE_BONDING);
3424     pairing_cb.is_ssp = false;
3425     pairing_cb.is_le_only = true; //TODO: we can derive classic pairing from this one
3426     pairing_cb.is_le_nc = false;
3427
3428     BTM_BleSecureConnectionOobDataReply(req_oob_type->bd_addr,
3429                                         oob_cb.oob_data.le_sc_c,
3430                                         oob_cb.oob_data.le_sc_r);
3431 }
3432
3433 void btif_dm_update_ble_remote_properties( BD_ADDR bd_addr, BD_NAME bd_name,
3434                                            tBT_DEVICE_TYPE dev_type)
3435 {
3436    btif_update_remote_properties(bd_addr,bd_name,NULL,dev_type);
3437 }
3438
3439 static void btif_dm_ble_tx_test_cback(void *p)
3440 {
3441     btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_LE_TX_TEST,
3442                           (char *)p, 1, NULL);
3443 }
3444
3445 static void btif_dm_ble_rx_test_cback(void *p)
3446 {
3447     btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_LE_RX_TEST,
3448                           (char *)p, 1, NULL);
3449 }
3450
3451 static void btif_dm_ble_test_end_cback(void *p)
3452 {
3453     btif_transfer_context(btif_dm_generic_evt, BTIF_DM_CB_LE_TEST_END,
3454                           (char *)p, 3, NULL);
3455 }
3456 /*******************************************************************************
3457 **
3458 ** Function         btif_le_test_mode
3459 **
3460 ** Description     Sends a HCI BLE Test command to the Controller
3461 **
3462 ** Returns          BT_STATUS_SUCCESS on success
3463 **
3464 *******************************************************************************/
3465 bt_status_t btif_le_test_mode(uint16_t opcode, uint8_t *buf, uint8_t len)
3466 {
3467      switch (opcode) {
3468          case HCI_BLE_TRANSMITTER_TEST:
3469              if (len != 3) return BT_STATUS_PARM_INVALID;
3470              BTM_BleTransmitterTest(buf[0],buf[1],buf[2], btif_dm_ble_tx_test_cback);
3471              break;
3472          case HCI_BLE_RECEIVER_TEST:
3473              if (len != 1) return BT_STATUS_PARM_INVALID;
3474              BTM_BleReceiverTest(buf[0], btif_dm_ble_rx_test_cback);
3475              break;
3476          case HCI_BLE_TEST_END:
3477              BTM_BleTestEnd((tBTM_CMPL_CB*) btif_dm_ble_test_end_cback);
3478              break;
3479          default:
3480              BTIF_TRACE_ERROR("%s: Unknown LE Test Mode Command 0x%x", __FUNCTION__, opcode);
3481              return BT_STATUS_UNSUPPORTED;
3482      }
3483      return BT_STATUS_SUCCESS;
3484 }
3485 #endif
3486
3487 void btif_dm_on_disable()
3488 {
3489     /* cancel any pending pairing requests */
3490     if (pairing_cb.state == BT_BOND_STATE_BONDING)
3491     {
3492         bt_bdaddr_t bd_addr;
3493
3494         BTIF_TRACE_DEBUG("%s: Cancel pending pairing request", __FUNCTION__);
3495         bdcpy(bd_addr.address, pairing_cb.bd_addr);
3496         btif_dm_cancel_bond(&bd_addr);
3497     }
3498 }
3499
3500 /*******************************************************************************
3501 **
3502 ** Function         btif_dm_read_energy_info
3503 **
3504 ** Description     Reads the energy info from controller
3505 **
3506 ** Returns         void
3507 **
3508 *******************************************************************************/
3509 void btif_dm_read_energy_info()
3510 {
3511 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
3512     BTA_DmBleGetEnergyInfo(bta_energy_info_cb);
3513 #endif
3514 }
3515
3516 static char* btif_get_default_local_name() {
3517     if (btif_default_local_name[0] == '\0')
3518     {
3519         int max_len = sizeof(btif_default_local_name) - 1;
3520         if (BTM_DEF_LOCAL_NAME[0] != '\0')
3521         {
3522             strncpy(btif_default_local_name, BTM_DEF_LOCAL_NAME, max_len);
3523         }
3524         else
3525         {
3526             char prop_model[PROPERTY_VALUE_MAX];
3527             osi_property_get(PROPERTY_PRODUCT_MODEL, prop_model, "");
3528             strncpy(btif_default_local_name, prop_model, max_len);
3529         }
3530         btif_default_local_name[max_len] = '\0';
3531     }
3532     return btif_default_local_name;
3533 }
3534
3535 static void btif_stats_add_bond_event(const bt_bdaddr_t *bd_addr,
3536                                       bt_bond_function_t function,
3537                                       bt_bond_state_t state) {
3538     pthread_mutex_lock(&bond_event_lock);
3539
3540     btif_bond_event_t* event = &btif_dm_bond_events[btif_events_end_index];
3541     memcpy(&event->bd_addr, bd_addr, sizeof(bt_bdaddr_t));
3542     event->function = function;
3543     event->state = state;
3544     clock_gettime(CLOCK_REALTIME, &event->timestamp);
3545
3546     btif_num_bond_events++;
3547     btif_events_end_index = (btif_events_end_index + 1) % (MAX_BTIF_BOND_EVENT_ENTRIES + 1);
3548     if (btif_events_end_index == btif_events_start_index) {
3549         btif_events_start_index = (btif_events_start_index + 1) % (MAX_BTIF_BOND_EVENT_ENTRIES + 1);
3550     }
3551
3552     int type;
3553     btif_get_device_type(bd_addr->address, &type);
3554
3555     device_type_t device_type;
3556     switch (type) {
3557         case BT_DEVICE_TYPE_BREDR:
3558             device_type = DEVICE_TYPE_BREDR;
3559             break;
3560         case BT_DEVICE_TYPE_BLE:
3561             device_type = DEVICE_TYPE_LE;
3562             break;
3563         case BT_DEVICE_TYPE_DUMO:
3564             device_type = DEVICE_TYPE_DUMO;
3565             break;
3566         default:
3567             device_type = DEVICE_TYPE_UNKNOWN;
3568             break;
3569     }
3570
3571     uint32_t cod = get_cod(bd_addr);
3572     uint64_t ts = event->timestamp.tv_sec * 1000 +
3573                   event->timestamp.tv_nsec / 1000000;
3574     metrics_log_pair_event(0, ts, cod, device_type);
3575
3576     pthread_mutex_unlock(&bond_event_lock);
3577 }
3578
3579 void btif_debug_bond_event_dump(int fd) {
3580     pthread_mutex_lock(&bond_event_lock);
3581     dprintf(fd, "\nBond Events: \n");
3582     dprintf(fd, "  Total Number of events: %zu\n", btif_num_bond_events);
3583     if (btif_num_bond_events > 0)
3584         dprintf(fd, "  Time          BD_ADDR            Function             State\n");
3585
3586     for (size_t i = btif_events_start_index; i != btif_events_end_index;
3587          i = (i + 1) % (MAX_BTIF_BOND_EVENT_ENTRIES + 1)) {
3588         btif_bond_event_t* event = &btif_dm_bond_events[i];
3589
3590         char eventtime[20];
3591         char temptime[20];
3592         struct tm *tstamp = localtime(&event->timestamp.tv_sec);
3593         strftime(temptime, sizeof(temptime), "%H:%M:%S", tstamp);
3594         snprintf(eventtime, sizeof(eventtime), "%s.%03ld", temptime,
3595                  event->timestamp.tv_nsec / 1000000);
3596
3597         char bdaddr[18];
3598         bdaddr_to_string(&event->bd_addr, bdaddr, sizeof(bdaddr));
3599
3600         char* func_name;
3601         switch (event->function) {
3602             case BTIF_DM_FUNC_CREATE_BOND:
3603                 func_name = "btif_dm_create_bond";
3604                 break;
3605             case BTIF_DM_FUNC_REMOVE_BOND:
3606                 func_name = "btif_dm_remove_bond";
3607                 break;
3608             case BTIF_DM_FUNC_BOND_STATE_CHANGED:
3609                 func_name = "bond_state_changed ";
3610                 break;
3611             default:
3612                 func_name = "Invalid value      ";
3613                 break;
3614         }
3615
3616         char* bond_state;
3617         switch (event->state) {
3618             case BT_BOND_STATE_NONE:
3619                 bond_state = "BOND_STATE_NONE";
3620                 break;
3621             case BT_BOND_STATE_BONDING:
3622                 bond_state = "BOND_STATE_BONDING";
3623                 break;
3624             case BT_BOND_STATE_BONDED:
3625                 bond_state = "BOND_STATE_BONDED";
3626                 break;
3627             default:
3628                 bond_state = "Invalid bond state";
3629                 break;
3630         }
3631         dprintf(fd, "  %s  %s  %s  %s\n", eventtime, bdaddr, func_name, bond_state);
3632     }
3633     pthread_mutex_unlock(&bond_event_lock);
3634 }