[PATCH 1/7] android: Add HCI snooping tool

[PATCH 1/7] android: Add HCI snooping tool

[Szymon Janc]

This tool is intended to be run as Android service. It supports
writing HCI snoop data in old btsnoop format only. By default traffic
is stored in /sdcard/btsnoop_hci.log file (can be overridded with
option - mainly for testing on Linux host). Only index 0 is sniffed.
---
 .gitignore                 |   1 +
 android/Android.mk         |  23 +++++
 android/Makefile.am        |   6 ++
 android/bluetoothd-snoop.c | 219 +++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 249 insertions(+)
 create mode 100644 android/bluetoothd-snoop.c

diff --git a/.gitignore b/.gitignore
index b97546e..1447c90 100644
--- a/.gitignore
+++ b/.gitignore
@@ -109,3 +109,4 @@ android/system-emulator
 android/bluetoothd
 android/haltest
 android/android-tester
+android/bluetoothd-snoop
diff --git a/android/Android.mk b/android/Android.mk
index 7e29899..1720823 100644
--- a/android/Android.mk
+++ b/android/Android.mk
@@ -253,3 +253,26 @@ LOCAL_MODULE_TAGS := debug
 LOCAL_MODULE := l2test
 
 include $(BUILD_EXECUTABLE)
+
+#
+# bluetoothd-snoop
+#
+
+include $(CLEAR_VARS)
+
+LOCAL_SRC_FILES := \
+	bluetoothd-snoop.c \
+	../monitor/mainloop.c \
+	../src/shared/btsnoop.c \
+
+LOCAL_C_INCLUDES := \
+	$(LOCAL_PATH)/.. \
+	$(LOCAL_PATH)/../lib \
+
+LOCAL_CFLAGS := $(BLUEZ_COMMON_CFLAGS)
+
+LOCAL_MODULE_PATH := $(TARGET_OUT_OPTIONAL_EXECUTABLES)
+LOCAL_MODULE_TAGS := optional
+LOCAL_MODULE := bluetoothd-snoop
+
+include $(BUILD_EXECUTABLE)
diff --git a/android/Makefile.am b/android/Makefile.am
index dec81ce..36210b9 100644
--- a/android/Makefile.am
+++ b/android/Makefile.am
@@ -4,6 +4,12 @@ noinst_PROGRAMS += android/system-emulator
 android_system_emulator_SOURCES = android/system-emulator.c \
 					monitor/mainloop.h monitor/mainloop.c
 
+noinst_PROGRAMS += android/bluetoothd-snoop
+
+android_bluetoothd_snoop_SOURCES = android/bluetoothd-snoop.c \
+				monitor/mainloop.h monitor/mainloop.c \
+				src/shared/btsnoop.h src/shared/btsnoop.c
+
 noinst_PROGRAMS += android/bluetoothd
 
 android_bluetoothd_SOURCES = android/main.c \
diff --git a/android/bluetoothd-snoop.c b/android/bluetoothd-snoop.c
new file mode 100644
index 0000000..02f44e9
--- /dev/null
+++ b/android/bluetoothd-snoop.c
@@ -0,0 +1,219 @@
+/*
+ *
+ *  BlueZ - Bluetooth protocol stack for Linux
+ *
+ *  Copyright (C) 2013  Intel Corporation. All rights reserved.
+ *
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include "lib/bluetooth.h"
+#include "lib/hci.h"
+#include "lib/mgmt.h"
+
+#include "monitor/mainloop.h"
+#include "src/shared/btsnoop.h"
+
+#define DEAULT_SNOOP_FILE "/sdcard/btsnoop_hci.log"
+
+#define MAX_PACKET_SIZE (1486 + 4)
+
+static struct btsnoop *snoop = NULL;
+static uint8_t monitor_buf[MAX_PACKET_SIZE];
+static int monitor_fd = -1;
+
+static void signal_callback(int signum, void *user_data)
+{
+	switch (signum) {
+	case SIGINT:
+	case SIGTERM:
+		mainloop_quit();
+		break;
+	}
+}
+
+static uint32_t get_flags_from_opcode(uint16_t opcode)
+{
+	switch (opcode) {
+	case BTSNOOP_OPCODE_NEW_INDEX:
+	case BTSNOOP_OPCODE_DEL_INDEX:
+		break;
+	case BTSNOOP_OPCODE_COMMAND_PKT:
+		return 0x02;
+	case BTSNOOP_OPCODE_EVENT_PKT:
+		return 0x03;
+	case BTSNOOP_OPCODE_ACL_TX_PKT:
+		return 0x00;
+	case BTSNOOP_OPCODE_ACL_RX_PKT:
+		return 0x01;
+	case BTSNOOP_OPCODE_SCO_TX_PKT:
+	case BTSNOOP_OPCODE_SCO_RX_PKT:
+		break;
+	}
+
+	return 0xff;
+}
+
+static void data_callback(int fd, uint32_t events, void *user_data)
+{
+	unsigned char control[32];
+	struct mgmt_hdr hdr;
+	struct msghdr msg;
+	struct iovec iov[2];
+
+	if (events & (EPOLLERR | EPOLLHUP)) {
+		mainloop_remove_fd(monitor_fd);
+		return;
+	}
+
+	iov[0].iov_base = &hdr;
+	iov[0].iov_len = MGMT_HDR_SIZE;
+	iov[1].iov_base = monitor_buf;
+	iov[1].iov_len = sizeof(monitor_buf);
+
+	memset(&msg, 0, sizeof(msg));
+	msg.msg_iov = iov;
+	msg.msg_iovlen = 2;
+	msg.msg_control = control;
+	msg.msg_controllen = sizeof(control);
+
+	while (true) {
+		struct cmsghdr *cmsg;
+		struct timeval *tv = NULL;
+		struct timeval ctv;
+		uint16_t opcode, index, pktlen;
+		uint32_t flags;
+		ssize_t len;
+
+		len = recvmsg(monitor_fd, &msg, MSG_DONTWAIT);
+		if (len < 0)
+			break;
+
+		if (len < MGMT_HDR_SIZE)
+			break;
+
+		for (cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL;
+					cmsg = CMSG_NXTHDR(&msg, cmsg)) {
+			if (cmsg->cmsg_level != SOL_SOCKET)
+				continue;
+
+			if (cmsg->cmsg_type == SCM_TIMESTAMP) {
+				memcpy(&ctv, CMSG_DATA(cmsg), sizeof(ctv));
+				tv = &ctv;
+			}
+		}
+
+		opcode = btohs(hdr.opcode);
+		index  = btohs(hdr.index);
+		pktlen = btohs(hdr.len);
+
+		if (index)
+			continue;
+
+		flags = get_flags_from_opcode(opcode);
+		if (flags != 0xff)
+			btsnoop_write(snoop, tv, flags, monitor_buf, pktlen);
+	}
+}
+
+static int open_monitor(const char *path)
+{
+	struct sockaddr_hci addr;
+	int opt = 1;
+
+	snoop = btsnoop_create(path, BTSNOOP_TYPE_HCI);
+	if (!snoop)
+		return -1;
+
+	monitor_fd = socket(AF_BLUETOOTH, SOCK_RAW | SOCK_CLOEXEC, BTPROTO_HCI);
+	if (monitor_fd < 0)
+		goto failed;
+
+	memset(&addr, 0, sizeof(addr));
+	addr.hci_family = AF_BLUETOOTH;
+	addr.hci_dev = HCI_DEV_NONE;
+	addr.hci_channel = HCI_CHANNEL_MONITOR;
+
+	if (bind(monitor_fd, (struct sockaddr *) &addr, sizeof(addr)) < 0)
+		goto failed_close;
+
+	if (setsockopt(monitor_fd, SOL_SOCKET, SO_TIMESTAMP, &opt, sizeof(opt))
+									< 0)
+		goto failed_close;
+
+	mainloop_add_fd(monitor_fd, EPOLLIN, data_callback, NULL, NULL);
+
+	return 0;
+
+failed_close:
+	close(monitor_fd);
+	monitor_fd = -1;
+
+failed:
+	btsnoop_unref(snoop);
+	snoop = NULL;
+
+	return -1;
+}
+
+static void close_monitor(void)
+{
+	btsnoop_unref(snoop);
+	snoop = NULL;
+
+	close(monitor_fd);
+	monitor_fd = -1;
+}
+
+int main(int argc, char *argv[])
+{
+	const char *path;
+	sigset_t mask;
+
+	if (argc > 1)
+		path = argv[1];
+	else
+		path = DEAULT_SNOOP_FILE;
+
+	mainloop_init();
+
+	sigemptyset(&mask);
+	sigaddset(&mask, SIGINT);
+	sigaddset(&mask, SIGTERM);
+
+	mainloop_set_signal(&mask, signal_callback, NULL, NULL);
+
+	if (open_monitor(path) < 0) {
+		printf("Failed to start bluetoothd_snoop\n");
+		return EXIT_FAILURE;
+	}
+
+	mainloop_run();
+
+	close_monitor();
+
+	return EXIT_SUCCESS;
+}
-- 
1.8.5.2

[PATCH 2/7] android/hal-bluetooth: Update snoop service name

[Szymon Janc]

Match service name with android snoop binary name. It is more common
to use '-' instead of '_' in the code for binaries name.
---
 android/hal-bluetooth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/android/hal-bluetooth.c b/android/hal-bluetooth.c
index 9f9814a..a95c4ea 100644
--- a/android/hal-bluetooth.c
+++ b/android/hal-bluetooth.c
@@ -28,7 +28,7 @@
 #include "hal-ipc.h"
 #include "hal-utils.h"
 
-#define SNOOP_SERVICE_NAME "bluetoothd_snoop"
+#define SNOOP_SERVICE_NAME "bluetoothd-snoop"
 
 static const bt_callbacks_t *bt_hal_cbacks = NULL;
 
-- 
1.8.5.2

[PATCH 3/7] android: Add support for bluetoothd-snoop service in system-emulator

[Szymon Janc]

This allows to test bluetoothd-snoop service on Linux host.
---
 android/system-emulator.c | 61 +++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 56 insertions(+), 5 deletions(-)

diff --git a/android/system-emulator.c b/android/system-emulator.c
index 611e46e..2dc9ad8 100644
--- a/android/system-emulator.c
+++ b/android/system-emulator.c
@@ -45,6 +45,7 @@
 static char exec_dir[PATH_MAX + 1];
 
 static pid_t daemon_pid = -1;
+static pid_t snoop_pid = -1;
 
 static void ctl_start(void)
 {
@@ -81,6 +82,47 @@ static void ctl_start(void)
 	daemon_pid = pid;
 }
 
+static void snoop_start(void)
+{
+	char prg_name[PATH_MAX + 1];
+	char *prg_argv[3];
+	char *prg_envp[1];
+	pid_t pid;
+
+	snprintf(prg_name, sizeof(prg_name), "%s/%s", exec_dir,
+							"bluetoothd-snoop");
+
+	prg_argv[0] = prg_name;
+	prg_argv[1] = "/tmp/btsnoop_hci.log";
+	prg_argv[2] = NULL;
+
+	prg_envp[0] = NULL;
+
+	printf("Starting %s\n", prg_name);
+
+	pid = fork();
+	if (pid < 0) {
+		perror("Failed to fork new process");
+		return;
+	}
+
+	if (pid == 0) {
+		execve(prg_argv[0], prg_argv, prg_envp);
+		exit(0);
+	}
+
+	printf("New process %d created\n", pid);
+
+	snoop_pid = pid;
+}
+
+static void snoop_stop(void)
+{
+	printf("Stoping %s/%s\n", exec_dir, "bluetoothd-snoop");
+
+	kill(snoop_pid, SIGTERM);
+}
+
 static void system_socket_callback(int fd, uint32_t events, void *user_data)
 {
 	char buf[4096];
@@ -97,13 +139,20 @@ static void system_socket_callback(int fd, uint32_t events, void *user_data)
 
 	printf("Received %s\n", buf);
 
-	if (strcmp(buf, "ctl.start=bluetoothd"))
-		return;
+	if (!strcmp(buf, "ctl.start=bluetoothd")) {
+		if (daemon_pid > 0)
+			return;
 
-	if (daemon_pid > 0)
-		return;
+		ctl_start();
+	} else if (!strcmp(buf, "ctl.start=bluetoothd-snoop")) {
+		if (snoop_pid > 0)
+			return;
 
-	ctl_start();
+		snoop_start();
+	} else if (!strcmp(buf, "ctl.stop=bluetoothd-snoop")) {
+		if (snoop_pid > 0)
+			snoop_stop();
+	}
 }
 
 static void signal_callback(int signum, void *user_data)
@@ -127,6 +176,8 @@ static void signal_callback(int signum, void *user_data)
 
 			if (pid == daemon_pid)
 				daemon_pid = -1;
+			else if (pid == snoop_pid)
+				snoop_pid = -1;
 		}
 		break;
 	}
-- 
1.8.5.2

[PATCH 4/7] android/hal-bluetooth: Add debug print to config_hci_snoop_log

[Szymon Janc]

Improves debugs and make it consistent with other methods.
---
 android/hal-bluetooth.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/android/hal-bluetooth.c b/android/hal-bluetooth.c
index a95c4ea..7accdcc 100644
--- a/android/hal-bluetooth.c
+++ b/android/hal-bluetooth.c
@@ -829,6 +829,8 @@ static int le_test_mode(uint16_t opcode, uint8_t *buf, uint8_t len)
 #if PLATFORM_SDK_VERSION > 18
 static int config_hci_snoop_log(uint8_t enable)
 {
+	DBG("enable %u", enable);
+
 	if (enable && property_set("ctl.start", SNOOP_SERVICE_NAME) < 0) {
 		error("Failed to start service %s", SNOOP_SERVICE_NAME);
 		return BT_STATUS_FAIL;
-- 
1.8.5.2

[PATCH 5/7] android/haltest: Improve EXEC macro robustness

[Szymon Janc]

Print info about method being NULL instead of crashing.
---
 android/client/if-main.h | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/android/client/if-main.h b/android/client/if-main.h
index a83f48b..4a5d4cc 100644
--- a/android/client/if-main.h
+++ b/android/client/if-main.h
@@ -147,8 +147,12 @@ const struct method *get_interface_method(const char *iname,
 /* Helper macro for executing function on interface and printing BT_STATUS */
 #define EXEC(f, ...) \
 	{ \
-		int err = f(__VA_ARGS__); \
-		haltest_info("%s: %s\n", #f, bt_status_t2str(err)); \
+		if (f) { \
+			int err = f(__VA_ARGS__); \
+			haltest_info("%s: %s\n", #f, bt_status_t2str(err)); \
+		} else { \
+			haltest_info("%s is NULL\n", #f); \
+		} \
 	}
 
 /* Helper macro for executing void function on interface */
-- 
1.8.5.2

[PATCH 6/7] android/haltest: Implement missing functions from bluetooth HAL

[Szymon Janc]

Implement functions added in Android 4.3+ to Bluetooth HAL.
---
 android/client/if-bt.c | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/android/client/if-bt.c b/android/client/if-bt.c
index 0cd43db..10b79f1 100644
--- a/android/client/if-bt.c
+++ b/android/client/if-bt.c
@@ -797,6 +797,36 @@ static void dut_mode_configure_p(int argc, const char **argv)
 	EXEC(if_bluetooth->dut_mode_configure, mode);
 }
 
+static void dut_mode_send_p(int argc, const char **argv)
+{
+	haltest_error("not implemented\n");
+}
+
+#if PLATFORM_SDK_VERSION > 17
+static void le_test_mode_p(int argc, const char **argv)
+{
+	haltest_error("not implemented\n");
+}
+#endif
+
+#if PLATFORM_SDK_VERSION > 18
+static void config_hci_snoop_log_p(int argc, const char **argv)
+{
+	uint8_t mode;
+
+	RETURN_IF_NULL(if_bluetooth);
+
+	if (argc <= 2) {
+		haltest_error("No mode specified\n");
+		return;
+	}
+
+	mode = strtol(argv[2], NULL, 0);
+
+	EXEC(if_bluetooth->config_hci_snoop_log, mode);
+}
+#endif
+
 static struct method methods[] = {
 	STD_METHOD(init),
 	STD_METHOD(cleanup),
@@ -820,6 +850,13 @@ static struct method methods[] = {
 	STD_METHODCH(ssp_reply, "<address> <ssp_veriant> 1|0 [<passkey>]"),
 	STD_METHODCH(get_profile_interface, "<profile id>"),
 	STD_METHODH(dut_mode_configure, "<dut mode>"),
+	STD_METHOD(dut_mode_send),
+#if PLATFORM_SDK_VERSION > 17
+	STD_METHOD(le_test_mode),
+#endif
+#if PLATFORM_SDK_VERSION > 18
+	STD_METHODH(config_hci_snoop_log, "<mode>"),
+#endif
 	END_METHOD
 };
 
-- 
1.8.5.2

[PATCH 7/7] android/build: Fix building HAL library on Linux

[Szymon Janc]

PLATFORM_SDK_VERSION was not passed while building HAL library on Linux
host resulting in 4.3+ features not being build.
---
 android/Makefile.am | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/android/Makefile.am b/android/Makefile.am
index 36210b9..7d9b580 100644
--- a/android/Makefile.am
+++ b/android/Makefile.am
@@ -59,7 +59,8 @@ android_libhal_internal_la_SOURCES = android/hal.h android/hal-bluetooth.c \
 					android/hal-log.h \
 					android/hal-ipc.h android/hal-ipc.c
 
-android_libhal_internal_la_CPPFLAGS = -I$(srcdir)/android
+android_libhal_internal_la_CPPFLAGS = -I$(srcdir)/android \
+					-DPLATFORM_SDK_VERSION=19
 
 noinst_PROGRAMS += android/haltest
 
-- 
1.8.5.2

Re: [PATCH 1/7] android: Add HCI snooping tool

[Johan Hedberg]

Hi Szymon,

On Mon, Dec 30, 2013, Szymon Janc wrote:
> This tool is intended to be run as Android service. It supports
> writing HCI snoop data in old btsnoop format only. By default traffic
> is stored in /sdcard/btsnoop_hci.log file (can be overridded with
> option - mainly for testing on Linux host). Only index 0 is sniffed.
> ---
>  .gitignore                 |   1 +
>  android/Android.mk         |  23 +++++
>  android/Makefile.am        |   6 ++
>  android/bluetoothd-snoop.c | 219 +++++++++++++++++++++++++++++++++++++++++++++
>  4 files changed, 249 insertions(+)
>  create mode 100644 android/bluetoothd-snoop.c

All patches in this set have been applied. Thanks.

Johan