1 /******************************************************************************
3 * Copyright (C) 2003-2012 Broadcom Corporation
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
17 ******************************************************************************/
21 #include "device/include/interop.h"
22 #include "include/bt_target.h"
23 #include "stack/btm/btm_int.h"
24 #include "stack/include/l2c_api.h"
25 #include "stack/smp/p_256_ecc_pp.h"
26 #include "stack/smp/smp_int.h"
27 #include "utils/include/bt_utils.h"
29 extern fixed_queue_t *btu_general_alarm_queue;
31 #if SMP_INCLUDED == TRUE
32 const UINT8 smp_association_table[2][SMP_IO_CAP_MAX][SMP_IO_CAP_MAX] =
35 {{SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_PASSKEY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_PASSKEY}, /* Display Only */
36 {SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_PASSKEY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_PASSKEY}, /* SMP_CAP_IO = 1 */
37 {SMP_MODEL_KEY_NOTIF, SMP_MODEL_KEY_NOTIF, SMP_MODEL_PASSKEY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_KEY_NOTIF}, /* keyboard only */
38 {SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY},/* No Input No Output */
39 {SMP_MODEL_KEY_NOTIF, SMP_MODEL_KEY_NOTIF, SMP_MODEL_PASSKEY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_KEY_NOTIF}}, /* keyboard display */
41 {{SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_KEY_NOTIF, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_KEY_NOTIF}, /* Display Only */
42 {SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_KEY_NOTIF, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_KEY_NOTIF}, /* SMP_CAP_IO = 1 */
43 {SMP_MODEL_PASSKEY, SMP_MODEL_PASSKEY, SMP_MODEL_PASSKEY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_PASSKEY}, /* keyboard only */
44 {SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_ENCRYPTION_ONLY},/* No Input No Output */
45 {SMP_MODEL_PASSKEY, SMP_MODEL_PASSKEY, SMP_MODEL_KEY_NOTIF, SMP_MODEL_ENCRYPTION_ONLY, SMP_MODEL_PASSKEY}} /* keyboard display */
46 /* display only */ /*SMP_CAP_IO = 1 */ /* keyboard only */ /* No InputOutput */ /* keyboard display */
49 #define SMP_KEY_DIST_TYPE_MAX 4
50 const tSMP_ACT smp_distribute_act [] =
55 smp_set_derive_link_key
58 static bool lmp_version_below(BD_ADDR bda, uint8_t version)
60 tACL_CONN *acl = btm_bda_to_acl(bda, BT_TRANSPORT_LE);
61 if (acl == NULL || acl->lmp_version == 0)
63 SMP_TRACE_WARNING("%s cannot retrieve LMP version...", __func__);
66 SMP_TRACE_WARNING("%s LMP version %d < %d", __func__, acl->lmp_version, version);
67 return acl->lmp_version < version;
70 static bool pts_test_send_authentication_complete_failure(tSMP_CB *p_cb)
74 if (p_cb->cert_failure < 2 || p_cb->cert_failure > 6)
77 SMP_TRACE_ERROR("%s failure case = %d", __func__, p_cb->cert_failure);
79 switch (p_cb->cert_failure)
82 reason = SMP_PAIR_AUTH_FAIL;
83 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
86 reason = SMP_PAIR_FAIL_UNKNOWN;
87 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
90 reason = SMP_PAIR_NOT_SUPPORT;
91 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
94 reason = SMP_PASSKEY_ENTRY_FAIL;
95 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
98 reason = SMP_REPEATED_ATTEMPTS;
99 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
106 /*******************************************************************************
107 ** Function smp_update_key_mask
108 ** Description This function updates the key mask for sending or receiving.
109 *******************************************************************************/
110 static void smp_update_key_mask (tSMP_CB *p_cb, UINT8 key_type, BOOLEAN recv)
112 SMP_TRACE_DEBUG("%s before update role=%d recv=%d local_i_key = %02x, local_r_key = %02x",
113 __func__, p_cb->role, recv, p_cb->local_i_key, p_cb->local_r_key);
115 if (((p_cb->le_secure_connections_mode_is_used) ||
116 (p_cb->smp_over_br)) &&
117 ((key_type == SMP_SEC_KEY_TYPE_ENC) || (key_type == SMP_SEC_KEY_TYPE_LK)))
119 /* in LE SC mode LTK, CSRK and BR/EDR LK are derived locally instead of
120 ** being exchanged with the peer */
121 p_cb->local_i_key &= ~key_type;
122 p_cb->local_r_key &= ~key_type;
125 if (p_cb->role == HCI_ROLE_SLAVE)
128 p_cb->local_i_key &= ~key_type;
130 p_cb->local_r_key &= ~key_type;
135 p_cb->local_r_key &= ~key_type;
137 p_cb->local_i_key &= ~key_type;
140 SMP_TRACE_DEBUG("updated local_i_key = %02x, local_r_key = %02x", p_cb->local_i_key,
144 /*******************************************************************************
145 ** Function smp_send_app_cback
146 ** Description notifies application about the events the application is interested in
147 *******************************************************************************/
148 void smp_send_app_cback(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
150 tSMP_EVT_DATA cb_data;
151 tSMP_STATUS callback_rc;
152 SMP_TRACE_DEBUG("%s p_cb->cb_evt=%d", __func__, p_cb->cb_evt);
153 if (p_cb->p_callback && p_cb->cb_evt != 0)
155 switch (p_cb->cb_evt)
157 case SMP_IO_CAP_REQ_EVT:
158 cb_data.io_req.auth_req = p_cb->peer_auth_req;
159 cb_data.io_req.oob_data = SMP_OOB_NONE;
160 cb_data.io_req.io_cap = SMP_DEFAULT_IO_CAPS;
161 cb_data.io_req.max_key_size = SMP_MAX_ENC_KEY_SIZE;
162 cb_data.io_req.init_keys = p_cb->local_i_key ;
163 cb_data.io_req.resp_keys = p_cb->local_r_key ;
164 SMP_TRACE_WARNING ( "io_cap = %d",cb_data.io_req.io_cap);
168 cb_data.passkey = p_data->passkey;
170 case SMP_SC_OOB_REQ_EVT:
171 cb_data.req_oob_type = p_data->req_oob_type;
173 case SMP_SC_LOC_OOB_DATA_UP_EVT:
174 cb_data.loc_oob_data = p_cb->sc_oob_data.loc_oob_data;
177 case SMP_BR_KEYS_REQ_EVT:
178 cb_data.io_req.auth_req = 0;
179 cb_data.io_req.oob_data = SMP_OOB_NONE;
180 cb_data.io_req.io_cap = 0;
181 cb_data.io_req.max_key_size = SMP_MAX_ENC_KEY_SIZE;
182 cb_data.io_req.init_keys = SMP_BR_SEC_DEFAULT_KEY;
183 cb_data.io_req.resp_keys = SMP_BR_SEC_DEFAULT_KEY;
190 callback_rc = (*p_cb->p_callback)(p_cb->cb_evt, p_cb->pairing_bda, &cb_data);
192 SMP_TRACE_DEBUG("callback_rc=%d p_cb->cb_evt=%d",callback_rc, p_cb->cb_evt );
194 if (callback_rc == SMP_SUCCESS)
196 switch (p_cb->cb_evt)
198 case SMP_IO_CAP_REQ_EVT:
199 p_cb->loc_auth_req = cb_data.io_req.auth_req;
200 p_cb->local_io_capability = cb_data.io_req.io_cap;
201 p_cb->loc_oob_flag = cb_data.io_req.oob_data;
202 p_cb->loc_enc_size = cb_data.io_req.max_key_size;
203 p_cb->local_i_key = cb_data.io_req.init_keys;
204 p_cb->local_r_key = cb_data.io_req.resp_keys;
206 if (!(p_cb->loc_auth_req & SMP_AUTH_BOND))
208 SMP_TRACE_WARNING ("Non bonding: No keys will be exchanged");
209 p_cb->local_i_key = 0;
210 p_cb->local_r_key = 0;
213 SMP_TRACE_WARNING ( "rcvd auth_req: 0x%02x, io_cap: %d \
214 loc_oob_flag: %d loc_enc_size: %d,"
215 "local_i_key: 0x%02x, local_r_key: 0x%02x",
216 p_cb->loc_auth_req, p_cb->local_io_capability, p_cb->loc_oob_flag,
217 p_cb->loc_enc_size, p_cb->local_i_key, p_cb->local_r_key);
219 p_cb->secure_connections_only_mode_required =
220 (btm_cb.security_mode == BTM_SEC_MODE_SC) ? TRUE : FALSE;
222 if (p_cb->secure_connections_only_mode_required)
224 p_cb->loc_auth_req |= SMP_SC_SUPPORT_BIT;
227 if (!(p_cb->loc_auth_req & SMP_SC_SUPPORT_BIT)
228 || lmp_version_below(p_cb->pairing_bda, HCI_PROTO_VERSION_4_2)
229 || interop_match_addr(INTEROP_DISABLE_LE_SECURE_CONNECTIONS,
230 (const bt_bdaddr_t *)&p_cb->pairing_bda))
232 p_cb->loc_auth_req &= ~SMP_KP_SUPPORT_BIT;
233 p_cb->local_i_key &= ~SMP_SEC_KEY_TYPE_LK;
234 p_cb->local_r_key &= ~SMP_SEC_KEY_TYPE_LK;
237 SMP_TRACE_WARNING("set auth_req: 0x%02x, local_i_key: 0x%02x, local_r_key: 0x%02x",
238 p_cb->loc_auth_req, p_cb->local_i_key, p_cb->local_r_key);
240 smp_sm_event(p_cb, SMP_IO_RSP_EVT, NULL);
243 case SMP_BR_KEYS_REQ_EVT:
244 p_cb->loc_enc_size = cb_data.io_req.max_key_size;
245 p_cb->local_i_key = cb_data.io_req.init_keys;
246 p_cb->local_r_key = cb_data.io_req.resp_keys;
248 p_cb->local_i_key &= ~SMP_SEC_KEY_TYPE_LK;
249 p_cb->local_r_key &= ~SMP_SEC_KEY_TYPE_LK;
251 SMP_TRACE_WARNING ( "for SMP over BR max_key_size: 0x%02x,\
252 local_i_key: 0x%02x, local_r_key: 0x%02x",
253 p_cb->loc_enc_size, p_cb->local_i_key, p_cb->local_r_key);
255 smp_br_state_machine_event(p_cb, SMP_BR_KEYS_RSP_EVT, NULL);
261 if (!p_cb->cb_evt && p_cb->discard_sec_req)
263 p_cb->discard_sec_req = FALSE;
264 smp_sm_event(p_cb, SMP_DISCARD_SEC_REQ_EVT, NULL);
267 SMP_TRACE_DEBUG("%s return", __func__);
270 /*******************************************************************************
271 ** Function smp_send_pair_fail
272 ** Description pairing failure to peer device if needed.
273 *******************************************************************************/
274 void smp_send_pair_fail(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
276 p_cb->status = *(UINT8 *)p_data;
277 p_cb->failure = *(UINT8 *)p_data;
279 SMP_TRACE_DEBUG("%s status=%d failure=%d ", __func__, p_cb->status, p_cb->failure);
281 if (p_cb->status <= SMP_MAX_FAIL_RSN_PER_SPEC && p_cb->status != SMP_SUCCESS)
283 smp_send_cmd(SMP_OPCODE_PAIRING_FAILED, p_cb);
284 p_cb->wait_for_authorization_complete = TRUE;
288 /*******************************************************************************
289 ** Function smp_send_pair_req
290 ** Description actions related to sending pairing request
291 *******************************************************************************/
292 void smp_send_pair_req(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
294 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (p_cb->pairing_bda);
295 SMP_TRACE_DEBUG("%s", __func__);
297 /* erase all keys when master sends pairing req*/
299 btm_sec_clear_ble_keys(p_dev_rec);
300 /* do not manipulate the key, let app decide,
301 leave out to BTM to mandate key distribution for bonding case */
302 smp_send_cmd(SMP_OPCODE_PAIRING_REQ, p_cb);
305 /*******************************************************************************
306 ** Function smp_send_pair_rsp
307 ** Description actions related to sending pairing response
308 *******************************************************************************/
309 void smp_send_pair_rsp(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
311 SMP_TRACE_DEBUG("%s", __func__);
313 p_cb->local_i_key &= p_cb->peer_i_key;
314 p_cb->local_r_key &= p_cb->peer_r_key;
316 if (smp_send_cmd (SMP_OPCODE_PAIRING_RSP, p_cb))
318 if (p_cb->selected_association_model == SMP_MODEL_SEC_CONN_OOB)
319 smp_use_oob_private_key(p_cb, NULL);
321 smp_decide_association_model(p_cb, NULL);
325 /*******************************************************************************
326 ** Function smp_send_confirm
327 ** Description send confirmation to the peer
328 *******************************************************************************/
329 void smp_send_confirm(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
331 SMP_TRACE_DEBUG("%s", __func__);
332 smp_send_cmd(SMP_OPCODE_CONFIRM, p_cb);
335 /*******************************************************************************
336 ** Function smp_send_init
337 ** Description process pairing initializer to slave device
338 *******************************************************************************/
339 void smp_send_init(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
341 SMP_TRACE_DEBUG("%s", __func__);
342 smp_send_cmd(SMP_OPCODE_INIT, p_cb);
345 /*******************************************************************************
346 ** Function smp_send_rand
347 ** Description send pairing random to the peer
348 *******************************************************************************/
349 void smp_send_rand(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
351 SMP_TRACE_DEBUG("%s", __func__);
352 smp_send_cmd(SMP_OPCODE_RAND, p_cb);
355 /*******************************************************************************
356 ** Function smp_send_pair_public_key
357 ** Description send pairing public key command to the peer
358 *******************************************************************************/
359 void smp_send_pair_public_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
361 SMP_TRACE_DEBUG("%s", __func__);
362 smp_send_cmd(SMP_OPCODE_PAIR_PUBLIC_KEY, p_cb);
365 /*******************************************************************************
366 ** Function SMP_SEND_COMMITMENT
367 ** Description send commitment command to the peer
368 *******************************************************************************/
369 void smp_send_commitment(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
371 SMP_TRACE_DEBUG("%s", __func__);
372 smp_send_cmd(SMP_OPCODE_PAIR_COMMITM, p_cb);
375 /*******************************************************************************
376 ** Function smp_send_dhkey_check
377 ** Description send DHKey Check command to the peer
378 *******************************************************************************/
379 void smp_send_dhkey_check(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
381 SMP_TRACE_DEBUG("%s", __func__);
382 smp_send_cmd(SMP_OPCODE_PAIR_DHKEY_CHECK, p_cb);
385 /*******************************************************************************
386 ** Function smp_send_keypress_notification
387 ** Description send Keypress Notification command to the peer
388 *******************************************************************************/
389 void smp_send_keypress_notification(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
391 p_cb->local_keypress_notification = *(UINT8 *) p_data;
392 smp_send_cmd(SMP_OPCODE_PAIR_KEYPR_NOTIF, p_cb);
395 /*******************************************************************************
396 ** Function smp_send_enc_info
397 ** Description send encryption information command.
398 *******************************************************************************/
399 void smp_send_enc_info(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
401 tBTM_LE_LENC_KEYS le_key;
403 SMP_TRACE_DEBUG("%s p_cb->loc_enc_size = %d", __func__, p_cb->loc_enc_size);
404 smp_update_key_mask (p_cb, SMP_SEC_KEY_TYPE_ENC, FALSE);
406 smp_send_cmd(SMP_OPCODE_ENCRYPT_INFO, p_cb);
407 smp_send_cmd(SMP_OPCODE_MASTER_ID, p_cb);
409 /* save the DIV and key size information when acting as slave device */
410 memcpy(le_key.ltk, p_cb->ltk, BT_OCTET16_LEN);
411 le_key.div = p_cb->div;
412 le_key.key_size = p_cb->loc_enc_size;
413 le_key.sec_level = p_cb->sec_level;
415 if ((p_cb->peer_auth_req & SMP_AUTH_BOND) && (p_cb->loc_auth_req & SMP_AUTH_BOND))
416 btm_sec_save_le_key(p_cb->pairing_bda, BTM_LE_KEY_LENC,
417 (tBTM_LE_KEY_VALUE *)&le_key, TRUE);
419 SMP_TRACE_WARNING ("%s", __func__);
421 smp_key_distribution(p_cb, NULL);
424 /*******************************************************************************
425 ** Function smp_send_id_info
426 ** Description send ID information command.
427 *******************************************************************************/
428 void smp_send_id_info(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
430 tBTM_LE_KEY_VALUE le_key;
431 SMP_TRACE_DEBUG("%s", __func__);
432 smp_update_key_mask (p_cb, SMP_SEC_KEY_TYPE_ID, FALSE);
434 smp_send_cmd(SMP_OPCODE_IDENTITY_INFO, p_cb);
435 smp_send_cmd(SMP_OPCODE_ID_ADDR, p_cb);
437 if ((p_cb->peer_auth_req & SMP_AUTH_BOND) && (p_cb->loc_auth_req & SMP_AUTH_BOND))
438 btm_sec_save_le_key(p_cb->pairing_bda, BTM_LE_KEY_LID,
441 SMP_TRACE_WARNING ("%s", __func__);
442 smp_key_distribution_by_transport(p_cb, NULL);
445 /*******************************************************************************
446 ** Function smp_send_csrk_info
447 ** Description send CSRK command.
448 *******************************************************************************/
449 void smp_send_csrk_info(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
451 tBTM_LE_LCSRK_KEYS key;
452 SMP_TRACE_DEBUG("%s", __func__);
453 smp_update_key_mask (p_cb, SMP_SEC_KEY_TYPE_CSRK, FALSE);
455 if (smp_send_cmd(SMP_OPCODE_SIGN_INFO, p_cb))
458 key.sec_level = p_cb->sec_level;
459 key.counter = 0; /* initialize the local counter */
460 memcpy (key.csrk, p_cb->csrk, BT_OCTET16_LEN);
461 btm_sec_save_le_key(p_cb->pairing_bda, BTM_LE_KEY_LCSRK, (tBTM_LE_KEY_VALUE *)&key, TRUE);
464 smp_key_distribution_by_transport(p_cb, NULL);
467 /*******************************************************************************
468 ** Function smp_send_ltk_reply
469 ** Description send LTK reply
470 *******************************************************************************/
471 void smp_send_ltk_reply(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
473 SMP_TRACE_DEBUG("%s", __func__);
474 /* send stk as LTK response */
475 btm_ble_ltk_request_reply(p_cb->pairing_bda, TRUE, p_data->key.p_data);
478 /*******************************************************************************
479 ** Function smp_proc_sec_req
480 ** Description process security request.
481 *******************************************************************************/
482 void smp_proc_sec_req(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
484 tBTM_LE_AUTH_REQ auth_req = *(tBTM_LE_AUTH_REQ *)p_data;
485 tBTM_BLE_SEC_REQ_ACT sec_req_act;
488 SMP_TRACE_DEBUG("%s auth_req=0x%x", __func__, auth_req);
492 btm_ble_link_sec_check(p_cb->pairing_bda, auth_req, &sec_req_act);
494 SMP_TRACE_DEBUG("%s sec_req_act=0x%x", __func__, sec_req_act);
498 case BTM_BLE_SEC_REQ_ACT_ENCRYPT:
499 SMP_TRACE_DEBUG("%s BTM_BLE_SEC_REQ_ACT_ENCRYPT", __func__);
500 smp_sm_event(p_cb, SMP_ENC_REQ_EVT, NULL);
503 case BTM_BLE_SEC_REQ_ACT_PAIR:
504 p_cb->secure_connections_only_mode_required =
505 (btm_cb.security_mode == BTM_SEC_MODE_SC) ? TRUE : FALSE;
507 /* respond to non SC pairing request as failure in SC only mode */
508 if (p_cb->secure_connections_only_mode_required &&
509 (auth_req & SMP_SC_SUPPORT_BIT) == 0)
511 reason = SMP_PAIR_AUTH_FAIL;
512 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
516 /* initialize local i/r key to be default keys */
517 p_cb->peer_auth_req = auth_req;
518 p_cb->local_r_key = p_cb->local_i_key = SMP_SEC_DEFAULT_KEY ;
519 p_cb->cb_evt = SMP_SEC_REQUEST_EVT;
523 case BTM_BLE_SEC_REQ_ACT_DISCARD:
524 p_cb->discard_sec_req = TRUE;
533 /*******************************************************************************
534 ** Function smp_proc_sec_grant
535 ** Description process security grant.
536 *******************************************************************************/
537 void smp_proc_sec_grant(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
539 UINT8 res= *(UINT8 *)p_data;
540 SMP_TRACE_DEBUG("%s", __func__);
541 if (res != SMP_SUCCESS)
543 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, p_data);
545 else /*otherwise, start pairing */
547 /* send IO request callback */
548 p_cb->cb_evt = SMP_IO_CAP_REQ_EVT;
552 /*******************************************************************************
553 ** Function smp_proc_pair_fail
554 ** Description process pairing failure from peer device
555 *******************************************************************************/
556 void smp_proc_pair_fail(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
558 SMP_TRACE_DEBUG("%s", __func__);
559 p_cb->status = *(UINT8 *)p_data;
561 /* Cancel pending auth complete timer if set */
562 alarm_cancel(p_cb->delayed_auth_timer_ent);
565 /*******************************************************************************
566 ** Function smp_proc_pair_cmd
567 ** Description Process the SMP pairing request/response from peer device
568 *******************************************************************************/
569 void smp_proc_pair_cmd(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
571 UINT8 *p = (UINT8 *)p_data;
572 UINT8 reason = SMP_ENC_KEY_SIZE;
573 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (p_cb->pairing_bda);
575 SMP_TRACE_DEBUG("%s", __func__);
576 /* erase all keys if it is slave proc pairing req*/
577 if (p_dev_rec && (p_cb->role == HCI_ROLE_SLAVE))
578 btm_sec_clear_ble_keys(p_dev_rec);
580 p_cb->flags |= SMP_PAIR_FLAG_ENC_AFTER_PAIR;
582 STREAM_TO_UINT8(p_cb->peer_io_caps, p);
583 STREAM_TO_UINT8(p_cb->peer_oob_flag, p);
584 STREAM_TO_UINT8(p_cb->peer_auth_req, p);
585 STREAM_TO_UINT8(p_cb->peer_enc_size, p);
586 STREAM_TO_UINT8(p_cb->peer_i_key, p);
587 STREAM_TO_UINT8(p_cb->peer_r_key, p);
589 if (smp_command_has_invalid_parameters(p_cb))
591 reason = SMP_INVALID_PARAMETERS;
592 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
596 // PTS Testing failure modes
597 if (pts_test_send_authentication_complete_failure(p_cb))
600 if (p_cb->role == HCI_ROLE_SLAVE)
602 if (!(p_cb->flags & SMP_PAIR_FLAGS_WE_STARTED_DD))
604 /* peer (master) started pairing sending Pairing Request */
605 p_cb->local_i_key = p_cb->peer_i_key;
606 p_cb->local_r_key = p_cb->peer_r_key;
608 p_cb->cb_evt = SMP_SEC_REQUEST_EVT;
610 else /* update local i/r key according to pairing request */
612 /* pairing started with this side (slave) sending Security Request */
613 p_cb->local_i_key &= p_cb->peer_i_key;
614 p_cb->local_r_key &= p_cb->peer_r_key;
615 p_cb->selected_association_model = smp_select_association_model(p_cb);
617 if (p_cb->secure_connections_only_mode_required &&
618 (!(p_cb->le_secure_connections_mode_is_used) ||
619 (p_cb->selected_association_model == SMP_MODEL_SEC_CONN_JUSTWORKS)))
621 SMP_TRACE_ERROR("%s pairing failed - slave requires secure connection only mode",
623 reason = SMP_PAIR_AUTH_FAIL;
624 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
628 if (p_cb->selected_association_model == SMP_MODEL_SEC_CONN_OOB)
630 if (smp_request_oob_data(p_cb)) return;
634 smp_send_pair_rsp(p_cb, NULL);
638 else /* Master receives pairing response */
640 p_cb->selected_association_model = smp_select_association_model(p_cb);
642 if (p_cb->secure_connections_only_mode_required &&
643 (!(p_cb->le_secure_connections_mode_is_used) ||
644 (p_cb->selected_association_model == SMP_MODEL_SEC_CONN_JUSTWORKS)))
646 SMP_TRACE_ERROR ("Master requires secure connection only mode \
647 but it can't be provided -> Master fails pairing");
648 reason = SMP_PAIR_AUTH_FAIL;
649 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
653 if (p_cb->selected_association_model == SMP_MODEL_SEC_CONN_OOB)
655 if (smp_request_oob_data(p_cb)) return;
659 smp_decide_association_model(p_cb, NULL);
664 /*******************************************************************************
665 ** Function smp_proc_confirm
666 ** Description process pairing confirm from peer device
667 *******************************************************************************/
668 void smp_proc_confirm(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
670 UINT8 *p = (UINT8 *)p_data;
671 UINT8 reason = SMP_INVALID_PARAMETERS;
673 SMP_TRACE_DEBUG("%s", __func__);
675 if (smp_command_has_invalid_parameters(p_cb))
677 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
683 /* save the SConfirm for comparison later */
684 STREAM_TO_ARRAY(p_cb->rconfirm, p, BT_OCTET16_LEN);
687 p_cb->flags |= SMP_PAIR_FLAGS_CMD_CONFIRM;
690 /*******************************************************************************
691 ** Function smp_proc_init
692 ** Description process pairing initializer from peer device
693 *******************************************************************************/
694 void smp_proc_init(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
696 UINT8 *p = (UINT8 *)p_data;
697 UINT8 reason = SMP_INVALID_PARAMETERS;
699 SMP_TRACE_DEBUG("%s", __func__);
701 if (smp_command_has_invalid_parameters(p_cb))
703 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
707 /* save the SRand for comparison */
708 STREAM_TO_ARRAY(p_cb->rrand, p, BT_OCTET16_LEN);
711 /*******************************************************************************
712 ** Function smp_proc_rand
713 ** Description process pairing random (nonce) from peer device
714 *******************************************************************************/
715 void smp_proc_rand(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
717 UINT8 *p = (UINT8 *)p_data;
718 UINT8 reason = SMP_INVALID_PARAMETERS;
720 SMP_TRACE_DEBUG("%s", __func__);
722 if (smp_command_has_invalid_parameters(p_cb))
724 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
728 /* save the SRand for comparison */
729 STREAM_TO_ARRAY(p_cb->rrand, p, BT_OCTET16_LEN);
732 /*******************************************************************************
733 ** Function smp_process_pairing_public_key
734 ** Description process pairing public key command from the peer device
735 ** - saves the peer public key;
736 ** - sets the flag indicating that the peer public key is received;
737 ** - calls smp_wait_for_both_public_keys(...).
739 *******************************************************************************/
740 void smp_process_pairing_public_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
742 UINT8 *p = (UINT8 *)p_data;
743 UINT8 reason = SMP_INVALID_PARAMETERS;
745 SMP_TRACE_DEBUG("%s", __func__);
747 if (smp_command_has_invalid_parameters(p_cb))
749 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
753 STREAM_TO_ARRAY(p_cb->peer_publ_key.x, p, BT_OCTET32_LEN);
754 STREAM_TO_ARRAY(p_cb->peer_publ_key.y, p, BT_OCTET32_LEN);
757 memcpy(pt.x, p_cb->peer_publ_key.x, BT_OCTET32_LEN);
758 memcpy(pt.y, p_cb->peer_publ_key.y, BT_OCTET32_LEN);
760 if (!ECC_ValidatePoint(&pt)) {
761 android_errorWriteLog(0x534e4554, "72377774");
762 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
766 p_cb->flags |= SMP_PAIR_FLAG_HAVE_PEER_PUBL_KEY;
768 smp_wait_for_both_public_keys(p_cb, NULL);
771 /*******************************************************************************
772 ** Function smp_process_pairing_commitment
773 ** Description process pairing commitment from peer device
774 *******************************************************************************/
775 void smp_process_pairing_commitment(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
777 UINT8 *p = (UINT8 *)p_data;
778 UINT8 reason = SMP_INVALID_PARAMETERS;
780 SMP_TRACE_DEBUG("%s", __func__);
782 if (smp_command_has_invalid_parameters(p_cb))
784 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
788 p_cb->flags |= SMP_PAIR_FLAG_HAVE_PEER_COMM;
792 STREAM_TO_ARRAY(p_cb->remote_commitment, p, BT_OCTET16_LEN);
796 /*******************************************************************************
797 ** Function smp_process_dhkey_check
798 ** Description process DHKey Check from peer device
799 *******************************************************************************/
800 void smp_process_dhkey_check(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
802 UINT8 *p = (UINT8 *)p_data;
803 UINT8 reason = SMP_INVALID_PARAMETERS;
805 SMP_TRACE_DEBUG("%s", __func__);
807 if (smp_command_has_invalid_parameters(p_cb))
809 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
815 STREAM_TO_ARRAY(p_cb->remote_dhkey_check, p, BT_OCTET16_LEN);
818 p_cb->flags |= SMP_PAIR_FLAG_HAVE_PEER_DHK_CHK;
821 /*******************************************************************************
822 ** Function smp_process_keypress_notification
823 ** Description process pairing keypress notification from peer device
824 *******************************************************************************/
825 void smp_process_keypress_notification(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
827 UINT8 *p = (UINT8 *)p_data;
828 UINT8 reason = SMP_INVALID_PARAMETERS;
830 SMP_TRACE_DEBUG("%s", __func__);
832 if (smp_command_has_invalid_parameters(p_cb))
834 if (p_cb->rcvd_cmd_len < 2) { // 1 (opcode) + 1 (Notif Type) bytes
835 android_errorWriteLog(0x534e4554, "111936834");
837 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
841 p_cb->status = *(UINT8 *)p_data;
845 STREAM_TO_UINT8(p_cb->peer_keypress_notification, p);
849 p_cb->peer_keypress_notification = BTM_SP_KEY_OUT_OF_RANGE;
851 p_cb->cb_evt = SMP_PEER_KEYPR_NOT_EVT;
854 /*******************************************************************************
855 ** Function smp_br_process_pairing_command
856 ** Description Process the SMP pairing request/response from peer device via
858 *******************************************************************************/
859 void smp_br_process_pairing_command(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
861 UINT8 *p = (UINT8 *)p_data;
862 UINT8 reason = SMP_ENC_KEY_SIZE;
863 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (p_cb->pairing_bda);
865 SMP_TRACE_DEBUG("%s", __func__);
866 /* rejecting BR pairing request over non-SC BR link */
867 if (!p_dev_rec->new_encryption_key_is_p256 && p_cb->role == HCI_ROLE_SLAVE)
869 reason = SMP_XTRANS_DERIVE_NOT_ALLOW;
870 smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &reason);
874 /* erase all keys if it is slave proc pairing req*/
875 if (p_dev_rec && (p_cb->role == HCI_ROLE_SLAVE))
876 btm_sec_clear_ble_keys(p_dev_rec);
878 p_cb->flags |= SMP_PAIR_FLAG_ENC_AFTER_PAIR;
880 STREAM_TO_UINT8(p_cb->peer_io_caps, p);
881 STREAM_TO_UINT8(p_cb->peer_oob_flag, p);
882 STREAM_TO_UINT8(p_cb->peer_auth_req, p);
883 STREAM_TO_UINT8(p_cb->peer_enc_size, p);
884 STREAM_TO_UINT8(p_cb->peer_i_key, p);
885 STREAM_TO_UINT8(p_cb->peer_r_key, p);
887 if (smp_command_has_invalid_parameters(p_cb))
889 reason = SMP_INVALID_PARAMETERS;
890 smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &reason);
894 /* peer (master) started pairing sending Pairing Request */
895 /* or being master device always use received i/r key as keys to distribute */
896 p_cb->local_i_key = p_cb->peer_i_key;
897 p_cb->local_r_key = p_cb->peer_r_key;
899 if (p_cb->role == HCI_ROLE_SLAVE)
901 p_dev_rec->new_encryption_key_is_p256 = FALSE;
902 /* shortcut to skip Security Grant step */
903 p_cb->cb_evt = SMP_BR_KEYS_REQ_EVT;
905 else /* Master receives pairing response */
907 SMP_TRACE_DEBUG("%s master rcvs valid PAIRING RESPONSE."
908 " Supposed to move to key distribution phase. ", __func__);
911 /* auth_req received via BR/EDR SM channel is set to 0,
912 but everything derived/exchanged has to be saved */
913 p_cb->peer_auth_req |= SMP_AUTH_BOND;
914 p_cb->loc_auth_req |= SMP_AUTH_BOND;
917 /*******************************************************************************
918 ** Function smp_br_process_security_grant
919 ** Description process security grant in case of pairing over BR/EDR transport.
920 *******************************************************************************/
921 void smp_br_process_security_grant(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
923 UINT8 res= *(UINT8 *)p_data;
924 SMP_TRACE_DEBUG("%s", __func__);
925 if (res != SMP_SUCCESS)
927 smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, p_data);
929 else /*otherwise, start pairing */
931 /* send IO request callback */
932 p_cb->cb_evt = SMP_BR_KEYS_REQ_EVT;
936 /*******************************************************************************
937 ** Function smp_br_check_authorization_request
938 ** Description sets the SMP kes to be derived/distribute over BR/EDR transport
939 ** before starting the distribution/derivation
940 *******************************************************************************/
941 void smp_br_check_authorization_request(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
943 UINT8 reason = SMP_SUCCESS;
945 SMP_TRACE_DEBUG("%s rcvs i_keys=0x%x r_keys=0x%x "
946 "(i-initiator r-responder)", __FUNCTION__, p_cb->local_i_key,
949 /* In LE SC mode LK field is ignored when BR/EDR transport is used */
950 p_cb->local_i_key &= ~SMP_SEC_KEY_TYPE_LK;
951 p_cb->local_r_key &= ~SMP_SEC_KEY_TYPE_LK;
953 /* In LE SC mode only IRK, IAI, CSRK are exchanged with the peer.
954 ** Set local_r_key on master to expect only these keys. */
955 if (p_cb->role == HCI_ROLE_MASTER)
957 p_cb->local_r_key &= (SMP_SEC_KEY_TYPE_ID | SMP_SEC_KEY_TYPE_CSRK);
960 SMP_TRACE_DEBUG("%s rcvs upgrades: i_keys=0x%x r_keys=0x%x "
961 "(i-initiator r-responder)", __FUNCTION__, p_cb->local_i_key,
964 if (/*((p_cb->peer_auth_req & SMP_AUTH_BOND) ||
965 (p_cb->loc_auth_req & SMP_AUTH_BOND)) &&*/
966 (p_cb->local_i_key || p_cb->local_r_key))
968 smp_br_state_machine_event(p_cb, SMP_BR_BOND_REQ_EVT, NULL);
970 /* if no peer key is expected, start master key distribution */
971 if (p_cb->role == HCI_ROLE_MASTER && p_cb->local_r_key == 0)
972 smp_key_distribution_by_transport(p_cb, NULL);
976 smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &reason);
980 /*******************************************************************************
981 ** Function smp_br_select_next_key
982 ** Description selects the next key to derive/send when BR/EDR transport is
984 *******************************************************************************/
985 void smp_br_select_next_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
987 UINT8 reason = SMP_SUCCESS;
988 SMP_TRACE_DEBUG("%s role=%d (0-master) r_keys=0x%x i_keys=0x%x",
989 __func__, p_cb->role, p_cb->local_r_key, p_cb->local_i_key);
991 if (p_cb->role == HCI_ROLE_SLAVE||
992 (!p_cb->local_r_key && p_cb->role == HCI_ROLE_MASTER))
994 smp_key_pick_key(p_cb, p_data);
997 if (!p_cb->local_i_key && !p_cb->local_r_key)
999 /* state check to prevent re-entrance */
1000 if (smp_get_br_state() == SMP_BR_STATE_BOND_PENDING)
1002 if (p_cb->total_tx_unacked == 0)
1003 smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &reason);
1005 p_cb->wait_for_authorization_complete = TRUE;
1010 /*******************************************************************************
1011 ** Function smp_proc_enc_info
1012 ** Description process encryption information from peer device
1013 *******************************************************************************/
1014 void smp_proc_enc_info(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1016 UINT8 *p = (UINT8 *)p_data;
1018 SMP_TRACE_DEBUG("%s", __func__);
1019 STREAM_TO_ARRAY(p_cb->ltk, p, BT_OCTET16_LEN);
1021 smp_key_distribution(p_cb, NULL);
1023 /*******************************************************************************
1024 ** Function smp_proc_master_id
1025 ** Description process master ID from slave device
1026 *******************************************************************************/
1027 void smp_proc_master_id(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1029 UINT8 *p = (UINT8 *)p_data;
1030 tBTM_LE_PENC_KEYS le_key;
1032 SMP_TRACE_DEBUG("%s", __func__);
1033 smp_update_key_mask (p_cb, SMP_SEC_KEY_TYPE_ENC, TRUE);
1035 STREAM_TO_UINT16(le_key.ediv, p);
1036 STREAM_TO_ARRAY(le_key.rand, p, BT_OCTET8_LEN );
1038 /* store the encryption keys from peer device */
1039 memcpy(le_key.ltk, p_cb->ltk, BT_OCTET16_LEN);
1040 le_key.sec_level = p_cb->sec_level;
1041 le_key.key_size = p_cb->loc_enc_size;
1043 if ((p_cb->peer_auth_req & SMP_AUTH_BOND) && (p_cb->loc_auth_req & SMP_AUTH_BOND))
1044 btm_sec_save_le_key(p_cb->pairing_bda,
1046 (tBTM_LE_KEY_VALUE *)&le_key, TRUE);
1048 smp_key_distribution(p_cb, NULL);
1051 /*******************************************************************************
1052 ** Function smp_proc_enc_info
1053 ** Description process identity information from peer device
1054 *******************************************************************************/
1055 void smp_proc_id_info(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1057 UINT8 *p = (UINT8 *)p_data;
1059 SMP_TRACE_DEBUG("%s", __func__);
1060 STREAM_TO_ARRAY (p_cb->tk, p, BT_OCTET16_LEN); /* reuse TK for IRK */
1061 smp_key_distribution_by_transport(p_cb, NULL);
1064 /*******************************************************************************
1065 ** Function smp_proc_id_addr
1066 ** Description process identity address from peer device
1067 *******************************************************************************/
1068 void smp_proc_id_addr(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1070 UINT8 *p = (UINT8 *)p_data;
1071 tBTM_LE_PID_KEYS pid_key;
1073 SMP_TRACE_DEBUG("%s", __func__);
1074 smp_update_key_mask (p_cb, SMP_SEC_KEY_TYPE_ID, TRUE);
1076 STREAM_TO_UINT8(pid_key.addr_type, p);
1077 STREAM_TO_BDADDR(pid_key.static_addr, p);
1078 memcpy(pid_key.irk, p_cb->tk, BT_OCTET16_LEN);
1080 /* to use as BD_ADDR for lk derived from ltk */
1081 p_cb->id_addr_rcvd = TRUE;
1082 p_cb->id_addr_type = pid_key.addr_type;
1083 memcpy(p_cb->id_addr, pid_key.static_addr, BD_ADDR_LEN);
1085 /* store the ID key from peer device */
1086 if ((p_cb->peer_auth_req & SMP_AUTH_BOND) && (p_cb->loc_auth_req & SMP_AUTH_BOND))
1087 btm_sec_save_le_key(p_cb->pairing_bda, BTM_LE_KEY_PID,
1088 (tBTM_LE_KEY_VALUE *)&pid_key, TRUE);
1089 smp_key_distribution_by_transport(p_cb, NULL);
1092 /*******************************************************************************
1093 ** Function smp_proc_srk_info
1094 ** Description process security information from peer device
1095 *******************************************************************************/
1096 void smp_proc_srk_info(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1098 tBTM_LE_PCSRK_KEYS le_key;
1100 SMP_TRACE_DEBUG("%s", __func__);
1101 smp_update_key_mask (p_cb, SMP_SEC_KEY_TYPE_CSRK, TRUE);
1103 /* save CSRK to security record */
1104 le_key.sec_level = p_cb->sec_level;
1105 memcpy (le_key.csrk, p_data, BT_OCTET16_LEN); /* get peer CSRK */
1106 le_key.counter = 0; /* initialize the peer counter */
1108 if ((p_cb->peer_auth_req & SMP_AUTH_BOND) && (p_cb->loc_auth_req & SMP_AUTH_BOND))
1109 btm_sec_save_le_key(p_cb->pairing_bda,
1111 (tBTM_LE_KEY_VALUE *)&le_key, TRUE);
1112 smp_key_distribution_by_transport(p_cb, NULL);
1115 /*******************************************************************************
1116 ** Function smp_proc_compare
1117 ** Description process compare value
1118 *******************************************************************************/
1119 void smp_proc_compare(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1123 SMP_TRACE_DEBUG("%s", __func__);
1124 if (!memcmp(p_cb->rconfirm, p_data->key.p_data, BT_OCTET16_LEN))
1126 /* compare the max encryption key size, and save the smaller one for the link */
1127 if ( p_cb->peer_enc_size < p_cb->loc_enc_size)
1128 p_cb->loc_enc_size = p_cb->peer_enc_size;
1130 if (p_cb->role == HCI_ROLE_SLAVE)
1131 smp_sm_event(p_cb, SMP_RAND_EVT, NULL);
1134 /* master device always use received i/r key as keys to distribute */
1135 p_cb->local_i_key = p_cb->peer_i_key;
1136 p_cb->local_r_key = p_cb->peer_r_key;
1138 smp_sm_event(p_cb, SMP_ENC_REQ_EVT, NULL);
1144 reason = p_cb->failure = SMP_CONFIRM_VALUE_ERR;
1145 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
1149 /*******************************************************************************
1150 ** Function smp_proc_sl_key
1151 ** Description process key ready events.
1152 *******************************************************************************/
1153 void smp_proc_sl_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1155 UINT8 key_type = p_data->key.key_type;
1157 SMP_TRACE_DEBUG("%s", __func__);
1158 if (key_type == SMP_KEY_TYPE_TK)
1160 smp_generate_srand_mrand_confirm(p_cb, NULL);
1162 else if (key_type == SMP_KEY_TYPE_CFM)
1164 smp_set_state(SMP_STATE_WAIT_CONFIRM);
1166 if (p_cb->flags & SMP_PAIR_FLAGS_CMD_CONFIRM)
1167 smp_sm_event(p_cb, SMP_CONFIRM_EVT, NULL);
1171 /*******************************************************************************
1172 ** Function smp_start_enc
1173 ** Description start encryption
1174 *******************************************************************************/
1175 void smp_start_enc(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1178 UINT8 reason = SMP_ENC_FAIL;
1180 SMP_TRACE_DEBUG("%s", __func__);
1182 cmd = btm_ble_start_encrypt(p_cb->pairing_bda, TRUE, p_data->key.p_data);
1184 cmd = btm_ble_start_encrypt(p_cb->pairing_bda, FALSE, NULL);
1186 if (cmd != BTM_CMD_STARTED && cmd != BTM_BUSY)
1187 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
1190 /*******************************************************************************
1191 ** Function smp_proc_discard
1192 ** Description processing for discard security request
1193 *******************************************************************************/
1194 void smp_proc_discard(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1196 SMP_TRACE_DEBUG("%s", __func__);
1197 if (!(p_cb->flags & SMP_PAIR_FLAGS_WE_STARTED_DD))
1198 smp_reset_control_value(p_cb);
1201 /*******************************************************************************
1202 ** Function smp_enc_cmpl
1203 ** Description encryption success
1204 *******************************************************************************/
1205 void smp_enc_cmpl(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1207 UINT8 enc_enable = *(UINT8 *)p_data;
1208 UINT8 reason = enc_enable ? SMP_SUCCESS : SMP_ENC_FAIL;
1210 SMP_TRACE_DEBUG("%s", __func__);
1211 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
1214 /*******************************************************************************
1215 ** Function smp_check_auth_req
1216 ** Description check authentication request
1217 *******************************************************************************/
1218 void smp_check_auth_req(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1220 UINT8 enc_enable = *(UINT8 *)p_data;
1221 UINT8 reason = enc_enable ? SMP_SUCCESS : SMP_ENC_FAIL;
1223 SMP_TRACE_DEBUG("%s rcvs enc_enable=%d i_keys=0x%x r_keys=0x%x "
1224 "(i-initiator r-responder)",
1225 __func__, enc_enable, p_cb->local_i_key, p_cb->local_r_key);
1226 if (enc_enable == 1)
1228 if (p_cb->le_secure_connections_mode_is_used)
1230 /* In LE SC mode LTK is used instead of STK and has to be always saved */
1231 p_cb->local_i_key |= SMP_SEC_KEY_TYPE_ENC;
1232 p_cb->local_r_key |= SMP_SEC_KEY_TYPE_ENC;
1234 /* In LE SC mode LK is derived from LTK only if both sides request it */
1235 if (!(p_cb->local_i_key & SMP_SEC_KEY_TYPE_LK) ||
1236 !(p_cb->local_r_key & SMP_SEC_KEY_TYPE_LK))
1238 p_cb->local_i_key &= ~SMP_SEC_KEY_TYPE_LK;
1239 p_cb->local_r_key &= ~SMP_SEC_KEY_TYPE_LK;
1242 /* In LE SC mode only IRK, IAI, CSRK are exchanged with the peer.
1243 ** Set local_r_key on master to expect only these keys.
1245 if (p_cb->role == HCI_ROLE_MASTER)
1247 p_cb->local_r_key &= (SMP_SEC_KEY_TYPE_ID | SMP_SEC_KEY_TYPE_CSRK);
1252 /* in legacy mode derivation of BR/EDR LK is not supported */
1253 p_cb->local_i_key &= ~SMP_SEC_KEY_TYPE_LK;
1254 p_cb->local_r_key &= ~SMP_SEC_KEY_TYPE_LK;
1256 SMP_TRACE_DEBUG("%s rcvs upgrades: i_keys=0x%x r_keys=0x%x "
1257 "(i-initiator r-responder)",
1258 __func__, p_cb->local_i_key, p_cb->local_r_key);
1260 if (/*((p_cb->peer_auth_req & SMP_AUTH_BOND) ||
1261 (p_cb->loc_auth_req & SMP_AUTH_BOND)) &&*/
1262 (p_cb->local_i_key || p_cb->local_r_key))
1264 smp_sm_event(p_cb, SMP_BOND_REQ_EVT, NULL);
1267 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
1269 else if (enc_enable == 0)
1271 /* if failed for encryption after pairing, send callback */
1272 if (p_cb->flags & SMP_PAIR_FLAG_ENC_AFTER_PAIR)
1273 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
1274 /* if enc failed for old security information */
1275 /* if master device, clean up and abck to idle; slave device do nothing */
1276 else if (p_cb->role == HCI_ROLE_MASTER)
1278 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
1283 /*******************************************************************************
1284 ** Function smp_key_pick_key
1285 ** Description Pick a key distribution function based on the key mask.
1286 *******************************************************************************/
1287 void smp_key_pick_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1289 UINT8 key_to_dist = (p_cb->role == HCI_ROLE_SLAVE) ? p_cb->local_r_key : p_cb->local_i_key;
1292 SMP_TRACE_DEBUG("%s key_to_dist=0x%x", __func__, key_to_dist);
1293 while (i < SMP_KEY_DIST_TYPE_MAX)
1295 SMP_TRACE_DEBUG("key to send = %02x, i = %d", key_to_dist, i);
1297 if (key_to_dist & (1 << i))
1299 SMP_TRACE_DEBUG("smp_distribute_act[%d]", i);
1300 (* smp_distribute_act[i])(p_cb, p_data);
1306 /*******************************************************************************
1307 ** Function smp_key_distribution
1308 ** Description start key distribution if required.
1309 *******************************************************************************/
1310 void smp_key_distribution(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1312 SMP_TRACE_DEBUG("%s role=%d (0-master) r_keys=0x%x i_keys=0x%x",
1313 __func__, p_cb->role, p_cb->local_r_key, p_cb->local_i_key);
1315 if (p_cb->role == HCI_ROLE_SLAVE ||
1316 (!p_cb->local_r_key && p_cb->role == HCI_ROLE_MASTER))
1318 smp_key_pick_key(p_cb, p_data);
1321 if (!p_cb->local_i_key && !p_cb->local_r_key)
1323 /* state check to prevent re-entrant */
1324 if (smp_get_state() == SMP_STATE_BOND_PENDING)
1326 if (p_cb->derive_lk)
1328 smp_derive_link_key_from_long_term_key(p_cb, NULL);
1329 p_cb->derive_lk = FALSE;
1332 if (p_cb->total_tx_unacked == 0)
1335 * Instead of declaring authorization complete immediately,
1336 * delay the event from being sent by SMP_DELAYED_AUTH_TIMEOUT_MS.
1337 * This allows the slave to send over Pairing Failed if the
1338 * last key is rejected. During this waiting window, the
1339 * state should remain in SMP_STATE_BOND_PENDING.
1341 if (!alarm_is_scheduled(p_cb->delayed_auth_timer_ent)) {
1342 SMP_TRACE_DEBUG("%s delaying auth complete.", __func__);
1343 alarm_set_on_queue(p_cb->delayed_auth_timer_ent, SMP_DELAYED_AUTH_TIMEOUT_MS,
1344 smp_delayed_auth_complete_timeout, NULL, btu_general_alarm_queue);
1347 p_cb->wait_for_authorization_complete = TRUE;
1353 /*******************************************************************************
1354 ** Function smp_decide_association_model
1355 ** Description This function is called to select assoc model to be used for
1356 ** STK generation and to start STK generation process.
1358 *******************************************************************************/
1359 void smp_decide_association_model(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1361 UINT8 failure = SMP_UNKNOWN_IO_CAP;
1364 tSMP_INT_DATA *p = NULL;
1366 SMP_TRACE_DEBUG("%s Association Model = %d", __func__, p_cb->selected_association_model);
1368 switch (p_cb->selected_association_model)
1370 case SMP_MODEL_ENCRYPTION_ONLY: /* TK = 0, go calculate Confirm */
1371 if (p_cb->role == HCI_ROLE_MASTER &&
1372 ((p_cb->peer_auth_req & SMP_AUTH_YN_BIT) != 0) &&
1373 ((p_cb->loc_auth_req & SMP_AUTH_YN_BIT) == 0))
1375 SMP_TRACE_ERROR ("IO capability does not meet authentication requirement");
1376 failure = SMP_PAIR_AUTH_FAIL;
1377 p = (tSMP_INT_DATA *)&failure;
1378 int_evt = SMP_AUTH_CMPL_EVT;
1382 p_cb->sec_level = SMP_SEC_UNAUTHENTICATE;
1383 SMP_TRACE_EVENT ("p_cb->sec_level =%d (SMP_SEC_UNAUTHENTICATE) ", p_cb->sec_level );
1385 key.key_type = SMP_KEY_TYPE_TK;
1386 key.p_data = p_cb->tk;
1387 p = (tSMP_INT_DATA *)&key;
1389 memset(p_cb->tk, 0, BT_OCTET16_LEN);
1391 int_evt = SMP_KEY_READY_EVT;
1395 case SMP_MODEL_PASSKEY:
1396 p_cb->sec_level = SMP_SEC_AUTHENTICATED;
1397 SMP_TRACE_EVENT ("p_cb->sec_level =%d (SMP_SEC_AUTHENTICATED) ", p_cb->sec_level );
1399 p_cb->cb_evt = SMP_PASSKEY_REQ_EVT;
1400 int_evt = SMP_TK_REQ_EVT;
1404 SMP_TRACE_ERROR ("Association Model = SMP_MODEL_OOB");
1405 p_cb->sec_level = SMP_SEC_AUTHENTICATED;
1406 SMP_TRACE_EVENT ("p_cb->sec_level =%d (SMP_SEC_AUTHENTICATED) ", p_cb->sec_level );
1408 p_cb->cb_evt = SMP_OOB_REQ_EVT;
1409 int_evt = SMP_TK_REQ_EVT;
1412 case SMP_MODEL_KEY_NOTIF:
1413 p_cb->sec_level = SMP_SEC_AUTHENTICATED;
1414 SMP_TRACE_DEBUG("Need to generate Passkey");
1416 /* generate passkey and notify application */
1417 smp_generate_passkey(p_cb, NULL);
1420 case SMP_MODEL_SEC_CONN_JUSTWORKS:
1421 case SMP_MODEL_SEC_CONN_NUM_COMP:
1422 case SMP_MODEL_SEC_CONN_PASSKEY_ENT:
1423 case SMP_MODEL_SEC_CONN_PASSKEY_DISP:
1424 case SMP_MODEL_SEC_CONN_OOB:
1425 int_evt = SMP_PUBL_KEY_EXCH_REQ_EVT;
1428 case SMP_MODEL_OUT_OF_RANGE:
1429 SMP_TRACE_ERROR("Association Model = SMP_MODEL_OUT_OF_RANGE (failed)");
1430 p = (tSMP_INT_DATA *)&failure;
1431 int_evt = SMP_AUTH_CMPL_EVT;
1435 SMP_TRACE_ERROR("Association Model = %d (SOMETHING IS WRONG WITH THE CODE)",
1436 p_cb->selected_association_model);
1437 p = (tSMP_INT_DATA *)&failure;
1438 int_evt = SMP_AUTH_CMPL_EVT;
1441 SMP_TRACE_EVENT ("sec_level=%d ", p_cb->sec_level );
1443 smp_sm_event(p_cb, int_evt, p);
1446 /*******************************************************************************
1447 ** Function smp_process_io_response
1448 ** Description process IO response for a slave device.
1449 *******************************************************************************/
1450 void smp_process_io_response(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1452 uint8_t reason = SMP_PAIR_AUTH_FAIL;
1454 SMP_TRACE_DEBUG("%s", __func__);
1455 if (p_cb->flags & SMP_PAIR_FLAGS_WE_STARTED_DD)
1457 /* pairing started by local (slave) Security Request */
1458 smp_set_state(SMP_STATE_SEC_REQ_PENDING);
1459 smp_send_cmd(SMP_OPCODE_SEC_REQ, p_cb);
1461 else /* plan to send pairing respond */
1463 /* pairing started by peer (master) Pairing Request */
1464 p_cb->selected_association_model = smp_select_association_model(p_cb);
1466 if (p_cb->secure_connections_only_mode_required &&
1467 (!(p_cb->le_secure_connections_mode_is_used) ||
1468 (p_cb->selected_association_model == SMP_MODEL_SEC_CONN_JUSTWORKS)))
1470 SMP_TRACE_ERROR ("Slave requires secure connection only mode \
1471 but it can't be provided -> Slave fails pairing");
1472 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
1476 if (p_cb->selected_association_model == SMP_MODEL_SEC_CONN_OOB)
1478 if (smp_request_oob_data(p_cb)) return;
1481 // PTS Testing failure modes
1482 if (pts_test_send_authentication_complete_failure(p_cb))
1485 smp_send_pair_rsp(p_cb, NULL);
1489 /*******************************************************************************
1490 ** Function smp_br_process_slave_keys_response
1491 ** Description process application keys response for a slave device
1492 ** (BR/EDR transport).
1493 *******************************************************************************/
1494 void smp_br_process_slave_keys_response(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1496 smp_br_send_pair_response(p_cb, NULL);
1499 /*******************************************************************************
1500 ** Function smp_br_send_pair_response
1501 ** Description actions related to sending pairing response over BR/EDR transport.
1502 *******************************************************************************/
1503 void smp_br_send_pair_response(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1505 SMP_TRACE_DEBUG("%s", __func__);
1507 p_cb->local_i_key &= p_cb->peer_i_key;
1508 p_cb->local_r_key &= p_cb->peer_r_key;
1510 smp_send_cmd (SMP_OPCODE_PAIRING_RSP, p_cb);
1513 /*******************************************************************************
1514 ** Function smp_pairing_cmpl
1515 ** Description This function is called to send the pairing complete callback
1516 ** and remove the connection if needed.
1517 *******************************************************************************/
1518 void smp_pairing_cmpl(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1520 if (p_cb->total_tx_unacked == 0)
1522 /* process the pairing complete */
1523 smp_proc_pairing_cmpl(p_cb);
1527 /*******************************************************************************
1528 ** Function smp_pair_terminate
1529 ** Description This function is called to send the pairing complete callback
1530 ** and remove the connection if needed.
1531 *******************************************************************************/
1532 void smp_pair_terminate(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1534 SMP_TRACE_DEBUG("%s", __func__);
1535 p_cb->status = SMP_CONN_TOUT;
1536 smp_proc_pairing_cmpl(p_cb);
1539 /*******************************************************************************
1540 ** Function smp_idle_terminate
1541 ** Description This function calledin idle state to determine to send authentication
1543 *******************************************************************************/
1544 void smp_idle_terminate(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1546 if (p_cb->flags & SMP_PAIR_FLAGS_WE_STARTED_DD)
1548 SMP_TRACE_DEBUG("Pairing terminated at IDLE state.");
1549 p_cb->status = SMP_FAIL;
1550 smp_proc_pairing_cmpl(p_cb);
1554 /*******************************************************************************
1555 ** Function smp_fast_conn_param
1556 ** Description apply default connection parameter for pairing process
1557 *******************************************************************************/
1558 void smp_fast_conn_param(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1560 /* Disable L2CAP connection parameter updates while bonding since
1561 some peripherals are not able to revert to fast connection parameters
1562 during the start of service discovery. Connection paramter updates
1563 get enabled again once service discovery completes. */
1564 L2CA_EnableUpdateBleConnParams(p_cb->pairing_bda, false);
1567 /*******************************************************************************
1568 ** Function smp_both_have_public_keys
1569 ** Description The function is called when both local and peer public keys are
1572 ** - invokes DHKey computation;
1573 ** - on slave side invokes sending local public key to the peer.
1574 ** - invokes SC phase 1 process.
1575 *******************************************************************************/
1576 void smp_both_have_public_keys(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1578 SMP_TRACE_DEBUG("%s",__func__);
1580 /* invokes DHKey computation */
1581 smp_compute_dhkey(p_cb);
1583 /* on slave side invokes sending local public key to the peer */
1584 if (p_cb->role == HCI_ROLE_SLAVE)
1585 smp_send_pair_public_key(p_cb, NULL);
1587 smp_sm_event(p_cb, SMP_SC_DHKEY_CMPLT_EVT, NULL);
1590 /*******************************************************************************
1591 ** Function smp_start_secure_connection_phase1
1592 ** Description The function starts Secure Connection phase1 i.e. invokes initialization of Secure Connection
1593 ** phase 1 parameters and starts building/sending to the peer
1594 ** messages appropriate for the role and association model.
1595 *******************************************************************************/
1596 void smp_start_secure_connection_phase1(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1598 SMP_TRACE_DEBUG("%s", __func__);
1600 if (p_cb->selected_association_model == SMP_MODEL_SEC_CONN_JUSTWORKS)
1602 p_cb->sec_level = SMP_SEC_UNAUTHENTICATE;
1603 SMP_TRACE_EVENT ("p_cb->sec_level =%d (SMP_SEC_UNAUTHENTICATE) ", p_cb->sec_level );
1607 p_cb->sec_level = SMP_SEC_AUTHENTICATED;
1608 SMP_TRACE_EVENT ("p_cb->sec_level =%d (SMP_SEC_AUTHENTICATED) ", p_cb->sec_level );
1611 switch(p_cb->selected_association_model)
1613 case SMP_MODEL_SEC_CONN_JUSTWORKS:
1614 case SMP_MODEL_SEC_CONN_NUM_COMP:
1615 memset(p_cb->local_random, 0, BT_OCTET16_LEN);
1616 smp_start_nonce_generation(p_cb);
1618 case SMP_MODEL_SEC_CONN_PASSKEY_ENT:
1619 /* user has to provide passkey */
1620 p_cb->cb_evt = SMP_PASSKEY_REQ_EVT;
1621 smp_sm_event(p_cb, SMP_TK_REQ_EVT, NULL);
1623 case SMP_MODEL_SEC_CONN_PASSKEY_DISP:
1624 /* passkey has to be provided to user */
1625 SMP_TRACE_DEBUG("Need to generate SC Passkey");
1626 smp_generate_passkey(p_cb, NULL);
1628 case SMP_MODEL_SEC_CONN_OOB:
1629 /* use the available OOB information */
1630 smp_process_secure_connection_oob_data(p_cb, NULL);
1633 SMP_TRACE_ERROR ("Association Model = %d is not used in LE SC",
1634 p_cb->selected_association_model);
1639 /*******************************************************************************
1640 ** Function smp_process_local_nonce
1641 ** Description The function processes new local nonce.
1643 ** Note It is supposed to be called in SC phase1.
1644 *******************************************************************************/
1645 void smp_process_local_nonce(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1647 SMP_TRACE_DEBUG("%s", __func__);
1649 switch(p_cb->selected_association_model)
1651 case SMP_MODEL_SEC_CONN_JUSTWORKS:
1652 case SMP_MODEL_SEC_CONN_NUM_COMP:
1653 if (p_cb->role == HCI_ROLE_SLAVE)
1655 /* slave calculates and sends local commitment */
1656 smp_calculate_local_commitment(p_cb);
1657 smp_send_commitment(p_cb, NULL);
1658 /* slave has to wait for peer nonce */
1659 smp_set_state(SMP_STATE_WAIT_NONCE);
1661 else /* i.e. master */
1663 if (p_cb->flags & SMP_PAIR_FLAG_HAVE_PEER_COMM)
1665 /* slave commitment is already received, send local nonce, wait for remote nonce*/
1666 SMP_TRACE_DEBUG("master in assoc mode = %d \
1667 already rcvd slave commitment - race condition",
1668 p_cb->selected_association_model);
1669 p_cb->flags &= ~SMP_PAIR_FLAG_HAVE_PEER_COMM;
1670 smp_send_rand(p_cb, NULL);
1671 smp_set_state(SMP_STATE_WAIT_NONCE);
1675 case SMP_MODEL_SEC_CONN_PASSKEY_ENT:
1676 case SMP_MODEL_SEC_CONN_PASSKEY_DISP:
1677 smp_calculate_local_commitment(p_cb);
1679 if (p_cb->role == HCI_ROLE_MASTER)
1681 smp_send_commitment(p_cb, NULL);
1685 if (p_cb->flags & SMP_PAIR_FLAG_HAVE_PEER_COMM)
1687 /* master commitment is already received */
1688 smp_send_commitment(p_cb, NULL);
1689 smp_set_state(SMP_STATE_WAIT_NONCE);
1693 case SMP_MODEL_SEC_CONN_OOB:
1694 if (p_cb->role == HCI_ROLE_MASTER)
1696 smp_send_rand(p_cb, NULL);
1699 smp_set_state(SMP_STATE_WAIT_NONCE);
1702 SMP_TRACE_ERROR ("Association Model = %d is not used in LE SC",
1703 p_cb->selected_association_model);
1708 /*******************************************************************************
1709 ** Function smp_process_peer_nonce
1710 ** Description The function processes newly received and saved in CB peer nonce.
1711 ** The actions depend on the selected association model and the role.
1713 ** Note It is supposed to be called in SC phase1.
1714 *******************************************************************************/
1715 void smp_process_peer_nonce(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1719 SMP_TRACE_DEBUG("%s start ", __func__);
1721 // PTS Testing failure modes
1722 if (p_cb->cert_failure == 1) {
1723 SMP_TRACE_ERROR("%s failure case = %d", __func__, p_cb->cert_failure);
1724 reason = p_cb->failure = SMP_CONFIRM_VALUE_ERR;
1725 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
1729 switch(p_cb->selected_association_model)
1731 case SMP_MODEL_SEC_CONN_JUSTWORKS:
1732 case SMP_MODEL_SEC_CONN_NUM_COMP:
1733 /* in these models only master receives commitment */
1734 if (p_cb->role == HCI_ROLE_MASTER)
1736 if (!smp_check_commitment(p_cb))
1738 reason = p_cb->failure = SMP_CONFIRM_VALUE_ERR;
1739 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
1745 /* slave sends local nonce */
1746 smp_send_rand(p_cb, NULL);
1749 if(p_cb->selected_association_model == SMP_MODEL_SEC_CONN_JUSTWORKS)
1751 /* go directly to phase 2 */
1752 smp_sm_event(p_cb, SMP_SC_PHASE1_CMPLT_EVT, NULL);
1754 else /* numeric comparison */
1756 smp_set_state(SMP_STATE_WAIT_NONCE);
1757 smp_sm_event(p_cb, SMP_SC_CALC_NC_EVT, NULL);
1760 case SMP_MODEL_SEC_CONN_PASSKEY_ENT:
1761 case SMP_MODEL_SEC_CONN_PASSKEY_DISP:
1762 if (!smp_check_commitment(p_cb) && p_cb->cert_failure != 9)
1764 reason = p_cb->failure = SMP_CONFIRM_VALUE_ERR;
1765 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
1769 if (p_cb->role == HCI_ROLE_SLAVE)
1771 smp_send_rand(p_cb, NULL);
1774 if (++p_cb->round < 20)
1776 smp_set_state(SMP_STATE_SEC_CONN_PHS1_START);
1777 p_cb->flags &= ~SMP_PAIR_FLAG_HAVE_PEER_COMM;
1778 smp_start_nonce_generation(p_cb);
1782 smp_sm_event(p_cb, SMP_SC_PHASE1_CMPLT_EVT, NULL);
1784 case SMP_MODEL_SEC_CONN_OOB:
1785 if (p_cb->role == HCI_ROLE_SLAVE)
1787 smp_send_rand(p_cb, NULL);
1790 smp_sm_event(p_cb, SMP_SC_PHASE1_CMPLT_EVT, NULL);
1793 SMP_TRACE_ERROR ("Association Model = %d is not used in LE SC",
1794 p_cb->selected_association_model);
1798 SMP_TRACE_DEBUG("%s end ",__FUNCTION__);
1801 /*******************************************************************************
1802 ** Function smp_match_dhkey_checks
1803 ** Description checks if the calculated peer DHKey Check value is the same as
1804 ** received from the peer DHKey check value.
1805 *******************************************************************************/
1806 void smp_match_dhkey_checks(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1808 UINT8 reason = SMP_DHKEY_CHK_FAIL;
1810 SMP_TRACE_DEBUG("%s", __func__);
1812 if (memcmp(p_data->key.p_data, p_cb->remote_dhkey_check, BT_OCTET16_LEN))
1814 SMP_TRACE_WARNING ("dhkey chcks do no match");
1815 p_cb->failure = reason;
1816 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
1820 SMP_TRACE_EVENT ("dhkey chcks match");
1822 /* compare the max encryption key size, and save the smaller one for the link */
1823 if (p_cb->peer_enc_size < p_cb->loc_enc_size)
1824 p_cb->loc_enc_size = p_cb->peer_enc_size;
1826 if (p_cb->role == HCI_ROLE_SLAVE)
1828 smp_sm_event(p_cb, SMP_PAIR_DHKEY_CHCK_EVT, NULL);
1832 /* master device always use received i/r key as keys to distribute */
1833 p_cb->local_i_key = p_cb->peer_i_key;
1834 p_cb->local_r_key = p_cb->peer_r_key;
1835 smp_sm_event(p_cb, SMP_ENC_REQ_EVT, NULL);
1839 /*******************************************************************************
1840 ** Function smp_move_to_secure_connections_phase2
1841 ** Description Signal State Machine to start SC phase 2 initialization (to
1842 ** compute local DHKey Check value).
1844 ** Note SM is supposed to be in the state SMP_STATE_SEC_CONN_PHS2_START.
1845 *******************************************************************************/
1846 void smp_move_to_secure_connections_phase2(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1848 SMP_TRACE_DEBUG("%s",__func__);
1849 smp_sm_event(p_cb, SMP_SC_PHASE1_CMPLT_EVT, NULL);
1852 /*******************************************************************************
1853 ** Function smp_phase_2_dhkey_checks_are_present
1854 ** Description generates event if dhkey check from the peer is already received.
1856 ** Note It is supposed to be used on slave to prevent race condition.
1857 ** It is supposed to be called after slave dhkey check is calculated.
1858 *******************************************************************************/
1859 void smp_phase_2_dhkey_checks_are_present(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1861 SMP_TRACE_DEBUG("%s",__func__);
1863 if (p_cb->flags & SMP_PAIR_FLAG_HAVE_PEER_DHK_CHK)
1864 smp_sm_event(p_cb, SMP_SC_2_DHCK_CHKS_PRES_EVT, NULL);
1867 /*******************************************************************************
1868 ** Function smp_wait_for_both_public_keys
1869 ** Description generates SMP_BOTH_PUBL_KEYS_RCVD_EVT event when both local and master
1870 ** public keys are available.
1872 ** Note on the slave it is used to prevent race condition.
1874 *******************************************************************************/
1875 void smp_wait_for_both_public_keys(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1877 SMP_TRACE_DEBUG("%s",__func__);
1879 if ((p_cb->flags & SMP_PAIR_FLAG_HAVE_PEER_PUBL_KEY) &&
1880 (p_cb->flags & SMP_PAIR_FLAG_HAVE_LOCAL_PUBL_KEY))
1882 if ((p_cb->role == HCI_ROLE_SLAVE) &&
1883 ((p_cb->req_oob_type == SMP_OOB_LOCAL) || (p_cb->req_oob_type == SMP_OOB_BOTH)))
1885 smp_set_state(SMP_STATE_PUBLIC_KEY_EXCH);
1887 smp_sm_event(p_cb, SMP_BOTH_PUBL_KEYS_RCVD_EVT, NULL);
1891 /*******************************************************************************
1892 ** Function smp_start_passkey_verification
1893 ** Description Starts SC passkey entry verification.
1894 *******************************************************************************/
1895 void smp_start_passkey_verification(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1899 SMP_TRACE_DEBUG("%s", __func__);
1900 p = p_cb->local_random;
1901 UINT32_TO_STREAM(p, p_data->passkey);
1903 p = p_cb->peer_random;
1904 UINT32_TO_STREAM(p, p_data->passkey);
1907 smp_start_nonce_generation(p_cb);
1910 /*******************************************************************************
1911 ** Function smp_process_secure_connection_oob_data
1912 ** Description Processes local/peer SC OOB data received from somewhere.
1913 *******************************************************************************/
1914 void smp_process_secure_connection_oob_data(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1916 SMP_TRACE_DEBUG("%s", __func__);
1918 tSMP_SC_OOB_DATA *p_sc_oob_data = &p_cb->sc_oob_data;
1919 if (p_sc_oob_data->loc_oob_data.present)
1921 memcpy(p_cb->local_random, p_sc_oob_data->loc_oob_data.randomizer,
1922 sizeof(p_cb->local_random));
1926 SMP_TRACE_EVENT ("local OOB randomizer is absent");
1927 memset(p_cb->local_random, 0, sizeof (p_cb->local_random));
1930 if (!p_sc_oob_data->peer_oob_data.present)
1932 SMP_TRACE_EVENT ("peer OOB data is absent");
1933 memset(p_cb->peer_random, 0, sizeof (p_cb->peer_random));
1937 memcpy(p_cb->peer_random, p_sc_oob_data->peer_oob_data.randomizer,
1938 sizeof(p_cb->peer_random));
1939 memcpy(p_cb->remote_commitment, p_sc_oob_data->peer_oob_data.commitment,
1940 sizeof(p_cb->remote_commitment));
1942 UINT8 reason = SMP_CONFIRM_VALUE_ERR;
1943 /* check commitment */
1944 if (!smp_check_commitment(p_cb))
1946 p_cb->failure = reason;
1947 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &reason);
1951 if (p_cb->peer_oob_flag != SMP_OOB_PRESENT)
1953 /* the peer doesn't have local randomiser */
1954 SMP_TRACE_EVENT ("peer didn't receive local OOB data, set local randomizer to 0");
1955 memset(p_cb->local_random, 0, sizeof (p_cb->local_random));
1959 print128(p_cb->local_random, (const UINT8 *)"local OOB randomizer");
1960 print128(p_cb->peer_random, (const UINT8 *)"peer OOB randomizer");
1961 smp_start_nonce_generation(p_cb);
1964 /*******************************************************************************
1965 ** Function smp_set_local_oob_keys
1966 ** Description Saves calculated private/public keys in sc_oob_data.loc_oob_data,
1967 ** starts nonce generation
1968 ** (to be saved in sc_oob_data.loc_oob_data.randomizer).
1969 *******************************************************************************/
1970 void smp_set_local_oob_keys(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1972 SMP_TRACE_DEBUG("%s", __func__);
1974 memcpy(p_cb->sc_oob_data.loc_oob_data.private_key_used, p_cb->private_key,
1976 p_cb->sc_oob_data.loc_oob_data.publ_key_used = p_cb->loc_publ_key;
1977 smp_start_nonce_generation(p_cb);
1980 /*******************************************************************************
1981 ** Function smp_set_local_oob_random_commitment
1982 ** Description Saves calculated randomizer and commitment in sc_oob_data.loc_oob_data,
1983 ** passes sc_oob_data.loc_oob_data up for safekeeping.
1984 *******************************************************************************/
1985 void smp_set_local_oob_random_commitment(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
1987 SMP_TRACE_DEBUG("%s", __func__);
1988 memcpy(p_cb->sc_oob_data.loc_oob_data.randomizer, p_cb->rand,
1991 smp_calculate_f4(p_cb->sc_oob_data.loc_oob_data.publ_key_used.x,
1992 p_cb->sc_oob_data.loc_oob_data.publ_key_used.x,
1993 p_cb->sc_oob_data.loc_oob_data.randomizer, 0,
1994 p_cb->sc_oob_data.loc_oob_data.commitment);
1996 #if SMP_DEBUG == TRUE
1997 UINT8 *p_print = NULL;
1998 SMP_TRACE_DEBUG("local SC OOB data set:");
1999 p_print = (UINT8*) &p_cb->sc_oob_data.loc_oob_data.addr_sent_to;
2000 smp_debug_print_nbyte_little_endian (p_print, (const UINT8 *)"addr_sent_to",
2001 sizeof(tBLE_BD_ADDR));
2002 p_print = (UINT8*) &p_cb->sc_oob_data.loc_oob_data.private_key_used;
2003 smp_debug_print_nbyte_little_endian (p_print, (const UINT8 *)"private_key_used",
2005 p_print = (UINT8*) &p_cb->sc_oob_data.loc_oob_data.publ_key_used.x;
2006 smp_debug_print_nbyte_little_endian (p_print, (const UINT8 *)"publ_key_used.x",
2008 p_print = (UINT8*) &p_cb->sc_oob_data.loc_oob_data.publ_key_used.y;
2009 smp_debug_print_nbyte_little_endian (p_print, (const UINT8 *)"publ_key_used.y",
2011 p_print = (UINT8*) &p_cb->sc_oob_data.loc_oob_data.randomizer;
2012 smp_debug_print_nbyte_little_endian (p_print, (const UINT8 *)"randomizer",
2014 p_print = (UINT8*) &p_cb->sc_oob_data.loc_oob_data.commitment;
2015 smp_debug_print_nbyte_little_endian (p_print,(const UINT8 *) "commitment",
2017 SMP_TRACE_DEBUG("");
2020 /* pass created OOB data up */
2021 p_cb->cb_evt = SMP_SC_LOC_OOB_DATA_UP_EVT;
2022 smp_send_app_cback(p_cb, NULL);
2024 smp_cb_cleanup(p_cb);
2027 /*******************************************************************************
2029 ** Function smp_link_encrypted
2031 ** Description This function is called when link is encrypted and notified to
2032 ** slave device. Proceed to to send LTK, DIV and ER to master if
2033 ** bonding the devices.
2038 *******************************************************************************/
2039 void smp_link_encrypted(BD_ADDR bda, UINT8 encr_enable)
2041 tSMP_CB *p_cb = &smp_cb;
2043 SMP_TRACE_DEBUG("%s encr_enable=%d", __func__, encr_enable);
2045 if (memcmp(&smp_cb.pairing_bda[0], bda, BD_ADDR_LEN) == 0)
2047 /* encryption completed with STK, remmeber the key size now, could be overwite
2048 * when key exchange happens */
2049 if (p_cb->loc_enc_size != 0 && encr_enable)
2051 /* update the link encryption key size if a SMP pairing just performed */
2052 btm_ble_update_sec_key_size(bda, p_cb->loc_enc_size);
2055 smp_sm_event(&smp_cb, SMP_ENCRYPTED_EVT, &encr_enable);
2059 /*******************************************************************************
2061 ** Function smp_proc_ltk_request
2063 ** Description This function is called when LTK request is received from
2068 *******************************************************************************/
2069 BOOLEAN smp_proc_ltk_request(BD_ADDR bda)
2071 SMP_TRACE_DEBUG("%s state = %d", __func__, smp_cb.state);
2072 BOOLEAN match = FALSE;
2074 if (!memcmp(bda, smp_cb.pairing_bda, BD_ADDR_LEN))
2078 BD_ADDR dummy_bda = {0};
2079 tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev(bda);
2080 if (p_dev_rec != NULL &&
2081 0 == memcmp(p_dev_rec->ble.pseudo_addr, smp_cb.pairing_bda, BD_ADDR_LEN) &&
2082 0 != memcmp(p_dev_rec->ble.pseudo_addr, dummy_bda, BD_ADDR_LEN))
2088 if (match && smp_cb.state == SMP_STATE_ENCRYPTION_PENDING)
2090 smp_sm_event(&smp_cb, SMP_ENC_REQ_EVT, NULL);
2097 /*******************************************************************************
2099 ** Function smp_process_secure_connection_long_term_key
2101 ** Description This function is called to process SC LTK.
2102 ** SC LTK is calculated and used instead of STK.
2103 ** Here SC LTK is saved in BLE DB.
2107 *******************************************************************************/
2108 void smp_process_secure_connection_long_term_key(void)
2110 tSMP_CB *p_cb = &smp_cb;
2112 SMP_TRACE_DEBUG("%s", __func__);
2113 smp_save_secure_connections_long_term_key(p_cb);
2115 smp_update_key_mask (p_cb, SMP_SEC_KEY_TYPE_ENC, FALSE);
2116 smp_key_distribution(p_cb, NULL);
2119 /*******************************************************************************
2121 ** Function smp_set_derive_link_key
2123 ** Description This function is called to set flag that indicates that
2124 ** BR/EDR LK has to be derived from LTK after all keys are
2129 *******************************************************************************/
2130 void smp_set_derive_link_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
2132 SMP_TRACE_DEBUG ("%s", __func__);
2133 p_cb->derive_lk = TRUE;
2134 smp_update_key_mask (p_cb, SMP_SEC_KEY_TYPE_LK, FALSE);
2135 smp_key_distribution(p_cb, NULL);
2138 /*******************************************************************************
2140 ** Function smp_derive_link_key_from_long_term_key
2142 ** Description This function is called to derive BR/EDR LK from LTK.
2146 *******************************************************************************/
2147 void smp_derive_link_key_from_long_term_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
2149 tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN;
2151 SMP_TRACE_DEBUG("%s", __func__);
2152 if (!smp_calculate_link_key_from_long_term_key(p_cb))
2154 SMP_TRACE_ERROR("%s failed", __FUNCTION__);
2155 smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &status);
2160 /*******************************************************************************
2162 ** Function smp_br_process_link_key
2164 ** Description This function is called to process BR/EDR LK:
2165 ** - to derive SMP LTK from BR/EDR LK;
2166 *8 - to save SMP LTK.
2170 *******************************************************************************/
2171 void smp_br_process_link_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
2173 tSMP_STATUS status = SMP_PAIR_FAIL_UNKNOWN;
2175 SMP_TRACE_DEBUG("%s", __func__);
2176 if (!smp_calculate_long_term_key_from_link_key(p_cb))
2178 SMP_TRACE_ERROR ("%s failed",__FUNCTION__);
2179 smp_sm_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &status);
2183 SMP_TRACE_DEBUG("%s: LTK derivation from LK successfully completed", __FUNCTION__);
2184 smp_save_secure_connections_long_term_key(p_cb);
2185 smp_update_key_mask (p_cb, SMP_SEC_KEY_TYPE_ENC, FALSE);
2186 smp_br_select_next_key(p_cb, NULL);
2189 /*******************************************************************************
2190 ** Function smp_key_distribution_by_transport
2191 ** Description depending on the transport used at the moment calls either
2192 ** smp_key_distribution(...) or smp_br_key_distribution(...).
2193 *******************************************************************************/
2194 void smp_key_distribution_by_transport(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
2196 SMP_TRACE_DEBUG("%s", __func__);
2197 if (p_cb->smp_over_br)
2199 smp_br_select_next_key(p_cb, NULL);
2203 smp_key_distribution(p_cb, NULL);
2207 /*******************************************************************************
2208 ** Function smp_br_pairing_complete
2209 ** Description This function is called to send the pairing complete callback
2210 ** and remove the connection if needed.
2211 *******************************************************************************/
2212 void smp_br_pairing_complete(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
2214 SMP_TRACE_DEBUG("%s", __func__);
2216 if (p_cb->total_tx_unacked == 0)
2218 /* process the pairing complete */
2219 smp_proc_pairing_cmpl(p_cb);