Lines Matching +full:y +full:- +full:rp
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
39 ((struct smp_dev *)((struct l2cap_chan *)((hdev)->smp_data))->data)
41 /* Low-level debug macros to be used for stuff that we don't want
53 #define SMP_ALLOW_CMD(smp, code) set_bit(code, &smp->allow_cmd)
162 dst[len - 1 - i] = src[i]; in swap_buf()
166 * AES-CMAC, f4, f5, f6, g2 and h6.
176 return -EFBIG; in aes_cmac()
180 return -EINVAL; in aes_cmac()
314 const u8 x[16], const u8 y[16], u32 *val) in smp_g2()
321 SMP_DBG("x %16phN y %16phN", x, y); in smp_g2()
323 memcpy(m, y, 16); in smp_g2()
500 struct l2cap_chan *chan = hdev->smp_data; in smp_irk_matches()
504 if (!chan || !chan->data) in smp_irk_matches()
509 err = smp_ah(irk, &bdaddr->b[3], hash); in smp_irk_matches()
513 return !crypto_memneq(bdaddr->b, hash, 3); in smp_irk_matches()
518 struct l2cap_chan *chan = hdev->smp_data; in smp_generate_rpa()
521 if (!chan || !chan->data) in smp_generate_rpa()
522 return -EOPNOTSUPP; in smp_generate_rpa()
524 get_random_bytes(&rpa->b[3], 3); in smp_generate_rpa()
526 rpa->b[5] &= 0x3f; /* Clear two most significant bits */ in smp_generate_rpa()
527 rpa->b[5] |= 0x40; /* Set second most significant bit */ in smp_generate_rpa()
529 err = smp_ah(irk, &rpa->b[3], rpa->b); in smp_generate_rpa()
540 struct l2cap_chan *chan = hdev->smp_data; in smp_generate_oob()
544 if (!chan || !chan->data) in smp_generate_oob()
545 return -EOPNOTSUPP; in smp_generate_oob()
547 smp = chan->data; in smp_generate_oob()
551 err = set_ecdh_privkey(smp->tfm_ecdh, debug_sk); in smp_generate_oob()
554 memcpy(smp->local_pk, debug_pk, 64); in smp_generate_oob()
555 smp->debug_key = true; in smp_generate_oob()
559 err = generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk); in smp_generate_oob()
566 if (crypto_memneq(smp->local_pk, debug_pk, 64)) in smp_generate_oob()
569 smp->debug_key = false; in smp_generate_oob()
572 SMP_DBG("OOB Public Key X: %32phN", smp->local_pk); in smp_generate_oob()
573 SMP_DBG("OOB Public Key Y: %32phN", smp->local_pk + 32); in smp_generate_oob()
575 get_random_bytes(smp->local_rand, 16); in smp_generate_oob()
577 err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->local_pk, in smp_generate_oob()
578 smp->local_rand, 0, hash); in smp_generate_oob()
582 memcpy(rand, smp->local_rand, 16); in smp_generate_oob()
584 smp->local_oob = true; in smp_generate_oob()
591 struct l2cap_chan *chan = conn->smp; in smp_send_cmd()
599 bt_dev_dbg(conn->hcon->hdev, "code 0x%2.2x", code); in smp_send_cmd()
613 if (!chan->data) in smp_send_cmd()
616 smp = chan->data; in smp_send_cmd()
618 cancel_delayed_work_sync(&smp->security_timer); in smp_send_cmd()
619 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT); in smp_send_cmd()
651 struct l2cap_chan *chan = conn->smp; in build_pairing_cmd()
652 struct smp_chan *smp = chan->data; in build_pairing_cmd()
653 struct hci_conn *hcon = conn->hcon; in build_pairing_cmd()
654 struct hci_dev *hdev = hcon->hdev; in build_pairing_cmd()
681 if (hcon->dst_type == ADDR_LE_DEV_PUBLIC) in build_pairing_cmd()
686 oob_data = hci_find_remote_oob_data(hdev, &hcon->dst, in build_pairing_cmd()
688 if (oob_data && oob_data->present) { in build_pairing_cmd()
689 set_bit(SMP_FLAG_REMOTE_OOB, &smp->flags); in build_pairing_cmd()
691 memcpy(smp->rr, oob_data->rand256, 16); in build_pairing_cmd()
692 memcpy(smp->pcnf, oob_data->hash256, 16); in build_pairing_cmd()
693 SMP_DBG("OOB Remote Confirmation: %16phN", smp->pcnf); in build_pairing_cmd()
694 SMP_DBG("OOB Remote Random: %16phN", smp->rr); in build_pairing_cmd()
702 req->io_capability = conn->hcon->io_capability; in build_pairing_cmd()
703 req->oob_flag = oob_flag; in build_pairing_cmd()
704 req->max_key_size = hdev->le_max_key_size; in build_pairing_cmd()
705 req->init_key_dist = local_dist; in build_pairing_cmd()
706 req->resp_key_dist = remote_dist; in build_pairing_cmd()
707 req->auth_req = (authreq & AUTH_REQ_MASK(hdev)); in build_pairing_cmd()
709 smp->remote_key_dist = remote_dist; in build_pairing_cmd()
713 rsp->io_capability = conn->hcon->io_capability; in build_pairing_cmd()
714 rsp->oob_flag = oob_flag; in build_pairing_cmd()
715 rsp->max_key_size = hdev->le_max_key_size; in build_pairing_cmd()
716 rsp->init_key_dist = req->init_key_dist & remote_dist; in build_pairing_cmd()
717 rsp->resp_key_dist = req->resp_key_dist & local_dist; in build_pairing_cmd()
718 rsp->auth_req = (authreq & AUTH_REQ_MASK(hdev)); in build_pairing_cmd()
720 smp->remote_key_dist = rsp->init_key_dist; in build_pairing_cmd()
725 struct l2cap_chan *chan = conn->smp; in check_enc_key_size()
726 struct hci_dev *hdev = conn->hcon->hdev; in check_enc_key_size()
727 struct smp_chan *smp = chan->data; in check_enc_key_size()
729 if (conn->hcon->pending_sec_level == BT_SECURITY_FIPS && in check_enc_key_size()
733 if (max_key_size > hdev->le_max_key_size || in check_enc_key_size()
737 smp->enc_key_size = max_key_size; in check_enc_key_size()
744 struct l2cap_chan *chan = conn->smp; in smp_chan_destroy()
745 struct smp_chan *smp = chan->data; in smp_chan_destroy()
746 struct hci_conn *hcon = conn->hcon; in smp_chan_destroy()
751 cancel_delayed_work_sync(&smp->security_timer); in smp_chan_destroy()
753 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags); in smp_chan_destroy()
756 kfree_sensitive(smp->csrk); in smp_chan_destroy()
757 kfree_sensitive(smp->responder_csrk); in smp_chan_destroy()
758 kfree_sensitive(smp->link_key); in smp_chan_destroy()
760 crypto_free_shash(smp->tfm_cmac); in smp_chan_destroy()
761 crypto_free_kpp(smp->tfm_ecdh); in smp_chan_destroy()
766 if (smp->ltk && smp->ltk->type == SMP_LTK_P256_DEBUG && in smp_chan_destroy()
767 !hci_dev_test_flag(hcon->hdev, HCI_KEEP_DEBUG_KEYS)) { in smp_chan_destroy()
768 list_del_rcu(&smp->ltk->list); in smp_chan_destroy()
769 kfree_rcu(smp->ltk, rcu); in smp_chan_destroy()
770 smp->ltk = NULL; in smp_chan_destroy()
775 if (smp->ltk) { in smp_chan_destroy()
776 list_del_rcu(&smp->ltk->list); in smp_chan_destroy()
777 kfree_rcu(smp->ltk, rcu); in smp_chan_destroy()
780 if (smp->responder_ltk) { in smp_chan_destroy()
781 list_del_rcu(&smp->responder_ltk->list); in smp_chan_destroy()
782 kfree_rcu(smp->responder_ltk, rcu); in smp_chan_destroy()
785 if (smp->remote_irk) { in smp_chan_destroy()
786 list_del_rcu(&smp->remote_irk->list); in smp_chan_destroy()
787 kfree_rcu(smp->remote_irk, rcu); in smp_chan_destroy()
791 chan->data = NULL; in smp_chan_destroy()
798 struct hci_conn *hcon = conn->hcon; in smp_failure()
799 struct l2cap_chan *chan = conn->smp; in smp_failure()
807 if (chan->data) in smp_failure()
844 if (test_bit(SMP_FLAG_SC, &smp->flags)) in get_auth_method()
853 struct hci_conn *hcon = conn->hcon; in tk_request()
854 struct l2cap_chan *chan = conn->smp; in tk_request()
855 struct smp_chan *smp = chan->data; in tk_request()
860 memset(smp->tk, 0, sizeof(smp->tk)); in tk_request()
861 clear_bit(SMP_FLAG_TK_VALID, &smp->flags); in tk_request()
863 bt_dev_dbg(hcon->hdev, "auth:%u lcl:%u rem:%u", auth, local_io, in tk_request()
867 * request or use just-works for outgoing ones. The JUST_CFM in tk_request()
873 smp->method = JUST_CFM; in tk_request()
875 smp->method = get_auth_method(smp, local_io, remote_io); in tk_request()
878 if (smp->method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, in tk_request()
879 &smp->flags)) in tk_request()
880 smp->method = JUST_WORKS; in tk_request()
883 if (smp->method == JUST_CFM && in tk_request()
884 hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT) in tk_request()
885 smp->method = JUST_WORKS; in tk_request()
887 /* If Just Works, Continue with Zero TK and ask user-space for in tk_request()
889 if (smp->method == JUST_WORKS) { in tk_request()
890 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, in tk_request()
891 hcon->type, in tk_request()
892 hcon->dst_type, in tk_request()
896 set_bit(SMP_FLAG_WAIT_USER, &smp->flags); in tk_request()
900 /* If this function is used for SC -> legacy fallback we in tk_request()
901 * can only recover the just-works case. in tk_request()
903 if (test_bit(SMP_FLAG_SC, &smp->flags)) in tk_request()
904 return -EINVAL; in tk_request()
907 if (smp->method != JUST_CFM) { in tk_request()
908 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags); in tk_request()
909 if (hcon->pending_sec_level < BT_SECURITY_HIGH) in tk_request()
910 hcon->pending_sec_level = BT_SECURITY_HIGH; in tk_request()
913 /* If both devices have Keyboard-Display I/O, the initiator in tk_request()
916 if (smp->method == OVERLAP) { in tk_request()
917 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) in tk_request()
918 smp->method = CFM_PASSKEY; in tk_request()
920 smp->method = REQ_PASSKEY; in tk_request()
924 if (smp->method == CFM_PASSKEY) { in tk_request()
925 memset(smp->tk, 0, sizeof(smp->tk)); in tk_request()
928 put_unaligned_le32(passkey, smp->tk); in tk_request()
929 bt_dev_dbg(hcon->hdev, "PassKey: %u", passkey); in tk_request()
930 set_bit(SMP_FLAG_TK_VALID, &smp->flags); in tk_request()
933 if (smp->method == REQ_PASSKEY) in tk_request()
934 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst, in tk_request()
935 hcon->type, hcon->dst_type); in tk_request()
936 else if (smp->method == JUST_CFM) in tk_request()
937 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, in tk_request()
938 hcon->type, hcon->dst_type, in tk_request()
941 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst, in tk_request()
942 hcon->type, hcon->dst_type, in tk_request()
950 struct l2cap_conn *conn = smp->conn; in smp_confirm()
954 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn); in smp_confirm()
956 ret = smp_c1(smp->tk, smp->prnd, smp->preq, smp->prsp, in smp_confirm()
957 conn->hcon->init_addr_type, &conn->hcon->init_addr, in smp_confirm()
958 conn->hcon->resp_addr_type, &conn->hcon->resp_addr, in smp_confirm()
963 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags); in smp_confirm()
965 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp); in smp_confirm()
967 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) in smp_confirm()
977 struct l2cap_conn *conn = smp->conn; in smp_random()
978 struct hci_conn *hcon = conn->hcon; in smp_random()
982 bt_dev_dbg(conn->hcon->hdev, "conn %p %s", conn, in smp_random()
983 test_bit(SMP_FLAG_INITIATOR, &smp->flags) ? "initiator" : in smp_random()
986 ret = smp_c1(smp->tk, smp->rrnd, smp->preq, smp->prsp, in smp_random()
987 hcon->init_addr_type, &hcon->init_addr, in smp_random()
988 hcon->resp_addr_type, &hcon->resp_addr, confirm); in smp_random()
992 if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) { in smp_random()
993 bt_dev_err(hcon->hdev, "pairing failed " in smp_random()
998 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in smp_random()
1003 smp_s1(smp->tk, smp->rrnd, smp->prnd, stk); in smp_random()
1005 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) in smp_random()
1008 hci_le_start_enc(hcon, ediv, rand, stk, smp->enc_key_size); in smp_random()
1009 hcon->enc_key_size = smp->enc_key_size; in smp_random()
1010 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags); in smp_random()
1016 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), in smp_random()
1017 smp->prnd); in smp_random()
1019 smp_s1(smp->tk, smp->prnd, smp->rrnd, stk); in smp_random()
1021 if (hcon->pending_sec_level == BT_SECURITY_HIGH) in smp_random()
1030 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, in smp_random()
1031 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand); in smp_random()
1039 struct l2cap_chan *chan = conn->smp; in smp_notify_keys()
1040 struct smp_chan *smp = chan->data; in smp_notify_keys()
1041 struct hci_conn *hcon = conn->hcon; in smp_notify_keys()
1042 struct hci_dev *hdev = hcon->hdev; in smp_notify_keys()
1043 struct smp_cmd_pairing *req = (void *) &smp->preq[1]; in smp_notify_keys()
1044 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1]; in smp_notify_keys()
1047 if (hcon->type == ACL_LINK) { in smp_notify_keys()
1048 if (hcon->key_type == HCI_LK_DEBUG_COMBINATION) in smp_notify_keys()
1052 &hcon->flags); in smp_notify_keys()
1058 persistent = !!((req->auth_req & rsp->auth_req) & in smp_notify_keys()
1062 if (smp->remote_irk) { in smp_notify_keys()
1063 mgmt_new_irk(hdev, smp->remote_irk, persistent); in smp_notify_keys()
1069 if (hcon->type == LE_LINK) { in smp_notify_keys()
1070 bacpy(&hcon->dst, &smp->remote_irk->bdaddr); in smp_notify_keys()
1071 hcon->dst_type = smp->remote_irk->addr_type; in smp_notify_keys()
1075 queue_delayed_work(hdev->workqueue, in smp_notify_keys()
1076 &conn->id_addr_timer, in smp_notify_keys()
1081 if (smp->csrk) { in smp_notify_keys()
1082 smp->csrk->bdaddr_type = hcon->dst_type; in smp_notify_keys()
1083 bacpy(&smp->csrk->bdaddr, &hcon->dst); in smp_notify_keys()
1084 mgmt_new_csrk(hdev, smp->csrk, persistent); in smp_notify_keys()
1087 if (smp->responder_csrk) { in smp_notify_keys()
1088 smp->responder_csrk->bdaddr_type = hcon->dst_type; in smp_notify_keys()
1089 bacpy(&smp->responder_csrk->bdaddr, &hcon->dst); in smp_notify_keys()
1090 mgmt_new_csrk(hdev, smp->responder_csrk, persistent); in smp_notify_keys()
1093 if (smp->ltk) { in smp_notify_keys()
1094 smp->ltk->bdaddr_type = hcon->dst_type; in smp_notify_keys()
1095 bacpy(&smp->ltk->bdaddr, &hcon->dst); in smp_notify_keys()
1096 mgmt_new_ltk(hdev, smp->ltk, persistent); in smp_notify_keys()
1099 if (smp->responder_ltk) { in smp_notify_keys()
1100 smp->responder_ltk->bdaddr_type = hcon->dst_type; in smp_notify_keys()
1101 bacpy(&smp->responder_ltk->bdaddr, &hcon->dst); in smp_notify_keys()
1102 mgmt_new_ltk(hdev, smp->responder_ltk, persistent); in smp_notify_keys()
1105 if (smp->link_key) { in smp_notify_keys()
1109 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags)) in smp_notify_keys()
1111 else if (hcon->sec_level == BT_SECURITY_FIPS) in smp_notify_keys()
1116 key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst, in smp_notify_keys()
1117 smp->link_key, type, 0, &persistent); in smp_notify_keys()
1125 key->type == HCI_LK_DEBUG_COMBINATION) { in smp_notify_keys()
1126 list_del_rcu(&key->list); in smp_notify_keys()
1135 struct hci_conn *hcon = smp->conn->hcon; in sc_add_ltk()
1138 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags)) in sc_add_ltk()
1143 if (hcon->pending_sec_level == BT_SECURITY_FIPS) in sc_add_ltk()
1148 smp->ltk = hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, in sc_add_ltk()
1149 key_type, auth, smp->tk, smp->enc_key_size, in sc_add_ltk()
1158 smp->link_key = kzalloc(16, GFP_KERNEL); in sc_generate_link_key()
1159 if (!smp->link_key) in sc_generate_link_key()
1162 if (test_bit(SMP_FLAG_CT2, &smp->flags)) { in sc_generate_link_key()
1166 if (smp_h7(smp->tfm_cmac, smp->tk, salt, smp->link_key)) { in sc_generate_link_key()
1167 kfree_sensitive(smp->link_key); in sc_generate_link_key()
1168 smp->link_key = NULL; in sc_generate_link_key()
1175 if (smp_h6(smp->tfm_cmac, smp->tk, tmp1, smp->link_key)) { in sc_generate_link_key()
1176 kfree_sensitive(smp->link_key); in sc_generate_link_key()
1177 smp->link_key = NULL; in sc_generate_link_key()
1182 if (smp_h6(smp->tfm_cmac, smp->link_key, lebr, smp->link_key)) { in sc_generate_link_key()
1183 kfree_sensitive(smp->link_key); in sc_generate_link_key()
1184 smp->link_key = NULL; in sc_generate_link_key()
1195 if (smp->remote_key_dist & SMP_DIST_ENC_KEY) in smp_allow_key_dist()
1197 else if (smp->remote_key_dist & SMP_DIST_ID_KEY) in smp_allow_key_dist()
1199 else if (smp->remote_key_dist & SMP_DIST_SIGN) in smp_allow_key_dist()
1207 struct hci_conn *hcon = smp->conn->hcon; in sc_generate_ltk()
1208 struct hci_dev *hdev = hcon->hdev; in sc_generate_ltk()
1211 key = hci_find_link_key(hdev, &hcon->dst); in sc_generate_ltk()
1217 if (key->type == HCI_LK_DEBUG_COMBINATION) in sc_generate_ltk()
1218 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); in sc_generate_ltk()
1220 if (test_bit(SMP_FLAG_CT2, &smp->flags)) { in sc_generate_ltk()
1224 if (smp_h7(smp->tfm_cmac, key->val, salt, smp->tk)) in sc_generate_ltk()
1230 if (smp_h6(smp->tfm_cmac, key->val, tmp2, smp->tk)) in sc_generate_ltk()
1234 if (smp_h6(smp->tfm_cmac, smp->tk, brle, smp->tk)) in sc_generate_ltk()
1243 struct l2cap_conn *conn = smp->conn; in smp_distribute_keys()
1244 struct hci_conn *hcon = conn->hcon; in smp_distribute_keys()
1245 struct hci_dev *hdev = hcon->hdev; in smp_distribute_keys()
1250 rsp = (void *) &smp->prsp[1]; in smp_distribute_keys()
1253 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags) && in smp_distribute_keys()
1254 (smp->remote_key_dist & KEY_DIST_MASK)) { in smp_distribute_keys()
1259 req = (void *) &smp->preq[1]; in smp_distribute_keys()
1261 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in smp_distribute_keys()
1262 keydist = &rsp->init_key_dist; in smp_distribute_keys()
1263 *keydist &= req->init_key_dist; in smp_distribute_keys()
1265 keydist = &rsp->resp_key_dist; in smp_distribute_keys()
1266 *keydist &= req->resp_key_dist; in smp_distribute_keys()
1269 if (test_bit(SMP_FLAG_SC, &smp->flags)) { in smp_distribute_keys()
1270 if (hcon->type == LE_LINK && (*keydist & SMP_DIST_LINK_KEY)) in smp_distribute_keys()
1272 if (hcon->type == ACL_LINK && (*keydist & SMP_DIST_ENC_KEY)) in smp_distribute_keys()
1293 get_random_bytes(enc.ltk, smp->enc_key_size); in smp_distribute_keys()
1294 memset(enc.ltk + smp->enc_key_size, 0, in smp_distribute_keys()
1295 sizeof(enc.ltk) - smp->enc_key_size); in smp_distribute_keys()
1302 authenticated = hcon->sec_level == BT_SECURITY_HIGH; in smp_distribute_keys()
1303 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, in smp_distribute_keys()
1305 smp->enc_key_size, ediv, rand); in smp_distribute_keys()
1306 smp->responder_ltk = ltk; in smp_distribute_keys()
1321 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk)); in smp_distribute_keys()
1331 bacpy(&addrinfo.bdaddr, &hcon->src); in smp_distribute_keys()
1332 addrinfo.addr_type = hcon->src_type; in smp_distribute_keys()
1349 if (hcon->sec_level > BT_SECURITY_MEDIUM) in smp_distribute_keys()
1350 csrk->type = MGMT_CSRK_LOCAL_AUTHENTICATED; in smp_distribute_keys()
1352 csrk->type = MGMT_CSRK_LOCAL_UNAUTHENTICATED; in smp_distribute_keys()
1353 memcpy(csrk->val, sign.csrk, sizeof(csrk->val)); in smp_distribute_keys()
1355 smp->responder_csrk = csrk; in smp_distribute_keys()
1363 if (smp->remote_key_dist & KEY_DIST_MASK) { in smp_distribute_keys()
1368 set_bit(SMP_FLAG_COMPLETE, &smp->flags); in smp_distribute_keys()
1378 struct l2cap_conn *conn = smp->conn; in smp_timeout()
1380 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn); in smp_timeout()
1382 hci_disconnect(conn->hcon, HCI_ERROR_REMOTE_USER_TERM); in smp_timeout()
1387 struct hci_conn *hcon = conn->hcon; in smp_chan_create()
1388 struct l2cap_chan *chan = conn->smp; in smp_chan_create()
1395 smp->tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0); in smp_chan_create()
1396 if (IS_ERR(smp->tfm_cmac)) { in smp_chan_create()
1397 bt_dev_err(hcon->hdev, "Unable to create CMAC crypto context"); in smp_chan_create()
1401 smp->tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0); in smp_chan_create()
1402 if (IS_ERR(smp->tfm_ecdh)) { in smp_chan_create()
1403 bt_dev_err(hcon->hdev, "Unable to create ECDH crypto context"); in smp_chan_create()
1407 smp->conn = conn; in smp_chan_create()
1408 chan->data = smp; in smp_chan_create()
1412 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout); in smp_chan_create()
1419 crypto_free_shash(smp->tfm_cmac); in smp_chan_create()
1427 struct hci_conn *hcon = smp->conn->hcon; in sc_mackey_and_ltk()
1430 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in sc_mackey_and_ltk()
1431 na = smp->prnd; in sc_mackey_and_ltk()
1432 nb = smp->rrnd; in sc_mackey_and_ltk()
1434 na = smp->rrnd; in sc_mackey_and_ltk()
1435 nb = smp->prnd; in sc_mackey_and_ltk()
1438 memcpy(a, &hcon->init_addr, 6); in sc_mackey_and_ltk()
1439 memcpy(b, &hcon->resp_addr, 6); in sc_mackey_and_ltk()
1440 a[6] = hcon->init_addr_type; in sc_mackey_and_ltk()
1441 b[6] = hcon->resp_addr_type; in sc_mackey_and_ltk()
1443 return smp_f5(smp->tfm_cmac, smp->dhkey, na, nb, a, b, mackey, ltk); in sc_mackey_and_ltk()
1448 struct hci_conn *hcon = smp->conn->hcon; in sc_dhkey_check()
1453 memcpy(a, &hcon->init_addr, 6); in sc_dhkey_check()
1454 memcpy(b, &hcon->resp_addr, 6); in sc_dhkey_check()
1455 a[6] = hcon->init_addr_type; in sc_dhkey_check()
1456 b[6] = hcon->resp_addr_type; in sc_dhkey_check()
1458 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in sc_dhkey_check()
1461 memcpy(io_cap, &smp->preq[1], 3); in sc_dhkey_check()
1465 memcpy(io_cap, &smp->prsp[1], 3); in sc_dhkey_check()
1470 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) in sc_dhkey_check()
1471 put_unaligned_le32(hcon->passkey_notify, r); in sc_dhkey_check()
1473 if (smp->method == REQ_OOB) in sc_dhkey_check()
1474 memcpy(r, smp->rr, 16); in sc_dhkey_check()
1476 smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap, in sc_dhkey_check()
1479 smp_send_cmd(smp->conn, SMP_CMD_DHKEY_CHECK, sizeof(check), &check); in sc_dhkey_check()
1484 struct l2cap_conn *conn = smp->conn; in sc_passkey_send_confirm()
1485 struct hci_conn *hcon = conn->hcon; in sc_passkey_send_confirm()
1489 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01); in sc_passkey_send_confirm()
1492 get_random_bytes(smp->prnd, sizeof(smp->prnd)); in sc_passkey_send_confirm()
1494 if (smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd, r, in sc_passkey_send_confirm()
1505 struct l2cap_conn *conn = smp->conn; in sc_passkey_round()
1506 struct hci_conn *hcon = conn->hcon; in sc_passkey_round()
1507 struct hci_dev *hdev = hcon->hdev; in sc_passkey_round()
1510 /* Ignore the PDU if we've already done 20 rounds (0 - 19) */ in sc_passkey_round()
1511 if (smp->passkey_round >= 20) in sc_passkey_round()
1516 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01); in sc_passkey_round()
1519 if (smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk, in sc_passkey_round()
1520 smp->rrnd, r, cfm)) in sc_passkey_round()
1523 if (crypto_memneq(smp->pcnf, cfm, 16)) in sc_passkey_round()
1526 smp->passkey_round++; in sc_passkey_round()
1528 if (smp->passkey_round == 20) { in sc_passkey_round()
1530 if (sc_mackey_and_ltk(smp, smp->mackey, smp->tk)) in sc_passkey_round()
1537 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in sc_passkey_round()
1539 sizeof(smp->prnd), smp->prnd); in sc_passkey_round()
1540 if (smp->passkey_round == 20) in sc_passkey_round()
1548 if (smp->passkey_round != 20) in sc_passkey_round()
1551 /* Passkey rounds are complete - start DHKey Check */ in sc_passkey_round()
1558 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) { in sc_passkey_round()
1559 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags); in sc_passkey_round()
1565 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in sc_passkey_round()
1567 sizeof(smp->prnd), smp->prnd); in sc_passkey_round()
1576 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) in sc_passkey_round()
1580 smp->passkey_round + 1); in sc_passkey_round()
1592 struct l2cap_conn *conn = smp->conn; in sc_user_reply()
1593 struct hci_conn *hcon = conn->hcon; in sc_user_reply()
1596 clear_bit(SMP_FLAG_WAIT_USER, &smp->flags); in sc_user_reply()
1600 smp_failure(smp->conn, SMP_PASSKEY_ENTRY_FAILED); in sc_user_reply()
1603 smp_failure(smp->conn, SMP_NUMERIC_COMP_FAILED); in sc_user_reply()
1606 hcon->passkey_notify = le32_to_cpu(passkey); in sc_user_reply()
1607 smp->passkey_round = 0; in sc_user_reply()
1609 if (test_and_clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) in sc_user_reply()
1615 return -EIO; in sc_user_reply()
1621 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in sc_user_reply()
1624 } else if (test_and_clear_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags)) { in sc_user_reply()
1634 struct l2cap_conn *conn = hcon->l2cap_data; in smp_user_confirm_reply()
1641 return -ENOTCONN; in smp_user_confirm_reply()
1643 bt_dev_dbg(conn->hcon->hdev, ""); in smp_user_confirm_reply()
1645 chan = conn->smp; in smp_user_confirm_reply()
1647 return -ENOTCONN; in smp_user_confirm_reply()
1650 if (!chan->data) { in smp_user_confirm_reply()
1651 err = -ENOTCONN; in smp_user_confirm_reply()
1655 smp = chan->data; in smp_user_confirm_reply()
1657 if (test_bit(SMP_FLAG_SC, &smp->flags)) { in smp_user_confirm_reply()
1665 memset(smp->tk, 0, sizeof(smp->tk)); in smp_user_confirm_reply()
1666 bt_dev_dbg(conn->hcon->hdev, "PassKey: %u", value); in smp_user_confirm_reply()
1667 put_unaligned_le32(value, smp->tk); in smp_user_confirm_reply()
1670 set_bit(SMP_FLAG_TK_VALID, &smp->flags); in smp_user_confirm_reply()
1679 err = -EOPNOTSUPP; in smp_user_confirm_reply()
1686 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) { in smp_user_confirm_reply()
1701 struct l2cap_conn *conn = smp->conn; in build_bredr_pairing_cmd()
1702 struct hci_dev *hdev = conn->hcon->hdev; in build_bredr_pairing_cmd()
1719 req->auth_req = SMP_AUTH_CT2; in build_bredr_pairing_cmd()
1720 req->init_key_dist = local_dist; in build_bredr_pairing_cmd()
1721 req->resp_key_dist = remote_dist; in build_bredr_pairing_cmd()
1722 req->max_key_size = conn->hcon->enc_key_size; in build_bredr_pairing_cmd()
1724 smp->remote_key_dist = remote_dist; in build_bredr_pairing_cmd()
1731 rsp->auth_req = SMP_AUTH_CT2; in build_bredr_pairing_cmd()
1732 rsp->max_key_size = conn->hcon->enc_key_size; in build_bredr_pairing_cmd()
1733 rsp->init_key_dist = req->init_key_dist & remote_dist; in build_bredr_pairing_cmd()
1734 rsp->resp_key_dist = req->resp_key_dist & local_dist; in build_bredr_pairing_cmd()
1736 smp->remote_key_dist = rsp->init_key_dist; in build_bredr_pairing_cmd()
1741 struct smp_cmd_pairing rsp, *req = (void *) skb->data; in smp_cmd_pairing_req()
1742 struct l2cap_chan *chan = conn->smp; in smp_cmd_pairing_req()
1743 struct hci_dev *hdev = conn->hcon->hdev; in smp_cmd_pairing_req()
1744 struct smp_chan *smp = chan->data; in smp_cmd_pairing_req()
1750 if (skb->len < sizeof(*req)) in smp_cmd_pairing_req()
1753 if (smp && test_bit(SMP_FLAG_INITIATOR, &smp->flags)) in smp_cmd_pairing_req()
1763 auth = req->auth_req & AUTH_REQ_MASK(hdev); in smp_cmd_pairing_req()
1772 smp->preq[0] = SMP_CMD_PAIRING_REQ; in smp_cmd_pairing_req()
1773 memcpy(&smp->preq[1], req, sizeof(*req)); in smp_cmd_pairing_req()
1777 * successfully received our local OOB data - therefore set the in smp_cmd_pairing_req()
1780 if (req->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob) in smp_cmd_pairing_req()
1781 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags); in smp_cmd_pairing_req()
1784 if (conn->hcon->type == ACL_LINK) { in smp_cmd_pairing_req()
1786 if (!test_bit(HCI_CONN_AES_CCM, &conn->hcon->flags) && in smp_cmd_pairing_req()
1790 set_bit(SMP_FLAG_SC, &smp->flags); in smp_cmd_pairing_req()
1794 if (req->auth_req & SMP_AUTH_CT2) in smp_cmd_pairing_req()
1795 set_bit(SMP_FLAG_CT2, &smp->flags); in smp_cmd_pairing_req()
1797 key_size = min(req->max_key_size, rsp.max_key_size); in smp_cmd_pairing_req()
1802 smp->remote_key_dist &= ~SMP_SC_NO_DIST; in smp_cmd_pairing_req()
1804 smp->prsp[0] = SMP_CMD_PAIRING_RSP; in smp_cmd_pairing_req()
1805 memcpy(&smp->prsp[1], &rsp, sizeof(rsp)); in smp_cmd_pairing_req()
1815 set_bit(SMP_FLAG_SC, &smp->flags); in smp_cmd_pairing_req()
1818 set_bit(SMP_FLAG_CT2, &smp->flags); in smp_cmd_pairing_req()
1821 if (conn->hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT) in smp_cmd_pairing_req()
1826 if (sec_level > conn->hcon->pending_sec_level) in smp_cmd_pairing_req()
1827 conn->hcon->pending_sec_level = sec_level; in smp_cmd_pairing_req()
1830 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { in smp_cmd_pairing_req()
1833 method = get_auth_method(smp, conn->hcon->io_capability, in smp_cmd_pairing_req()
1834 req->io_capability); in smp_cmd_pairing_req()
1839 key_size = min(req->max_key_size, rsp.max_key_size); in smp_cmd_pairing_req()
1843 get_random_bytes(smp->prnd, sizeof(smp->prnd)); in smp_cmd_pairing_req()
1845 smp->prsp[0] = SMP_CMD_PAIRING_RSP; in smp_cmd_pairing_req()
1846 memcpy(&smp->prsp[1], &rsp, sizeof(rsp)); in smp_cmd_pairing_req()
1850 clear_bit(SMP_FLAG_INITIATOR, &smp->flags); in smp_cmd_pairing_req()
1859 if (test_bit(SMP_FLAG_SC, &smp->flags)) { in smp_cmd_pairing_req()
1862 smp->remote_key_dist &= ~SMP_SC_NO_DIST; in smp_cmd_pairing_req()
1868 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability); in smp_cmd_pairing_req()
1877 struct hci_dev *hdev = smp->conn->hcon->hdev; in sc_send_public_key()
1881 if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) { in sc_send_public_key()
1882 struct l2cap_chan *chan = hdev->smp_data; in sc_send_public_key()
1885 if (!chan || !chan->data) in sc_send_public_key()
1888 smp_dev = chan->data; in sc_send_public_key()
1890 memcpy(smp->local_pk, smp_dev->local_pk, 64); in sc_send_public_key()
1891 memcpy(smp->lr, smp_dev->local_rand, 16); in sc_send_public_key()
1893 if (smp_dev->debug_key) in sc_send_public_key()
1894 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); in sc_send_public_key()
1901 if (set_ecdh_privkey(smp->tfm_ecdh, debug_sk)) in sc_send_public_key()
1903 memcpy(smp->local_pk, debug_pk, 64); in sc_send_public_key()
1904 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); in sc_send_public_key()
1908 if (generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk)) in sc_send_public_key()
1914 if (crypto_memneq(smp->local_pk, debug_pk, 64)) in sc_send_public_key()
1920 SMP_DBG("Local Public Key X: %32phN", smp->local_pk); in sc_send_public_key()
1921 SMP_DBG("Local Public Key Y: %32phN", smp->local_pk + 32); in sc_send_public_key()
1923 smp_send_cmd(smp->conn, SMP_CMD_PUBLIC_KEY, 64, smp->local_pk); in sc_send_public_key()
1930 struct smp_cmd_pairing *req, *rsp = (void *) skb->data; in smp_cmd_pairing_rsp()
1931 struct l2cap_chan *chan = conn->smp; in smp_cmd_pairing_rsp()
1932 struct smp_chan *smp = chan->data; in smp_cmd_pairing_rsp()
1933 struct hci_dev *hdev = conn->hcon->hdev; in smp_cmd_pairing_rsp()
1939 if (skb->len < sizeof(*rsp)) in smp_cmd_pairing_rsp()
1942 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) in smp_cmd_pairing_rsp()
1947 req = (void *) &smp->preq[1]; in smp_cmd_pairing_rsp()
1949 key_size = min(req->max_key_size, rsp->max_key_size); in smp_cmd_pairing_rsp()
1953 auth = rsp->auth_req & AUTH_REQ_MASK(hdev); in smp_cmd_pairing_rsp()
1959 * successfully received our local OOB data - therefore set the in smp_cmd_pairing_rsp()
1962 if (rsp->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob) in smp_cmd_pairing_rsp()
1963 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags); in smp_cmd_pairing_rsp()
1965 smp->prsp[0] = SMP_CMD_PAIRING_RSP; in smp_cmd_pairing_rsp()
1966 memcpy(&smp->prsp[1], rsp, sizeof(*rsp)); in smp_cmd_pairing_rsp()
1971 smp->remote_key_dist &= rsp->resp_key_dist; in smp_cmd_pairing_rsp()
1973 if ((req->auth_req & SMP_AUTH_CT2) && (auth & SMP_AUTH_CT2)) in smp_cmd_pairing_rsp()
1974 set_bit(SMP_FLAG_CT2, &smp->flags); in smp_cmd_pairing_rsp()
1977 if (conn->hcon->type == ACL_LINK) { in smp_cmd_pairing_rsp()
1979 smp->remote_key_dist &= ~SMP_SC_NO_DIST; in smp_cmd_pairing_rsp()
1984 if ((req->auth_req & SMP_AUTH_SC) && (auth & SMP_AUTH_SC)) in smp_cmd_pairing_rsp()
1985 set_bit(SMP_FLAG_SC, &smp->flags); in smp_cmd_pairing_rsp()
1986 else if (conn->hcon->pending_sec_level > BT_SECURITY_HIGH) in smp_cmd_pairing_rsp()
1987 conn->hcon->pending_sec_level = BT_SECURITY_HIGH; in smp_cmd_pairing_rsp()
1990 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) { in smp_cmd_pairing_rsp()
1993 method = get_auth_method(smp, req->io_capability, in smp_cmd_pairing_rsp()
1994 rsp->io_capability); in smp_cmd_pairing_rsp()
1999 get_random_bytes(smp->prnd, sizeof(smp->prnd)); in smp_cmd_pairing_rsp()
2004 smp->remote_key_dist &= rsp->resp_key_dist; in smp_cmd_pairing_rsp()
2006 if (test_bit(SMP_FLAG_SC, &smp->flags)) { in smp_cmd_pairing_rsp()
2008 smp->remote_key_dist &= ~SMP_SC_NO_DIST; in smp_cmd_pairing_rsp()
2013 auth |= req->auth_req; in smp_cmd_pairing_rsp()
2015 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability); in smp_cmd_pairing_rsp()
2019 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags); in smp_cmd_pairing_rsp()
2022 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags)) in smp_cmd_pairing_rsp()
2030 struct l2cap_conn *conn = smp->conn; in sc_check_confirm()
2032 bt_dev_dbg(conn->hcon->hdev, ""); in sc_check_confirm()
2034 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) in sc_check_confirm()
2037 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in sc_check_confirm()
2038 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), in sc_check_confirm()
2039 smp->prnd); in sc_check_confirm()
2046 /* Work-around for some implementations that incorrectly copy RFU bits
2052 struct l2cap_conn *conn = smp->conn; in fixup_sc_false_positive()
2053 struct hci_conn *hcon = conn->hcon; in fixup_sc_false_positive()
2054 struct hci_dev *hdev = hcon->hdev; in fixup_sc_false_positive()
2059 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) in fixup_sc_false_positive()
2063 bt_dev_err(hdev, "refusing legacy fallback in SC-only mode"); in fixup_sc_false_positive()
2069 req = (void *) &smp->preq[1]; in fixup_sc_false_positive()
2070 rsp = (void *) &smp->prsp[1]; in fixup_sc_false_positive()
2073 smp->remote_key_dist = (req->init_key_dist & rsp->resp_key_dist); in fixup_sc_false_positive()
2075 auth = req->auth_req & AUTH_REQ_MASK(hdev); in fixup_sc_false_positive()
2077 if (tk_request(conn, 0, auth, rsp->io_capability, req->io_capability)) { in fixup_sc_false_positive()
2082 clear_bit(SMP_FLAG_SC, &smp->flags); in fixup_sc_false_positive()
2089 struct l2cap_chan *chan = conn->smp; in smp_cmd_pairing_confirm()
2090 struct smp_chan *smp = chan->data; in smp_cmd_pairing_confirm()
2091 struct hci_conn *hcon = conn->hcon; in smp_cmd_pairing_confirm()
2092 struct hci_dev *hdev = hcon->hdev; in smp_cmd_pairing_confirm()
2095 test_bit(SMP_FLAG_INITIATOR, &smp->flags) ? "initiator" : in smp_cmd_pairing_confirm()
2098 if (skb->len < sizeof(smp->pcnf)) in smp_cmd_pairing_confirm()
2101 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf)); in smp_cmd_pairing_confirm()
2102 skb_pull(skb, sizeof(smp->pcnf)); in smp_cmd_pairing_confirm()
2104 if (test_bit(SMP_FLAG_SC, &smp->flags)) { in smp_cmd_pairing_confirm()
2108 if (test_bit(SMP_FLAG_REMOTE_PK, &smp->flags)) in smp_cmd_pairing_confirm()
2118 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in smp_cmd_pairing_confirm()
2119 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), in smp_cmd_pairing_confirm()
2120 smp->prnd); in smp_cmd_pairing_confirm()
2125 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags)) in smp_cmd_pairing_confirm()
2128 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags); in smp_cmd_pairing_confirm()
2135 struct l2cap_chan *chan = conn->smp; in smp_cmd_pairing_random()
2136 struct smp_chan *smp = chan->data; in smp_cmd_pairing_random()
2137 struct hci_conn *hcon = conn->hcon; in smp_cmd_pairing_random()
2142 bt_dev_dbg(hcon->hdev, "conn %p", conn); in smp_cmd_pairing_random()
2144 if (skb->len < sizeof(smp->rrnd)) in smp_cmd_pairing_random()
2147 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd)); in smp_cmd_pairing_random()
2148 skb_pull(skb, sizeof(smp->rrnd)); in smp_cmd_pairing_random()
2150 if (!test_bit(SMP_FLAG_SC, &smp->flags)) in smp_cmd_pairing_random()
2153 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in smp_cmd_pairing_random()
2154 pkax = smp->local_pk; in smp_cmd_pairing_random()
2155 pkbx = smp->remote_pk; in smp_cmd_pairing_random()
2156 na = smp->prnd; in smp_cmd_pairing_random()
2157 nb = smp->rrnd; in smp_cmd_pairing_random()
2159 pkax = smp->remote_pk; in smp_cmd_pairing_random()
2160 pkbx = smp->local_pk; in smp_cmd_pairing_random()
2161 na = smp->rrnd; in smp_cmd_pairing_random()
2162 nb = smp->prnd; in smp_cmd_pairing_random()
2165 if (smp->method == REQ_OOB) { in smp_cmd_pairing_random()
2166 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) in smp_cmd_pairing_random()
2168 sizeof(smp->prnd), smp->prnd); in smp_cmd_pairing_random()
2174 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) in smp_cmd_pairing_random()
2177 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in smp_cmd_pairing_random()
2180 err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk, in smp_cmd_pairing_random()
2181 smp->rrnd, 0, cfm); in smp_cmd_pairing_random()
2185 if (crypto_memneq(smp->pcnf, cfm, 16)) in smp_cmd_pairing_random()
2188 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), in smp_cmd_pairing_random()
2189 smp->prnd); in smp_cmd_pairing_random()
2192 /* Only Just-Works pairing requires extra checks */ in smp_cmd_pairing_random()
2193 if (smp->method != JUST_WORKS) in smp_cmd_pairing_random()
2200 if (hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, in smp_cmd_pairing_random()
2201 hcon->role)) { in smp_cmd_pairing_random()
2213 err = sc_mackey_and_ltk(smp, smp->mackey, smp->tk); in smp_cmd_pairing_random()
2217 if (smp->method == REQ_OOB) { in smp_cmd_pairing_random()
2218 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in smp_cmd_pairing_random()
2225 err = smp_g2(smp->tfm_cmac, pkax, pkbx, na, nb, &passkey); in smp_cmd_pairing_random()
2232 if (smp->method == JUST_WORKS) in smp_cmd_pairing_random()
2235 err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, hcon->type, in smp_cmd_pairing_random()
2236 hcon->dst_type, passkey, confirm_hint); in smp_cmd_pairing_random()
2240 set_bit(SMP_FLAG_WAIT_USER, &smp->flags); in smp_cmd_pairing_random()
2248 struct hci_conn *hcon = conn->hcon; in smp_ltk_encrypt()
2250 key = hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role); in smp_ltk_encrypt()
2257 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) in smp_ltk_encrypt()
2260 hci_le_start_enc(hcon, key->ediv, key->rand, key->val, key->enc_size); in smp_ltk_encrypt()
2261 hcon->enc_key_size = key->enc_size; in smp_ltk_encrypt()
2264 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags); in smp_ltk_encrypt()
2277 * connection to be re-encrypted with an LTK, even if the LTK in smp_sufficient_security()
2282 test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) && in smp_sufficient_security()
2283 hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role)) in smp_sufficient_security()
2286 if (hcon->sec_level >= sec_level) in smp_sufficient_security()
2296 if (smp->conn->hcon->type == ACL_LINK) in smp_send_pairing_req()
2299 build_pairing_cmd(smp->conn, &cp, NULL, auth); in smp_send_pairing_req()
2301 smp->preq[0] = SMP_CMD_PAIRING_REQ; in smp_send_pairing_req()
2302 memcpy(&smp->preq[1], &cp, sizeof(cp)); in smp_send_pairing_req()
2304 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp); in smp_send_pairing_req()
2307 set_bit(SMP_FLAG_INITIATOR, &smp->flags); in smp_send_pairing_req()
2312 struct smp_cmd_security_req *rp = (void *) skb->data; in smp_cmd_security_req() local
2313 struct hci_conn *hcon = conn->hcon; in smp_cmd_security_req()
2314 struct hci_dev *hdev = hcon->hdev; in smp_cmd_security_req()
2320 if (skb->len < sizeof(*rp)) in smp_cmd_security_req()
2323 if (hcon->role != HCI_ROLE_MASTER) in smp_cmd_security_req()
2326 auth = rp->auth_req & AUTH_REQ_MASK(hdev); in smp_cmd_security_req()
2331 if (hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT) in smp_cmd_security_req()
2341 smp_ltk_encrypt(conn, hcon->sec_level); in smp_cmd_security_req()
2345 if (sec_level > hcon->pending_sec_level) in smp_cmd_security_req()
2346 hcon->pending_sec_level = sec_level; in smp_cmd_security_req()
2348 if (smp_ltk_encrypt(conn, hcon->pending_sec_level)) in smp_cmd_security_req()
2359 skb_pull(skb, sizeof(*rp)); in smp_cmd_security_req()
2371 smp_send_cmd(smp->conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp); in smp_send_security_req()
2374 clear_bit(SMP_FLAG_INITIATOR, &smp->flags); in smp_send_security_req()
2379 struct l2cap_conn *conn = hcon->l2cap_data; in smp_conn_security()
2385 bt_dev_dbg(hcon->hdev, "conn %p hcon %p level 0x%2.2x", conn, hcon, in smp_conn_security()
2392 if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED)) in smp_conn_security()
2398 if (sec_level > hcon->pending_sec_level) in smp_conn_security()
2399 hcon->pending_sec_level = sec_level; in smp_conn_security()
2401 if (hcon->role == HCI_ROLE_MASTER) in smp_conn_security()
2402 if (smp_ltk_encrypt(conn, hcon->pending_sec_level)) in smp_conn_security()
2405 chan = conn->smp; in smp_conn_security()
2407 bt_dev_err(hcon->hdev, "security requested but not available"); in smp_conn_security()
2414 if (chan->data) { in smp_conn_security()
2427 if (hci_dev_test_flag(hcon->hdev, HCI_SC_ENABLED)) { in smp_conn_security()
2429 if (hci_dev_test_flag(hcon->hdev, HCI_SSP_ENABLED)) in smp_conn_security()
2434 * Needed to pass certification test SM/MAS/PKE/BV-01-C in smp_conn_security()
2436 if (!hci_dev_test_flag(hcon->hdev, HCI_FORCE_NO_MITM)) { in smp_conn_security()
2440 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT || in smp_conn_security()
2441 hcon->pending_sec_level > BT_SECURITY_MEDIUM) in smp_conn_security()
2445 if (hcon->role == HCI_ROLE_MASTER) in smp_conn_security()
2473 conn = hcon->l2cap_data; in smp_cancel_and_remove_pairing()
2477 chan = conn->smp; in smp_cancel_and_remove_pairing()
2483 smp = chan->data; in smp_cancel_and_remove_pairing()
2487 smp->ltk = NULL; in smp_cancel_and_remove_pairing()
2488 smp->responder_ltk = NULL; in smp_cancel_and_remove_pairing()
2489 smp->remote_irk = NULL; in smp_cancel_and_remove_pairing()
2491 if (test_bit(SMP_FLAG_COMPLETE, &smp->flags)) in smp_cancel_and_remove_pairing()
2506 struct smp_cmd_encrypt_info *rp = (void *) skb->data; in smp_cmd_encrypt_info() local
2507 struct l2cap_chan *chan = conn->smp; in smp_cmd_encrypt_info()
2508 struct smp_chan *smp = chan->data; in smp_cmd_encrypt_info()
2510 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn); in smp_cmd_encrypt_info()
2512 if (skb->len < sizeof(*rp)) in smp_cmd_encrypt_info()
2516 if (hci_is_blocked_key(conn->hcon->hdev, HCI_BLOCKED_KEY_TYPE_LTK, in smp_cmd_encrypt_info()
2517 rp->ltk)) { in smp_cmd_encrypt_info()
2518 bt_dev_warn_ratelimited(conn->hcon->hdev, in smp_cmd_encrypt_info()
2520 &conn->hcon->dst); in smp_cmd_encrypt_info()
2526 skb_pull(skb, sizeof(*rp)); in smp_cmd_encrypt_info()
2528 memcpy(smp->tk, rp->ltk, sizeof(smp->tk)); in smp_cmd_encrypt_info()
2535 struct smp_cmd_initiator_ident *rp = (void *)skb->data; in smp_cmd_initiator_ident() local
2536 struct l2cap_chan *chan = conn->smp; in smp_cmd_initiator_ident()
2537 struct smp_chan *smp = chan->data; in smp_cmd_initiator_ident()
2538 struct hci_dev *hdev = conn->hcon->hdev; in smp_cmd_initiator_ident()
2539 struct hci_conn *hcon = conn->hcon; in smp_cmd_initiator_ident()
2545 if (skb->len < sizeof(*rp)) in smp_cmd_initiator_ident()
2549 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY; in smp_cmd_initiator_ident()
2551 if (smp->remote_key_dist & SMP_DIST_ID_KEY) in smp_cmd_initiator_ident()
2553 else if (smp->remote_key_dist & SMP_DIST_SIGN) in smp_cmd_initiator_ident()
2556 skb_pull(skb, sizeof(*rp)); in smp_cmd_initiator_ident()
2558 authenticated = (hcon->sec_level == BT_SECURITY_HIGH); in smp_cmd_initiator_ident()
2559 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK, in smp_cmd_initiator_ident()
2560 authenticated, smp->tk, smp->enc_key_size, in smp_cmd_initiator_ident()
2561 rp->ediv, rp->rand); in smp_cmd_initiator_ident()
2562 smp->ltk = ltk; in smp_cmd_initiator_ident()
2563 if (!(smp->remote_key_dist & KEY_DIST_MASK)) in smp_cmd_initiator_ident()
2571 struct smp_cmd_ident_info *info = (void *) skb->data; in smp_cmd_ident_info()
2572 struct l2cap_chan *chan = conn->smp; in smp_cmd_ident_info()
2573 struct smp_chan *smp = chan->data; in smp_cmd_ident_info()
2575 bt_dev_dbg(conn->hcon->hdev, ""); in smp_cmd_ident_info()
2577 if (skb->len < sizeof(*info)) in smp_cmd_ident_info()
2581 if (hci_is_blocked_key(conn->hcon->hdev, HCI_BLOCKED_KEY_TYPE_IRK, in smp_cmd_ident_info()
2582 info->irk)) { in smp_cmd_ident_info()
2583 bt_dev_warn_ratelimited(conn->hcon->hdev, in smp_cmd_ident_info()
2585 &conn->hcon->dst); in smp_cmd_ident_info()
2593 memcpy(smp->irk, info->irk, 16); in smp_cmd_ident_info()
2601 struct smp_cmd_ident_addr_info *info = (void *) skb->data; in smp_cmd_ident_addr_info()
2602 struct l2cap_chan *chan = conn->smp; in smp_cmd_ident_addr_info()
2603 struct smp_chan *smp = chan->data; in smp_cmd_ident_addr_info()
2604 struct hci_conn *hcon = conn->hcon; in smp_cmd_ident_addr_info()
2607 bt_dev_dbg(hcon->hdev, ""); in smp_cmd_ident_addr_info()
2609 if (skb->len < sizeof(*info)) in smp_cmd_ident_addr_info()
2613 smp->remote_key_dist &= ~SMP_DIST_ID_KEY; in smp_cmd_ident_addr_info()
2615 if (smp->remote_key_dist & SMP_DIST_SIGN) in smp_cmd_ident_addr_info()
2630 if (!bacmp(&info->bdaddr, BDADDR_ANY) || in smp_cmd_ident_addr_info()
2631 !hci_is_identity_address(&info->bdaddr, info->addr_type)) { in smp_cmd_ident_addr_info()
2632 bt_dev_err(hcon->hdev, "ignoring IRK with no identity address"); in smp_cmd_ident_addr_info()
2641 if (hci_is_identity_address(&hcon->dst, hcon->dst_type) && in smp_cmd_ident_addr_info()
2642 (bacmp(&info->bdaddr, &hcon->dst) || in smp_cmd_ident_addr_info()
2643 info->addr_type != hcon->dst_type)) { in smp_cmd_ident_addr_info()
2644 bt_dev_err(hcon->hdev, in smp_cmd_ident_addr_info()
2649 bacpy(&smp->id_addr, &info->bdaddr); in smp_cmd_ident_addr_info()
2650 smp->id_addr_type = info->addr_type; in smp_cmd_ident_addr_info()
2652 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type)) in smp_cmd_ident_addr_info()
2653 bacpy(&rpa, &hcon->dst); in smp_cmd_ident_addr_info()
2657 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr, in smp_cmd_ident_addr_info()
2658 smp->id_addr_type, smp->irk, &rpa); in smp_cmd_ident_addr_info()
2661 if (!(smp->remote_key_dist & KEY_DIST_MASK)) in smp_cmd_ident_addr_info()
2669 struct smp_cmd_sign_info *rp = (void *) skb->data; in smp_cmd_sign_info() local
2670 struct l2cap_chan *chan = conn->smp; in smp_cmd_sign_info()
2671 struct smp_chan *smp = chan->data; in smp_cmd_sign_info()
2674 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn); in smp_cmd_sign_info()
2676 if (skb->len < sizeof(*rp)) in smp_cmd_sign_info()
2680 smp->remote_key_dist &= ~SMP_DIST_SIGN; in smp_cmd_sign_info()
2682 skb_pull(skb, sizeof(*rp)); in smp_cmd_sign_info()
2686 if (conn->hcon->sec_level > BT_SECURITY_MEDIUM) in smp_cmd_sign_info()
2687 csrk->type = MGMT_CSRK_REMOTE_AUTHENTICATED; in smp_cmd_sign_info()
2689 csrk->type = MGMT_CSRK_REMOTE_UNAUTHENTICATED; in smp_cmd_sign_info()
2690 memcpy(csrk->val, rp->csrk, sizeof(csrk->val)); in smp_cmd_sign_info()
2692 smp->csrk = csrk; in smp_cmd_sign_info()
2703 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags) || in sc_select_method()
2704 test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) in sc_select_method()
2712 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in sc_select_method()
2713 local = (void *) &smp->preq[1]; in sc_select_method()
2714 remote = (void *) &smp->prsp[1]; in sc_select_method()
2716 local = (void *) &smp->prsp[1]; in sc_select_method()
2717 remote = (void *) &smp->preq[1]; in sc_select_method()
2720 local_io = local->io_capability; in sc_select_method()
2721 remote_io = remote->io_capability; in sc_select_method()
2723 local_mitm = (local->auth_req & SMP_AUTH_MITM); in sc_select_method()
2724 remote_mitm = (remote->auth_req & SMP_AUTH_MITM); in sc_select_method()
2735 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags)) in sc_select_method()
2743 struct smp_cmd_public_key *key = (void *) skb->data; in smp_cmd_public_key()
2744 struct hci_conn *hcon = conn->hcon; in smp_cmd_public_key()
2745 struct l2cap_chan *chan = conn->smp; in smp_cmd_public_key()
2746 struct smp_chan *smp = chan->data; in smp_cmd_public_key()
2747 struct hci_dev *hdev = hcon->hdev; in smp_cmd_public_key()
2754 if (skb->len < sizeof(*key)) in smp_cmd_public_key()
2760 if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) && in smp_cmd_public_key()
2761 !crypto_memneq(key, smp->local_pk, 64)) { in smp_cmd_public_key()
2766 memcpy(smp->remote_pk, key, 64); in smp_cmd_public_key()
2768 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) { in smp_cmd_public_key()
2769 err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->remote_pk, in smp_cmd_public_key()
2770 smp->rr, 0, cfm.confirm_val); in smp_cmd_public_key()
2774 if (crypto_memneq(cfm.confirm_val, smp->pcnf, 16)) in smp_cmd_public_key()
2778 /* Non-initiating device sends its public key after receiving in smp_cmd_public_key()
2781 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in smp_cmd_public_key()
2787 SMP_DBG("Remote Public Key X: %32phN", smp->remote_pk); in smp_cmd_public_key()
2788 SMP_DBG("Remote Public Key Y: %32phN", smp->remote_pk + 32); in smp_cmd_public_key()
2793 if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) { in smp_cmd_public_key()
2794 struct l2cap_chan *hchan = hdev->smp_data; in smp_cmd_public_key()
2797 if (!hchan || !hchan->data) in smp_cmd_public_key()
2800 smp_dev = hchan->data; in smp_cmd_public_key()
2802 tfm_ecdh = smp_dev->tfm_ecdh; in smp_cmd_public_key()
2804 tfm_ecdh = smp->tfm_ecdh; in smp_cmd_public_key()
2807 if (compute_ecdh_secret(tfm_ecdh, smp->remote_pk, smp->dhkey)) in smp_cmd_public_key()
2810 SMP_DBG("DHKey %32phN", smp->dhkey); in smp_cmd_public_key()
2812 set_bit(SMP_FLAG_REMOTE_PK, &smp->flags); in smp_cmd_public_key()
2814 smp->method = sc_select_method(smp); in smp_cmd_public_key()
2816 bt_dev_dbg(hdev, "selected method 0x%02x", smp->method); in smp_cmd_public_key()
2819 if (smp->method == JUST_WORKS || smp->method == JUST_CFM) in smp_cmd_public_key()
2820 hcon->pending_sec_level = BT_SECURITY_MEDIUM; in smp_cmd_public_key()
2822 hcon->pending_sec_level = BT_SECURITY_FIPS; in smp_cmd_public_key()
2824 if (!crypto_memneq(debug_pk, smp->remote_pk, 64)) in smp_cmd_public_key()
2825 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); in smp_cmd_public_key()
2827 if (smp->method == DSP_PASSKEY) { in smp_cmd_public_key()
2828 get_random_bytes(&hcon->passkey_notify, in smp_cmd_public_key()
2829 sizeof(hcon->passkey_notify)); in smp_cmd_public_key()
2830 hcon->passkey_notify %= 1000000; in smp_cmd_public_key()
2831 hcon->passkey_entered = 0; in smp_cmd_public_key()
2832 smp->passkey_round = 0; in smp_cmd_public_key()
2833 if (mgmt_user_passkey_notify(hdev, &hcon->dst, hcon->type, in smp_cmd_public_key()
2834 hcon->dst_type, in smp_cmd_public_key()
2835 hcon->passkey_notify, in smp_cmd_public_key()
2836 hcon->passkey_entered)) in smp_cmd_public_key()
2842 if (smp->method == REQ_OOB) { in smp_cmd_public_key()
2843 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) in smp_cmd_public_key()
2845 sizeof(smp->prnd), smp->prnd); in smp_cmd_public_key()
2852 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) in smp_cmd_public_key()
2855 if (smp->method == REQ_PASSKEY) { in smp_cmd_public_key()
2856 if (mgmt_user_passkey_request(hdev, &hcon->dst, hcon->type, in smp_cmd_public_key()
2857 hcon->dst_type)) in smp_cmd_public_key()
2860 set_bit(SMP_FLAG_WAIT_USER, &smp->flags); in smp_cmd_public_key()
2864 /* The Initiating device waits for the non-initiating device to in smp_cmd_public_key()
2867 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) in smp_cmd_public_key()
2870 err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd, in smp_cmd_public_key()
2883 struct smp_cmd_dhkey_check *check = (void *) skb->data; in smp_cmd_dhkey_check()
2884 struct l2cap_chan *chan = conn->smp; in smp_cmd_dhkey_check()
2885 struct hci_conn *hcon = conn->hcon; in smp_cmd_dhkey_check()
2886 struct smp_chan *smp = chan->data; in smp_cmd_dhkey_check()
2891 bt_dev_dbg(hcon->hdev, "conn %p", conn); in smp_cmd_dhkey_check()
2893 if (skb->len < sizeof(*check)) in smp_cmd_dhkey_check()
2896 memcpy(a, &hcon->init_addr, 6); in smp_cmd_dhkey_check()
2897 memcpy(b, &hcon->resp_addr, 6); in smp_cmd_dhkey_check()
2898 a[6] = hcon->init_addr_type; in smp_cmd_dhkey_check()
2899 b[6] = hcon->resp_addr_type; in smp_cmd_dhkey_check()
2901 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in smp_cmd_dhkey_check()
2904 memcpy(io_cap, &smp->prsp[1], 3); in smp_cmd_dhkey_check()
2908 memcpy(io_cap, &smp->preq[1], 3); in smp_cmd_dhkey_check()
2913 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) in smp_cmd_dhkey_check()
2914 put_unaligned_le32(hcon->passkey_notify, r); in smp_cmd_dhkey_check()
2915 else if (smp->method == REQ_OOB) in smp_cmd_dhkey_check()
2916 memcpy(r, smp->lr, 16); in smp_cmd_dhkey_check()
2918 err = smp_f6(smp->tfm_cmac, smp->mackey, smp->rrnd, smp->prnd, r, in smp_cmd_dhkey_check()
2923 if (crypto_memneq(check->e, e, 16)) in smp_cmd_dhkey_check()
2926 if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in smp_cmd_dhkey_check()
2927 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) { in smp_cmd_dhkey_check()
2928 set_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags); in smp_cmd_dhkey_check()
2938 if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) { in smp_cmd_dhkey_check()
2939 hci_le_start_enc(hcon, 0, 0, smp->tk, smp->enc_key_size); in smp_cmd_dhkey_check()
2940 hcon->enc_key_size = smp->enc_key_size; in smp_cmd_dhkey_check()
2949 struct smp_cmd_keypress_notify *kp = (void *) skb->data; in smp_cmd_keypress_notify()
2951 bt_dev_dbg(conn->hcon->hdev, "value 0x%02x", kp->value); in smp_cmd_keypress_notify()
2958 struct l2cap_conn *conn = chan->conn; in smp_sig_channel()
2959 struct hci_conn *hcon = conn->hcon; in smp_sig_channel()
2964 if (skb->len < 1) in smp_sig_channel()
2965 return -EILSEQ; in smp_sig_channel()
2967 if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED)) { in smp_sig_channel()
2972 code = skb->data[0]; in smp_sig_channel()
2975 smp = chan->data; in smp_sig_channel()
2980 if (smp && !test_and_clear_bit(code, &smp->allow_cmd)) in smp_sig_channel()
2996 err = -EPERM; in smp_sig_channel()
3048 bt_dev_dbg(hcon->hdev, "Unknown command code 0x%2.2x", code); in smp_sig_channel()
3063 bt_dev_err(hcon->hdev, "unexpected SMP command 0x%02x from %pMR", in smp_sig_channel()
3064 code, &hcon->dst); in smp_sig_channel()
3071 struct l2cap_conn *conn = chan->conn; in smp_teardown_cb()
3073 bt_dev_dbg(conn->hcon->hdev, "chan %p", chan); in smp_teardown_cb()
3075 if (chan->data) in smp_teardown_cb()
3078 conn->smp = NULL; in smp_teardown_cb()
3084 struct l2cap_conn *conn = chan->conn; in bredr_pairing()
3085 struct hci_conn *hcon = conn->hcon; in bredr_pairing()
3086 struct hci_dev *hdev = hcon->hdev; in bredr_pairing()
3092 if (!test_bit(HCI_CONN_NEW_LINK_KEY, &hcon->flags)) in bredr_pairing()
3096 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags)) in bredr_pairing()
3100 if (hcon->role != HCI_ROLE_MASTER) in bredr_pairing()
3108 if (!test_bit(HCI_CONN_AES_CCM, &hcon->flags) && in bredr_pairing()
3121 if (!(conn->remote_fixed_chan & L2CAP_FC_SMP_BREDR)) in bredr_pairing()
3125 if (chan->data) in bredr_pairing()
3134 set_bit(SMP_FLAG_SC, &smp->flags); in bredr_pairing()
3143 struct smp_chan *smp = chan->data; in smp_resume_cb()
3144 struct l2cap_conn *conn = chan->conn; in smp_resume_cb()
3145 struct hci_conn *hcon = conn->hcon; in smp_resume_cb()
3147 bt_dev_dbg(hcon->hdev, "chan %p", chan); in smp_resume_cb()
3149 if (hcon->type == ACL_LINK) { in smp_resume_cb()
3157 if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags)) in smp_resume_cb()
3160 cancel_delayed_work(&smp->security_timer); in smp_resume_cb()
3167 struct l2cap_conn *conn = chan->conn; in smp_ready_cb()
3168 struct hci_conn *hcon = conn->hcon; in smp_ready_cb()
3170 bt_dev_dbg(hcon->hdev, "chan %p", chan); in smp_ready_cb()
3178 conn->smp = chan; in smp_ready_cb()
3180 if (hcon->type == ACL_LINK && test_bit(HCI_CONN_ENCRYPT, &hcon->flags)) in smp_ready_cb()
3188 bt_dev_dbg(chan->conn->hcon->hdev, "chan %p", chan); in smp_recv_cb()
3192 struct smp_chan *smp = chan->data; in smp_recv_cb()
3195 cancel_delayed_work_sync(&smp->security_timer); in smp_recv_cb()
3197 hci_disconnect(chan->conn->hcon, HCI_ERROR_AUTH_FAILURE); in smp_recv_cb()
3211 return ERR_PTR(-ENOMEM); in smp_alloc_skb_cb()
3213 skb->priority = HCI_PRIO_MAX; in smp_alloc_skb_cb()
3214 bt_cb(skb)->l2cap.chan = chan; in smp_alloc_skb_cb()
3246 chan->chan_type = pchan->chan_type; in smp_new_conn_cb()
3247 chan->ops = &smp_chan_ops; in smp_new_conn_cb()
3248 chan->scid = pchan->scid; in smp_new_conn_cb()
3249 chan->dcid = chan->scid; in smp_new_conn_cb()
3250 chan->imtu = pchan->imtu; in smp_new_conn_cb()
3251 chan->omtu = pchan->omtu; in smp_new_conn_cb()
3252 chan->mode = pchan->mode; in smp_new_conn_cb()
3259 atomic_set(&chan->nesting, L2CAP_NESTING_SMP); in smp_new_conn_cb()
3298 return ERR_PTR(-ENOMEM); in smp_add_cid()
3307 tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0); in smp_add_cid()
3315 smp->local_oob = false; in smp_add_cid()
3316 smp->tfm_cmac = tfm_cmac; in smp_add_cid()
3317 smp->tfm_ecdh = tfm_ecdh; in smp_add_cid()
3323 crypto_free_shash(smp->tfm_cmac); in smp_add_cid()
3324 crypto_free_kpp(smp->tfm_ecdh); in smp_add_cid()
3327 return ERR_PTR(-ENOMEM); in smp_add_cid()
3330 chan->data = smp; in smp_add_cid()
3339 hci_copy_identity_address(hdev, &chan->src, &bdaddr_type); in smp_add_cid()
3342 chan->src_type = BDADDR_LE_PUBLIC; in smp_add_cid()
3344 chan->src_type = BDADDR_LE_RANDOM; in smp_add_cid()
3346 bacpy(&chan->src, &hdev->bdaddr); in smp_add_cid()
3347 chan->src_type = BDADDR_BREDR; in smp_add_cid()
3350 chan->state = BT_LISTEN; in smp_add_cid()
3351 chan->mode = L2CAP_MODE_BASIC; in smp_add_cid()
3352 chan->imtu = L2CAP_DEFAULT_MTU; in smp_add_cid()
3353 chan->ops = &smp_root_chan_ops; in smp_add_cid()
3356 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT); in smp_add_cid()
3367 smp = chan->data; in smp_del_chan()
3369 chan->data = NULL; in smp_del_chan()
3370 crypto_free_shash(smp->tfm_cmac); in smp_del_chan()
3371 crypto_free_kpp(smp->tfm_ecdh); in smp_del_chan()
3381 return -EALREADY; in smp_force_bredr()
3390 hdev->smp_bredr_data = chan; in smp_force_bredr()
3394 chan = hdev->smp_bredr_data; in smp_force_bredr()
3395 hdev->smp_bredr_data = NULL; in smp_force_bredr()
3416 if (WARN_ON(hdev->smp_data)) { in smp_register()
3417 chan = hdev->smp_data; in smp_register()
3418 hdev->smp_data = NULL; in smp_register()
3426 hdev->smp_data = chan; in smp_register()
3434 if (WARN_ON(hdev->smp_bredr_data)) { in smp_register()
3435 chan = hdev->smp_bredr_data; in smp_register()
3436 hdev->smp_bredr_data = NULL; in smp_register()
3443 chan = hdev->smp_data; in smp_register()
3444 hdev->smp_data = NULL; in smp_register()
3449 hdev->smp_bredr_data = chan; in smp_register()
3458 if (hdev->smp_bredr_data) { in smp_unregister()
3459 chan = hdev->smp_bredr_data; in smp_unregister()
3460 hdev->smp_bredr_data = NULL; in smp_unregister()
3464 if (hdev->smp_data) { in smp_unregister()
3465 chan = hdev->smp_data; in smp_unregister()
3466 hdev->smp_data = NULL; in smp_unregister()
3487 return -EINVAL; in test_debug_key()
3507 return -EINVAL; in test_ah()
3537 return -EINVAL; in test_c1()
3562 return -EINVAL; in test_s1()
3594 return -EINVAL; in test_f4()
3628 return -EINVAL; in test_f5()
3631 return -EINVAL; in test_f5()
3664 return -EINVAL; in test_f6()
3684 const u8 y[16] = { in test_g2() local
3691 err = smp_g2(tfm_cmac, u, v, x, y, &val); in test_g2()
3696 return -EINVAL; in test_g2()
3718 return -EINVAL; in test_h6()
3832 tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0); in bt_selftest_smp()