projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Add a new PID/VID 0227/0930 for AR3012.
[deliverable/linux.git] / net / bluetooth / smp.c
CommitLineData
eb492e01
AB		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License version 2 as
7 published by the Free Software Foundation;
8
9 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20 SOFTWARE IS DISCLAIMED.
21*/
22
8c520a59
GP		 23#include <linux/crypto.h>
24#include <linux/scatterlist.h>
25#include <crypto/b128ops.h>
26
eb492e01
AB		 27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
2b64d153 30#include <net/bluetooth/mgmt.h>
ac4b7236
MH		 31
32#include "smp.h"
d22ef0bc 33
17b02e62 34#define SMP_TIMEOUT msecs_to_jiffies(30000)
5d3de7df 35
065a13e2
JH		 36#define AUTH_REQ_MASK 0x07
37
533e35d4
JH		 38enum {
39 SMP_FLAG_TK_VALID,
40 SMP_FLAG_CFM_PENDING,
41 SMP_FLAG_MITM_AUTH,
42 SMP_FLAG_COMPLETE,
43 SMP_FLAG_INITIATOR,
44};
4bc58f51
JH		 45
46struct smp_chan {
47 struct l2cap_conn *conn;
48 u8 preq[7]; /* SMP Pairing Request */
49 u8 prsp[7]; /* SMP Pairing Response */
50 u8 prnd[16]; /* SMP Pairing Random (local) */
51 u8 rrnd[16]; /* SMP Pairing Random (remote) */
52 u8 pcnf[16]; /* SMP Pairing Confirm */
53 u8 tk[16]; /* SMP Temporary Key */
54 u8 enc_key_size;
55 u8 remote_key_dist;
56 bdaddr_t id_addr;
57 u8 id_addr_type;
58 u8 irk[16];
59 struct smp_csrk *csrk;
60 struct smp_csrk *slave_csrk;
61 struct smp_ltk *ltk;
62 struct smp_ltk *slave_ltk;
63 struct smp_irk *remote_irk;
4a74d658 64 unsigned long flags;
6a7bd103
JH		 65
66 struct crypto_blkcipher *tfm_aes;
4bc58f51
JH		 67};
68
8a2936f4 69static inline void swap_buf(const u8 *src, u8 *dst, size_t len)
d22ef0bc 70{
8a2936f4 71 size_t i;
d22ef0bc 72
8a2936f4
JH		 73 for (i = 0; i < len; i++)
74 dst[len - 1 - i] = src[i];
d22ef0bc
AB		 75}
76
77static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
78{
79 struct blkcipher_desc desc;
80 struct scatterlist sg;
943a732a 81 uint8_t tmp[16], data[16];
201a5929 82 int err;
d22ef0bc
AB		 83
84 if (tfm == NULL) {
85 BT_ERR("tfm %p", tfm);
86 return -EINVAL;
87 }
88
89 desc.tfm = tfm;
90 desc.flags = 0;
91
943a732a 92 /* The most significant octet of key corresponds to k[0] */
8a2936f4 93 swap_buf(k, tmp, 16);
943a732a
JH		 94
95 err = crypto_blkcipher_setkey(tfm, tmp, 16);
d22ef0bc
AB		 96 if (err) {
97 BT_ERR("cipher setkey failed: %d", err);
98 return err;
99 }
100
943a732a 101 /* Most significant octet of plaintextData corresponds to data[0] */
8a2936f4 102 swap_buf(r, data, 16);
943a732a
JH		 103
104 sg_init_one(&sg, data, 16);
d22ef0bc 105
d22ef0bc
AB		 106 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
107 if (err)
108 BT_ERR("Encrypt data error %d", err);
109
943a732a 110 /* Most significant octet of encryptedData corresponds to data[0] */
8a2936f4 111 swap_buf(data, r, 16);
943a732a 112
d22ef0bc
AB		 113 return err;
114}
115
60478054
JH		 116static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
117{
943a732a 118 u8 _res[16];
60478054
JH		 119 int err;
120
121 /* r' = padding || r */
943a732a
JH		 122 memcpy(_res, r, 3);
123 memset(_res + 3, 0, 13);
60478054 124
943a732a 125 err = smp_e(tfm, irk, _res);
60478054
JH		 126 if (err) {
127 BT_ERR("Encrypt error");
128 return err;
129 }
130
131 /* The output of the random address function ah is:
132 * ah(h, r) = e(k, r') mod 2^24
133 * The output of the security function e is then truncated to 24 bits
134 * by taking the least significant 24 bits of the output of e as the
135 * result of ah.
136 */
943a732a 137 memcpy(res, _res, 3);
60478054
JH		 138
139 return 0;
140}
141
defce9e8 142bool smp_irk_matches(struct hci_dev *hdev, u8 irk[16], bdaddr_t *bdaddr)
60478054 143{
defce9e8
JH		 144 struct l2cap_chan *chan = hdev->smp_data;
145 struct crypto_blkcipher *tfm;
60478054
JH		 146 u8 hash[3];
147 int err;
148
defce9e8
JH		 149 if (!chan || !chan->data)
150 return false;
151
152 tfm = chan->data;
153
60478054
JH		 154 BT_DBG("RPA %pMR IRK %*phN", bdaddr, 16, irk);
155
156 err = smp_ah(tfm, irk, &bdaddr->b[3], hash);
157 if (err)
158 return false;
159
160 return !memcmp(bdaddr->b, hash, 3);
161}
162
defce9e8 163int smp_generate_rpa(struct hci_dev *hdev, u8 irk[16], bdaddr_t *rpa)
b1e2b3ae 164{
defce9e8
JH		 165 struct l2cap_chan *chan = hdev->smp_data;
166 struct crypto_blkcipher *tfm;
b1e2b3ae
JH		 167 int err;
168
defce9e8
JH		 169 if (!chan || !chan->data)
170 return -EOPNOTSUPP;
171
172 tfm = chan->data;
173
b1e2b3ae
JH		 174 get_random_bytes(&rpa->b[3], 3);
175
176 rpa->b[5] &= 0x3f; /* Clear two most significant bits */
177 rpa->b[5] |= 0x40; /* Set second most significant bit */
178
179 err = smp_ah(tfm, irk, &rpa->b[3], rpa->b);
180 if (err < 0)
181 return err;
182
183 BT_DBG("RPA %pMR", rpa);
184
185 return 0;
186}
187
ec70f36f
JH		 188static int smp_c1(struct smp_chan *smp, u8 k[16], u8 r[16], u8 preq[7],
189 u8 pres[7], u8 _iat, bdaddr_t *ia, u8 _rat, bdaddr_t *ra,
190 u8 res[16])
d22ef0bc 191{
ec70f36f 192 struct hci_dev *hdev = smp->conn->hcon->hdev;
d22ef0bc
AB		 193 u8 p1[16], p2[16];
194 int err;
195
ec70f36f
JH		 196 BT_DBG("%s", hdev->name);
197
d22ef0bc
AB		 198 memset(p1, 0, 16);
199
200 /* p1 = pres || preq || _rat || _iat */
943a732a
JH		 201 p1[0] = _iat;
202 p1[1] = _rat;
203 memcpy(p1 + 2, preq, 7);
204 memcpy(p1 + 9, pres, 7);
d22ef0bc
AB		 205
206 /* p2 = padding || ia || ra */
943a732a
JH		 207 memcpy(p2, ra, 6);
208 memcpy(p2 + 6, ia, 6);
209 memset(p2 + 12, 0, 4);
d22ef0bc
AB		 210
211 /* res = r XOR p1 */
212 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
213
214 /* res = e(k, res) */
ec70f36f 215 err = smp_e(smp->tfm_aes, k, res);
d22ef0bc
AB		 216 if (err) {
217 BT_ERR("Encrypt data error");
218 return err;
219 }
220
221 /* res = res XOR p2 */
222 u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
223
224 /* res = e(k, res) */
ec70f36f 225 err = smp_e(smp->tfm_aes, k, res);
d22ef0bc
AB		 226 if (err)
227 BT_ERR("Encrypt data error");
228
229 return err;
230}
231
ec70f36f
JH		 232static int smp_s1(struct smp_chan *smp, u8 k[16], u8 r1[16], u8 r2[16],
233 u8 _r[16])
d22ef0bc 234{
ec70f36f 235 struct hci_dev *hdev = smp->conn->hcon->hdev;
d22ef0bc
AB		 236 int err;
237
ec70f36f
JH		 238 BT_DBG("%s", hdev->name);
239
d22ef0bc 240 /* Just least significant octets from r1 and r2 are considered */
943a732a
JH		 241 memcpy(_r, r2, 8);
242 memcpy(_r + 8, r1, 8);
d22ef0bc 243
ec70f36f 244 err = smp_e(smp->tfm_aes, k, _r);
d22ef0bc
AB		 245 if (err)
246 BT_ERR("Encrypt data error");
247
248 return err;
249}
250
5d88cc73 251static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
eb492e01 252{
5d88cc73
JH		 253 struct l2cap_chan *chan = conn->smp;
254 struct kvec iv[2];
255 struct msghdr msg;
eb492e01 256
5d88cc73
JH		 257 if (!chan)
258 return;
eb492e01 259
5d88cc73 260 BT_DBG("code 0x%2.2x", code);
eb492e01 261
5d88cc73
JH		 262 iv[0].iov_base = &code;
263 iv[0].iov_len = 1;
eb492e01 264
5d88cc73
JH		 265 iv[1].iov_base = data;
266 iv[1].iov_len = len;
eb492e01 267
5d88cc73 268 memset(&msg, 0, sizeof(msg));
eb492e01 269
5d88cc73
JH		 270 msg.msg_iov = (struct iovec *) &iv;
271 msg.msg_iovlen = 2;
eb492e01 272
5d88cc73 273 l2cap_chan_send(chan, &msg, 1 + len);
e2dcd113 274
6c9d42a1 275 cancel_delayed_work_sync(&conn->security_timer);
17b02e62 276 schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
eb492e01
AB		 277}
278
2b64d153
BG		 279static __u8 authreq_to_seclevel(__u8 authreq)
280{
281 if (authreq & SMP_AUTH_MITM)
282 return BT_SECURITY_HIGH;
283 else
284 return BT_SECURITY_MEDIUM;
285}
286
287static __u8 seclevel_to_authreq(__u8 sec_level)
288{
289 switch (sec_level) {
290 case BT_SECURITY_HIGH:
291 return SMP_AUTH_MITM | SMP_AUTH_BONDING;
292 case BT_SECURITY_MEDIUM:
293 return SMP_AUTH_BONDING;
294 default:
295 return SMP_AUTH_NONE;
296 }
297}
298
b8e66eac 299static void build_pairing_cmd(struct l2cap_conn *conn,
f1560463
MH		 300 struct smp_cmd_pairing *req,
301 struct smp_cmd_pairing *rsp, __u8 authreq)
b8e66eac 302{
5d88cc73
JH		 303 struct l2cap_chan *chan = conn->smp;
304 struct smp_chan *smp = chan->data;
fd349c02
JH		 305 struct hci_conn *hcon = conn->hcon;
306 struct hci_dev *hdev = hcon->hdev;
307 u8 local_dist = 0, remote_dist = 0;
54790f73 308
b6ae8457 309 if (test_bit(HCI_BONDABLE, &conn->hcon->hdev->dev_flags)) {
7ee4ea36
MH		 310 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
311 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
54790f73 312 authreq |= SMP_AUTH_BONDING;
2b64d153
BG		 313 } else {
314 authreq &= ~SMP_AUTH_BONDING;
54790f73
VCG		 315 }
316
fd349c02
JH		 317 if (test_bit(HCI_RPA_RESOLVING, &hdev->dev_flags))
318 remote_dist |= SMP_DIST_ID_KEY;
319
863efaf2
JH		 320 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
321 local_dist |= SMP_DIST_ID_KEY;
322
54790f73
VCG		 323 if (rsp == NULL) {
324 req->io_capability = conn->hcon->io_capability;
325 req->oob_flag = SMP_OOB_NOT_PRESENT;
326 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 327 req->init_key_dist = local_dist;
328 req->resp_key_dist = remote_dist;
065a13e2 329 req->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 330
331 smp->remote_key_dist = remote_dist;
54790f73
VCG		 332 return;
333 }
334
335 rsp->io_capability = conn->hcon->io_capability;
336 rsp->oob_flag = SMP_OOB_NOT_PRESENT;
337 rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
fd349c02
JH		 338 rsp->init_key_dist = req->init_key_dist & remote_dist;
339 rsp->resp_key_dist = req->resp_key_dist & local_dist;
065a13e2 340 rsp->auth_req = (authreq & AUTH_REQ_MASK);
fd349c02
JH		 341
342 smp->remote_key_dist = rsp->init_key_dist;
b8e66eac
VCG		 343}
344
3158c50c
VCG		 345static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
346{
5d88cc73
JH		 347 struct l2cap_chan *chan = conn->smp;
348 struct smp_chan *smp = chan->data;
1c1def09 349
3158c50c 350 if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
f1560463 351 (max_key_size < SMP_MIN_ENC_KEY_SIZE))
3158c50c
VCG		 352 return SMP_ENC_KEY_SIZE;
353
f7aa611a 354 smp->enc_key_size = max_key_size;
3158c50c
VCG		 355
356 return 0;
357}
358
84794e11 359static void smp_failure(struct l2cap_conn *conn, u8 reason)
4f957a76 360{
bab73cb6
JH		 361 struct hci_conn *hcon = conn->hcon;
362
84794e11 363 if (reason)
4f957a76 364 smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
f1560463 365 &reason);
4f957a76 366
ce39fb4e
MH		 367 clear_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags);
368 mgmt_auth_failed(hcon->hdev, &hcon->dst, hcon->type, hcon->dst_type,
369 HCI_ERROR_AUTH_FAILURE);
f1c09c07 370
61a0cfb0
AG		 371 cancel_delayed_work_sync(&conn->security_timer);
372
ce39fb4e 373 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
f1c09c07 374 smp_chan_destroy(conn);
4f957a76
BG		 375}
376
2b64d153
BG		 377#define JUST_WORKS 0x00
378#define JUST_CFM 0x01
379#define REQ_PASSKEY 0x02
380#define CFM_PASSKEY 0x03
381#define REQ_OOB 0x04
382#define OVERLAP 0xFF
383
384static const u8 gen_method[5][5] = {
385 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
386 { JUST_WORKS, JUST_CFM, REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
387 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
388 { JUST_WORKS, JUST_CFM, JUST_WORKS, JUST_WORKS, JUST_CFM },
389 { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP },
390};
391
581370cc
JH		 392static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io)
393{
2bcd4003
JH		 394 /* If either side has unknown io_caps, use JUST_CFM (which gets
395 * converted later to JUST_WORKS if we're initiators.
396 */
581370cc
JH		 397 if (local_io > SMP_IO_KEYBOARD_DISPLAY ||
398 remote_io > SMP_IO_KEYBOARD_DISPLAY)
2bcd4003 399 return JUST_CFM;
581370cc
JH		 400
401 return gen_method[remote_io][local_io];
402}
403
2b64d153
BG		 404static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
405 u8 local_io, u8 remote_io)
406{
407 struct hci_conn *hcon = conn->hcon;
5d88cc73
JH		 408 struct l2cap_chan *chan = conn->smp;
409 struct smp_chan *smp = chan->data;
2b64d153
BG		 410 u8 method;
411 u32 passkey = 0;
412 int ret = 0;
413
414 /* Initialize key for JUST WORKS */
415 memset(smp->tk, 0, sizeof(smp->tk));
4a74d658 416 clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 417
418 BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
419
2bcd4003
JH		 420 /* If neither side wants MITM, either "just" confirm an incoming
421 * request or use just-works for outgoing ones. The JUST_CFM
422 * will be converted to JUST_WORKS if necessary later in this
423 * function. If either side has MITM look up the method from the
424 * table.
425 */
581370cc 426 if (!(auth & SMP_AUTH_MITM))
2bcd4003 427 method = JUST_CFM;
2b64d153 428 else
581370cc 429 method = get_auth_method(smp, local_io, remote_io);
2b64d153 430
a82505c7 431 /* Don't confirm locally initiated pairing attempts */
4a74d658 432 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
a82505c7
JH		 433 method = JUST_WORKS;
434
02f3e254
JH		 435 /* Don't bother user space with no IO capabilities */
436 if (method == JUST_CFM && hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
437 method = JUST_WORKS;
438
2b64d153
BG		 439 /* If Just Works, Continue with Zero TK */
440 if (method == JUST_WORKS) {
4a74d658 441 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 442 return 0;
443 }
444
445 /* Not Just Works/Confirm results in MITM Authentication */
446 if (method != JUST_CFM)
4a74d658 447 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
2b64d153
BG		 448
449 /* If both devices have Keyoard-Display I/O, the master
450 * Confirms and the slave Enters the passkey.
451 */
452 if (method == OVERLAP) {
40bef302 453 if (hcon->role == HCI_ROLE_MASTER)
2b64d153
BG		 454 method = CFM_PASSKEY;
455 else
456 method = REQ_PASSKEY;
457 }
458
01ad34d2 459 /* Generate random passkey. */
2b64d153 460 if (method == CFM_PASSKEY) {
943a732a 461 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153
BG		 462 get_random_bytes(&passkey, sizeof(passkey));
463 passkey %= 1000000;
943a732a 464 put_unaligned_le32(passkey, smp->tk);
2b64d153 465 BT_DBG("PassKey: %d", passkey);
4a74d658 466 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 467 }
468
469 hci_dev_lock(hcon->hdev);
470
471 if (method == REQ_PASSKEY)
ce39fb4e 472 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
272d90df 473 hcon->type, hcon->dst_type);
4eb65e66
JH		 474 else if (method == JUST_CFM)
475 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
476 hcon->type, hcon->dst_type,
477 passkey, 1);
2b64d153 478 else
01ad34d2 479 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
272d90df 480 hcon->type, hcon->dst_type,
39adbffe 481 passkey, 0);
2b64d153
BG		 482
483 hci_dev_unlock(hcon->hdev);
484
485 return ret;
486}
487
1cc61144 488static u8 smp_confirm(struct smp_chan *smp)
8aab4757 489{
8aab4757 490 struct l2cap_conn *conn = smp->conn;
8aab4757
VCG		 491 struct smp_cmd_pairing_confirm cp;
492 int ret;
8aab4757
VCG		 493
494 BT_DBG("conn %p", conn);
495
ec70f36f 496 ret = smp_c1(smp, smp->tk, smp->prnd, smp->preq, smp->prsp,
b1cd5fd9 497 conn->hcon->init_addr_type, &conn->hcon->init_addr,
943a732a
JH		 498 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
499 cp.confirm_val);
1cc61144
JH		 500 if (ret)
501 return SMP_UNSPECIFIED;
8aab4757 502
4a74d658 503 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153 504
8aab4757
VCG		 505 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
506
1cc61144 507 return 0;
8aab4757
VCG		 508}
509
861580a9 510static u8 smp_random(struct smp_chan *smp)
8aab4757 511{
8aab4757
VCG		 512 struct l2cap_conn *conn = smp->conn;
513 struct hci_conn *hcon = conn->hcon;
861580a9 514 u8 confirm[16];
8aab4757
VCG		 515 int ret;
516
ec70f36f 517 if (IS_ERR_OR_NULL(smp->tfm_aes))
861580a9 518 return SMP_UNSPECIFIED;
8aab4757
VCG		 519
520 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
521
ec70f36f 522 ret = smp_c1(smp, smp->tk, smp->rrnd, smp->preq, smp->prsp,
b1cd5fd9 523 hcon->init_addr_type, &hcon->init_addr,
943a732a 524 hcon->resp_addr_type, &hcon->resp_addr, confirm);
861580a9
JH		 525 if (ret)
526 return SMP_UNSPECIFIED;
8aab4757 527
8aab4757
VCG		 528 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
529 BT_ERR("Pairing failed (confirmation values mismatch)");
861580a9 530 return SMP_CONFIRM_FAILED;
8aab4757
VCG		 531 }
532
533 if (hcon->out) {
fe39c7b2
MH		 534 u8 stk[16];
535 __le64 rand = 0;
536 __le16 ediv = 0;
8aab4757 537
ec70f36f 538 smp_s1(smp, smp->tk, smp->rrnd, smp->prnd, stk);
8aab4757 539
f7aa611a 540 memset(stk + smp->enc_key_size, 0,
04124681 541 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 542
861580a9
JH		 543 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
544 return SMP_UNSPECIFIED;
8aab4757
VCG		 545
546 hci_le_start_enc(hcon, ediv, rand, stk);
f7aa611a 547 hcon->enc_key_size = smp->enc_key_size;
fe59a05f 548 set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
8aab4757 549 } else {
fff3490f 550 u8 stk[16], auth;
fe39c7b2
MH		 551 __le64 rand = 0;
552 __le16 ediv = 0;
8aab4757 553
943a732a
JH		 554 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
555 smp->prnd);
8aab4757 556
ec70f36f 557 smp_s1(smp, smp->tk, smp->prnd, smp->rrnd, stk);
8aab4757 558
f7aa611a 559 memset(stk + smp->enc_key_size, 0,
f1560463 560 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
8aab4757 561
fff3490f
JH		 562 if (hcon->pending_sec_level == BT_SECURITY_HIGH)
563 auth = 1;
564 else
565 auth = 0;
566
7d5843b7
JH		 567 /* Even though there's no _SLAVE suffix this is the
568 * slave STK we're adding for later lookup (the master
569 * STK never needs to be stored).
570 */
ce39fb4e 571 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
2ceba539 572 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand);
8aab4757
VCG		 573 }
574
861580a9 575 return 0;
8aab4757
VCG		 576}
577
578static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
579{
5d88cc73 580 struct l2cap_chan *chan = conn->smp;
8aab4757
VCG		 581 struct smp_chan *smp;
582
f1560463 583 smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
616d55be
JH		 584 if (!smp) {
585 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
8aab4757 586 return NULL;
616d55be 587 }
8aab4757 588
6a7bd103
JH		 589 smp->tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
590 if (IS_ERR(smp->tfm_aes)) {
591 BT_ERR("Unable to create ECB crypto context");
592 kfree(smp);
616d55be 593 clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
6a7bd103
JH		 594 return NULL;
595 }
596
8aab4757 597 smp->conn = conn;
5d88cc73 598 chan->data = smp;
8aab4757
VCG		 599
600 hci_conn_hold(conn->hcon);
601
602 return smp;
603}
604
605void smp_chan_destroy(struct l2cap_conn *conn)
606{
5d88cc73
JH		 607 struct l2cap_chan *chan = conn->smp;
608 struct smp_chan *smp = chan->data;
f4a407be 609 bool complete;
c8eb9690 610
f1c09c07 611 BUG_ON(!smp);
c8eb9690 612
4a74d658 613 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
f4a407be
JH		 614 mgmt_smp_complete(conn->hcon, complete);
615
7ee4ea36
MH		 616 kfree(smp->csrk);
617 kfree(smp->slave_csrk);
618
6a7bd103
JH		 619 crypto_free_blkcipher(smp->tfm_aes);
620
759331d7
JH		 621 /* If pairing failed clean up any keys we might have */
622 if (!complete) {
623 if (smp->ltk) {
624 list_del(&smp->ltk->list);
625 kfree(smp->ltk);
626 }
627
628 if (smp->slave_ltk) {
629 list_del(&smp->slave_ltk->list);
630 kfree(smp->slave_ltk);
631 }
632
633 if (smp->remote_irk) {
634 list_del(&smp->remote_irk->list);
635 kfree(smp->remote_irk);
636 }
637 }
638
5d88cc73 639 chan->data = NULL;
c8eb9690 640 kfree(smp);
76a68ba0 641 hci_conn_drop(conn->hcon);
8aab4757
VCG		 642}
643
2b64d153
BG		 644int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
645{
b10e8017 646 struct l2cap_conn *conn = hcon->l2cap_data;
5d88cc73 647 struct l2cap_chan *chan;
2b64d153
BG		 648 struct smp_chan *smp;
649 u32 value;
2b64d153
BG		 650
651 BT_DBG("");
652
642ac774 653 if (!conn || !test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
2b64d153
BG		 654 return -ENOTCONN;
655
5d88cc73
JH		 656 chan = conn->smp;
657 if (!chan)
658 return -ENOTCONN;
659
660 smp = chan->data;
2b64d153
BG		 661
662 switch (mgmt_op) {
663 case MGMT_OP_USER_PASSKEY_REPLY:
664 value = le32_to_cpu(passkey);
943a732a 665 memset(smp->tk, 0, sizeof(smp->tk));
2b64d153 666 BT_DBG("PassKey: %d", value);
943a732a 667 put_unaligned_le32(value, smp->tk);
2b64d153
BG		 668 /* Fall Through */
669 case MGMT_OP_USER_CONFIRM_REPLY:
4a74d658 670 set_bit(SMP_FLAG_TK_VALID, &smp->flags);
2b64d153
BG		 671 break;
672 case MGMT_OP_USER_PASSKEY_NEG_REPLY:
673 case MGMT_OP_USER_CONFIRM_NEG_REPLY:
84794e11 674 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 675 return 0;
676 default:
84794e11 677 smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
2b64d153
BG		 678 return -EOPNOTSUPP;
679 }
680
681 /* If it is our turn to send Pairing Confirm, do so now */
1cc61144
JH		 682 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
683 u8 rsp = smp_confirm(smp);
684 if (rsp)
685 smp_failure(conn, rsp);
686 }
2b64d153
BG		 687
688 return 0;
689}
690
da85e5e5 691static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 692{
3158c50c 693 struct smp_cmd_pairing rsp, *req = (void *) skb->data;
b3c6410b 694 struct hci_dev *hdev = conn->hcon->hdev;
8aab4757 695 struct smp_chan *smp;
c7262e71 696 u8 key_size, auth, sec_level;
8aab4757 697 int ret;
88ba43b6
AB		 698
699 BT_DBG("conn %p", conn);
700
c46b98be 701 if (skb->len < sizeof(*req))
38e4a915 702 return SMP_INVALID_PARAMS;
c46b98be 703
40bef302 704 if (conn->hcon->role != HCI_ROLE_SLAVE)
2b64d153
BG		 705 return SMP_CMD_NOTSUPP;
706
5d88cc73 707 if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
8aab4757 708 smp = smp_chan_create(conn);
5d88cc73
JH		 709 } else {
710 struct l2cap_chan *chan = conn->smp;
711 smp = chan->data;
712 }
8aab4757 713
d08fd0e7
AE		 714 if (!smp)
715 return SMP_UNSPECIFIED;
d26a2345 716
b6ae8457 717 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags) &&
b3c6410b
JH		 718 (req->auth_req & SMP_AUTH_BONDING))
719 return SMP_PAIRING_NOTSUPP;
720
1c1def09
VCG		 721 smp->preq[0] = SMP_CMD_PAIRING_REQ;
722 memcpy(&smp->preq[1], req, sizeof(*req));
3158c50c 723 skb_pull(skb, sizeof(*req));
88ba43b6 724
2b64d153 725 /* We didn't start the pairing, so match remote */
1ef35827 726 auth = req->auth_req;
da85e5e5 727
c7262e71
JH		 728 sec_level = authreq_to_seclevel(auth);
729 if (sec_level > conn->hcon->pending_sec_level)
730 conn->hcon->pending_sec_level = sec_level;
fdde0a26 731
2ed8f65c
JH		 732 /* If we need MITM check that it can be acheived */
733 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
734 u8 method;
735
736 method = get_auth_method(smp, conn->hcon->io_capability,
737 req->io_capability);
738 if (method == JUST_WORKS || method == JUST_CFM)
739 return SMP_AUTH_REQUIREMENTS;
740 }
741
2b64d153 742 build_pairing_cmd(conn, req, &rsp, auth);
3158c50c
VCG		 743
744 key_size = min(req->max_key_size, rsp.max_key_size);
745 if (check_enc_key_size(conn, key_size))
746 return SMP_ENC_KEY_SIZE;
88ba43b6 747
e84a6b13 748 get_random_bytes(smp->prnd, sizeof(smp->prnd));
8aab4757 749
1c1def09
VCG		 750 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
751 memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
f01ead31 752
3158c50c 753 smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
da85e5e5 754
2b64d153
BG		 755 /* Request setup of TK */
756 ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
757 if (ret)
758 return SMP_UNSPECIFIED;
759
da85e5e5 760 return 0;
88ba43b6
AB		 761}
762
da85e5e5 763static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 764{
3158c50c 765 struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
5d88cc73
JH		 766 struct l2cap_chan *chan = conn->smp;
767 struct smp_chan *smp = chan->data;
2b64d153 768 u8 key_size, auth = SMP_AUTH_NONE;
7d24ddcc 769 int ret;
88ba43b6
AB		 770
771 BT_DBG("conn %p", conn);
772
c46b98be 773 if (skb->len < sizeof(*rsp))
38e4a915 774 return SMP_INVALID_PARAMS;
c46b98be 775
40bef302 776 if (conn->hcon->role != HCI_ROLE_MASTER)
2b64d153
BG		 777 return SMP_CMD_NOTSUPP;
778
3158c50c
VCG		 779 skb_pull(skb, sizeof(*rsp));
780
1c1def09 781 req = (void *) &smp->preq[1];
da85e5e5 782
3158c50c
VCG		 783 key_size = min(req->max_key_size, rsp->max_key_size);
784 if (check_enc_key_size(conn, key_size))
785 return SMP_ENC_KEY_SIZE;
786
2ed8f65c
JH		 787 /* If we need MITM check that it can be acheived */
788 if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
789 u8 method;
790
791 method = get_auth_method(smp, req->io_capability,
792 rsp->io_capability);
793 if (method == JUST_WORKS || method == JUST_CFM)
794 return SMP_AUTH_REQUIREMENTS;
795 }
796
e84a6b13 797 get_random_bytes(smp->prnd, sizeof(smp->prnd));
7d24ddcc 798
8aab4757
VCG		 799 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
800 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
7d24ddcc 801
fdcc4bec
JH		 802 /* Update remote key distribution in case the remote cleared
803 * some bits that we had enabled in our request.
804 */
805 smp->remote_key_dist &= rsp->resp_key_dist;
806
2b64d153 807 if ((req->auth_req & SMP_AUTH_BONDING) &&
f1560463 808 (rsp->auth_req & SMP_AUTH_BONDING))
2b64d153
BG		 809 auth = SMP_AUTH_BONDING;
810
811 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
812
476585ec 813 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2b64d153
BG		 814 if (ret)
815 return SMP_UNSPECIFIED;
816
4a74d658 817 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2b64d153
BG		 818
819 /* Can't compose response until we have been confirmed */
4a74d658 820 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 821 return smp_confirm(smp);
da85e5e5
VCG		 822
823 return 0;
88ba43b6
AB		 824}
825
da85e5e5 826static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 827{
5d88cc73
JH		 828 struct l2cap_chan *chan = conn->smp;
829 struct smp_chan *smp = chan->data;
7d24ddcc 830
88ba43b6
AB		 831 BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
832
c46b98be 833 if (skb->len < sizeof(smp->pcnf))
38e4a915 834 return SMP_INVALID_PARAMS;
c46b98be 835
1c1def09
VCG		 836 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
837 skb_pull(skb, sizeof(smp->pcnf));
88ba43b6 838
943a732a
JH		 839 if (conn->hcon->out)
840 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
841 smp->prnd);
4a74d658 842 else if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
1cc61144 843 return smp_confirm(smp);
943a732a 844 else
4a74d658 845 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
da85e5e5
VCG		 846
847 return 0;
88ba43b6
AB		 848}
849
da85e5e5 850static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6 851{
5d88cc73
JH		 852 struct l2cap_chan *chan = conn->smp;
853 struct smp_chan *smp = chan->data;
7d24ddcc 854
8aab4757 855 BT_DBG("conn %p", conn);
3158c50c 856
c46b98be 857 if (skb->len < sizeof(smp->rrnd))
38e4a915 858 return SMP_INVALID_PARAMS;
c46b98be 859
943a732a 860 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
8aab4757 861 skb_pull(skb, sizeof(smp->rrnd));
e7e62c85 862
861580a9 863 return smp_random(smp);
88ba43b6
AB		 864}
865
f81cd823 866static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
988c5997 867{
c9839a11 868 struct smp_ltk *key;
988c5997
VCG		 869 struct hci_conn *hcon = conn->hcon;
870
98a0b845 871 key = hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 872 hcon->role);
988c5997 873 if (!key)
f81cd823 874 return false;
988c5997 875
4dab7864 876 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
f81cd823 877 return false;
4dab7864 878
51a8efd7 879 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
f81cd823 880 return true;
988c5997 881
c9839a11
VCG		 882 hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
883 hcon->enc_key_size = key->enc_size;
988c5997 884
fe59a05f
JH		 885 /* We never store STKs for master role, so clear this flag */
886 clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
887
f81cd823 888 return true;
988c5997 889}
f1560463 890
854f4727
JH		 891bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level)
892{
893 if (sec_level == BT_SECURITY_LOW)
894 return true;
895
9ab65d60
JH		 896 /* If we're encrypted with an STK always claim insufficient
897 * security. This way we allow the connection to be re-encrypted
898 * with an LTK, even if the LTK provides the same level of
b2d5e254
JH		 899 * security. Only exception is if we don't have an LTK (e.g.
900 * because of key distribution bits).
9ab65d60 901 */
b2d5e254
JH		 902 if (test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) &&
903 hci_find_ltk_by_addr(hcon->hdev, &hcon->dst, hcon->dst_type,
e804d25d 904 hcon->role))
9ab65d60
JH		 905 return false;
906
854f4727
JH		 907 if (hcon->sec_level >= sec_level)
908 return true;
909
910 return false;
911}
912
da85e5e5 913static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
88ba43b6
AB		 914{
915 struct smp_cmd_security_req *rp = (void *) skb->data;
916 struct smp_cmd_pairing cp;
f1cb9af5 917 struct hci_conn *hcon = conn->hcon;
8aab4757 918 struct smp_chan *smp;
c7262e71 919 u8 sec_level;
88ba43b6
AB		 920
921 BT_DBG("conn %p", conn);
922
c46b98be 923 if (skb->len < sizeof(*rp))
38e4a915 924 return SMP_INVALID_PARAMS;
c46b98be 925
40bef302 926 if (hcon->role != HCI_ROLE_MASTER)
86ca9eac
JH		 927 return SMP_CMD_NOTSUPP;
928
c7262e71 929 sec_level = authreq_to_seclevel(rp->auth_req);
854f4727
JH		 930 if (smp_sufficient_security(hcon, sec_level))
931 return 0;
932
c7262e71
JH		 933 if (sec_level > hcon->pending_sec_level)
934 hcon->pending_sec_level = sec_level;
feb45eb5 935
4dab7864 936 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
988c5997
VCG		 937 return 0;
938
51a8efd7 939 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
da85e5e5 940 return 0;
f1cb9af5 941
8aab4757 942 smp = smp_chan_create(conn);
c29d2444
JH		 943 if (!smp)
944 return SMP_UNSPECIFIED;
d26a2345 945
b6ae8457 946 if (!test_bit(HCI_BONDABLE, &hcon->hdev->dev_flags) &&
616d55be
JH		 947 (rp->auth_req & SMP_AUTH_BONDING))
948 return SMP_PAIRING_NOTSUPP;
949
88ba43b6 950 skb_pull(skb, sizeof(*rp));
88ba43b6 951
da85e5e5 952 memset(&cp, 0, sizeof(cp));
54790f73 953 build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
88ba43b6 954
1c1def09
VCG		 955 smp->preq[0] = SMP_CMD_PAIRING_REQ;
956 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 957
88ba43b6 958 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
f1cb9af5 959
da85e5e5 960 return 0;
88ba43b6
AB		 961}
962
cc110922 963int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
eb492e01 964{
cc110922 965 struct l2cap_conn *conn = hcon->l2cap_data;
0a66cf20 966 struct smp_chan *smp;
2b64d153 967 __u8 authreq;
eb492e01 968
3a0259bb
VCG		 969 BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
970
0a66cf20
JH		 971 /* This may be NULL if there's an unexpected disconnection */
972 if (!conn)
973 return 1;
974
757aee0f 975 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
2e65c9d2
AG		 976 return 1;
977
ad32a2f5 978 if (smp_sufficient_security(hcon, sec_level))
eb492e01 979 return 1;
f1cb9af5 980
c7262e71
JH		 981 if (sec_level > hcon->pending_sec_level)
982 hcon->pending_sec_level = sec_level;
983
40bef302 984 if (hcon->role == HCI_ROLE_MASTER)
c7262e71
JH		 985 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
986 return 0;
d26a2345 987
51a8efd7 988 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 989 return 0;
990
8aab4757 991 smp = smp_chan_create(conn);
2b64d153
BG		 992 if (!smp)
993 return 1;
994
995 authreq = seclevel_to_authreq(sec_level);
d26a2345 996
79897d20
JH		 997 /* Require MITM if IO Capability allows or the security level
998 * requires it.
2e233644 999 */
79897d20 1000 if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
c7262e71 1001 hcon->pending_sec_level > BT_SECURITY_MEDIUM)
2e233644
JH		 1002 authreq |= SMP_AUTH_MITM;
1003
40bef302 1004 if (hcon->role == HCI_ROLE_MASTER) {
d26a2345 1005 struct smp_cmd_pairing cp;
f01ead31 1006
2b64d153 1007 build_pairing_cmd(conn, &cp, NULL, authreq);
1c1def09
VCG		 1008 smp->preq[0] = SMP_CMD_PAIRING_REQ;
1009 memcpy(&smp->preq[1], &cp, sizeof(cp));
f01ead31 1010
eb492e01
AB		 1011 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
1012 } else {
1013 struct smp_cmd_security_req cp;
2b64d153 1014 cp.auth_req = authreq;
eb492e01
AB		 1015 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
1016 }
1017
4a74d658 1018 set_bit(SMP_FLAG_INITIATOR, &smp->flags);
edca792c 1019
eb492e01
AB		 1020 return 0;
1021}
1022
7034b911
VCG		 1023static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
1024{
16b90839 1025 struct smp_cmd_encrypt_info *rp = (void *) skb->data;
5d88cc73
JH		 1026 struct l2cap_chan *chan = conn->smp;
1027 struct smp_chan *smp = chan->data;
16b90839 1028
c46b98be
JH		 1029 BT_DBG("conn %p", conn);
1030
1031 if (skb->len < sizeof(*rp))
38e4a915 1032 return SMP_INVALID_PARAMS;
c46b98be 1033
6131ddc8
JH		 1034 /* Ignore this PDU if it wasn't requested */
1035 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
1036 return 0;
1037
16b90839
VCG		 1038 skb_pull(skb, sizeof(*rp));
1039
1c1def09 1040 memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
16b90839 1041
7034b911
VCG		 1042 return 0;
1043}
1044
1045static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
1046{
16b90839 1047 struct smp_cmd_master_ident *rp = (void *) skb->data;
5d88cc73
JH		 1048 struct l2cap_chan *chan = conn->smp;
1049 struct smp_chan *smp = chan->data;
c9839a11
VCG		 1050 struct hci_dev *hdev = conn->hcon->hdev;
1051 struct hci_conn *hcon = conn->hcon;
23d0e128 1052 struct smp_ltk *ltk;
c9839a11 1053 u8 authenticated;
16b90839 1054
c46b98be
JH		 1055 BT_DBG("conn %p", conn);
1056
1057 if (skb->len < sizeof(*rp))
38e4a915 1058 return SMP_INVALID_PARAMS;
c46b98be 1059
6131ddc8
JH		 1060 /* Ignore this PDU if it wasn't requested */
1061 if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
1062 return 0;
1063
9747a9f3
JH		 1064 /* Mark the information as received */
1065 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
1066
16b90839 1067 skb_pull(skb, sizeof(*rp));
7034b911 1068
c9839a11 1069 hci_dev_lock(hdev);
ce39fb4e 1070 authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
2ceba539 1071 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK,
23d0e128
JH		 1072 authenticated, smp->tk, smp->enc_key_size,
1073 rp->ediv, rp->rand);
1074 smp->ltk = ltk;
fd349c02 1075 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
4bd6d38e 1076 smp_distribute_keys(conn);
c9839a11 1077 hci_dev_unlock(hdev);
7034b911
VCG		 1078
1079 return 0;
1080}
1081
fd349c02
JH		 1082static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
1083{
1084 struct smp_cmd_ident_info *info = (void *) skb->data;
5d88cc73
JH		 1085 struct l2cap_chan *chan = conn->smp;
1086 struct smp_chan *smp = chan->data;
fd349c02
JH		 1087
1088 BT_DBG("");
1089
1090 if (skb->len < sizeof(*info))
38e4a915 1091 return SMP_INVALID_PARAMS;
fd349c02 1092
6131ddc8
JH		 1093 /* Ignore this PDU if it wasn't requested */
1094 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1095 return 0;
1096
fd349c02
JH		 1097 skb_pull(skb, sizeof(*info));
1098
1099 memcpy(smp->irk, info->irk, 16);
1100
1101 return 0;
1102}
1103
1104static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1105 struct sk_buff *skb)
1106{
1107 struct smp_cmd_ident_addr_info *info = (void *) skb->data;
5d88cc73
JH		 1108 struct l2cap_chan *chan = conn->smp;
1109 struct smp_chan *smp = chan->data;
fd349c02
JH		 1110 struct hci_conn *hcon = conn->hcon;
1111 bdaddr_t rpa;
1112
1113 BT_DBG("");
1114
1115 if (skb->len < sizeof(*info))
38e4a915 1116 return SMP_INVALID_PARAMS;
fd349c02 1117
6131ddc8
JH		 1118 /* Ignore this PDU if it wasn't requested */
1119 if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
1120 return 0;
1121
9747a9f3
JH		 1122 /* Mark the information as received */
1123 smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
1124
fd349c02
JH		 1125 skb_pull(skb, sizeof(*info));
1126
31dd624e
JH		 1127 hci_dev_lock(hcon->hdev);
1128
a9a58f86
JH		 1129 /* Strictly speaking the Core Specification (4.1) allows sending
1130 * an empty address which would force us to rely on just the IRK
1131 * as "identity information". However, since such
1132 * implementations are not known of and in order to not over
1133 * complicate our implementation, simply pretend that we never
1134 * received an IRK for such a device.
1135 */
1136 if (!bacmp(&info->bdaddr, BDADDR_ANY)) {
1137 BT_ERR("Ignoring IRK with no identity address");
31dd624e 1138 goto distribute;
a9a58f86
JH		 1139 }
1140
fd349c02
JH		 1141 bacpy(&smp->id_addr, &info->bdaddr);
1142 smp->id_addr_type = info->addr_type;
1143
1144 if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
1145 bacpy(&rpa, &hcon->dst);
1146 else
1147 bacpy(&rpa, BDADDR_ANY);
1148
23d0e128
JH		 1149 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
1150 smp->id_addr_type, smp->irk, &rpa);
fd349c02 1151
31dd624e 1152distribute:
4bd6d38e 1153 smp_distribute_keys(conn);
fd349c02 1154
31dd624e
JH		 1155 hci_dev_unlock(hcon->hdev);
1156
fd349c02
JH		 1157 return 0;
1158}
1159
7ee4ea36
MH		 1160static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
1161{
1162 struct smp_cmd_sign_info *rp = (void *) skb->data;
5d88cc73
JH		 1163 struct l2cap_chan *chan = conn->smp;
1164 struct smp_chan *smp = chan->data;
7ee4ea36
MH		 1165 struct hci_dev *hdev = conn->hcon->hdev;
1166 struct smp_csrk *csrk;
1167
1168 BT_DBG("conn %p", conn);
1169
1170 if (skb->len < sizeof(*rp))
38e4a915 1171 return SMP_INVALID_PARAMS;
7ee4ea36
MH		 1172
1173 /* Ignore this PDU if it wasn't requested */
1174 if (!(smp->remote_key_dist & SMP_DIST_SIGN))
1175 return 0;
1176
1177 /* Mark the information as received */
1178 smp->remote_key_dist &= ~SMP_DIST_SIGN;
1179
1180 skb_pull(skb, sizeof(*rp));
1181
1182 hci_dev_lock(hdev);
1183 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1184 if (csrk) {
1185 csrk->master = 0x01;
1186 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
1187 }
1188 smp->csrk = csrk;
5fcb9347 1189 smp_distribute_keys(conn);
7ee4ea36
MH		 1190 hci_dev_unlock(hdev);
1191
1192 return 0;
1193}
1194
5d88cc73 1195static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
eb492e01 1196{
5d88cc73 1197 struct l2cap_conn *conn = chan->conn;
7b9899db 1198 struct hci_conn *hcon = conn->hcon;
92381f5c 1199 __u8 code, reason;
eb492e01
AB		 1200 int err = 0;
1201
7b9899db
MH		 1202 if (hcon->type != LE_LINK) {
1203 kfree_skb(skb);
3432711f 1204 return 0;
7b9899db
MH		 1205 }
1206
92381f5c
MH		 1207 if (skb->len < 1) {
1208 kfree_skb(skb);
1209 return -EILSEQ;
1210 }
1211
06ae3314 1212 if (!test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags)) {
beb19e4c 1213 err = -EOPNOTSUPP;
2e65c9d2
AG		 1214 reason = SMP_PAIRING_NOTSUPP;
1215 goto done;
1216 }
1217
92381f5c 1218 code = skb->data[0];
eb492e01
AB		 1219 skb_pull(skb, sizeof(code));
1220
8cf9fa12
JH		 1221 /*
1222 * The SMP context must be initialized for all other PDUs except
1223 * pairing and security requests. If we get any other PDU when
1224 * not initialized simply disconnect (done if this function
1225 * returns an error).
1226 */
1227 if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
d3368605 1228 !test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
8cf9fa12
JH		 1229 BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
1230 kfree_skb(skb);
beb19e4c 1231 return -EOPNOTSUPP;
8cf9fa12
JH		 1232 }
1233
eb492e01
AB		 1234 switch (code) {
1235 case SMP_CMD_PAIRING_REQ:
da85e5e5 1236 reason = smp_cmd_pairing_req(conn, skb);
eb492e01
AB		 1237 break;
1238
1239 case SMP_CMD_PAIRING_FAIL:
84794e11 1240 smp_failure(conn, 0);
da85e5e5
VCG		 1241 reason = 0;
1242 err = -EPERM;
eb492e01
AB		 1243 break;
1244
1245 case SMP_CMD_PAIRING_RSP:
da85e5e5 1246 reason = smp_cmd_pairing_rsp(conn, skb);
88ba43b6
AB		 1247 break;
1248
1249 case SMP_CMD_SECURITY_REQ:
da85e5e5 1250 reason = smp_cmd_security_req(conn, skb);
88ba43b6
AB		 1251 break;
1252
eb492e01 1253 case SMP_CMD_PAIRING_CONFIRM:
da85e5e5 1254 reason = smp_cmd_pairing_confirm(conn, skb);
88ba43b6
AB		 1255 break;
1256
eb492e01 1257 case SMP_CMD_PAIRING_RANDOM:
da85e5e5 1258 reason = smp_cmd_pairing_random(conn, skb);
88ba43b6
AB		 1259 break;
1260
eb492e01 1261 case SMP_CMD_ENCRYPT_INFO:
7034b911
VCG		 1262 reason = smp_cmd_encrypt_info(conn, skb);
1263 break;
1264
eb492e01 1265 case SMP_CMD_MASTER_IDENT:
7034b911
VCG		 1266 reason = smp_cmd_master_ident(conn, skb);
1267 break;
1268
eb492e01 1269 case SMP_CMD_IDENT_INFO:
fd349c02
JH		 1270 reason = smp_cmd_ident_info(conn, skb);
1271 break;
1272
eb492e01 1273 case SMP_CMD_IDENT_ADDR_INFO:
fd349c02
JH		 1274 reason = smp_cmd_ident_addr_info(conn, skb);
1275 break;
1276
eb492e01 1277 case SMP_CMD_SIGN_INFO:
7ee4ea36 1278 reason = smp_cmd_sign_info(conn, skb);
7034b911
VCG		 1279 break;
1280
eb492e01
AB		 1281 default:
1282 BT_DBG("Unknown command code 0x%2.2x", code);
1283
1284 reason = SMP_CMD_NOTSUPP;
eb492e01 1285 err = -EOPNOTSUPP;
3a0259bb 1286 goto done;
eb492e01
AB		 1287 }
1288
3a0259bb
VCG		 1289done:
1290 if (reason)
84794e11 1291 smp_failure(conn, reason);
3a0259bb 1292
eb492e01
AB		 1293 kfree_skb(skb);
1294 return err;
1295}
7034b911 1296
35d70271
JH		 1297static void smp_notify_keys(struct l2cap_conn *conn)
1298{
5d88cc73
JH		 1299 struct l2cap_chan *chan = conn->smp;
1300 struct smp_chan *smp = chan->data;
35d70271
JH		 1301 struct hci_conn *hcon = conn->hcon;
1302 struct hci_dev *hdev = hcon->hdev;
53ac6ab6
MH		 1303 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
1304 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
1305 bool persistent;
35d70271 1306
61b1a7fb 1307 if (smp->remote_irk) {
95fbac8a 1308 mgmt_new_irk(hdev, smp->remote_irk);
61b1a7fb
JH		 1309 /* Now that user space can be considered to know the
1310 * identity address track the connection based on it
1311 * from now on.
1312 */
1313 bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
1314 hcon->dst_type = smp->remote_irk->addr_type;
1315 l2cap_conn_update_id_addr(hcon);
66d8e837
MH		 1316
1317 /* When receiving an indentity resolving key for
1318 * a remote device that does not use a resolvable
1319 * private address, just remove the key so that
1320 * it is possible to use the controller white
1321 * list for scanning.
1322 *
1323 * Userspace will have been told to not store
1324 * this key at this point. So it is safe to
1325 * just remove it.
1326 */
1327 if (!bacmp(&smp->remote_irk->rpa, BDADDR_ANY)) {
1328 list_del(&smp->remote_irk->list);
1329 kfree(smp->remote_irk);
1330 smp->remote_irk = NULL;
1331 }
61b1a7fb 1332 }
95fbac8a 1333
53ac6ab6
MH		 1334 /* The LTKs and CSRKs should be persistent only if both sides
1335 * had the bonding bit set in their authentication requests.
1336 */
1337 persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
1338
7ee4ea36
MH		 1339 if (smp->csrk) {
1340 smp->csrk->bdaddr_type = hcon->dst_type;
1341 bacpy(&smp->csrk->bdaddr, &hcon->dst);
53ac6ab6 1342 mgmt_new_csrk(hdev, smp->csrk, persistent);
7ee4ea36
MH		 1343 }
1344
1345 if (smp->slave_csrk) {
1346 smp->slave_csrk->bdaddr_type = hcon->dst_type;
1347 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
53ac6ab6 1348 mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
7ee4ea36
MH		 1349 }
1350
35d70271
JH		 1351 if (smp->ltk) {
1352 smp->ltk->bdaddr_type = hcon->dst_type;
1353 bacpy(&smp->ltk->bdaddr, &hcon->dst);
53ac6ab6 1354 mgmt_new_ltk(hdev, smp->ltk, persistent);
35d70271
JH		 1355 }
1356
1357 if (smp->slave_ltk) {
1358 smp->slave_ltk->bdaddr_type = hcon->dst_type;
1359 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
53ac6ab6 1360 mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
35d70271
JH		 1361 }
1362}
1363
4bd6d38e 1364int smp_distribute_keys(struct l2cap_conn *conn)
7034b911
VCG		 1365{
1366 struct smp_cmd_pairing *req, *rsp;
5d88cc73
JH		 1367 struct l2cap_chan *chan = conn->smp;
1368 struct smp_chan *smp = chan->data;
524237cb
JH		 1369 struct hci_conn *hcon = conn->hcon;
1370 struct hci_dev *hdev = hcon->hdev;
7034b911
VCG		 1371 __u8 *keydist;
1372
4bd6d38e 1373 BT_DBG("conn %p", conn);
7034b911 1374
524237cb 1375 if (!test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
d26a2345
VCG		 1376 return 0;
1377
1c1def09 1378 rsp = (void *) &smp->prsp[1];
7034b911
VCG		 1379
1380 /* The responder sends its keys first */
efabba37 1381 if (hcon->out && (smp->remote_key_dist & 0x07))
7034b911
VCG		 1382 return 0;
1383
1c1def09 1384 req = (void *) &smp->preq[1];
7034b911 1385
524237cb 1386 if (hcon->out) {
7034b911
VCG		 1387 keydist = &rsp->init_key_dist;
1388 *keydist &= req->init_key_dist;
1389 } else {
1390 keydist = &rsp->resp_key_dist;
1391 *keydist &= req->resp_key_dist;
1392 }
1393
7034b911
VCG		 1394 BT_DBG("keydist 0x%x", *keydist);
1395
1396 if (*keydist & SMP_DIST_ENC_KEY) {
1397 struct smp_cmd_encrypt_info enc;
1398 struct smp_cmd_master_ident ident;
23d0e128 1399 struct smp_ltk *ltk;
c9839a11 1400 u8 authenticated;
7034b911 1401 __le16 ediv;
fe39c7b2 1402 __le64 rand;
7034b911
VCG		 1403
1404 get_random_bytes(enc.ltk, sizeof(enc.ltk));
1405 get_random_bytes(&ediv, sizeof(ediv));
fe39c7b2 1406 get_random_bytes(&rand, sizeof(rand));
7034b911
VCG		 1407
1408 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1409
c9839a11 1410 authenticated = hcon->sec_level == BT_SECURITY_HIGH;
524237cb 1411 ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
2ceba539 1412 SMP_LTK_SLAVE, authenticated, enc.ltk,
fe39c7b2 1413 smp->enc_key_size, ediv, rand);
23d0e128 1414 smp->slave_ltk = ltk;
16b90839 1415
58115373 1416 ident.ediv = ediv;
fe39c7b2 1417 ident.rand = rand;
7034b911
VCG		 1418
1419 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
1420
1421 *keydist &= ~SMP_DIST_ENC_KEY;
1422 }
1423
1424 if (*keydist & SMP_DIST_ID_KEY) {
1425 struct smp_cmd_ident_addr_info addrinfo;
1426 struct smp_cmd_ident_info idinfo;
1427
863efaf2 1428 memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
7034b911
VCG		 1429
1430 smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1431
82d4b359
JH		 1432 /* The hci_conn contains the local identity address
1433 * after the connection has been established.
1434 *
1435 * This is true even when the connection has been
1436 * established using a resolvable random address.
1437 */
524237cb 1438 bacpy(&addrinfo.bdaddr, &hcon->src);
82d4b359 1439 addrinfo.addr_type = hcon->src_type;
7034b911
VCG		 1440
1441 smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
f1560463 1442 &addrinfo);
7034b911
VCG		 1443
1444 *keydist &= ~SMP_DIST_ID_KEY;
1445 }
1446
1447 if (*keydist & SMP_DIST_SIGN) {
1448 struct smp_cmd_sign_info sign;
7ee4ea36 1449 struct smp_csrk *csrk;
7034b911 1450
7ee4ea36 1451 /* Generate a new random key */
7034b911
VCG		 1452 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1453
7ee4ea36
MH		 1454 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1455 if (csrk) {
1456 csrk->master = 0x00;
1457 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
1458 }
1459 smp->slave_csrk = csrk;
1460
7034b911
VCG		 1461 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1462
1463 *keydist &= ~SMP_DIST_SIGN;
1464 }
1465
efabba37
JH		 1466 /* If there are still keys to be received wait for them */
1467 if ((smp->remote_key_dist & 0x07))
1468 return 0;
1469
1d98bf4f
JH		 1470 clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
1471 cancel_delayed_work_sync(&conn->security_timer);
4a74d658 1472 set_bit(SMP_FLAG_COMPLETE, &smp->flags);
1d98bf4f 1473 smp_notify_keys(conn);
efabba37 1474
1d98bf4f 1475 smp_chan_destroy(conn);
d26a2345 1476
7034b911
VCG		 1477 return 0;
1478}
711eafe3 1479
70db83c4
JH		 1480static void smp_teardown_cb(struct l2cap_chan *chan, int err)
1481{
1482 struct l2cap_conn *conn = chan->conn;
1483
1484 BT_DBG("chan %p", chan);
1485
5d88cc73
JH		 1486 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
1487 cancel_delayed_work_sync(&conn->security_timer);
1488 smp_chan_destroy(conn);
1489 }
1490
70db83c4
JH		 1491 conn->smp = NULL;
1492 l2cap_chan_put(chan);
1493}
1494
1495static void smp_ready_cb(struct l2cap_chan *chan)
1496{
1497 struct l2cap_conn *conn = chan->conn;
1498
1499 BT_DBG("chan %p", chan);
1500
1501 conn->smp = chan;
1502 l2cap_chan_hold(chan);
1503}
1504
1505static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan,
1506 unsigned long hdr_len,
1507 unsigned long len, int nb)
1508{
1509 struct sk_buff *skb;
1510
1511 skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
1512 if (!skb)
1513 return ERR_PTR(-ENOMEM);
1514
1515 skb->priority = HCI_PRIO_MAX;
1516 bt_cb(skb)->chan = chan;
1517
1518 return skb;
1519}
1520
1521static const struct l2cap_ops smp_chan_ops = {
1522 .name = "Security Manager",
1523 .ready = smp_ready_cb,
5d88cc73 1524 .recv = smp_recv_cb,
70db83c4
JH		 1525 .alloc_skb = smp_alloc_skb_cb,
1526 .teardown = smp_teardown_cb,
1527
1528 .new_connection = l2cap_chan_no_new_connection,
70db83c4
JH		 1529 .state_change = l2cap_chan_no_state_change,
1530 .close = l2cap_chan_no_close,
1531 .defer = l2cap_chan_no_defer,
1532 .suspend = l2cap_chan_no_suspend,
1533 .resume = l2cap_chan_no_resume,
1534 .set_shutdown = l2cap_chan_no_set_shutdown,
1535 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1536 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1537};
1538
1539static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
1540{
1541 struct l2cap_chan *chan;
1542
1543 BT_DBG("pchan %p", pchan);
1544
1545 chan = l2cap_chan_create();
1546 if (!chan)
1547 return NULL;
1548
1549 chan->chan_type = pchan->chan_type;
1550 chan->ops = &smp_chan_ops;
1551 chan->scid = pchan->scid;
1552 chan->dcid = chan->scid;
1553 chan->imtu = pchan->imtu;
1554 chan->omtu = pchan->omtu;
1555 chan->mode = pchan->mode;
1556
1557 BT_DBG("created chan %p", chan);
1558
1559 return chan;
1560}
1561
1562static const struct l2cap_ops smp_root_chan_ops = {
1563 .name = "Security Manager Root",
1564 .new_connection = smp_new_conn_cb,
1565
1566 /* None of these are implemented for the root channel */
1567 .close = l2cap_chan_no_close,
1568 .alloc_skb = l2cap_chan_no_alloc_skb,
1569 .recv = l2cap_chan_no_recv,
1570 .state_change = l2cap_chan_no_state_change,
1571 .teardown = l2cap_chan_no_teardown,
1572 .ready = l2cap_chan_no_ready,
1573 .defer = l2cap_chan_no_defer,
1574 .suspend = l2cap_chan_no_suspend,
1575 .resume = l2cap_chan_no_resume,
1576 .set_shutdown = l2cap_chan_no_set_shutdown,
1577 .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
1578 .memcpy_fromiovec = l2cap_chan_no_memcpy_fromiovec,
1579};
1580
711eafe3
JH		 1581int smp_register(struct hci_dev *hdev)
1582{
70db83c4 1583 struct l2cap_chan *chan;
defce9e8 1584 struct crypto_blkcipher *tfm_aes;
70db83c4 1585
711eafe3
JH		 1586 BT_DBG("%s", hdev->name);
1587
defce9e8
JH		 1588 tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
1589 if (IS_ERR(tfm_aes)) {
1590 int err = PTR_ERR(tfm_aes);
711eafe3 1591 BT_ERR("Unable to create crypto context");
711eafe3
JH		 1592 return err;
1593 }
1594
70db83c4
JH		 1595 chan = l2cap_chan_create();
1596 if (!chan) {
defce9e8 1597 crypto_free_blkcipher(tfm_aes);
70db83c4
JH		 1598 return -ENOMEM;
1599 }
1600
defce9e8
JH		 1601 chan->data = tfm_aes;
1602
5d88cc73 1603 l2cap_add_scid(chan, L2CAP_CID_SMP);
70db83c4
JH		 1604
1605 l2cap_chan_set_defaults(chan);
1606
1607 bacpy(&chan->src, &hdev->bdaddr);
1608 chan->src_type = BDADDR_LE_PUBLIC;
1609 chan->state = BT_LISTEN;
1610 chan->mode = L2CAP_MODE_BASIC;
1611 chan->imtu = L2CAP_DEFAULT_MTU;
1612 chan->ops = &smp_root_chan_ops;
1613
1614 hdev->smp_data = chan;
1615
711eafe3
JH		 1616 return 0;
1617}
1618
1619void smp_unregister(struct hci_dev *hdev)
1620{
70db83c4 1621 struct l2cap_chan *chan = hdev->smp_data;
defce9e8 1622 struct crypto_blkcipher *tfm_aes;
70db83c4
JH		 1623
1624 if (!chan)
1625 return;
1626
1627 BT_DBG("%s chan %p", hdev->name, chan);
711eafe3 1628
defce9e8
JH		 1629 tfm_aes = chan->data;
1630 if (tfm_aes) {
1631 chan->data = NULL;
1632 crypto_free_blkcipher(tfm_aes);
711eafe3 1633 }
70db83c4
JH		 1634
1635 hdev->smp_data = NULL;
1636 l2cap_chan_put(chan);
711eafe3 1637}
Linux kernel - Deliverables
This page took 0.680385 seconds and 5 git commands to generate.