Merge branch 'ble-auto-upgrade'

Author: benma

backend/devices/bitbox02/assets/da14531-firmware.bin

@@ -0,0 +1,28 @@
+// Copyright 2025 Shift Crypto AG
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package bitbox02
+
+import (
+	"crypto/sha256"
+	_ "embed" // Needed for the go:embed directive below.
+)
+
+//go:embed assets/da14531-firmware.bin
+var bluetoothFirmware []byte
+
+func bundledBluetoothFirmwareHash() []byte {
+	hash := sha256.Sum256(bluetoothFirmware)
+	return hash[:]
+}

backend/devices/bitbox02/bluetooth.go

@@ -17,6 +17,8 @@
 package bitbox02
 
 import (
+	"encoding/hex"
+
 	deviceevent "github.com/BitBoxSwiss/bitbox-wallet-app/backend/devices/device/event"
 	keystoreInterface "github.com/BitBoxSwiss/bitbox-wallet-app/backend/keystore"
 	"github.com/BitBoxSwiss/bitbox-wallet-app/util/logging"
@@ -90,6 +92,27 @@ func NewDevice(
 					Subject: string(deviceevent.EventKeystoreAvailable),
 					Action:  action.Replace,
 				})
+
+			}
+		}
+
+		// Temporary automatic Bluetooth firmware upgrade during the testing phase. We prompt an
+		// upgrade every time if the bundled firmware does not match the actual firmware on the
+		// device.  TODO: remove before production release.
+		if ev == firmware.EventStatusChanged && device.SupportsBluetooth() {
+			switch device.Device.Status() {
+			case firmware.StatusInitialized, firmware.StatusUninitialized:
+				info, err := device.DeviceInfo()
+				if err != nil {
+					device.log.WithError(err).Error("DeviceInfo")
+					return
+				}
+				if info.Bluetooth != nil &&
+					info.Bluetooth.FirmwareHash != hex.EncodeToString(bundledBluetoothFirmwareHash()) {
+					if err := device.BluetoothUpgrade(bluetoothFirmware); err != nil {
+						device.log.WithError(err).Error("BluetoothUpgrade")
+					}
+				}
 			}
 		}
 	})

backend/devices/bitbox02/device.go

@@ -51,6 +51,13 @@ var pairedDeviceIdentifiers: Set<String> {
     }
 }
 
+class BLEConnectionContext {
+    let identifier = UUID()
+    let semaphore = DispatchSemaphore(value: 0)
+    var readBuffer = Data()
+    var readBufferLock = NSLock()
+}
+
 class BluetoothManager: NSObject, ObservableObject, CBCentralManagerDelegate, CBPeripheralDelegate {
     private var state: State = State(
         bluetoothAvailable: false,
@@ -70,9 +77,11 @@ class BluetoothManager: NSObject, ObservableObject, CBCentralManagerDelegate, CB
     // This is for failed connections to not enter an infinite connect loop.
     private var dontAutoConnectSet: Set<UUID> = []
 
-    private var readBuffer = Data()
-    private let readBufferLock = NSLock()  // Ensure thread-safe buffer access
-    private let semaphore = DispatchSemaphore(value: 0)
+    private var currentContext: BLEConnectionContext?
+    // Locks access to the `currentContext` var only, not to its contents. This is important, as
+    // one can't keep the context locked while waiting for the semaphore, which would lead to a
+    // deadlock.
+    private let currentContextLock = NSLock()
 
     override init() {
         super.init()
@@ -93,6 +102,9 @@ class BluetoothManager: NSObject, ObservableObject, CBCentralManagerDelegate, CB
         state.discoveredPeripherals[peripheralID] = metadata
         state.scanning = false
         updateBackendState()
+        currentContextLock.lock()
+        currentContext = BLEConnectionContext()
+        currentContextLock.unlock()
         centralManager.connect(metadata.peripheral, options: nil)
     }
 
@@ -246,17 +258,24 @@ class BluetoothManager: NSObject, ObservableObject, CBCentralManagerDelegate, CB
             return
         }
 
+        currentContextLock.lock()
+        guard let ctx = currentContext else {
+            currentContextLock.unlock()
+            return
+        }
+        currentContextLock.unlock()
+
         if characteristic == pReader, let data = characteristic.value {
             if data.count != 64 {
                 print("BLE: ERROR, expected 64 bytes")
             }
             print("BLE: received data: \(data.hexEncodedString())")
-            readBufferLock.lock()
-            readBuffer.append(data)
-            readBufferLock.unlock()
+            ctx.readBufferLock.lock()
+            ctx.readBuffer.append(data)
+            ctx.readBufferLock.unlock()
 
             // Signal the semaphore to unblock `readBlocking`
-            semaphore.signal()
+            ctx.semaphore.signal()
         }
         if characteristic == pProduct {
             print("BLE: product changed: \(String(describing: parseProduct()))")
@@ -281,13 +300,19 @@ class BluetoothManager: NSObject, ObservableObject, CBCentralManagerDelegate, CB
         pWriter = nil
         pProduct = nil
         state.discoveredPeripherals.removeAll()
-       isPaired = false
+        isPaired = false
         updateBackendState()
 
         // Have the backend scan right away, which will make it detect that we disconnected.
         // Otherwise there would be up to a second of delay (the backend device manager scan interval).
         MobileserverUsbUpdate()
 
+        // Unblock a pending readBlocking() call if there is one.
+        currentContextLock.lock()
+        currentContext?.semaphore.signal()
+        currentContext = nil
+        currentContextLock.unlock()
+
         restartScan()
     }
 
@@ -297,22 +322,46 @@ class BluetoothManager: NSObject, ObservableObject, CBCentralManagerDelegate, CB
         handleDisconnect()
     }
 
-    func readBlocking(length: Int) -> Data? {
+    struct ReadError: Error {
+        let message: String
+    }
+    
+    func readBlocking(length: Int) throws -> Data {
         if !isConnected() {
-            return nil
+            throw ReadError(message: "not connected")
         }
         print("BLE: wants to read \(length)")
 
+        currentContextLock.lock()
+        guard let ctx = currentContext else {
+            currentContextLock.unlock()
+            throw ReadError(message: "no connection context")
+        }
+        currentContextLock.unlock()
+        
+        let currentID = ctx.identifier;
+
         var data = Data()
 
         // Loop until we've read the required amount of data
         while data.count < length {
-            // Block until BLE reader callback notifies us
-            semaphore.wait()
-            readBufferLock.lock()
-            data.append(readBuffer.prefix(64))
-            readBuffer = readBuffer.advanced(by: 64)
-            readBufferLock.unlock()
+            // Block until BLE reader callback notifies us or the peripheral is disconnected.
+            ctx.semaphore.wait()
+            
+            if !isConnected() {
+                throw ReadError(message: "the peripheral has disconnected while reading")
+            }
+            currentContextLock.lock()
+            let exit = currentContext?.identifier != currentID
+            currentContextLock.unlock()
+            if exit {
+                throw ReadError(message: "the peripheral has disconnected while reading")
+            }
+            
+            ctx.readBufferLock.lock()
+            data.append(ctx.readBuffer.prefix(64))
+            ctx.readBuffer = ctx.readBuffer.advanced(by: 64)
+            ctx.readBufferLock.unlock()
         }
         print("BLE: got \(data.count)")
 
@@ -457,7 +506,7 @@ class BluetoothReadWriteCloser: NSObject, MobileserverGoReadWriteCloserInterface
     }
 
     func read(_ n: Int) throws -> Data {
-        return bluetoothManager.readBlocking(length: n)!
+        try bluetoothManager.readBlocking(length: n)
     }
 
     func write(_ data: Data?, n: UnsafeMutablePointer<Int>?) throws {