From a842d54f4deece9c9693e951052bfdbaf60d0188 Mon Sep 17 00:00:00 2001 From: Zhi Wei Jian Date: Fri, 26 Jun 2026 09:08:17 +0800 Subject: [PATCH] feat(ble/bluedroid): add CS Security Requirements host support (Core 6.3) (cherry picked from commit 919622c01ce8f05de41ad2c033fdfa947d84c44c) Co-authored-by: zhiweijian --- components/bt/host/bluedroid/Kconfig.in | 16 +++- .../bt/host/bluedroid/api/esp_gap_ble_api.c | 52 +++++++++++ .../api/include/api/esp_gap_ble_api.h | 89 +++++++++++++++++++ .../bt/host/bluedroid/bta/dm/bta_dm_act.c | 12 +++ .../bt/host/bluedroid/bta/dm/bta_dm_api.c | 27 ++++++ .../bt/host/bluedroid/bta/dm/bta_dm_main.c | 4 + .../bluedroid/bta/dm/include/bta_dm_int.h | 24 +++++ .../host/bluedroid/bta/include/bta/bta_api.h | 8 ++ .../btc/profile/std/gap/btc_gap_ble.c | 20 +++++ .../btc/profile/std/include/btc_gap_ble.h | 14 +++ .../include/common/bluedroid_user_config.h | 17 ++-- .../common/include/common/bt_target.h | 5 ++ .../host/bluedroid/stack/btm/btm_ble_5_gap.c | 36 ++++++++ .../bt/host/bluedroid/stack/hcic/hciblecmds.c | 39 ++++++++ .../stack/include/stack/btm_ble_api.h | 24 ++++- .../bluedroid/stack/include/stack/hcidefs.h | 4 + .../bluedroid/stack/include/stack/hcimsgs.h | 7 ++ 17 files changed, 389 insertions(+), 9 deletions(-) diff --git a/components/bt/host/bluedroid/Kconfig.in b/components/bt/host/bluedroid/Kconfig.in index 10584dbff98..8b2006baba8 100644 --- a/components/bt/host/bluedroid/Kconfig.in +++ b/components/bt/host/bluedroid/Kconfig.in @@ -1516,7 +1516,21 @@ config BT_BLE_FEAT_CHANNEL_SOUNDING depends on (BT_BLE_50_FEATURES_SUPPORTED && ((BT_CONTROLLER_ENABLED && SOC_BLE_CHANNEL_SOUNDING_SUPPORTED) || BT_CONTROLLER_DISABLED)) # NOERROR default n help - Enable BLE channel sounding + Enable BLE channel sounding. + CS Security Requirements (Core 6.3) is configured separately via + BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS. + +config BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS + bool "Enable BLE CS Security Requirements (Core 6.3)" + depends on BT_BLE_FEAT_CHANNEL_SOUNDING && ((BT_CONTROLLER_ENABLED && SOC_BLE_CS_SECURITY_REQUIREMENTS_SUPPORTED) || BT_CONTROLLER_DISABLED) # NOERROR + default n + help + Enable Channel Sounding security requirements HCI commands (Bluetooth Core 6.3). + Supports LE CS Set Security Requirements (0x00A7) and + LE CS Set Default Security Requirements (0x00A8). + Use esp_ble_cs_set_security_requirements() and + esp_ble_cs_set_default_security_requirements(). + config BT_BLE_FEAT_ADV_MONITOR bool "Enable BLE Advertising Monitor (LE Monitor Advertisement)" depends on (BT_BLE_50_FEATURES_SUPPORTED && ((BT_CONTROLLER_ENABLED && SOC_BLE_ADV_MONITOR_SUPPORTED) || BT_CONTROLLER_DISABLED)) # NOERROR diff --git a/components/bt/host/bluedroid/api/esp_gap_ble_api.c b/components/bt/host/bluedroid/api/esp_gap_ble_api.c index 718faa8bf3a..eca58b2515e 100644 --- a/components/bt/host/bluedroid/api/esp_gap_ble_api.c +++ b/components/bt/host/bluedroid/api/esp_gap_ble_api.c @@ -2945,6 +2945,58 @@ esp_err_t esp_ble_cs_security_enable(uint16_t conn_handle) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); } +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +/* Host does not validate conn_handle range or CS_Security_Requirements reserved bits; Controller checks. */ +esp_err_t esp_ble_cs_set_security_requirements(esp_ble_cs_set_security_requirements_params *params) +{ + btc_msg_t msg = {0}; + btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); + + if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { + return ESP_ERR_INVALID_STATE; + } + + if (!params) { + return ESP_ERR_INVALID_ARG; + } + + msg.sig = BTC_SIG_API_CALL; + msg.pid = BTC_PID_GAP_BLE; + msg.act = BTC_GAP_BLE_CS_SET_SECURITY_REQUIREMENTS; + + arg.cs_set_security_requirements_params.conn_handle = params->conn_handle; + arg.cs_set_security_requirements_params.cs_security_requirements = params->cs_security_requirements; + + return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL) + == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); +} + +/* Host does not validate CS_Security_Requirements reserved bits; Controller checks. */ +esp_err_t esp_ble_cs_set_default_security_requirements(esp_ble_cs_set_default_security_requirements_params *params) +{ + btc_msg_t msg = {0}; + btc_ble_5_gap_args_t arg; + memset(&arg, 0, sizeof(arg)); + + if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) { + return ESP_ERR_INVALID_STATE; + } + + if (!params) { + return ESP_ERR_INVALID_ARG; + } + + msg.sig = BTC_SIG_API_CALL; + msg.pid = BTC_PID_GAP_BLE; + msg.act = BTC_GAP_BLE_CS_SET_DEFAULT_SECURITY_REQUIREMENTS; + + arg.cs_set_default_security_requirements_params.cs_security_requirements = params->cs_security_requirements; + + return (btc_transfer_context(&msg, &arg, sizeof(btc_ble_5_gap_args_t), NULL, NULL) + == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL); +} +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) esp_err_t esp_ble_cs_set_default_settings(esp_ble_cs_set_default_settings_params *default_setting_params) { diff --git a/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h b/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h index 5571130b3be..b76289d8bf8 100644 --- a/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h +++ b/components/bt/host/bluedroid/api/include/api/esp_gap_ble_api.h @@ -285,6 +285,8 @@ typedef enum { ESP_GAP_BLE_ENABLE_UTP_OTA_MODE_COMPLETE_EVT, /*!< When enable UTP OTA mode complete, the event comes */ ESP_GAP_BLE_UTP_SEND_COMPLETE_EVT, /*!< When UTP send complete, the event comes */ ESP_GAP_BLE_UTP_RECEIVE_EVT, /*!< When UTP data is received, the event comes */ + ESP_GAP_BLE_CS_SET_SECURITY_REQUIREMENTS_CMPL_EVT, /*!< When CS set security requirements complete, the event comes */ + ESP_GAP_BLE_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_CMPL_EVT, /*!< When CS set default security requirements complete, the event comes */ ESP_GAP_BLE_EVT_MAX, /*!< when maximum advertising event complete, the event comes */ } esp_gap_ble_cb_event_t; @@ -1730,6 +1732,33 @@ typedef enum { /** Reflector role is enabled */ #define ESP_BLE_CS_REFLECTOR_ROLE_ENABLED (1 << 1) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +/** CS tone security requirement (bit 0 of CS_Security_Requirements) */ +#define ESP_BLE_CS_SECURITY_REQUIREMENT_CS_TONE (1ULL << 0) +/** 150 ns RTT accuracy security requirement (bit 1) */ +#define ESP_BLE_CS_SECURITY_REQUIREMENT_RTT_150NS_ACCURACY (1ULL << 1) +/** 10 ns RTT accuracy security requirement (bit 2) */ +#define ESP_BLE_CS_SECURITY_REQUIREMENT_RTT_10NS_ACCURACY (1ULL << 2) +/** RTT sounding sequence or random sequence security requirement (bit 3) */ +#define ESP_BLE_CS_SECURITY_REQUIREMENT_RTT_SOUNDING_OR_RANDOM (1ULL << 3) +/** Normalized Attack Detector Metric security requirement (bit 4) */ +#define ESP_BLE_CS_SECURITY_REQUIREMENT_NADM (1ULL << 4) + +/** +* @brief CS set security requirements parameters +*/ +typedef struct { + uint16_t conn_handle; /*!< Connection_Handle. Host does not validate the handle range; the Controller checks it (0x0000 to 0x0EFF). */ + uint64_t cs_security_requirements; /*!< 8-octet CS security requirements bitmask (bits 0-4). Host does not validate reserved bits 5-63; the Controller checks they are zero. */ +} esp_ble_cs_set_security_requirements_params; + +/** +* @brief CS set default security requirements parameters +*/ +typedef struct { + uint64_t cs_security_requirements; /*!< 8-octet CS security requirements bitmask for future connections (bits 0-4). Host does not validate reserved bits 5-63; the Controller checks they are zero. */ +} esp_ble_cs_set_default_security_requirements_params; +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) /** * @brief CS set default settings parameters @@ -2494,6 +2523,23 @@ typedef union { uint8_t data[ESP_BLE_GAP_UTP_DATA_MAX_LEN]; /*!< UTP data */ } utp_receive; /*!< Event parameter of ESP_GAP_BLE_UTP_RECEIVE_EVT */ #endif // #if (BLE_FEAT_LE_UTP == TRUE) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) + /** + * @brief ESP_GAP_BLE_CS_SET_SECURITY_REQUIREMENTS_CMPL_EVT + */ + struct ble_cs_set_security_requirements { + esp_bt_status_t status; /*!< 0x00: CS set security requirements command succeeded + other: CS set security requirements command failed */ + uint16_t conn_handle; /*!< Connection Handle */ + } cs_set_security_requirements; /*!< Event parameter of ESP_GAP_BLE_CS_SET_SECURITY_REQUIREMENTS_CMPL_EVT */ + /** + * @brief ESP_GAP_BLE_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_CMPL_EVT + */ + struct ble_cs_set_default_security_requirements { + esp_bt_status_t status; /*!< 0x00: CS set default security requirements command succeeded + other: CS set default security requirements command failed */ + } cs_set_default_security_requirements; /*!< Event parameter of ESP_GAP_BLE_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_CMPL_EVT */ +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) /** * @brief ESP_GAP_BLE_CHANNEL_SELECT_ALGORITHM_EVT */ @@ -4965,6 +5011,49 @@ esp_err_t esp_ble_cs_write_cached_remote_supported_capabilities(esp_ble_cs_write */ esp_err_t esp_ble_cs_security_enable(uint16_t conn_handle); +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +/** + * @brief Set Channel Sounding security requirements for a connection (Core 6.3). + * + * Requires CONFIG_BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS and CS Host Support enabled + * via esp_ble_gap_set_host_feature(ESP_BLE_HOST_FEATURE_CS_HOST_SUPPORT, 1). + * Must be issued before CS procedures are enabled on the connection. + * + * The Host does not validate Connection_Handle range or CS_Security_Requirements + * reserved bits (5-63); the Controller performs these checks and reports errors + * via ESP_GAP_BLE_CS_SET_SECURITY_REQUIREMENTS_CMPL_EVT. + * + * @param[in] params: CS set security requirements parameters + * + * @return + * - ESP_OK : success (command queued) + * - ESP_ERR_INVALID_ARG : params is NULL + * - ESP_ERR_INVALID_STATE : Bluedroid is not enabled + * - ESP_FAIL : other failures + */ +esp_err_t esp_ble_cs_set_security_requirements(esp_ble_cs_set_security_requirements_params *params); + +/** + * @brief Set initial Channel Sounding security requirements for future connections (Core 6.3). + * + * Requires CONFIG_BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS and CS Host Support enabled + * via esp_ble_gap_set_host_feature(ESP_BLE_HOST_FEATURE_CS_HOST_SUPPORT, 1). + * Does not affect existing connections. + * + * The Host does not validate CS_Security_Requirements reserved bits (5-63); + * the Controller performs this check and reports errors via + * ESP_GAP_BLE_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_CMPL_EVT. + * + * @param[in] params: CS set default security requirements parameters + * + * @return + * - ESP_OK : success (command queued) + * - ESP_ERR_INVALID_ARG : params is NULL + * - ESP_ERR_INVALID_STATE : Bluedroid is not enabled + * - ESP_FAIL : other failures + */ +esp_err_t esp_ble_cs_set_default_security_requirements(esp_ble_cs_set_default_security_requirements_params *params); +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) /** * @brief This function is used to set default CS settings in the local Controller diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_act.c b/components/bt/host/bluedroid/bta/dm/bta_dm_act.c index b00f23c8b00..0130e7db02d 100644 --- a/components/bt/host/bluedroid/bta/dm/bta_dm_act.c +++ b/components/bt/host/bluedroid/bta/dm/bta_dm_act.c @@ -6406,6 +6406,18 @@ void bta_dm_api_cs_procedure_enable(tBTA_DM_MSG *p_data) } #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +void bta_dm_api_cs_set_security_requirements(tBTA_DM_MSG *p_data) +{ + BTM_BleGapCsSetSecurityRequirements(p_data->set_security_requirements_params.conn_handle, + p_data->set_security_requirements_params.cs_security_requirements); +} + +void bta_dm_api_cs_set_default_security_requirements(tBTA_DM_MSG *p_data) +{ + BTM_BleGapCsSetDefaultSecurityRequirements(p_data->set_default_security_requirements_params.cs_security_requirements); +} +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) #if ((defined BTA_GATT_INCLUDED) && (BTA_GATT_INCLUDED == TRUE) && SDP_INCLUDED == TRUE) #ifndef BTA_DM_GATT_CLOSE_DELAY_TOUT diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_api.c b/components/bt/host/bluedroid/bta/dm/bta_dm_api.c index 6ccc7e9d1ea..57f816f913f 100644 --- a/components/bt/host/bluedroid/bta/dm/bta_dm_api.c +++ b/components/bt/host/bluedroid/bta/dm/bta_dm_api.c @@ -2647,6 +2647,33 @@ void BTA_DmBleGapCsProcEnable(uint16_t conn_handle, uint8_t config_id, uint8_t e #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +void BTA_DmBleGapCsSetSecurityRequirements(uint16_t conn_handle, uint64_t cs_security_requirements) +{ + tBTA_DM_API_CS_SET_SECURITY_REQUIREMENTS_PARAMS *p_msg; + + if ((p_msg = (tBTA_DM_API_CS_SET_SECURITY_REQUIREMENTS_PARAMS *) + osi_malloc(sizeof(tBTA_DM_API_CS_SET_SECURITY_REQUIREMENTS_PARAMS))) != NULL) { + p_msg->hdr.event = BTA_DM_API_CS_SET_SECURITY_REQUIREMENTS; + p_msg->conn_handle = conn_handle; + p_msg->cs_security_requirements = cs_security_requirements; + bta_sys_sendmsg(p_msg); + } +} + +void BTA_DmBleGapCsSetDefaultSecurityRequirements(uint64_t cs_security_requirements) +{ + tBTA_DM_API_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_PARAMS *p_msg; + + if ((p_msg = (tBTA_DM_API_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_PARAMS *) + osi_malloc(sizeof(tBTA_DM_API_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_PARAMS))) != NULL) { + p_msg->hdr.event = BTA_DM_API_CS_SET_DEFAULT_SECURITY_REQUIREMENTS; + p_msg->cs_security_requirements = cs_security_requirements; + bta_sys_sendmsg(p_msg); + } +} + +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) /******************************************************************************* ** diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_main.c b/components/bt/host/bluedroid/bta/dm/bta_dm_main.c index b85c91663b9..2ee25451264 100644 --- a/components/bt/host/bluedroid/bta/dm/bta_dm_main.c +++ b/components/bt/host/bluedroid/bta/dm/bta_dm_main.c @@ -328,6 +328,10 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = { bta_dm_api_cs_set_procedure_params, /* BTA_DM_API_CS_SET_PROCEDURE_PARAMS */ bta_dm_api_cs_procedure_enable, /* BTA_DM_API_CS_PROCEDURE_ENABLE */ #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) + bta_dm_api_cs_set_security_requirements, /* BTA_DM_API_CS_SET_SECURITY_REQUIREMENTS */ + bta_dm_api_cs_set_default_security_requirements, /* BTA_DM_API_CS_SET_DEFAULT_SECURITY_REQUIREMENTS */ +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) #if (BLE_FEAT_DBAF == TRUE) bta_dm_ble_gap_set_decision_data, /* BTA_DM_API_SET_DECISION_DATA_EVT */ bta_dm_ble_gap_set_decision_instructions, /* BTA_DM_API_SET_DECISION_INSTRUCTIONS_EVT */ diff --git a/components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h b/components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h index eed23f69050..e2e61e0f1af 100644 --- a/components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h +++ b/components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h @@ -325,6 +325,10 @@ enum { BTA_DM_API_CS_SET_PROCEDURE_PARAMS, BTA_DM_API_CS_PROCEDURE_ENABLE, #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) + BTA_DM_API_CS_SET_SECURITY_REQUIREMENTS, + BTA_DM_API_CS_SET_DEFAULT_SECURITY_REQUIREMENTS, +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) #if (BLE_FEAT_DBAF == TRUE) BTA_DM_API_SET_DECISION_DATA_EVT, BTA_DM_API_SET_DECISION_INSTRUCTIONS_EVT, @@ -1228,6 +1232,18 @@ typedef struct { UINT8 enable; } tBTA_DM_API_CS_PROC_ENABLE_PARAMS; +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +typedef struct { + BT_HDR hdr; + UINT16 conn_handle; + UINT64 cs_security_requirements; +} tBTA_DM_API_CS_SET_SECURITY_REQUIREMENTS_PARAMS; + +typedef struct { + BT_HDR hdr; + UINT64 cs_security_requirements; +} tBTA_DM_API_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_PARAMS; +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) #endif /* BLE_INCLUDED */ @@ -2030,6 +2046,10 @@ typedef union { tBTA_DM_API_CS_SET_PROC_PARAMS set_proc_params; tBTA_DM_API_CS_PROC_ENABLE_PARAMS proc_enable_params; #endif +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) + tBTA_DM_API_CS_SET_SECURITY_REQUIREMENTS_PARAMS set_security_requirements_params; + tBTA_DM_API_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_PARAMS set_default_security_requirements_params; +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) } tBTA_DM_MSG; @@ -2727,4 +2747,8 @@ void bta_dm_api_cs_set_channel_classification(tBTA_DM_MSG *p_data); void bta_dm_api_cs_set_procedure_params(tBTA_DM_MSG *p_data); void bta_dm_api_cs_procedure_enable(tBTA_DM_MSG *p_data); #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +void bta_dm_api_cs_set_security_requirements(tBTA_DM_MSG *p_data); +void bta_dm_api_cs_set_default_security_requirements(tBTA_DM_MSG *p_data); +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) #endif /* BTA_DM_INT_H */ diff --git a/components/bt/host/bluedroid/bta/include/bta/bta_api.h b/components/bt/host/bluedroid/bta/include/bta/bta_api.h index 5295770db22..92c8af0fd61 100644 --- a/components/bt/host/bluedroid/bta/include/bta/bta_api.h +++ b/components/bt/host/bluedroid/bta/include/bta/bta_api.h @@ -1655,6 +1655,10 @@ typedef struct { #define BTA_BLE_GAP_CS_SUBEVENT_RESULT_EVT BTM_BLE_GAP_CS_SUBEVENT_RESULT_EVT #define BTA_BLE_GAP_CS_SUBEVENT_RESULT_CONTINUE_EVT BTM_BLE_GAP_CS_SUBEVENT_RESULT_CONTINUE_EVT #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +#define BTA_BLE_GAP_CS_SET_SECURITY_REQUIREMENTS_CMPL_EVT BTM_BLE_GAP_CS_SET_SECURITY_REQUIREMENTS_CMPL_EVT +#define BTA_BLE_GAP_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_CMPL_EVT BTM_BLE_GAP_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_CMPL_EVT +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) #define BTA_DM_BLE_5_GAP_UNKNOWN_EVT BTM_BLE_5_GAP_UNKNOWN_EVT typedef tBTM_BLE_5_GAP_EVENT tBTA_DM_BLE_5_GAP_EVENT; @@ -2985,6 +2989,10 @@ void BTA_DmBleGapCsSetChannelClass(uint8_t *channel_class, uint8_t channl_len); void BTA_DmBleGapCsSetProcPatams(tBTA_DM_CS_SET_PROC_PARAMS *set_proc_params); void BTA_DmBleGapCsProcEnable(uint16_t conn_handle, uint8_t config_id, uint8_t enable); #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +void BTA_DmBleGapCsSetSecurityRequirements(uint16_t conn_handle, uint64_t cs_security_requirements); +void BTA_DmBleGapCsSetDefaultSecurityRequirements(uint64_t cs_security_requirements); +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) /******************************************************************************* ** diff --git a/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c b/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c index 0d8e2ca07c9..7e4a11e3898 100644 --- a/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c +++ b/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_ble.c @@ -1711,6 +1711,17 @@ void btc_ble_5_gap_callback(tBTA_DM_BLE_5_GAP_EVENT event, param.cs_security_enable.status = btc_btm_status_to_esp_status(params->cs_security_enable.status); param.cs_security_enable.conn_handle = params->cs_security_enable.conn_handle; break; +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) + case BTA_BLE_GAP_CS_SET_SECURITY_REQUIREMENTS_CMPL_EVT: + msg.act = ESP_GAP_BLE_CS_SET_SECURITY_REQUIREMENTS_CMPL_EVT; + param.cs_set_security_requirements.status = btc_btm_status_to_esp_status(params->cs_set_security_requirements.status); + param.cs_set_security_requirements.conn_handle = params->cs_set_security_requirements.conn_handle; + break; + case BTA_BLE_GAP_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_CMPL_EVT: + msg.act = ESP_GAP_BLE_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_CMPL_EVT; + param.cs_set_default_security_requirements.status = btc_btm_status_to_esp_status(params->cs_set_default_security_requirements.status); + break; +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) case BTA_BLE_GAP_CS_CONFIG_CMPL_EVT: msg.act = ESP_GAP_BLE_CS_CONFIG_CMPL_EVT; param.cs_config_update.status = btc_btm_status_to_esp_status(params->cs_config_update.status); @@ -3787,6 +3798,15 @@ void btc_gap_ble_call_handler(btc_msg_t *msg) BTA_DmBleGapCsProcEnable(arg_5->cs_procedure_enable_params.conn_handle, arg_5->cs_procedure_enable_params.config_id, arg_5->cs_procedure_enable_params.enable); break; #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) + case BTC_GAP_BLE_CS_SET_SECURITY_REQUIREMENTS: + BTA_DmBleGapCsSetSecurityRequirements(arg_5->cs_set_security_requirements_params.conn_handle, + arg_5->cs_set_security_requirements_params.cs_security_requirements); + break; + case BTC_GAP_BLE_CS_SET_DEFAULT_SECURITY_REQUIREMENTS: + BTA_DmBleGapCsSetDefaultSecurityRequirements(arg_5->cs_set_default_security_requirements_params.cs_security_requirements); + break; +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) #if (BT_GATTS_KEY_MATERIAL_CHAR == TRUE) case BTC_GAP_BLE_ACT_SET_KEY_MATERIAL: BTA_DmBleSetKeyMaterial(arg->set_key_material.session_key, arg->set_key_material.iv); diff --git a/components/bt/host/bluedroid/btc/profile/std/include/btc_gap_ble.h b/components/bt/host/bluedroid/btc/profile/std/include/btc_gap_ble.h index 7f4d6e590f8..41fc24c7a74 100644 --- a/components/bt/host/bluedroid/btc/profile/std/include/btc_gap_ble.h +++ b/components/bt/host/bluedroid/btc/profile/std/include/btc_gap_ble.h @@ -187,6 +187,10 @@ typedef enum { BTC_GAP_BLE_CS_SET_PROCEDURE_PARAMS, BTC_GAP_BLE_CS_PROCEDURE_ENABLE, #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) + BTC_GAP_BLE_CS_SET_SECURITY_REQUIREMENTS, + BTC_GAP_BLE_CS_SET_DEFAULT_SECURITY_REQUIREMENTS, +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) #if (BT_GATTS_KEY_MATERIAL_CHAR == TRUE) BTC_GAP_BLE_ACT_SET_KEY_MATERIAL, #endif @@ -798,6 +802,16 @@ typedef union { uint8_t enable; } cs_procedure_enable_params; #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) + struct cs_set_security_requirements_params_args { + uint16_t conn_handle; + uint64_t cs_security_requirements; + } cs_set_security_requirements_params; + + struct cs_set_default_security_requirements_params_args { + uint64_t cs_security_requirements; + } cs_set_default_security_requirements_params; +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) } btc_ble_5_gap_args_t; #endif // #if (BLE_50_FEATURE_SUPPORT == TRUE) diff --git a/components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h b/components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h index 66575a782fd..a6887c2ec18 100644 --- a/components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h +++ b/components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h @@ -343,6 +343,11 @@ #define UC_BT_BLE_FEAT_CHANNEL_SOUNDING FALSE #endif +#ifdef CONFIG_BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS +#define UC_BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS CONFIG_BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS +#else +#define UC_BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS FALSE +#endif #ifdef CONFIG_BT_BLE_FEAT_ADV_MONITOR #define UC_BT_BLE_FEAT_ADV_MONITOR CONFIG_BT_BLE_FEAT_ADV_MONITOR @@ -356,6 +361,11 @@ #define UC_BT_BLE_FEAT_DBAF FALSE #endif +#ifdef CONFIG_BT_BLE_FEAT_FRAME_SPACE_UPDATE +#define UC_BT_BLE_FEAT_FRAME_SPACE_UPDATE CONFIG_BT_BLE_FEAT_FRAME_SPACE_UPDATE +#else +#define UC_BT_BLE_FEAT_FRAME_SPACE_UPDATE FALSE +#endif #ifdef CONFIG_BT_BLE_FEAT_LL_EXT_FEAT #define UC_BT_BLE_FEAT_LL_EXT_FEAT CONFIG_BT_BLE_FEAT_LL_EXT_FEAT @@ -375,13 +385,6 @@ #define UC_BT_BLE_FEAT_LE_UTP FALSE #endif -#ifdef CONFIG_BT_BLE_FEAT_FRAME_SPACE_UPDATE -#define UC_BT_BLE_FEAT_FRAME_SPACE_UPDATE CONFIG_BT_BLE_FEAT_FRAME_SPACE_UPDATE -#else -#define UC_BT_BLE_FEAT_FRAME_SPACE_UPDATE FALSE -#endif - - #ifdef CONFIG_BT_BLE_VENDOR_HCI_EN #define UC_BT_BLE_VENDOR_HCI_EN CONFIG_BT_BLE_VENDOR_HCI_EN #else diff --git a/components/bt/host/bluedroid/common/include/common/bt_target.h b/components/bt/host/bluedroid/common/include/common/bt_target.h index 14a68cacd7a..3c9151b7cc4 100644 --- a/components/bt/host/bluedroid/common/include/common/bt_target.h +++ b/components/bt/host/bluedroid/common/include/common/bt_target.h @@ -405,6 +405,11 @@ #define BT_BLE_FEAT_CHANNEL_SOUNDING FALSE #endif +#if (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) && (UC_BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +#define BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS TRUE +#else +#define BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS FALSE +#endif /* LE Monitor Advertisement (Bluetooth Core 6.0) */ #if (BLE_50_FEATURE_SUPPORT == TRUE) && (defined UC_BT_BLE_FEAT_ADV_MONITOR) && (UC_BT_BLE_FEAT_ADV_MONITOR == TRUE) diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c b/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c index 4ccdec8174e..bcf2cc0ea45 100644 --- a/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c +++ b/components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c @@ -2602,3 +2602,39 @@ void btm_ble_cs_subevt_continue_result_evt(tBTM_BLE_CS_SUBEVT_RESULT_CONTINUE_EV } #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) + +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +/* Host does not validate conn_handle range or CS_Security_Requirements reserved bits; Controller checks. */ +void BTM_BleGapCsSetSecurityRequirements(UINT16 conn_handle, UINT64 cs_security_requirements) +{ + tBTM_STATUS status = BTM_SUCCESS; + tHCI_STATUS err = HCI_SUCCESS; + tBTM_BLE_5_GAP_CB_PARAMS cb_params = {0}; + + if ((err = btsnd_hcic_ble_cs_set_security_requirements(conn_handle, cs_security_requirements)) != HCI_SUCCESS) { + BTM_TRACE_ERROR("cs set security requirements, cmd err=0x%x", err); + status = BTM_HCI_ERROR | err; + } + + cb_params.cs_set_security_requirements.status = status; + cb_params.cs_set_security_requirements.conn_handle = conn_handle; + BTM_ExtBleCallbackTrigger(BTM_BLE_GAP_CS_SET_SECURITY_REQUIREMENTS_CMPL_EVT, &cb_params); +} + +/* Host does not validate CS_Security_Requirements reserved bits; Controller checks. */ +void BTM_BleGapCsSetDefaultSecurityRequirements(UINT64 cs_security_requirements) +{ + tBTM_STATUS status = BTM_SUCCESS; + tHCI_STATUS err = HCI_SUCCESS; + tBTM_BLE_5_GAP_CB_PARAMS cb_params = {0}; + + if ((err = btsnd_hcic_ble_cs_set_default_security_requirements(cs_security_requirements)) != HCI_SUCCESS) { + BTM_TRACE_ERROR("cs set default security requirements, cmd err=0x%x", err); + status = BTM_HCI_ERROR | err; + } + + cb_params.cs_set_default_security_requirements.status = status; + BTM_ExtBleCallbackTrigger(BTM_BLE_GAP_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_CMPL_EVT, &cb_params); +} + +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) diff --git a/components/bt/host/bluedroid/stack/hcic/hciblecmds.c b/components/bt/host/bluedroid/stack/hcic/hciblecmds.c index cb725a94ba2..1dbe71b2886 100644 --- a/components/bt/host/bluedroid/stack/hcic/hciblecmds.c +++ b/components/bt/host/bluedroid/stack/hcic/hciblecmds.c @@ -3770,3 +3770,42 @@ UINT8 btsnd_hcic_ble_cs_procedure_enable(UINT16 conn_handle, UINT8 config_id, UI return TRUE; } #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) + +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +UINT8 btsnd_hcic_ble_cs_set_security_requirements(UINT16 conn_handle, UINT64 cs_security_requirements) +{ + BT_HDR *p; + UINT8 *pp; + + HCI_TRACE_DEBUG("cs set security requirements conn_handle %d", conn_handle); + + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_CS_SET_SECURITY_REQUIREMENTS_LEN); + + pp = (UINT8 *)(p + 1); + + UINT16_TO_STREAM(pp, HCI_BLE_CS_SET_SECURITY_REQUIREMENTS); + UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_CS_SET_SECURITY_REQUIREMENTS_LEN); + UINT16_TO_STREAM(pp, conn_handle); + ARRAY_TO_STREAM(pp, (UINT8 *)&cs_security_requirements, 8); + + return btu_hcif_send_cmd_sync(LOCAL_BR_EDR_CONTROLLER_ID, p); +} + +UINT8 btsnd_hcic_ble_cs_set_default_security_requirements(UINT64 cs_security_requirements) +{ + BT_HDR *p; + UINT8 *pp; + + HCI_TRACE_DEBUG("cs set default security requirements"); + + HCIC_BLE_CMD_CREATED_U8(p, pp, HCIC_PARAM_SIZE_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_LEN); + + pp = (UINT8 *)(p + 1); + + UINT16_TO_STREAM(pp, HCI_BLE_CS_SET_DEFAULT_SECURITY_REQUIREMENTS); + UINT8_TO_STREAM(pp, HCIC_PARAM_SIZE_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_LEN); + ARRAY_TO_STREAM(pp, (UINT8 *)&cs_security_requirements, 8); + + return btu_hcif_send_cmd_sync(LOCAL_BR_EDR_CONTROLLER_ID, p); +} +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) diff --git a/components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h b/components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h index cdc884c627d..eae0a71b2ee 100644 --- a/components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h +++ b/components/bt/host/bluedroid/stack/include/stack/btm_ble_api.h @@ -1012,7 +1012,11 @@ typedef void (tBTM_UPDATE_DUPLICATE_EXCEPTIONAL_LIST_CMPL_CBACK) (tBTM_STATUS st #define BTM_BLE_5_GAP_UTP_SEND_COMPLETE_EVT 84 #define BTM_BLE_5_GAP_UTP_RECEIVE_EVT 85 #endif // #if (BLE_FEAT_LE_UTP == TRUE) -#define BTM_BLE_5_GAP_UNKNOWN_EVT 91 +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +#define BTM_BLE_GAP_CS_SET_SECURITY_REQUIREMENTS_CMPL_EVT 88 +#define BTM_BLE_GAP_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_CMPL_EVT 89 +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +#define BTM_BLE_5_GAP_UNKNOWN_EVT 90 typedef UINT8 tBTM_BLE_5_GAP_EVENT; #if (BLE_FEAT_ISO_EN == TRUE) @@ -1555,6 +1559,16 @@ typedef struct { UINT16 conn_handle; } tBTM_BLE_CS_SEC_ENABLE_CMPL_EVT; +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +typedef struct { + UINT8 status; + UINT16 conn_handle; +} tBTM_BLE_CS_SET_SECURITY_REQUIREMENTS_CMPL_EVT; + +typedef struct { + UINT8 status; +} tBTM_BLE_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_CMPL_EVT; +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) typedef struct { UINT8 status; @@ -2057,6 +2071,10 @@ typedef union { #if (BLE_FEAT_LE_UTP == TRUE) tBTM_BLE_UTP_RECEIVE utp_receive; #endif // #if (BLE_FEAT_LE_UTP == TRUE) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) + tBTM_BLE_CS_SET_SECURITY_REQUIREMENTS_CMPL_EVT cs_set_security_requirements; + tBTM_BLE_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_CMPL_EVT cs_set_default_security_requirements; +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) } tBTM_BLE_5_GAP_CB_PARAMS; typedef struct { @@ -3397,5 +3415,9 @@ void BTM_BleGapCsSetProcPatams(UINT16 conn_handle, UINT8 config_id, UINT16 max_p UINT8 SNR_control_initiator, UINT8 SNR_control_reflector); void BTM_BleGapCsProcEnable(UINT16 conn_handle, UINT8 config_id, UINT8 enable); #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +void BTM_BleGapCsSetSecurityRequirements(UINT16 conn_handle, UINT64 cs_security_requirements); +void BTM_BleGapCsSetDefaultSecurityRequirements(UINT64 cs_security_requirements); +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) #endif diff --git a/components/bt/host/bluedroid/stack/include/stack/hcidefs.h b/components/bt/host/bluedroid/stack/include/stack/hcidefs.h index 14259213170..6622e6bd434 100644 --- a/components/bt/host/bluedroid/stack/include/stack/hcidefs.h +++ b/components/bt/host/bluedroid/stack/include/stack/hcidefs.h @@ -493,6 +493,10 @@ #define HCI_BLE_CS_SET_PROCEDURE_ENABLE (0x0094 | HCI_GRP_BLE_CMDS) #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +#define HCI_BLE_CS_SET_SECURITY_REQUIREMENTS (0x00A7 | HCI_GRP_BLE_CMDS) +#define HCI_BLE_CS_SET_DEFAULT_SECURITY_REQUIREMENTS (0x00A8 | HCI_GRP_BLE_CMDS) +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) #if (BLE_FEAT_LE_UTP == TRUE) #define HCI_BLE_ENABLE_UTP_OTA_MODE (0x009F | HCI_GRP_BLE_CMDS) diff --git a/components/bt/host/bluedroid/stack/include/stack/hcimsgs.h b/components/bt/host/bluedroid/stack/include/stack/hcimsgs.h index f9e6c91c20d..30b2f5794e8 100644 --- a/components/bt/host/bluedroid/stack/include/stack/hcimsgs.h +++ b/components/bt/host/bluedroid/stack/include/stack/hcimsgs.h @@ -1415,5 +1415,12 @@ UINT8 btsnd_hcic_ble_cs_set_procedure_params(UINT16 conn_handle, UINT8 config_id UINT8 btsnd_hcic_ble_cs_procedure_enable(UINT16 conn_handle, UINT8 config_id, UINT8 enable); #endif // (BT_BLE_FEAT_CHANNEL_SOUNDING == TRUE) +#if (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) +#define HCIC_PARAM_SIZE_CS_SET_SECURITY_REQUIREMENTS_LEN 10 +#define HCIC_PARAM_SIZE_CS_SET_DEFAULT_SECURITY_REQUIREMENTS_LEN 8 + +UINT8 btsnd_hcic_ble_cs_set_security_requirements(UINT16 conn_handle, UINT64 cs_security_requirements); +UINT8 btsnd_hcic_ble_cs_set_default_security_requirements(UINT64 cs_security_requirements); +#endif // (BT_BLE_FEAT_CS_SECURITY_REQUIREMENTS == TRUE) #endif