Lines Matching full:smp
36 #include "smp.h"
53 #define SMP_ALLOW_CMD(smp, code) set_bit(code, &smp->allow_cmd) argument
101 u8 preq[7]; /* SMP Pairing Request */
102 u8 prsp[7]; /* SMP Pairing Response */
103 u8 prnd[16]; /* SMP Pairing Random (local) */
104 u8 rrnd[16]; /* SMP Pairing Random (remote) */
105 u8 pcnf[16]; /* SMP Pairing Confirm */
106 u8 tk[16]; /* SMP Temporary Key */
134 /* These debug key values are defined in the SMP section of the core
165 /* The following functions map to the LE SC SMP crypto functions
237 * the SMP section of the Bluetooth core specification. In ASCII in smp_f5()
371 /* The following functions map to the legacy SMP crypto functions e, c1,
541 struct smp_dev *smp; in smp_generate_oob() local
547 smp = chan->data; in smp_generate_oob()
551 err = set_ecdh_privkey(smp->tfm_ecdh, debug_sk); in smp_generate_oob()
554 memcpy(smp->local_pk, debug_pk, 64); in smp_generate_oob()
555 smp->debug_key = true; in smp_generate_oob()
559 err = generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk); in smp_generate_oob()
566 if (crypto_memneq(smp->local_pk, debug_pk, 64)) in smp_generate_oob()
569 smp->debug_key = false; in smp_generate_oob()
572 SMP_DBG("OOB Public Key X: %32phN", smp->local_pk); in smp_generate_oob()
573 SMP_DBG("OOB Public Key Y: %32phN", smp->local_pk + 32); in smp_generate_oob()
575 get_random_bytes(smp->local_rand, 16); in smp_generate_oob()
577 err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->local_pk, in smp_generate_oob()
578 smp->local_rand, 0, hash); in smp_generate_oob()
582 memcpy(rand, smp->local_rand, 16); in smp_generate_oob()
584 smp->local_oob = true; in smp_generate_oob()
591 struct l2cap_chan *chan = conn->smp; in smp_send_cmd()
592 struct smp_chan *smp; in smp_send_cmd() local
616 smp = chan->data; in smp_send_cmd()
618 cancel_delayed_work_sync(&smp->security_timer); in smp_send_cmd()
619 schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT); in smp_send_cmd()
651 struct l2cap_chan *chan = conn->smp; in build_pairing_cmd()
652 struct smp_chan *smp = chan->data; in build_pairing_cmd() local
689 set_bit(SMP_FLAG_REMOTE_OOB, &smp->flags); in build_pairing_cmd()
691 memcpy(smp->rr, oob_data->rand256, 16); in build_pairing_cmd()
692 memcpy(smp->pcnf, oob_data->hash256, 16); in build_pairing_cmd()
693 SMP_DBG("OOB Remote Confirmation: %16phN", smp->pcnf); in build_pairing_cmd()
694 SMP_DBG("OOB Remote Random: %16phN", smp->rr); in build_pairing_cmd()
709 smp->remote_key_dist = remote_dist; in build_pairing_cmd()
720 smp->remote_key_dist = rsp->init_key_dist; in build_pairing_cmd()
725 struct l2cap_chan *chan = conn->smp; in check_enc_key_size()
727 struct smp_chan *smp = chan->data; in check_enc_key_size() local
737 smp->enc_key_size = max_key_size; in check_enc_key_size()
744 struct l2cap_chan *chan = conn->smp; in smp_chan_destroy()
745 struct smp_chan *smp = chan->data; in smp_chan_destroy() local
749 BUG_ON(!smp); in smp_chan_destroy()
751 cancel_delayed_work_sync(&smp->security_timer); in smp_chan_destroy()
753 complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags); in smp_chan_destroy()
756 kfree_sensitive(smp->csrk); in smp_chan_destroy()
757 kfree_sensitive(smp->responder_csrk); in smp_chan_destroy()
758 kfree_sensitive(smp->link_key); in smp_chan_destroy()
760 crypto_free_shash(smp->tfm_cmac); in smp_chan_destroy()
761 crypto_free_kpp(smp->tfm_ecdh); in smp_chan_destroy()
766 if (smp->ltk && smp->ltk->type == SMP_LTK_P256_DEBUG && in smp_chan_destroy()
768 list_del_rcu(&smp->ltk->list); in smp_chan_destroy()
769 kfree_rcu(smp->ltk, rcu); in smp_chan_destroy()
770 smp->ltk = NULL; in smp_chan_destroy()
775 if (smp->ltk) { in smp_chan_destroy()
776 list_del_rcu(&smp->ltk->list); in smp_chan_destroy()
777 kfree_rcu(smp->ltk, rcu); in smp_chan_destroy()
780 if (smp->responder_ltk) { in smp_chan_destroy()
781 list_del_rcu(&smp->responder_ltk->list); in smp_chan_destroy()
782 kfree_rcu(smp->responder_ltk, rcu); in smp_chan_destroy()
785 if (smp->remote_irk) { in smp_chan_destroy()
786 list_del_rcu(&smp->remote_irk->list); in smp_chan_destroy()
787 kfree_rcu(smp->remote_irk, rcu); in smp_chan_destroy()
792 kfree_sensitive(smp); in smp_chan_destroy()
799 struct l2cap_chan *chan = conn->smp; in smp_failure()
835 static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io) in get_auth_method() argument
844 if (test_bit(SMP_FLAG_SC, &smp->flags)) in get_auth_method()
854 struct l2cap_chan *chan = conn->smp; in tk_request()
855 struct smp_chan *smp = chan->data; in tk_request() local
860 memset(smp->tk, 0, sizeof(smp->tk)); in tk_request()
861 clear_bit(SMP_FLAG_TK_VALID, &smp->flags); in tk_request()
873 smp->method = JUST_CFM; in tk_request()
875 smp->method = get_auth_method(smp, local_io, remote_io); in tk_request()
878 if (smp->method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, in tk_request()
879 &smp->flags)) in tk_request()
880 smp->method = JUST_WORKS; in tk_request()
883 if (smp->method == JUST_CFM && in tk_request()
885 smp->method = JUST_WORKS; in tk_request()
889 if (smp->method == JUST_WORKS) { in tk_request()
896 set_bit(SMP_FLAG_WAIT_USER, &smp->flags); in tk_request()
903 if (test_bit(SMP_FLAG_SC, &smp->flags)) in tk_request()
907 if (smp->method != JUST_CFM) { in tk_request()
908 set_bit(SMP_FLAG_MITM_AUTH, &smp->flags); in tk_request()
916 if (smp->method == OVERLAP) { in tk_request()
918 smp->method = CFM_PASSKEY; in tk_request()
920 smp->method = REQ_PASSKEY; in tk_request()
924 if (smp->method == CFM_PASSKEY) { in tk_request()
925 memset(smp->tk, 0, sizeof(smp->tk)); in tk_request()
928 put_unaligned_le32(passkey, smp->tk); in tk_request()
930 set_bit(SMP_FLAG_TK_VALID, &smp->flags); in tk_request()
933 if (smp->method == REQ_PASSKEY) in tk_request()
936 else if (smp->method == JUST_CFM) in tk_request()
948 static u8 smp_confirm(struct smp_chan *smp) in smp_confirm() argument
950 struct l2cap_conn *conn = smp->conn; in smp_confirm()
956 ret = smp_c1(smp->tk, smp->prnd, smp->preq, smp->prsp, in smp_confirm()
963 clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags); in smp_confirm()
965 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp); in smp_confirm()
968 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); in smp_confirm()
970 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); in smp_confirm()
975 static u8 smp_random(struct smp_chan *smp) in smp_random() argument
977 struct l2cap_conn *conn = smp->conn; in smp_random()
985 ret = smp_c1(smp->tk, smp->rrnd, smp->preq, smp->prsp, in smp_random()
991 if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) { in smp_random()
1002 smp_s1(smp->tk, smp->rrnd, smp->prnd, stk); in smp_random()
1007 hci_le_start_enc(hcon, ediv, rand, stk, smp->enc_key_size); in smp_random()
1008 hcon->enc_key_size = smp->enc_key_size; in smp_random()
1015 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), in smp_random()
1016 smp->prnd); in smp_random()
1018 smp_s1(smp->tk, smp->prnd, smp->rrnd, stk); in smp_random()
1030 SMP_STK, auth, stk, smp->enc_key_size, ediv, rand); in smp_random()
1038 struct l2cap_chan *chan = conn->smp; in smp_notify_keys()
1039 struct smp_chan *smp = chan->data; in smp_notify_keys() local
1042 struct smp_cmd_pairing *req = (void *) &smp->preq[1]; in smp_notify_keys()
1043 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1]; in smp_notify_keys()
1061 if (smp->remote_irk) { in smp_notify_keys()
1062 smp->remote_irk->link_type = hcon->type; in smp_notify_keys()
1063 mgmt_new_irk(hdev, smp->remote_irk, persistent); in smp_notify_keys()
1070 bacpy(&hcon->dst, &smp->remote_irk->bdaddr); in smp_notify_keys()
1071 hcon->dst_type = smp->remote_irk->addr_type; in smp_notify_keys()
1081 if (smp->csrk) { in smp_notify_keys()
1082 smp->csrk->link_type = hcon->type; in smp_notify_keys()
1083 smp->csrk->bdaddr_type = hcon->dst_type; in smp_notify_keys()
1084 bacpy(&smp->csrk->bdaddr, &hcon->dst); in smp_notify_keys()
1085 mgmt_new_csrk(hdev, smp->csrk, persistent); in smp_notify_keys()
1088 if (smp->responder_csrk) { in smp_notify_keys()
1089 smp->responder_csrk->link_type = hcon->type; in smp_notify_keys()
1090 smp->responder_csrk->bdaddr_type = hcon->dst_type; in smp_notify_keys()
1091 bacpy(&smp->responder_csrk->bdaddr, &hcon->dst); in smp_notify_keys()
1092 mgmt_new_csrk(hdev, smp->responder_csrk, persistent); in smp_notify_keys()
1095 if (smp->ltk) { in smp_notify_keys()
1096 smp->ltk->link_type = hcon->type; in smp_notify_keys()
1097 smp->ltk->bdaddr_type = hcon->dst_type; in smp_notify_keys()
1098 bacpy(&smp->ltk->bdaddr, &hcon->dst); in smp_notify_keys()
1099 mgmt_new_ltk(hdev, smp->ltk, persistent); in smp_notify_keys()
1102 if (smp->responder_ltk) { in smp_notify_keys()
1103 smp->responder_ltk->link_type = hcon->type; in smp_notify_keys()
1104 smp->responder_ltk->bdaddr_type = hcon->dst_type; in smp_notify_keys()
1105 bacpy(&smp->responder_ltk->bdaddr, &hcon->dst); in smp_notify_keys()
1106 mgmt_new_ltk(hdev, smp->responder_ltk, persistent); in smp_notify_keys()
1109 if (smp->link_key) { in smp_notify_keys()
1113 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags)) in smp_notify_keys()
1120 key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst, in smp_notify_keys()
1121 smp->link_key, type, 0, &persistent); in smp_notify_keys()
1139 static void sc_add_ltk(struct smp_chan *smp) in sc_add_ltk() argument
1141 struct hci_conn *hcon = smp->conn->hcon; in sc_add_ltk()
1144 if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags)) in sc_add_ltk()
1154 smp->ltk = hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, in sc_add_ltk()
1155 key_type, auth, smp->tk, smp->enc_key_size, in sc_add_ltk()
1159 static void sc_generate_link_key(struct smp_chan *smp) in sc_generate_link_key() argument
1164 smp->link_key = kzalloc(16, GFP_KERNEL); in sc_generate_link_key()
1165 if (!smp->link_key) in sc_generate_link_key()
1168 if (test_bit(SMP_FLAG_CT2, &smp->flags)) { in sc_generate_link_key()
1172 if (smp_h7(smp->tfm_cmac, smp->tk, salt, smp->link_key)) { in sc_generate_link_key()
1173 kfree_sensitive(smp->link_key); in sc_generate_link_key()
1174 smp->link_key = NULL; in sc_generate_link_key()
1181 if (smp_h6(smp->tfm_cmac, smp->tk, tmp1, smp->link_key)) { in sc_generate_link_key()
1182 kfree_sensitive(smp->link_key); in sc_generate_link_key()
1183 smp->link_key = NULL; in sc_generate_link_key()
1188 if (smp_h6(smp->tfm_cmac, smp->link_key, lebr, smp->link_key)) { in sc_generate_link_key()
1189 kfree_sensitive(smp->link_key); in sc_generate_link_key()
1190 smp->link_key = NULL; in sc_generate_link_key()
1195 static void smp_allow_key_dist(struct smp_chan *smp) in smp_allow_key_dist() argument
1201 if (smp->remote_key_dist & SMP_DIST_ENC_KEY) in smp_allow_key_dist()
1202 SMP_ALLOW_CMD(smp, SMP_CMD_ENCRYPT_INFO); in smp_allow_key_dist()
1203 else if (smp->remote_key_dist & SMP_DIST_ID_KEY) in smp_allow_key_dist()
1204 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO); in smp_allow_key_dist()
1205 else if (smp->remote_key_dist & SMP_DIST_SIGN) in smp_allow_key_dist()
1206 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO); in smp_allow_key_dist()
1209 static void sc_generate_ltk(struct smp_chan *smp) in sc_generate_ltk() argument
1213 struct hci_conn *hcon = smp->conn->hcon; in sc_generate_ltk()
1224 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); in sc_generate_ltk()
1226 if (test_bit(SMP_FLAG_CT2, &smp->flags)) { in sc_generate_ltk()
1230 if (smp_h7(smp->tfm_cmac, key->val, salt, smp->tk)) in sc_generate_ltk()
1236 if (smp_h6(smp->tfm_cmac, key->val, tmp2, smp->tk)) in sc_generate_ltk()
1240 if (smp_h6(smp->tfm_cmac, smp->tk, brle, smp->tk)) in sc_generate_ltk()
1243 sc_add_ltk(smp); in sc_generate_ltk()
1246 static void smp_distribute_keys(struct smp_chan *smp) in smp_distribute_keys() argument
1249 struct l2cap_conn *conn = smp->conn; in smp_distribute_keys()
1256 rsp = (void *) &smp->prsp[1]; in smp_distribute_keys()
1259 if (hcon->out && (smp->remote_key_dist & KEY_DIST_MASK)) { in smp_distribute_keys()
1260 smp_allow_key_dist(smp); in smp_distribute_keys()
1264 req = (void *) &smp->preq[1]; in smp_distribute_keys()
1274 if (test_bit(SMP_FLAG_SC, &smp->flags)) { in smp_distribute_keys()
1276 sc_generate_link_key(smp); in smp_distribute_keys()
1278 sc_generate_ltk(smp); in smp_distribute_keys()
1298 get_random_bytes(enc.ltk, smp->enc_key_size); in smp_distribute_keys()
1299 memset(enc.ltk + smp->enc_key_size, 0, in smp_distribute_keys()
1300 sizeof(enc.ltk) - smp->enc_key_size); in smp_distribute_keys()
1310 smp->enc_key_size, ediv, rand); in smp_distribute_keys()
1311 smp->responder_ltk = ltk; in smp_distribute_keys()
1360 smp->responder_csrk = csrk; in smp_distribute_keys()
1368 if (smp->remote_key_dist & KEY_DIST_MASK) { in smp_distribute_keys()
1369 smp_allow_key_dist(smp); in smp_distribute_keys()
1373 set_bit(SMP_FLAG_COMPLETE, &smp->flags); in smp_distribute_keys()
1381 struct smp_chan *smp = container_of(work, struct smp_chan, in smp_timeout() local
1383 struct l2cap_conn *conn = smp->conn; in smp_timeout()
1393 struct l2cap_chan *chan = conn->smp; in smp_chan_create()
1394 struct smp_chan *smp; in smp_chan_create() local
1396 smp = kzalloc(sizeof(*smp), GFP_ATOMIC); in smp_chan_create()
1397 if (!smp) in smp_chan_create()
1400 smp->tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0); in smp_chan_create()
1401 if (IS_ERR(smp->tfm_cmac)) { in smp_chan_create()
1406 smp->tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0); in smp_chan_create()
1407 if (IS_ERR(smp->tfm_ecdh)) { in smp_chan_create()
1412 smp->conn = conn; in smp_chan_create()
1413 chan->data = smp; in smp_chan_create()
1415 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_FAIL); in smp_chan_create()
1417 INIT_DELAYED_WORK(&smp->security_timer, smp_timeout); in smp_chan_create()
1421 return smp; in smp_chan_create()
1424 crypto_free_shash(smp->tfm_cmac); in smp_chan_create()
1426 kfree_sensitive(smp); in smp_chan_create()
1430 static int sc_mackey_and_ltk(struct smp_chan *smp, u8 mackey[16], u8 ltk[16]) in sc_mackey_and_ltk() argument
1432 struct hci_conn *hcon = smp->conn->hcon; in sc_mackey_and_ltk()
1436 na = smp->prnd; in sc_mackey_and_ltk()
1437 nb = smp->rrnd; in sc_mackey_and_ltk()
1439 na = smp->rrnd; in sc_mackey_and_ltk()
1440 nb = smp->prnd; in sc_mackey_and_ltk()
1448 return smp_f5(smp->tfm_cmac, smp->dhkey, na, nb, a, b, mackey, ltk); in sc_mackey_and_ltk()
1451 static void sc_dhkey_check(struct smp_chan *smp) in sc_dhkey_check() argument
1453 struct hci_conn *hcon = smp->conn->hcon; in sc_dhkey_check()
1466 memcpy(io_cap, &smp->preq[1], 3); in sc_dhkey_check()
1470 memcpy(io_cap, &smp->prsp[1], 3); in sc_dhkey_check()
1475 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) in sc_dhkey_check()
1478 if (smp->method == REQ_OOB) in sc_dhkey_check()
1479 memcpy(r, smp->rr, 16); in sc_dhkey_check()
1481 smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap, in sc_dhkey_check()
1484 smp_send_cmd(smp->conn, SMP_CMD_DHKEY_CHECK, sizeof(check), &check); in sc_dhkey_check()
1487 static u8 sc_passkey_send_confirm(struct smp_chan *smp) in sc_passkey_send_confirm() argument
1489 struct l2cap_conn *conn = smp->conn; in sc_passkey_send_confirm()
1494 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01); in sc_passkey_send_confirm()
1497 get_random_bytes(smp->prnd, sizeof(smp->prnd)); in sc_passkey_send_confirm()
1499 if (smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd, r, in sc_passkey_send_confirm()
1508 static u8 sc_passkey_round(struct smp_chan *smp, u8 smp_op) in sc_passkey_round() argument
1510 struct l2cap_conn *conn = smp->conn; in sc_passkey_round()
1516 if (smp->passkey_round >= 20) in sc_passkey_round()
1521 r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01); in sc_passkey_round()
1524 if (smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk, in sc_passkey_round()
1525 smp->rrnd, r, cfm)) in sc_passkey_round()
1528 if (crypto_memneq(smp->pcnf, cfm, 16)) in sc_passkey_round()
1531 smp->passkey_round++; in sc_passkey_round()
1533 if (smp->passkey_round == 20) { in sc_passkey_round()
1535 if (sc_mackey_and_ltk(smp, smp->mackey, smp->tk)) in sc_passkey_round()
1544 sizeof(smp->prnd), smp->prnd); in sc_passkey_round()
1545 if (smp->passkey_round == 20) in sc_passkey_round()
1546 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); in sc_passkey_round()
1548 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); in sc_passkey_round()
1553 if (smp->passkey_round != 20) in sc_passkey_round()
1554 return sc_passkey_round(smp, 0); in sc_passkey_round()
1557 sc_dhkey_check(smp); in sc_passkey_round()
1558 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); in sc_passkey_round()
1563 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) { in sc_passkey_round()
1564 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags); in sc_passkey_round()
1568 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); in sc_passkey_round()
1572 sizeof(smp->prnd), smp->prnd); in sc_passkey_round()
1576 return sc_passkey_send_confirm(smp); in sc_passkey_round()
1585 smp->passkey_round + 1); in sc_passkey_round()
1587 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); in sc_passkey_round()
1589 return sc_passkey_send_confirm(smp); in sc_passkey_round()
1595 static int sc_user_reply(struct smp_chan *smp, u16 mgmt_op, __le32 passkey) in sc_user_reply() argument
1597 struct l2cap_conn *conn = smp->conn; in sc_user_reply()
1601 clear_bit(SMP_FLAG_WAIT_USER, &smp->flags); in sc_user_reply()
1605 smp_failure(smp->conn, SMP_PASSKEY_ENTRY_FAILED); in sc_user_reply()
1608 smp_failure(smp->conn, SMP_NUMERIC_COMP_FAILED); in sc_user_reply()
1612 smp->passkey_round = 0; in sc_user_reply()
1614 if (test_and_clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) in sc_user_reply()
1619 if (sc_passkey_round(smp, smp_op)) in sc_user_reply()
1627 sc_dhkey_check(smp); in sc_user_reply()
1628 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); in sc_user_reply()
1629 } else if (test_and_clear_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags)) { in sc_user_reply()
1630 sc_dhkey_check(smp); in sc_user_reply()
1631 sc_add_ltk(smp); in sc_user_reply()
1641 struct smp_chan *smp; in smp_user_confirm_reply() local
1650 chan = conn->smp; in smp_user_confirm_reply()
1660 smp = chan->data; in smp_user_confirm_reply()
1662 if (test_bit(SMP_FLAG_SC, &smp->flags)) { in smp_user_confirm_reply()
1663 err = sc_user_reply(smp, mgmt_op, passkey); in smp_user_confirm_reply()
1670 memset(smp->tk, 0, sizeof(smp->tk)); in smp_user_confirm_reply()
1672 put_unaligned_le32(value, smp->tk); in smp_user_confirm_reply()
1675 set_bit(SMP_FLAG_TK_VALID, &smp->flags); in smp_user_confirm_reply()
1691 if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) { in smp_user_confirm_reply()
1692 u8 rsp = smp_confirm(smp); in smp_user_confirm_reply()
1702 static void build_bredr_pairing_cmd(struct smp_chan *smp, in build_bredr_pairing_cmd() argument
1706 struct l2cap_conn *conn = smp->conn; in build_bredr_pairing_cmd()
1729 smp->remote_key_dist = remote_dist; in build_bredr_pairing_cmd()
1741 smp->remote_key_dist = rsp->init_key_dist; in build_bredr_pairing_cmd()
1747 struct l2cap_chan *chan = conn->smp; in smp_cmd_pairing_req()
1749 struct smp_chan *smp; in smp_cmd_pairing_req() local
1762 smp = smp_chan_create(conn); in smp_cmd_pairing_req()
1764 smp = chan->data; in smp_cmd_pairing_req()
1766 if (!smp) in smp_cmd_pairing_req()
1779 smp->preq[0] = SMP_CMD_PAIRING_REQ; in smp_cmd_pairing_req()
1780 memcpy(&smp->preq[1], req, sizeof(*req)); in smp_cmd_pairing_req()
1788 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags); in smp_cmd_pairing_req()
1790 /* SMP over BR/EDR requires special treatment */ in smp_cmd_pairing_req()
1797 set_bit(SMP_FLAG_SC, &smp->flags); in smp_cmd_pairing_req()
1799 build_bredr_pairing_cmd(smp, req, &rsp); in smp_cmd_pairing_req()
1802 set_bit(SMP_FLAG_CT2, &smp->flags); in smp_cmd_pairing_req()
1809 smp->remote_key_dist &= ~SMP_SC_NO_DIST; in smp_cmd_pairing_req()
1811 smp->prsp[0] = SMP_CMD_PAIRING_RSP; in smp_cmd_pairing_req()
1812 memcpy(&smp->prsp[1], &rsp, sizeof(rsp)); in smp_cmd_pairing_req()
1815 smp_distribute_keys(smp); in smp_cmd_pairing_req()
1822 set_bit(SMP_FLAG_SC, &smp->flags); in smp_cmd_pairing_req()
1825 set_bit(SMP_FLAG_CT2, &smp->flags); in smp_cmd_pairing_req()
1840 method = get_auth_method(smp, conn->hcon->io_capability, in smp_cmd_pairing_req()
1850 get_random_bytes(smp->prnd, sizeof(smp->prnd)); in smp_cmd_pairing_req()
1852 smp->prsp[0] = SMP_CMD_PAIRING_RSP; in smp_cmd_pairing_req()
1853 memcpy(&smp->prsp[1], &rsp, sizeof(rsp)); in smp_cmd_pairing_req()
1857 clear_bit(SMP_FLAG_INITIATOR, &smp->flags); in smp_cmd_pairing_req()
1864 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); in smp_cmd_pairing_req()
1866 if (test_bit(SMP_FLAG_SC, &smp->flags)) { in smp_cmd_pairing_req()
1867 SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY); in smp_cmd_pairing_req()
1869 smp->remote_key_dist &= ~SMP_SC_NO_DIST; in smp_cmd_pairing_req()
1882 static u8 sc_send_public_key(struct smp_chan *smp) in sc_send_public_key() argument
1884 struct hci_dev *hdev = smp->conn->hcon->hdev; in sc_send_public_key()
1888 if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) { in sc_send_public_key()
1897 memcpy(smp->local_pk, smp_dev->local_pk, 64); in sc_send_public_key()
1898 memcpy(smp->lr, smp_dev->local_rand, 16); in sc_send_public_key()
1901 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); in sc_send_public_key()
1908 if (set_ecdh_privkey(smp->tfm_ecdh, debug_sk)) in sc_send_public_key()
1910 memcpy(smp->local_pk, debug_pk, 64); in sc_send_public_key()
1911 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); in sc_send_public_key()
1915 if (generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk)) in sc_send_public_key()
1921 if (crypto_memneq(smp->local_pk, debug_pk, 64)) in sc_send_public_key()
1927 SMP_DBG("Local Public Key X: %32phN", smp->local_pk); in sc_send_public_key()
1928 SMP_DBG("Local Public Key Y: %32phN", smp->local_pk + 32); in sc_send_public_key()
1930 smp_send_cmd(smp->conn, SMP_CMD_PUBLIC_KEY, 64, smp->local_pk); in sc_send_public_key()
1938 struct l2cap_chan *chan = conn->smp; in smp_cmd_pairing_rsp()
1939 struct smp_chan *smp = chan->data; in smp_cmd_pairing_rsp() local
1954 req = (void *) &smp->preq[1]; in smp_cmd_pairing_rsp()
1970 set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags); in smp_cmd_pairing_rsp()
1972 smp->prsp[0] = SMP_CMD_PAIRING_RSP; in smp_cmd_pairing_rsp()
1973 memcpy(&smp->prsp[1], rsp, sizeof(*rsp)); in smp_cmd_pairing_rsp()
1978 smp->remote_key_dist &= rsp->resp_key_dist; in smp_cmd_pairing_rsp()
1981 set_bit(SMP_FLAG_CT2, &smp->flags); in smp_cmd_pairing_rsp()
1986 smp->remote_key_dist &= ~SMP_SC_NO_DIST; in smp_cmd_pairing_rsp()
1987 smp_distribute_keys(smp); in smp_cmd_pairing_rsp()
1992 set_bit(SMP_FLAG_SC, &smp->flags); in smp_cmd_pairing_rsp()
2000 method = get_auth_method(smp, req->io_capability, in smp_cmd_pairing_rsp()
2006 get_random_bytes(smp->prnd, sizeof(smp->prnd)); in smp_cmd_pairing_rsp()
2011 smp->remote_key_dist &= rsp->resp_key_dist; in smp_cmd_pairing_rsp()
2013 if (test_bit(SMP_FLAG_SC, &smp->flags)) { in smp_cmd_pairing_rsp()
2015 smp->remote_key_dist &= ~SMP_SC_NO_DIST; in smp_cmd_pairing_rsp()
2016 SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY); in smp_cmd_pairing_rsp()
2017 return sc_send_public_key(smp); in smp_cmd_pairing_rsp()
2026 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags); in smp_cmd_pairing_rsp()
2029 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags)) in smp_cmd_pairing_rsp()
2030 return smp_confirm(smp); in smp_cmd_pairing_rsp()
2035 static u8 sc_check_confirm(struct smp_chan *smp) in sc_check_confirm() argument
2037 struct l2cap_conn *conn = smp->conn; in sc_check_confirm()
2041 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) in sc_check_confirm()
2042 return sc_passkey_round(smp, SMP_CMD_PAIRING_CONFIRM); in sc_check_confirm()
2045 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), in sc_check_confirm()
2046 smp->prnd); in sc_check_confirm()
2047 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); in sc_check_confirm()
2057 static int fixup_sc_false_positive(struct smp_chan *smp) in fixup_sc_false_positive() argument
2059 struct l2cap_conn *conn = smp->conn; in fixup_sc_false_positive()
2074 bt_dev_err(hdev, "trying to fall back to legacy SMP"); in fixup_sc_false_positive()
2076 req = (void *) &smp->preq[1]; in fixup_sc_false_positive()
2077 rsp = (void *) &smp->prsp[1]; in fixup_sc_false_positive()
2080 smp->remote_key_dist = (req->init_key_dist & rsp->resp_key_dist); in fixup_sc_false_positive()
2085 bt_dev_err(hdev, "failed to fall back to legacy SMP"); in fixup_sc_false_positive()
2089 clear_bit(SMP_FLAG_SC, &smp->flags); in fixup_sc_false_positive()
2096 struct l2cap_chan *chan = conn->smp; in smp_cmd_pairing_confirm()
2097 struct smp_chan *smp = chan->data; in smp_cmd_pairing_confirm() local
2104 if (skb->len < sizeof(smp->pcnf)) in smp_cmd_pairing_confirm()
2107 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf)); in smp_cmd_pairing_confirm()
2108 skb_pull(skb, sizeof(smp->pcnf)); in smp_cmd_pairing_confirm()
2110 if (test_bit(SMP_FLAG_SC, &smp->flags)) { in smp_cmd_pairing_confirm()
2114 if (test_bit(SMP_FLAG_REMOTE_PK, &smp->flags)) in smp_cmd_pairing_confirm()
2115 return sc_check_confirm(smp); in smp_cmd_pairing_confirm()
2117 bt_dev_err(hdev, "Unexpected SMP Pairing Confirm"); in smp_cmd_pairing_confirm()
2119 ret = fixup_sc_false_positive(smp); in smp_cmd_pairing_confirm()
2125 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), in smp_cmd_pairing_confirm()
2126 smp->prnd); in smp_cmd_pairing_confirm()
2127 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); in smp_cmd_pairing_confirm()
2131 if (test_bit(SMP_FLAG_TK_VALID, &smp->flags)) in smp_cmd_pairing_confirm()
2132 return smp_confirm(smp); in smp_cmd_pairing_confirm()
2134 set_bit(SMP_FLAG_CFM_PENDING, &smp->flags); in smp_cmd_pairing_confirm()
2141 struct l2cap_chan *chan = conn->smp; in smp_cmd_pairing_random()
2142 struct smp_chan *smp = chan->data; in smp_cmd_pairing_random() local
2150 if (skb->len < sizeof(smp->rrnd)) in smp_cmd_pairing_random()
2153 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd)); in smp_cmd_pairing_random()
2154 skb_pull(skb, sizeof(smp->rrnd)); in smp_cmd_pairing_random()
2156 if (!test_bit(SMP_FLAG_SC, &smp->flags)) in smp_cmd_pairing_random()
2157 return smp_random(smp); in smp_cmd_pairing_random()
2160 pkax = smp->local_pk; in smp_cmd_pairing_random()
2161 pkbx = smp->remote_pk; in smp_cmd_pairing_random()
2162 na = smp->prnd; in smp_cmd_pairing_random()
2163 nb = smp->rrnd; in smp_cmd_pairing_random()
2165 pkax = smp->remote_pk; in smp_cmd_pairing_random()
2166 pkbx = smp->local_pk; in smp_cmd_pairing_random()
2167 na = smp->rrnd; in smp_cmd_pairing_random()
2168 nb = smp->prnd; in smp_cmd_pairing_random()
2171 if (smp->method == REQ_OOB) { in smp_cmd_pairing_random()
2174 sizeof(smp->prnd), smp->prnd); in smp_cmd_pairing_random()
2175 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); in smp_cmd_pairing_random()
2180 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) in smp_cmd_pairing_random()
2181 return sc_passkey_round(smp, SMP_CMD_PAIRING_RANDOM); in smp_cmd_pairing_random()
2186 err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk, in smp_cmd_pairing_random()
2187 smp->rrnd, 0, cfm); in smp_cmd_pairing_random()
2191 if (crypto_memneq(smp->pcnf, cfm, 16)) in smp_cmd_pairing_random()
2194 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), in smp_cmd_pairing_random()
2195 smp->prnd); in smp_cmd_pairing_random()
2196 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); in smp_cmd_pairing_random()
2199 if (smp->method != JUST_WORKS) in smp_cmd_pairing_random()
2219 err = sc_mackey_and_ltk(smp, smp->mackey, smp->tk); in smp_cmd_pairing_random()
2223 if (smp->method == REQ_OOB) { in smp_cmd_pairing_random()
2225 sc_dhkey_check(smp); in smp_cmd_pairing_random()
2226 SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK); in smp_cmd_pairing_random()
2231 err = smp_g2(smp->tfm_cmac, pkax, pkbx, na, nb, &passkey); in smp_cmd_pairing_random()
2238 if (smp->method == JUST_WORKS) in smp_cmd_pairing_random()
2246 set_bit(SMP_FLAG_WAIT_USER, &smp->flags); in smp_cmd_pairing_random()
2304 struct smp_chan *smp; in smp_cmd_security_req() local
2340 smp = smp_chan_create(conn); in smp_cmd_security_req()
2341 if (!smp) in smp_cmd_security_req()
2353 smp->preq[0] = SMP_CMD_PAIRING_REQ; in smp_cmd_security_req()
2354 memcpy(&smp->preq[1], &cp, sizeof(cp)); in smp_cmd_security_req()
2357 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP); in smp_cmd_security_req()
2366 struct smp_chan *smp; in smp_conn_security() local
2390 chan = conn->smp; in smp_conn_security()
2398 /* If SMP is already in progress ignore this request */ in smp_conn_security()
2404 smp = smp_chan_create(conn); in smp_conn_security()
2405 if (!smp) { in smp_conn_security()
2434 smp->preq[0] = SMP_CMD_PAIRING_REQ; in smp_conn_security()
2435 memcpy(&smp->preq[1], &cp, sizeof(cp)); in smp_conn_security()
2438 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP); in smp_conn_security()
2443 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_REQ); in smp_conn_security()
2446 set_bit(SMP_FLAG_INITIATOR, &smp->flags); in smp_conn_security()
2460 struct smp_chan *smp; in smp_cancel_and_remove_pairing() local
2474 chan = conn->smp; in smp_cancel_and_remove_pairing()
2480 smp = chan->data; in smp_cancel_and_remove_pairing()
2481 if (smp) { in smp_cancel_and_remove_pairing()
2484 smp->ltk = NULL; in smp_cancel_and_remove_pairing()
2485 smp->responder_ltk = NULL; in smp_cancel_and_remove_pairing()
2486 smp->remote_irk = NULL; in smp_cancel_and_remove_pairing()
2488 if (test_bit(SMP_FLAG_COMPLETE, &smp->flags)) in smp_cancel_and_remove_pairing()
2504 struct l2cap_chan *chan = conn->smp; in smp_cmd_encrypt_info()
2505 struct smp_chan *smp = chan->data; in smp_cmd_encrypt_info() local
2521 SMP_ALLOW_CMD(smp, SMP_CMD_INITIATOR_IDENT); in smp_cmd_encrypt_info()
2525 memcpy(smp->tk, rp->ltk, sizeof(smp->tk)); in smp_cmd_encrypt_info()
2533 struct l2cap_chan *chan = conn->smp; in smp_cmd_initiator_ident()
2534 struct smp_chan *smp = chan->data; in smp_cmd_initiator_ident() local
2546 smp->remote_key_dist &= ~SMP_DIST_ENC_KEY; in smp_cmd_initiator_ident()
2548 if (smp->remote_key_dist & SMP_DIST_ID_KEY) in smp_cmd_initiator_ident()
2549 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO); in smp_cmd_initiator_ident()
2550 else if (smp->remote_key_dist & SMP_DIST_SIGN) in smp_cmd_initiator_ident()
2551 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO); in smp_cmd_initiator_ident()
2557 authenticated, smp->tk, smp->enc_key_size, in smp_cmd_initiator_ident()
2559 smp->ltk = ltk; in smp_cmd_initiator_ident()
2560 if (!(smp->remote_key_dist & KEY_DIST_MASK)) in smp_cmd_initiator_ident()
2561 smp_distribute_keys(smp); in smp_cmd_initiator_ident()
2569 struct l2cap_chan *chan = conn->smp; in smp_cmd_ident_info()
2570 struct smp_chan *smp = chan->data; in smp_cmd_ident_info() local
2586 SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_ADDR_INFO); in smp_cmd_ident_info()
2590 memcpy(smp->irk, info->irk, 16); in smp_cmd_ident_info()
2599 struct l2cap_chan *chan = conn->smp; in smp_cmd_ident_addr_info()
2600 struct smp_chan *smp = chan->data; in smp_cmd_ident_addr_info() local
2610 smp->remote_key_dist &= ~SMP_DIST_ID_KEY; in smp_cmd_ident_addr_info()
2612 if (smp->remote_key_dist & SMP_DIST_SIGN) in smp_cmd_ident_addr_info()
2613 SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO); in smp_cmd_ident_addr_info()
2646 bacpy(&smp->id_addr, &info->bdaddr); in smp_cmd_ident_addr_info()
2647 smp->id_addr_type = info->addr_type; in smp_cmd_ident_addr_info()
2654 smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr, in smp_cmd_ident_addr_info()
2655 smp->id_addr_type, smp->irk, &rpa); in smp_cmd_ident_addr_info()
2658 if (!(smp->remote_key_dist & KEY_DIST_MASK)) in smp_cmd_ident_addr_info()
2659 smp_distribute_keys(smp); in smp_cmd_ident_addr_info()
2667 struct l2cap_chan *chan = conn->smp; in smp_cmd_sign_info()
2668 struct smp_chan *smp = chan->data; in smp_cmd_sign_info() local
2677 smp->remote_key_dist &= ~SMP_DIST_SIGN; in smp_cmd_sign_info()
2689 smp->csrk = csrk; in smp_cmd_sign_info()
2690 smp_distribute_keys(smp); in smp_cmd_sign_info()
2695 static u8 sc_select_method(struct smp_chan *smp) in sc_select_method() argument
2697 struct l2cap_conn *conn = smp->conn; in sc_select_method()
2702 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags) || in sc_select_method()
2703 test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) in sc_select_method()
2712 local = (void *) &smp->preq[1]; in sc_select_method()
2713 remote = (void *) &smp->prsp[1]; in sc_select_method()
2715 local = (void *) &smp->prsp[1]; in sc_select_method()
2716 remote = (void *) &smp->preq[1]; in sc_select_method()
2729 method = get_auth_method(smp, local_io, remote_io); in sc_select_method()
2734 if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags)) in sc_select_method()
2744 struct l2cap_chan *chan = conn->smp; in smp_cmd_public_key()
2745 struct smp_chan *smp = chan->data; in smp_cmd_public_key() local
2759 if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) && in smp_cmd_public_key()
2760 !crypto_memneq(key, smp->local_pk, 64)) { in smp_cmd_public_key()
2765 memcpy(smp->remote_pk, key, 64); in smp_cmd_public_key()
2767 if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) { in smp_cmd_public_key()
2768 err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->remote_pk, in smp_cmd_public_key()
2769 smp->rr, 0, cfm.confirm_val); in smp_cmd_public_key()
2773 if (crypto_memneq(cfm.confirm_val, smp->pcnf, 16)) in smp_cmd_public_key()
2781 err = sc_send_public_key(smp); in smp_cmd_public_key()
2786 SMP_DBG("Remote Public Key X: %32phN", smp->remote_pk); in smp_cmd_public_key()
2787 SMP_DBG("Remote Public Key Y: %32phN", smp->remote_pk + 32); in smp_cmd_public_key()
2792 if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) { in smp_cmd_public_key()
2803 tfm_ecdh = smp->tfm_ecdh; in smp_cmd_public_key()
2806 if (compute_ecdh_secret(tfm_ecdh, smp->remote_pk, smp->dhkey)) in smp_cmd_public_key()
2809 SMP_DBG("DHKey %32phN", smp->dhkey); in smp_cmd_public_key()
2811 set_bit(SMP_FLAG_REMOTE_PK, &smp->flags); in smp_cmd_public_key()
2813 smp->method = sc_select_method(smp); in smp_cmd_public_key()
2815 bt_dev_dbg(hdev, "selected method 0x%02x", smp->method); in smp_cmd_public_key()
2818 if (smp->method == JUST_WORKS || smp->method == JUST_CFM) in smp_cmd_public_key()
2823 if (!crypto_memneq(debug_pk, smp->remote_pk, 64)) in smp_cmd_public_key()
2824 set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); in smp_cmd_public_key()
2826 if (smp->method == DSP_PASSKEY) { in smp_cmd_public_key()
2831 smp->passkey_round = 0; in smp_cmd_public_key()
2837 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); in smp_cmd_public_key()
2838 return sc_passkey_round(smp, SMP_CMD_PUBLIC_KEY); in smp_cmd_public_key()
2841 if (smp->method == REQ_OOB) { in smp_cmd_public_key()
2844 sizeof(smp->prnd), smp->prnd); in smp_cmd_public_key()
2846 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); in smp_cmd_public_key()
2852 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); in smp_cmd_public_key()
2854 if (smp->method == REQ_PASSKEY) { in smp_cmd_public_key()
2858 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM); in smp_cmd_public_key()
2859 set_bit(SMP_FLAG_WAIT_USER, &smp->flags); in smp_cmd_public_key()
2869 err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd, in smp_cmd_public_key()
2875 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM); in smp_cmd_public_key()
2883 struct l2cap_chan *chan = conn->smp; in smp_cmd_dhkey_check()
2885 struct smp_chan *smp = chan->data; in smp_cmd_dhkey_check() local
2903 memcpy(io_cap, &smp->prsp[1], 3); in smp_cmd_dhkey_check()
2907 memcpy(io_cap, &smp->preq[1], 3); in smp_cmd_dhkey_check()
2912 if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY) in smp_cmd_dhkey_check()
2914 else if (smp->method == REQ_OOB) in smp_cmd_dhkey_check()
2915 memcpy(r, smp->lr, 16); in smp_cmd_dhkey_check()
2917 err = smp_f6(smp->tfm_cmac, smp->mackey, smp->rrnd, smp->prnd, r, in smp_cmd_dhkey_check()
2926 if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) { in smp_cmd_dhkey_check()
2927 set_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags); in smp_cmd_dhkey_check()
2932 sc_dhkey_check(smp); in smp_cmd_dhkey_check()
2935 sc_add_ltk(smp); in smp_cmd_dhkey_check()
2938 hci_le_start_enc(hcon, 0, 0, smp->tk, smp->enc_key_size); in smp_cmd_dhkey_check()
2939 hcon->enc_key_size = smp->enc_key_size; in smp_cmd_dhkey_check()
2959 struct smp_chan *smp; in smp_sig_channel() local
2974 smp = chan->data; in smp_sig_channel()
2979 if (smp && !test_and_clear_bit(code, &smp->allow_cmd)) in smp_sig_channel()
2985 if (!smp && code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ) in smp_sig_channel()
3062 bt_dev_err(hcon->hdev, "unexpected SMP command 0x%02x from %pMR", in smp_sig_channel()
3077 conn->smp = NULL; in smp_teardown_cb()
3087 struct smp_chan *smp; in bredr_pairing() local
3099 /* Only initiator may initiate SMP over BR/EDR */ in bredr_pairing()
3107 /* BR/EDR must use Secure Connections for SMP */ in bredr_pairing()
3120 /* Remote must support SMP fixed chan for BR/EDR */ in bredr_pairing()
3124 /* Don't bother if SMP is already ongoing */ in bredr_pairing()
3128 smp = smp_chan_create(conn); in bredr_pairing()
3129 if (!smp) { in bredr_pairing()
3130 bt_dev_err(hdev, "unable to create SMP context for BR/EDR"); in bredr_pairing()
3134 set_bit(SMP_FLAG_SC, &smp->flags); in bredr_pairing()
3136 bt_dev_dbg(hdev, "starting SMP over BR/EDR"); in bredr_pairing()
3138 /* Prepare and send the BR/EDR SMP Pairing Request */ in bredr_pairing()
3139 build_bredr_pairing_cmd(smp, &req, NULL); in bredr_pairing()
3141 smp->preq[0] = SMP_CMD_PAIRING_REQ; in bredr_pairing()
3142 memcpy(&smp->preq[1], &req, sizeof(req)); in bredr_pairing()
3145 SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP); in bredr_pairing()
3150 struct smp_chan *smp = chan->data; in smp_resume_cb() local
3161 if (!smp) in smp_resume_cb()
3167 cancel_delayed_work(&smp->security_timer); in smp_resume_cb()
3169 smp_distribute_keys(smp); in smp_resume_cb()
3185 conn->smp = chan; in smp_ready_cb()
3199 struct smp_chan *smp = chan->data; in smp_recv_cb() local
3201 if (smp) in smp_recv_cb()
3202 cancel_delayed_work_sync(&smp->security_timer); in smp_recv_cb()
3261 /* Other L2CAP channels may request SMP routines in order to in smp_new_conn_cb()
3262 * change the security level. This means that the SMP channel in smp_new_conn_cb()
3294 struct smp_dev *smp; in smp_add_cid() local
3299 smp = NULL; in smp_add_cid()
3303 smp = kzalloc(sizeof(*smp), GFP_KERNEL); in smp_add_cid()
3304 if (!smp) in smp_add_cid()
3310 kfree_sensitive(smp); in smp_add_cid()
3318 kfree_sensitive(smp); in smp_add_cid()
3322 smp->local_oob = false; in smp_add_cid()
3323 smp->tfm_cmac = tfm_cmac; in smp_add_cid()
3324 smp->tfm_ecdh = tfm_ecdh; in smp_add_cid()
3329 if (smp) { in smp_add_cid()
3330 crypto_free_shash(smp->tfm_cmac); in smp_add_cid()
3331 crypto_free_kpp(smp->tfm_ecdh); in smp_add_cid()
3332 kfree_sensitive(smp); in smp_add_cid()
3337 chan->data = smp; in smp_add_cid()
3370 struct smp_dev *smp; in smp_del_chan() local
3374 smp = chan->data; in smp_del_chan()
3375 if (smp) { in smp_del_chan()
3377 crypto_free_shash(smp->tfm_cmac); in smp_del_chan()
3378 crypto_free_kpp(smp->tfm_ecdh); in smp_del_chan()
3379 kfree_sensitive(smp); in smp_del_chan()
3418 * there is also no need to register any SMP channel. in smp_register()
3812 BT_INFO("SMP test passed in %llu usecs", duration); in run_selftests()