Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 53ee9021 authored by Animesh Fatehpuria's avatar Animesh Fatehpuria
Browse files

CTKD: Fix role change bug on legacy BT stack 

If a role switch happens before connection complete, we incorrectly
ignore the information. This can sometimes cause CTKD to not function
properly.

Bug: 186367778
Tag: #refactor
Test: atest net_test_main_shim, presubmit, manual role change testing
(with and without gd enabled)

Change-Id: I619376d35051a9b5ead74608a66fae1c5ea32c2b
parent 67193845

system/stack/acl/btm_acl.cc

+37 −4
Original line number Diff line number Diff line
@@ -96,9 +96,14 @@ struct StackAclBtmAcl { 
  }

};



struct RoleChangeView {

  tHCI_ROLE new_role = HCI_ROLE_UNKNOWN;

  RawAddress bd_addr;

};



namespace {

StackAclBtmAcl internal_;



std::unique_ptr<RoleChangeView> delayed_role_change_ = nullptr;

const bluetooth::legacy::hci::Interface& GetLegacyHciInterface() {

  return bluetooth::legacy::hci::GetInterface();

}
@@ -1382,6 +1387,13 @@ void StackAclBtmAcl::btm_acl_role_changed(tHCI_STATUS hci_status, 
                                          tHCI_ROLE new_role) {

  tACL_CONN* p_acl = internal_.btm_bda_to_acl(bd_addr, BT_TRANSPORT_BR_EDR);

  if (p_acl == nullptr) {

    // If we get a role change before connection complete, we cache the new

    // role here and then propagate it when ACL Link is created.

    RoleChangeView role_change;

    role_change.new_role = new_role;

    role_change.bd_addr = bd_addr;

    delayed_role_change_ =

        std::make_unique<RoleChangeView>(std::move(role_change));

    LOG_WARN("Unable to find active acl");

    return;

  }
@@ -2182,6 +2194,16 @@ void btm_acl_reset_paging(void) { 
 *

 ******************************************************************************/

void btm_acl_paging(BT_HDR* p, const RawAddress& bda) {

  // This function is called by the device initiating the connection.

  // If no role change is requested from the remote device, we want

  // to classify the connection initiator as the central device.

  if (delayed_role_change_ == nullptr) {

    RoleChangeView role_change;

    role_change.bd_addr = bda;

    role_change.new_role = HCI_ROLE_CENTRAL;

    delayed_role_change_ =

        std::make_unique<RoleChangeView>(std::move(role_change));

  }

  if (!BTM_IsAclConnectionUp(bda, BT_TRANSPORT_BR_EDR)) {

    VLOG(1) << "connecting_bda: " << btm_cb.connecting_bda;

    if (btm_cb.paging && bda == btm_cb.connecting_bda) {
@@ -2522,7 +2544,13 @@ bool acl_set_peer_le_features_from_handle(uint16_t hci_handle, 


void on_acl_br_edr_connected(const RawAddress& bda, uint16_t handle,

                             uint8_t enc_mode) {

  if (delayed_role_change_ != nullptr && delayed_role_change_->bd_addr == bda) {

    btm_sec_connected(bda, handle, HCI_SUCCESS, enc_mode,

                      delayed_role_change_->new_role);

  } else {

    btm_sec_connected(bda, handle, HCI_SUCCESS, enc_mode);

  }

  delayed_role_change_ = nullptr;

  btm_acl_set_paging(false);

  l2c_link_hci_conn_comp(HCI_SUCCESS, handle, bda);

  constexpr uint16_t link_supervision_timeout = 8000;
@@ -2548,8 +2576,13 @@ void on_acl_br_edr_connected(const RawAddress& bda, uint16_t handle, 
void on_acl_br_edr_failed(const RawAddress& bda, tHCI_STATUS status) {

  ASSERT_LOG(status != HCI_SUCCESS,

             "Successful connection entering failing code path");



  if (delayed_role_change_ != nullptr && delayed_role_change_->bd_addr == bda) {

    btm_sec_connected(bda, HCI_INVALID_HANDLE, status, false,

                      delayed_role_change_->new_role);

  } else {

    btm_sec_connected(bda, HCI_INVALID_HANDLE, status, false);

  }

  delayed_role_change_ = nullptr;

  btm_acl_set_paging(false);

  l2c_link_hci_conn_comp(status, HCI_INVALID_HANDLE, bda);

}

system/stack/btm/btm_sec.cc

+3 −2
Original line number Diff line number Diff line
@@ -3349,7 +3349,8 @@ static void btm_sec_connect_after_reject_timeout(UNUSED_ATTR void* data) { 
 *

 ******************************************************************************/

void btm_sec_connected(const RawAddress& bda, uint16_t handle,

                       tHCI_STATUS status, uint8_t enc_mode) {

                       tHCI_STATUS status, uint8_t enc_mode,

                       tHCI_ROLE assigned_role) {

  tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bda);

  tBTM_STATUS res;

  bool is_pairing_device = false;
@@ -3577,7 +3578,7 @@ void btm_sec_connected(const RawAddress& bda, uint16_t handle, 
  }



  p_dev_rec->hci_handle = handle;

  btm_acl_created(bda, handle, HCI_ROLE_PERIPHERAL, BT_TRANSPORT_BR_EDR);

  btm_acl_created(bda, handle, assigned_role, BT_TRANSPORT_BR_EDR);



  /* role may not be correct here, it will be updated by l2cap, but we need to

   */

system/stack/btm/btm_sec.h

+4 −1
Original line number Diff line number Diff line
@@ -22,11 +22,13 @@ 
 *

 ******************************************************************************/



#pragma once

#include <cstdint>

#include "stack/btm/security_device_record.h"

#include "stack/include/btm_api_types.h"

#include "stack/include/hci_error_code.h"

#include "stack/include/security_client_callbacks.h"

#include "types/hci_role.h"



#define BTM_SEC_MAX_COLLISION_DELAY (5000)
@@ -624,7 +626,8 @@ void btm_sec_encrypt_change(uint16_t handle, tHCI_STATUS status, 
 *

 ******************************************************************************/

void btm_sec_connected(const RawAddress& bda, uint16_t handle,

                       tHCI_STATUS status, uint8_t enc_mode);

                       tHCI_STATUS status, uint8_t enc_mode,

                       tHCI_ROLE assigned_role = HCI_ROLE_PERIPHERAL);



/*******************************************************************************

 *

system/stack/btm/security_device_record.h

+3 −1
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ 
#include "main/shim/dumpsys.h"

#include "osi/include/alarm.h"

#include "stack/include/btm_api_types.h"

#include "types/hci_role.h"

#include "types/raw_address.h"



typedef char tBTM_LOC_BD_NAME[BTM_MAX_LOC_BD_NAME_LEN + 1];
@@ -227,7 +228,8 @@ struct tBTM_SEC_DEV_REC { 
                               uint8_t pin_len, uint8_t* p_pin);

  friend void btm_sec_auth_complete(uint16_t handle, tHCI_STATUS status);

  friend void btm_sec_connected(const RawAddress& bda, uint16_t handle,

                                tHCI_STATUS status, uint8_t enc_mode);

                                tHCI_STATUS status, uint8_t enc_mode,

                                tHCI_ROLE);

  friend void btm_sec_encrypt_change(uint16_t handle, tHCI_STATUS status,

                                     uint8_t encr_enable);

  friend void btm_sec_link_key_notification(const RawAddress& p_bda,

system/stack/l2cap/l2c_link.cc

+0 −3
Original line number Diff line number Diff line
@@ -190,9 +190,6 @@ void l2c_link_hci_conn_comp(tHCI_STATUS status, uint16_t handle, 
    /* Get the peer information if the l2cap flow-control/rtrans is supported */

    l2cu_send_peer_info_req(p_lcb, L2CAP_EXTENDED_FEATURES_INFO_TYPE);



    /* Tell BTM Acl management about the link */

    btm_acl_created(ci.bd_addr, handle, p_lcb->LinkRole(), BT_TRANSPORT_BR_EDR);



    if (p_lcb->IsBonding()) {

      LOG_DEBUG("Link is dedicated bonding handle:0x%04x", p_lcb->Handle());

      if (l2cu_start_post_bond_timer(handle)) return;