smp.c

   1/*
   2   BlueZ - Bluetooth protocol stack for Linux
   3   Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
   4
   5   This program is free software; you can redistribute it and/or modify
   6   it under the terms of the GNU General Public License version 2 as
   7   published by the Free Software Foundation;
   8
   9   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20   SOFTWARE IS DISCLAIMED.
  21*/
  22
  23#include <linux/debugfs.h>
  24#include <linux/scatterlist.h>
  25#include <crypto/aes.h>
  26#include <crypto/hash.h>
  27#include <crypto/kpp.h>
  28#include <crypto/utils.h>
  29
  30#include <net/bluetooth/bluetooth.h>
  31#include <net/bluetooth/hci_core.h>
  32#include <net/bluetooth/l2cap.h>
  33#include <net/bluetooth/mgmt.h>
  34
  35#include "ecdh_helper.h"
  36#include "smp.h"
  37
  38#define SMP_DEV(hdev) \
  39	((struct smp_dev *)((struct l2cap_chan *)((hdev)->smp_data))->data)
  40
  41/* Low-level debug macros to be used for stuff that we don't want
  42 * accidentally in dmesg, i.e. the values of the various crypto keys
  43 * and the inputs & outputs of crypto functions.
  44 */
  45#ifdef DEBUG
  46#define SMP_DBG(fmt, ...) printk(KERN_DEBUG "%s: " fmt, __func__, \
  47				 ##__VA_ARGS__)
  48#else
  49#define SMP_DBG(fmt, ...) no_printk(KERN_DEBUG "%s: " fmt, __func__, \
  50				    ##__VA_ARGS__)
  51#endif
  52
  53#define SMP_ALLOW_CMD(smp, code)	set_bit(code, &smp->allow_cmd)
  54
  55/* Keys which are not distributed with Secure Connections */
  56#define SMP_SC_NO_DIST (SMP_DIST_ENC_KEY | SMP_DIST_LINK_KEY)
  57
  58#define SMP_TIMEOUT	secs_to_jiffies(30)
  59
  60#define ID_ADDR_TIMEOUT	msecs_to_jiffies(200)
  61
  62#define AUTH_REQ_MASK(dev)	(hci_dev_test_flag(dev, HCI_SC_ENABLED) ? \
  63				 0x3f : 0x07)
  64#define KEY_DIST_MASK		0x07
  65
  66/* Maximum message length that can be passed to aes_cmac */
  67#define CMAC_MSG_MAX	80
  68
  69enum {
  70	SMP_FLAG_TK_VALID,
  71	SMP_FLAG_CFM_PENDING,
  72	SMP_FLAG_MITM_AUTH,
  73	SMP_FLAG_COMPLETE,
  74	SMP_FLAG_INITIATOR,
  75	SMP_FLAG_SC,
  76	SMP_FLAG_REMOTE_PK,
  77	SMP_FLAG_DEBUG_KEY,
  78	SMP_FLAG_WAIT_USER,
  79	SMP_FLAG_DHKEY_PENDING,
  80	SMP_FLAG_REMOTE_OOB,
  81	SMP_FLAG_LOCAL_OOB,
  82	SMP_FLAG_CT2,
  83};
  84
  85struct smp_dev {
  86	/* Secure Connections OOB data */
  87	bool			local_oob;
  88	u8			local_pk[64];
  89	u8			local_rand[16];
  90	bool			debug_key;
  91
  92	struct crypto_shash	*tfm_cmac;
  93	struct crypto_kpp	*tfm_ecdh;
  94};
  95
  96struct smp_chan {
  97	struct l2cap_conn	*conn;
  98	struct delayed_work	security_timer;
  99	unsigned long           allow_cmd; /* Bitmask of allowed commands */
 100
 101	u8		preq[7]; /* SMP Pairing Request */
 102	u8		prsp[7]; /* SMP Pairing Response */
 103	u8		prnd[16]; /* SMP Pairing Random (local) */
 104	u8		rrnd[16]; /* SMP Pairing Random (remote) */
 105	u8		pcnf[16]; /* SMP Pairing Confirm */
 106	u8		tk[16]; /* SMP Temporary Key */
 107	u8		rr[16]; /* Remote OOB ra/rb value */
 108	u8		lr[16]; /* Local OOB ra/rb value */
 109	u8		enc_key_size;
 110	u8		remote_key_dist;
 111	bdaddr_t	id_addr;
 112	u8		id_addr_type;
 113	u8		irk[16];
 114	struct smp_csrk	*csrk;
 115	struct smp_csrk	*responder_csrk;
 116	struct smp_ltk	*ltk;
 117	struct smp_ltk	*responder_ltk;
 118	struct smp_irk	*remote_irk;
 119	u8		*link_key;
 120	unsigned long	flags;
 121	u8		method;
 122	u8		passkey_round;
 123
 124	/* Secure Connections variables */
 125	u8			local_pk[64];
 126	u8			remote_pk[64];
 127	u8			dhkey[32];
 128	u8			mackey[16];
 129
 130	struct crypto_shash	*tfm_cmac;
 131	struct crypto_kpp	*tfm_ecdh;
 132};
 133
 134/* These debug key values are defined in the SMP section of the core
 135 * specification. debug_pk is the public debug key and debug_sk the
 136 * private debug key.
 137 */
 138static const u8 debug_pk[64] = {
 139		0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
 140		0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
 141		0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
 142		0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20,
 143
 144		0x8b, 0xd2, 0x89, 0x15, 0xd0, 0x8e, 0x1c, 0x74,
 145		0x24, 0x30, 0xed, 0x8f, 0xc2, 0x45, 0x63, 0x76,
 146		0x5c, 0x15, 0x52, 0x5a, 0xbf, 0x9a, 0x32, 0x63,
 147		0x6d, 0xeb, 0x2a, 0x65, 0x49, 0x9c, 0x80, 0xdc,
 148};
 149
 150static const u8 debug_sk[32] = {
 151		0xbd, 0x1a, 0x3c, 0xcd, 0xa6, 0xb8, 0x99, 0x58,
 152		0x99, 0xb7, 0x40, 0xeb, 0x7b, 0x60, 0xff, 0x4a,
 153		0x50, 0x3f, 0x10, 0xd2, 0xe3, 0xb3, 0xc9, 0x74,
 154		0x38, 0x5f, 0xc5, 0xa3, 0xd4, 0xf6, 0x49, 0x3f,
 155};
 156
 157static inline void swap_buf(const u8 *src, u8 *dst, size_t len)
 158{
 159	size_t i;
 160
 161	for (i = 0; i < len; i++)
 162		dst[len - 1 - i] = src[i];
 163}
 164
 165/* The following functions map to the LE SC SMP crypto functions
 166 * AES-CMAC, f4, f5, f6, g2 and h6.
 167 */
 168
 169static int aes_cmac(struct crypto_shash *tfm, const u8 k[16], const u8 *m,
 170		    size_t len, u8 mac[16])
 171{
 172	uint8_t tmp[16], mac_msb[16], msg_msb[CMAC_MSG_MAX];
 173	int err;
 174
 175	if (len > CMAC_MSG_MAX)
 176		return -EFBIG;
 177
 178	if (!tfm) {
 179		BT_ERR("tfm %p", tfm);
 180		return -EINVAL;
 181	}
 182
 183	/* Swap key and message from LSB to MSB */
 184	swap_buf(k, tmp, 16);
 185	swap_buf(m, msg_msb, len);
 186
 187	SMP_DBG("msg (len %zu) %*phN", len, (int) len, m);
 188	SMP_DBG("key %16phN", k);
 189
 190	err = crypto_shash_setkey(tfm, tmp, 16);
 191	if (err) {
 192		BT_ERR("cipher setkey failed: %d", err);
 193		return err;
 194	}
 195
 196	err = crypto_shash_tfm_digest(tfm, msg_msb, len, mac_msb);
 197	if (err) {
 198		BT_ERR("Hash computation error %d", err);
 199		return err;
 200	}
 201
 202	swap_buf(mac_msb, mac, 16);
 203
 204	SMP_DBG("mac %16phN", mac);
 205
 206	return 0;
 207}
 208
 209static int smp_f4(struct crypto_shash *tfm_cmac, const u8 u[32],
 210		  const u8 v[32], const u8 x[16], u8 z, u8 res[16])
 211{
 212	u8 m[65];
 213	int err;
 214
 215	SMP_DBG("u %32phN", u);
 216	SMP_DBG("v %32phN", v);
 217	SMP_DBG("x %16phN z %02x", x, z);
 218
 219	m[0] = z;
 220	memcpy(m + 1, v, 32);
 221	memcpy(m + 33, u, 32);
 222
 223	err = aes_cmac(tfm_cmac, x, m, sizeof(m), res);
 224	if (err)
 225		return err;
 226
 227	SMP_DBG("res %16phN", res);
 228
 229	return err;
 230}
 231
 232static int smp_f5(struct crypto_shash *tfm_cmac, const u8 w[32],
 233		  const u8 n1[16], const u8 n2[16], const u8 a1[7],
 234		  const u8 a2[7], u8 mackey[16], u8 ltk[16])
 235{
 236	/* The btle, salt and length "magic" values are as defined in
 237	 * the SMP section of the Bluetooth core specification. In ASCII
 238	 * the btle value ends up being 'btle'. The salt is just a
 239	 * random number whereas length is the value 256 in little
 240	 * endian format.
 241	 */
 242	const u8 btle[4] = { 0x65, 0x6c, 0x74, 0x62 };
 243	const u8 salt[16] = { 0xbe, 0x83, 0x60, 0x5a, 0xdb, 0x0b, 0x37, 0x60,
 244			      0x38, 0xa5, 0xf5, 0xaa, 0x91, 0x83, 0x88, 0x6c };
 245	const u8 length[2] = { 0x00, 0x01 };
 246	u8 m[53], t[16];
 247	int err;
 248
 249	SMP_DBG("w %32phN", w);
 250	SMP_DBG("n1 %16phN n2 %16phN", n1, n2);
 251	SMP_DBG("a1 %7phN a2 %7phN", a1, a2);
 252
 253	err = aes_cmac(tfm_cmac, salt, w, 32, t);
 254	if (err)
 255		return err;
 256
 257	SMP_DBG("t %16phN", t);
 258
 259	memcpy(m, length, 2);
 260	memcpy(m + 2, a2, 7);
 261	memcpy(m + 9, a1, 7);
 262	memcpy(m + 16, n2, 16);
 263	memcpy(m + 32, n1, 16);
 264	memcpy(m + 48, btle, 4);
 265
 266	m[52] = 0; /* Counter */
 267
 268	err = aes_cmac(tfm_cmac, t, m, sizeof(m), mackey);
 269	if (err)
 270		return err;
 271
 272	SMP_DBG("mackey %16phN", mackey);
 273
 274	m[52] = 1; /* Counter */
 275
 276	err = aes_cmac(tfm_cmac, t, m, sizeof(m), ltk);
 277	if (err)
 278		return err;
 279
 280	SMP_DBG("ltk %16phN", ltk);
 281
 282	return 0;
 283}
 284
 285static int smp_f6(struct crypto_shash *tfm_cmac, const u8 w[16],
 286		  const u8 n1[16], const u8 n2[16], const u8 r[16],
 287		  const u8 io_cap[3], const u8 a1[7], const u8 a2[7],
 288		  u8 res[16])
 289{
 290	u8 m[65];
 291	int err;
 292
 293	SMP_DBG("w %16phN", w);
 294	SMP_DBG("n1 %16phN n2 %16phN", n1, n2);
 295	SMP_DBG("r %16phN io_cap %3phN a1 %7phN a2 %7phN", r, io_cap, a1, a2);
 296
 297	memcpy(m, a2, 7);
 298	memcpy(m + 7, a1, 7);
 299	memcpy(m + 14, io_cap, 3);
 300	memcpy(m + 17, r, 16);
 301	memcpy(m + 33, n2, 16);
 302	memcpy(m + 49, n1, 16);
 303
 304	err = aes_cmac(tfm_cmac, w, m, sizeof(m), res);
 305	if (err)
 306		return err;
 307
 308	SMP_DBG("res %16phN", res);
 309
 310	return err;
 311}
 312
 313static int smp_g2(struct crypto_shash *tfm_cmac, const u8 u[32], const u8 v[32],
 314		  const u8 x[16], const u8 y[16], u32 *val)
 315{
 316	u8 m[80], tmp[16];
 317	int err;
 318
 319	SMP_DBG("u %32phN", u);
 320	SMP_DBG("v %32phN", v);
 321	SMP_DBG("x %16phN y %16phN", x, y);
 322
 323	memcpy(m, y, 16);
 324	memcpy(m + 16, v, 32);
 325	memcpy(m + 48, u, 32);
 326
 327	err = aes_cmac(tfm_cmac, x, m, sizeof(m), tmp);
 328	if (err)
 329		return err;
 330
 331	*val = get_unaligned_le32(tmp);
 332	*val %= 1000000;
 333
 334	SMP_DBG("val %06u", *val);
 335
 336	return 0;
 337}
 338
 339static int smp_h6(struct crypto_shash *tfm_cmac, const u8 w[16],
 340		  const u8 key_id[4], u8 res[16])
 341{
 342	int err;
 343
 344	SMP_DBG("w %16phN key_id %4phN", w, key_id);
 345
 346	err = aes_cmac(tfm_cmac, w, key_id, 4, res);
 347	if (err)
 348		return err;
 349
 350	SMP_DBG("res %16phN", res);
 351
 352	return err;
 353}
 354
 355static int smp_h7(struct crypto_shash *tfm_cmac, const u8 w[16],
 356		  const u8 salt[16], u8 res[16])
 357{
 358	int err;
 359
 360	SMP_DBG("w %16phN salt %16phN", w, salt);
 361
 362	err = aes_cmac(tfm_cmac, salt, w, 16, res);
 363	if (err)
 364		return err;
 365
 366	SMP_DBG("res %16phN", res);
 367
 368	return err;
 369}
 370
 371/* The following functions map to the legacy SMP crypto functions e, c1,
 372 * s1 and ah.
 373 */
 374
 375static int smp_e(const u8 *k, u8 *r)
 376{
 377	struct crypto_aes_ctx ctx;
 378	uint8_t tmp[16], data[16];
 379	int err;
 380
 381	SMP_DBG("k %16phN r %16phN", k, r);
 382
 383	/* The most significant octet of key corresponds to k[0] */
 384	swap_buf(k, tmp, 16);
 385
 386	err = aes_expandkey(&ctx, tmp, 16);
 387	if (err) {
 388		BT_ERR("cipher setkey failed: %d", err);
 389		return err;
 390	}
 391
 392	/* Most significant octet of plaintextData corresponds to data[0] */
 393	swap_buf(r, data, 16);
 394
 395	aes_encrypt(&ctx, data, data);
 396
 397	/* Most significant octet of encryptedData corresponds to data[0] */
 398	swap_buf(data, r, 16);
 399
 400	SMP_DBG("r %16phN", r);
 401
 402	memzero_explicit(&ctx, sizeof(ctx));
 403	return err;
 404}
 405
 406static int smp_c1(const u8 k[16],
 407		  const u8 r[16], const u8 preq[7], const u8 pres[7], u8 _iat,
 408		  const bdaddr_t *ia, u8 _rat, const bdaddr_t *ra, u8 res[16])
 409{
 410	u8 p1[16], p2[16];
 411	int err;
 412
 413	SMP_DBG("k %16phN r %16phN", k, r);
 414	SMP_DBG("iat %u ia %6phN rat %u ra %6phN", _iat, ia, _rat, ra);
 415	SMP_DBG("preq %7phN pres %7phN", preq, pres);
 416
 417	memset(p1, 0, 16);
 418
 419	/* p1 = pres || preq || _rat || _iat */
 420	p1[0] = _iat;
 421	p1[1] = _rat;
 422	memcpy(p1 + 2, preq, 7);
 423	memcpy(p1 + 9, pres, 7);
 424
 425	SMP_DBG("p1 %16phN", p1);
 426
 427	/* res = r XOR p1 */
 428	crypto_xor_cpy(res, r, p1, sizeof(p1));
 429
 430	/* res = e(k, res) */
 431	err = smp_e(k, res);
 432	if (err) {
 433		BT_ERR("Encrypt data error");
 434		return err;
 435	}
 436
 437	/* p2 = padding || ia || ra */
 438	memcpy(p2, ra, 6);
 439	memcpy(p2 + 6, ia, 6);
 440	memset(p2 + 12, 0, 4);
 441
 442	SMP_DBG("p2 %16phN", p2);
 443
 444	/* res = res XOR p2 */
 445	crypto_xor(res, p2, sizeof(p2));
 446
 447	/* res = e(k, res) */
 448	err = smp_e(k, res);
 449	if (err)
 450		BT_ERR("Encrypt data error");
 451
 452	return err;
 453}
 454
 455static int smp_s1(const u8 k[16],
 456		  const u8 r1[16], const u8 r2[16], u8 _r[16])
 457{
 458	int err;
 459
 460	/* Just least significant octets from r1 and r2 are considered */
 461	memcpy(_r, r2, 8);
 462	memcpy(_r + 8, r1, 8);
 463
 464	err = smp_e(k, _r);
 465	if (err)
 466		BT_ERR("Encrypt data error");
 467
 468	return err;
 469}
 470
 471static int smp_ah(const u8 irk[16], const u8 r[3], u8 res[3])
 472{
 473	u8 _res[16];
 474	int err;
 475
 476	/* r' = padding || r */
 477	memcpy(_res, r, 3);
 478	memset(_res + 3, 0, 13);
 479
 480	err = smp_e(irk, _res);
 481	if (err) {
 482		BT_ERR("Encrypt error");
 483		return err;
 484	}
 485
 486	/* The output of the random address function ah is:
 487	 *	ah(k, r) = e(k, r') mod 2^24
 488	 * The output of the security function e is then truncated to 24 bits
 489	 * by taking the least significant 24 bits of the output of e as the
 490	 * result of ah.
 491	 */
 492	memcpy(res, _res, 3);
 493
 494	return 0;
 495}
 496
 497bool smp_irk_matches(struct hci_dev *hdev, const u8 irk[16],
 498		     const bdaddr_t *bdaddr)
 499{
 500	struct l2cap_chan *chan = hdev->smp_data;
 501	u8 hash[3];
 502	int err;
 503
 504	if (!chan || !chan->data)
 505		return false;
 506
 507	bt_dev_dbg(hdev, "RPA %pMR IRK %*phN", bdaddr, 16, irk);
 508
 509	err = smp_ah(irk, &bdaddr->b[3], hash);
 510	if (err)
 511		return false;
 512
 513	return !crypto_memneq(bdaddr->b, hash, 3);
 514}
 515
 516int smp_generate_rpa(struct hci_dev *hdev, const u8 irk[16], bdaddr_t *rpa)
 517{
 518	struct l2cap_chan *chan = hdev->smp_data;
 519	int err;
 520
 521	if (!chan || !chan->data)
 522		return -EOPNOTSUPP;
 523
 524	get_random_bytes(&rpa->b[3], 3);
 525
 526	rpa->b[5] &= 0x3f;	/* Clear two most significant bits */
 527	rpa->b[5] |= 0x40;	/* Set second most significant bit */
 528
 529	err = smp_ah(irk, &rpa->b[3], rpa->b);
 530	if (err < 0)
 531		return err;
 532
 533	bt_dev_dbg(hdev, "RPA %pMR", rpa);
 534
 535	return 0;
 536}
 537
 538int smp_generate_oob(struct hci_dev *hdev, u8 hash[16], u8 rand[16])
 539{
 540	struct l2cap_chan *chan = hdev->smp_data;
 541	struct smp_dev *smp;
 542	int err;
 543
 544	if (!chan || !chan->data)
 545		return -EOPNOTSUPP;
 546
 547	smp = chan->data;
 548
 549	if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) {
 550		bt_dev_dbg(hdev, "Using debug keys");
 551		err = set_ecdh_privkey(smp->tfm_ecdh, debug_sk);
 552		if (err)
 553			return err;
 554		memcpy(smp->local_pk, debug_pk, 64);
 555		smp->debug_key = true;
 556	} else {
 557		while (true) {
 558			/* Generate key pair for Secure Connections */
 559			err = generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk);
 560			if (err)
 561				return err;
 562
 563			/* This is unlikely, but we need to check that
 564			 * we didn't accidentally generate a debug key.
 565			 */
 566			if (crypto_memneq(smp->local_pk, debug_pk, 64))
 567				break;
 568		}
 569		smp->debug_key = false;
 570	}
 571
 572	SMP_DBG("OOB Public Key X: %32phN", smp->local_pk);
 573	SMP_DBG("OOB Public Key Y: %32phN", smp->local_pk + 32);
 574
 575	get_random_bytes(smp->local_rand, 16);
 576
 577	err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->local_pk,
 578		     smp->local_rand, 0, hash);
 579	if (err < 0)
 580		return err;
 581
 582	memcpy(rand, smp->local_rand, 16);
 583
 584	smp->local_oob = true;
 585
 586	return 0;
 587}
 588
 589static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
 590{
 591	struct l2cap_chan *chan = conn->smp;
 592	struct smp_chan *smp;
 593	struct kvec iv[2];
 594	struct msghdr msg;
 595
 596	if (!chan)
 597		return;
 598
 599	bt_dev_dbg(conn->hcon->hdev, "code 0x%2.2x", code);
 600
 601	iv[0].iov_base = &code;
 602	iv[0].iov_len = 1;
 603
 604	iv[1].iov_base = data;
 605	iv[1].iov_len = len;
 606
 607	memset(&msg, 0, sizeof(msg));
 608
 609	iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iv, 2, 1 + len);
 610
 611	l2cap_chan_send(chan, &msg, 1 + len, NULL);
 612
 613	if (!chan->data)
 614		return;
 615
 616	smp = chan->data;
 617
 618	cancel_delayed_work_sync(&smp->security_timer);
 619	schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT);
 620}
 621
 622static u8 authreq_to_seclevel(u8 authreq)
 623{
 624	if (authreq & SMP_AUTH_MITM) {
 625		if (authreq & SMP_AUTH_SC)
 626			return BT_SECURITY_FIPS;
 627		else
 628			return BT_SECURITY_HIGH;
 629	} else {
 630		return BT_SECURITY_MEDIUM;
 631	}
 632}
 633
 634static __u8 seclevel_to_authreq(__u8 sec_level)
 635{
 636	switch (sec_level) {
 637	case BT_SECURITY_FIPS:
 638	case BT_SECURITY_HIGH:
 639		return SMP_AUTH_MITM | SMP_AUTH_BONDING;
 640	case BT_SECURITY_MEDIUM:
 641		return SMP_AUTH_BONDING;
 642	default:
 643		return SMP_AUTH_NONE;
 644	}
 645}
 646
 647static void build_pairing_cmd(struct l2cap_conn *conn,
 648			      struct smp_cmd_pairing *req,
 649			      struct smp_cmd_pairing *rsp, __u8 authreq)
 650{
 651	struct l2cap_chan *chan = conn->smp;
 652	struct smp_chan *smp = chan->data;
 653	struct hci_conn *hcon = conn->hcon;
 654	struct hci_dev *hdev = hcon->hdev;
 655	u8 local_dist = 0, remote_dist = 0, oob_flag = SMP_OOB_NOT_PRESENT;
 656
 657	if (hci_dev_test_flag(hdev, HCI_BONDABLE)) {
 658		local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
 659		remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
 660		authreq |= SMP_AUTH_BONDING;
 661	} else {
 662		authreq &= ~SMP_AUTH_BONDING;
 663	}
 664
 665	if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING))
 666		remote_dist |= SMP_DIST_ID_KEY;
 667
 668	if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 669		local_dist |= SMP_DIST_ID_KEY;
 670
 671	if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
 672	    (authreq & SMP_AUTH_SC)) {
 673		struct oob_data *oob_data;
 674		u8 bdaddr_type;
 675
 676		if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
 677			local_dist |= SMP_DIST_LINK_KEY;
 678			remote_dist |= SMP_DIST_LINK_KEY;
 679		}
 680
 681		if (hcon->dst_type == ADDR_LE_DEV_PUBLIC)
 682			bdaddr_type = BDADDR_LE_PUBLIC;
 683		else
 684			bdaddr_type = BDADDR_LE_RANDOM;
 685
 686		oob_data = hci_find_remote_oob_data(hdev, &hcon->dst,
 687						    bdaddr_type);
 688		if (oob_data && oob_data->present) {
 689			set_bit(SMP_FLAG_REMOTE_OOB, &smp->flags);
 690			oob_flag = SMP_OOB_PRESENT;
 691			memcpy(smp->rr, oob_data->rand256, 16);
 692			memcpy(smp->pcnf, oob_data->hash256, 16);
 693			SMP_DBG("OOB Remote Confirmation: %16phN", smp->pcnf);
 694			SMP_DBG("OOB Remote Random: %16phN", smp->rr);
 695		}
 696
 697	} else {
 698		authreq &= ~SMP_AUTH_SC;
 699	}
 700
 701	if (rsp == NULL) {
 702		req->io_capability = conn->hcon->io_capability;
 703		req->oob_flag = oob_flag;
 704		req->max_key_size = hdev->le_max_key_size;
 705		req->init_key_dist = local_dist;
 706		req->resp_key_dist = remote_dist;
 707		req->auth_req = (authreq & AUTH_REQ_MASK(hdev));
 708
 709		smp->remote_key_dist = remote_dist;
 710		return;
 711	}
 712
 713	rsp->io_capability = conn->hcon->io_capability;
 714	rsp->oob_flag = oob_flag;
 715	rsp->max_key_size = hdev->le_max_key_size;
 716	rsp->init_key_dist = req->init_key_dist & remote_dist;
 717	rsp->resp_key_dist = req->resp_key_dist & local_dist;
 718	rsp->auth_req = (authreq & AUTH_REQ_MASK(hdev));
 719
 720	smp->remote_key_dist = rsp->init_key_dist;
 721}
 722
 723static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
 724{
 725	struct l2cap_chan *chan = conn->smp;
 726	struct hci_dev *hdev = conn->hcon->hdev;
 727	struct smp_chan *smp = chan->data;
 728
 729	if (conn->hcon->pending_sec_level == BT_SECURITY_FIPS &&
 730	    max_key_size != SMP_MAX_ENC_KEY_SIZE)
 731		return SMP_ENC_KEY_SIZE;
 732
 733	if (max_key_size > hdev->le_max_key_size ||
 734	    max_key_size < SMP_MIN_ENC_KEY_SIZE)
 735		return SMP_ENC_KEY_SIZE;
 736
 737	smp->enc_key_size = max_key_size;
 738
 739	return 0;
 740}
 741
 742static void smp_chan_destroy(struct l2cap_conn *conn)
 743{
 744	struct l2cap_chan *chan = conn->smp;
 745	struct smp_chan *smp = chan->data;
 746	struct hci_conn *hcon = conn->hcon;
 747	bool complete;
 748
 749	BUG_ON(!smp);
 750
 751	cancel_delayed_work_sync(&smp->security_timer);
 752
 753	complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
 754	mgmt_smp_complete(hcon, complete);
 755
 756	kfree_sensitive(smp->csrk);
 757	kfree_sensitive(smp->responder_csrk);
 758	kfree_sensitive(smp->link_key);
 759
 760	crypto_free_shash(smp->tfm_cmac);
 761	crypto_free_kpp(smp->tfm_ecdh);
 762
 763	/* Ensure that we don't leave any debug key around if debug key
 764	 * support hasn't been explicitly enabled.
 765	 */
 766	if (smp->ltk && smp->ltk->type == SMP_LTK_P256_DEBUG &&
 767	    !hci_dev_test_flag(hcon->hdev, HCI_KEEP_DEBUG_KEYS)) {
 768		list_del_rcu(&smp->ltk->list);
 769		kfree_rcu(smp->ltk, rcu);
 770		smp->ltk = NULL;
 771	}
 772
 773	/* If pairing failed clean up any keys we might have */
 774	if (!complete) {
 775		if (smp->ltk) {
 776			list_del_rcu(&smp->ltk->list);
 777			kfree_rcu(smp->ltk, rcu);
 778		}
 779
 780		if (smp->responder_ltk) {
 781			list_del_rcu(&smp->responder_ltk->list);
 782			kfree_rcu(smp->responder_ltk, rcu);
 783		}
 784
 785		if (smp->remote_irk) {
 786			list_del_rcu(&smp->remote_irk->list);
 787			kfree_rcu(smp->remote_irk, rcu);
 788		}
 789	}
 790
 791	chan->data = NULL;
 792	kfree_sensitive(smp);
 793	hci_conn_drop(hcon);
 794}
 795
 796static void smp_failure(struct l2cap_conn *conn, u8 reason)
 797{
 798	struct hci_conn *hcon = conn->hcon;
 799	struct l2cap_chan *chan = conn->smp;
 800
 801	if (reason)
 802		smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
 803			     &reason);
 804
 805	mgmt_auth_failed(hcon, HCI_ERROR_AUTH_FAILURE);
 806
 807	if (chan->data)
 808		smp_chan_destroy(conn);
 809}
 810
 811#define JUST_WORKS	0x00
 812#define JUST_CFM	0x01
 813#define REQ_PASSKEY	0x02
 814#define CFM_PASSKEY	0x03
 815#define REQ_OOB		0x04
 816#define DSP_PASSKEY	0x05
 817#define OVERLAP		0xFF
 818
 819static const u8 gen_method[5][5] = {
 820	{ JUST_WORKS,  JUST_CFM,    REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
 821	{ JUST_WORKS,  JUST_CFM,    REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
 822	{ CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
 823	{ JUST_WORKS,  JUST_CFM,    JUST_WORKS,  JUST_WORKS, JUST_CFM    },
 824	{ CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP     },
 825};
 826
 827static const u8 sc_method[5][5] = {
 828	{ JUST_WORKS,  JUST_CFM,    REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
 829	{ JUST_WORKS,  CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
 830	{ DSP_PASSKEY, DSP_PASSKEY, REQ_PASSKEY, JUST_WORKS, DSP_PASSKEY },
 831	{ JUST_WORKS,  JUST_CFM,    JUST_WORKS,  JUST_WORKS, JUST_CFM    },
 832	{ DSP_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
 833};
 834
 835static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io)
 836{
 837	/* If either side has unknown io_caps, use JUST_CFM (which gets
 838	 * converted later to JUST_WORKS if we're initiators.
 839	 */
 840	if (local_io > SMP_IO_KEYBOARD_DISPLAY ||
 841	    remote_io > SMP_IO_KEYBOARD_DISPLAY)
 842		return JUST_CFM;
 843
 844	if (test_bit(SMP_FLAG_SC, &smp->flags))
 845		return sc_method[remote_io][local_io];
 846
 847	return gen_method[remote_io][local_io];
 848}
 849
 850static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
 851						u8 local_io, u8 remote_io)
 852{
 853	struct hci_conn *hcon = conn->hcon;
 854	struct l2cap_chan *chan = conn->smp;
 855	struct smp_chan *smp = chan->data;
 856	u32 passkey = 0;
 857	int ret;
 858
 859	/* Initialize key for JUST WORKS */
 860	memset(smp->tk, 0, sizeof(smp->tk));
 861	clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
 862
 863	bt_dev_dbg(hcon->hdev, "auth:%u lcl:%u rem:%u", auth, local_io,
 864		   remote_io);
 865
 866	/* If neither side wants MITM, either "just" confirm an incoming
 867	 * request or use just-works for outgoing ones. The JUST_CFM
 868	 * will be converted to JUST_WORKS if necessary later in this
 869	 * function. If either side has MITM look up the method from the
 870	 * table.
 871	 */
 872	if (!(auth & SMP_AUTH_MITM))
 873		smp->method = JUST_CFM;
 874	else
 875		smp->method = get_auth_method(smp, local_io, remote_io);
 876
 877	/* Don't confirm locally initiated pairing attempts */
 878	if (smp->method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR,
 879						&smp->flags))
 880		smp->method = JUST_WORKS;
 881
 882	/* Don't bother user space with no IO capabilities */
 883	if (smp->method == JUST_CFM &&
 884	    hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
 885		smp->method = JUST_WORKS;
 886
 887	/* If Just Works, Continue with Zero TK and ask user-space for
 888	 * confirmation */
 889	if (smp->method == JUST_WORKS) {
 890		ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
 891						hcon->type,
 892						hcon->dst_type,
 893						passkey, 1);
 894		if (ret)
 895			return ret;
 896		set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
 897		return 0;
 898	}
 899
 900	/* If this function is used for SC -> legacy fallback we
 901	 * can only recover the just-works case.
 902	 */
 903	if (test_bit(SMP_FLAG_SC, &smp->flags))
 904		return -EINVAL;
 905
 906	/* Not Just Works/Confirm results in MITM Authentication */
 907	if (smp->method != JUST_CFM) {
 908		set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
 909		if (hcon->pending_sec_level < BT_SECURITY_HIGH)
 910			hcon->pending_sec_level = BT_SECURITY_HIGH;
 911	}
 912
 913	/* If both devices have Keyboard-Display I/O, the initiator
 914	 * Confirms and the responder Enters the passkey.
 915	 */
 916	if (smp->method == OVERLAP) {
 917		if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
 918			smp->method = CFM_PASSKEY;
 919		else
 920			smp->method = REQ_PASSKEY;
 921	}
 922
 923	/* Generate random passkey. */
 924	if (smp->method == CFM_PASSKEY) {
 925		memset(smp->tk, 0, sizeof(smp->tk));
 926		get_random_bytes(&passkey, sizeof(passkey));
 927		passkey %= 1000000;
 928		put_unaligned_le32(passkey, smp->tk);
 929		bt_dev_dbg(hcon->hdev, "PassKey: %u", passkey);
 930		set_bit(SMP_FLAG_TK_VALID, &smp->flags);
 931	}
 932
 933	if (smp->method == REQ_PASSKEY)
 934		ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
 935						hcon->type, hcon->dst_type);
 936	else if (smp->method == JUST_CFM)
 937		ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
 938						hcon->type, hcon->dst_type,
 939						passkey, 1);
 940	else
 941		ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
 942						hcon->type, hcon->dst_type,
 943						passkey, 0);
 944
 945	return ret;
 946}
 947
 948static u8 smp_confirm(struct smp_chan *smp)
 949{
 950	struct l2cap_conn *conn = smp->conn;
 951	struct smp_cmd_pairing_confirm cp;
 952	int ret;
 953
 954	bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
 955
 956	ret = smp_c1(smp->tk, smp->prnd, smp->preq, smp->prsp,
 957		     conn->hcon->init_addr_type, &conn->hcon->init_addr,
 958		     conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
 959		     cp.confirm_val);
 960	if (ret)
 961		return SMP_UNSPECIFIED;
 962
 963	clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
 964
 965	smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
 966
 967	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
 968		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
 969	else
 970		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
 971
 972	return 0;
 973}
 974
 975static u8 smp_random(struct smp_chan *smp)
 976{
 977	struct l2cap_conn *conn = smp->conn;
 978	struct hci_conn *hcon = conn->hcon;
 979	u8 confirm[16];
 980	int ret;
 981
 982	bt_dev_dbg(conn->hcon->hdev, "conn %p %s", conn,
 983		   test_bit(SMP_FLAG_INITIATOR, &smp->flags) ? "initiator" :
 984		   "responder");
 985
 986	ret = smp_c1(smp->tk, smp->rrnd, smp->preq, smp->prsp,
 987		     hcon->init_addr_type, &hcon->init_addr,
 988		     hcon->resp_addr_type, &hcon->resp_addr, confirm);
 989	if (ret)
 990		return SMP_UNSPECIFIED;
 991
 992	if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) {
 993		bt_dev_err(hcon->hdev, "pairing failed "
 994			   "(confirmation values mismatch)");
 995		return SMP_CONFIRM_FAILED;
 996	}
 997
 998	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
 999		u8 stk[16];
1000		__le64 rand = 0;
1001		__le16 ediv = 0;
1002
1003		smp_s1(smp->tk, smp->rrnd, smp->prnd, stk);
1004
1005		if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
1006			return SMP_UNSPECIFIED;
1007
1008		hci_le_start_enc(hcon, ediv, rand, stk, smp->enc_key_size);
1009		hcon->enc_key_size = smp->enc_key_size;
1010		set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
1011	} else {
1012		u8 stk[16], auth;
1013		__le64 rand = 0;
1014		__le16 ediv = 0;
1015
1016		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
1017			     smp->prnd);
1018
1019		smp_s1(smp->tk, smp->prnd, smp->rrnd, stk);
1020
1021		auth = test_bit(SMP_FLAG_MITM_AUTH, &smp->flags) ? 1 : 0;
1022
1023		/* Even though there's no _RESPONDER suffix this is the
1024		 * responder STK we're adding for later lookup (the initiator
1025		 * STK never needs to be stored).
1026		 */
1027		hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
1028			    SMP_STK, auth, stk, smp->enc_key_size, ediv, rand);
1029	}
1030
1031	return 0;
1032}
1033
1034static void smp_notify_keys(struct l2cap_conn *conn)
1035{
1036	struct l2cap_chan *chan = conn->smp;
1037	struct smp_chan *smp = chan->data;
1038	struct hci_conn *hcon = conn->hcon;
1039	struct hci_dev *hdev = hcon->hdev;
1040	struct smp_cmd_pairing *req = (void *) &smp->preq[1];
1041	struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
1042	bool persistent;
1043
1044	if (hcon->type == ACL_LINK) {
1045		if (hcon->key_type == HCI_LK_DEBUG_COMBINATION)
1046			persistent = false;
1047		else
1048			persistent = !test_bit(HCI_CONN_FLUSH_KEY,
1049					       &hcon->flags);
1050	} else {
1051		/* The LTKs, IRKs and CSRKs should be persistent only if
1052		 * both sides had the bonding bit set in their
1053		 * authentication requests.
1054		 */
1055		persistent = !!((req->auth_req & rsp->auth_req) &
1056				SMP_AUTH_BONDING);
1057	}
1058
1059	if (smp->remote_irk) {
1060		mgmt_new_irk(hdev, smp->remote_irk, persistent);
1061
1062		/* Now that user space can be considered to know the
1063		 * identity address track the connection based on it
1064		 * from now on (assuming this is an LE link).
1065		 */
1066		if (hcon->type == LE_LINK) {
1067			bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
1068			hcon->dst_type = smp->remote_irk->addr_type;
1069			/* Use a short delay to make sure the new address is
1070			 * propagated _before_ the channels.
1071			 */
1072			queue_delayed_work(hdev->workqueue,
1073					   &conn->id_addr_timer,
1074					   ID_ADDR_TIMEOUT);
1075		}
1076	}
1077
1078	if (smp->csrk) {
1079		smp->csrk->bdaddr_type = hcon->dst_type;
1080		bacpy(&smp->csrk->bdaddr, &hcon->dst);
1081		mgmt_new_csrk(hdev, smp->csrk, persistent);
1082	}
1083
1084	if (smp->responder_csrk) {
1085		smp->responder_csrk->bdaddr_type = hcon->dst_type;
1086		bacpy(&smp->responder_csrk->bdaddr, &hcon->dst);
1087		mgmt_new_csrk(hdev, smp->responder_csrk, persistent);
1088	}
1089
1090	if (smp->ltk) {
1091		smp->ltk->bdaddr_type = hcon->dst_type;
1092		bacpy(&smp->ltk->bdaddr, &hcon->dst);
1093		mgmt_new_ltk(hdev, smp->ltk, persistent);
1094	}
1095
1096	if (smp->responder_ltk) {
1097		smp->responder_ltk->bdaddr_type = hcon->dst_type;
1098		bacpy(&smp->responder_ltk->bdaddr, &hcon->dst);
1099		mgmt_new_ltk(hdev, smp->responder_ltk, persistent);
1100	}
1101
1102	if (smp->link_key) {
1103		struct link_key *key;
1104		u8 type;
1105
1106		if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags))
1107			type = HCI_LK_DEBUG_COMBINATION;
1108		else if (hcon->sec_level == BT_SECURITY_FIPS)
1109			type = HCI_LK_AUTH_COMBINATION_P256;
1110		else
1111			type = HCI_LK_UNAUTH_COMBINATION_P256;
1112
1113		key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst,
1114				       smp->link_key, type, 0, &persistent);
1115		if (key) {
1116			mgmt_new_link_key(hdev, key, persistent);
1117
1118			/* Don't keep debug keys around if the relevant
1119			 * flag is not set.
1120			 */
1121			if (!hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS) &&
1122			    key->type == HCI_LK_DEBUG_COMBINATION) {
1123				list_del_rcu(&key->list);
1124				kfree_rcu(key, rcu);
1125			}
1126		}
1127	}
1128}
1129
1130static void sc_add_ltk(struct smp_chan *smp)
1131{
1132	struct hci_conn *hcon = smp->conn->hcon;
1133	u8 key_type, auth;
1134
1135	if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags))
1136		key_type = SMP_LTK_P256_DEBUG;
1137	else
1138		key_type = SMP_LTK_P256;
1139
1140	if (hcon->pending_sec_level == BT_SECURITY_FIPS)
1141		auth = 1;
1142	else
1143		auth = 0;
1144
1145	smp->ltk = hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
1146			       key_type, auth, smp->tk, smp->enc_key_size,
1147			       0, 0);
1148}
1149
1150static void sc_generate_link_key(struct smp_chan *smp)
1151{
1152	/* From core spec. Spells out in ASCII as 'lebr'. */
1153	const u8 lebr[4] = { 0x72, 0x62, 0x65, 0x6c };
1154
1155	smp->link_key = kzalloc(16, GFP_KERNEL);
1156	if (!smp->link_key)
1157		return;
1158
1159	if (test_bit(SMP_FLAG_CT2, &smp->flags)) {
1160		/* SALT = 0x000000000000000000000000746D7031 */
1161		const u8 salt[16] = { 0x31, 0x70, 0x6d, 0x74 };
1162
1163		if (smp_h7(smp->tfm_cmac, smp->tk, salt, smp->link_key)) {
1164			kfree_sensitive(smp->link_key);
1165			smp->link_key = NULL;
1166			return;
1167		}
1168	} else {
1169		/* From core spec. Spells out in ASCII as 'tmp1'. */
1170		const u8 tmp1[4] = { 0x31, 0x70, 0x6d, 0x74 };
1171
1172		if (smp_h6(smp->tfm_cmac, smp->tk, tmp1, smp->link_key)) {
1173			kfree_sensitive(smp->link_key);
1174			smp->link_key = NULL;
1175			return;
1176		}
1177	}
1178
1179	if (smp_h6(smp->tfm_cmac, smp->link_key, lebr, smp->link_key)) {
1180		kfree_sensitive(smp->link_key);
1181		smp->link_key = NULL;
1182		return;
1183	}
1184}
1185
1186static void smp_allow_key_dist(struct smp_chan *smp)
1187{
1188	/* Allow the first expected phase 3 PDU. The rest of the PDUs
1189	 * will be allowed in each PDU handler to ensure we receive
1190	 * them in the correct order.
1191	 */
1192	if (smp->remote_key_dist & SMP_DIST_ENC_KEY)
1193		SMP_ALLOW_CMD(smp, SMP_CMD_ENCRYPT_INFO);
1194	else if (smp->remote_key_dist & SMP_DIST_ID_KEY)
1195		SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
1196	else if (smp->remote_key_dist & SMP_DIST_SIGN)
1197		SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
1198}
1199
1200static void sc_generate_ltk(struct smp_chan *smp)
1201{
1202	/* From core spec. Spells out in ASCII as 'brle'. */
1203	const u8 brle[4] = { 0x65, 0x6c, 0x72, 0x62 };
1204	struct hci_conn *hcon = smp->conn->hcon;
1205	struct hci_dev *hdev = hcon->hdev;
1206	struct link_key *key;
1207
1208	key = hci_find_link_key(hdev, &hcon->dst);
1209	if (!key) {
1210		bt_dev_err(hdev, "no Link Key found to generate LTK");
1211		return;
1212	}
1213
1214	if (key->type == HCI_LK_DEBUG_COMBINATION)
1215		set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
1216
1217	if (test_bit(SMP_FLAG_CT2, &smp->flags)) {
1218		/* SALT = 0x000000000000000000000000746D7032 */
1219		const u8 salt[16] = { 0x32, 0x70, 0x6d, 0x74 };
1220
1221		if (smp_h7(smp->tfm_cmac, key->val, salt, smp->tk))
1222			return;
1223	} else {
1224		/* From core spec. Spells out in ASCII as 'tmp2'. */
1225		const u8 tmp2[4] = { 0x32, 0x70, 0x6d, 0x74 };
1226
1227		if (smp_h6(smp->tfm_cmac, key->val, tmp2, smp->tk))
1228			return;
1229	}
1230
1231	if (smp_h6(smp->tfm_cmac, smp->tk, brle, smp->tk))
1232		return;
1233
1234	sc_add_ltk(smp);
1235}
1236
1237static void smp_distribute_keys(struct smp_chan *smp)
1238{
1239	struct smp_cmd_pairing *req, *rsp;
1240	struct l2cap_conn *conn = smp->conn;
1241	struct hci_conn *hcon = conn->hcon;
1242	struct hci_dev *hdev = hcon->hdev;
1243	__u8 *keydist;
1244
1245	bt_dev_dbg(hdev, "conn %p", conn);
1246
1247	rsp = (void *) &smp->prsp[1];
1248
1249	/* The responder sends its keys first */
1250	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags) &&
1251	    (smp->remote_key_dist & KEY_DIST_MASK)) {
1252		smp_allow_key_dist(smp);
1253		return;
1254	}
1255
1256	req = (void *) &smp->preq[1];
1257
1258	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
1259		keydist = &rsp->init_key_dist;
1260		*keydist &= req->init_key_dist;
1261	} else {
1262		keydist = &rsp->resp_key_dist;
1263		*keydist &= req->resp_key_dist;
1264	}
1265
1266	if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1267		if (hcon->type == LE_LINK && (*keydist & SMP_DIST_LINK_KEY))
1268			sc_generate_link_key(smp);
1269		if (hcon->type == ACL_LINK && (*keydist & SMP_DIST_ENC_KEY))
1270			sc_generate_ltk(smp);
1271
1272		/* Clear the keys which are generated but not distributed */
1273		*keydist &= ~SMP_SC_NO_DIST;
1274	}
1275
1276	bt_dev_dbg(hdev, "keydist 0x%x", *keydist);
1277
1278	if (*keydist & SMP_DIST_ENC_KEY) {
1279		struct smp_cmd_encrypt_info enc;
1280		struct smp_cmd_initiator_ident ident;
1281		struct smp_ltk *ltk;
1282		u8 authenticated;
1283		__le16 ediv;
1284		__le64 rand;
1285
1286		/* Make sure we generate only the significant amount of
1287		 * bytes based on the encryption key size, and set the rest
1288		 * of the value to zeroes.
1289		 */
1290		get_random_bytes(enc.ltk, smp->enc_key_size);
1291		memset(enc.ltk + smp->enc_key_size, 0,
1292		       sizeof(enc.ltk) - smp->enc_key_size);
1293
1294		get_random_bytes(&ediv, sizeof(ediv));
1295		get_random_bytes(&rand, sizeof(rand));
1296
1297		smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1298
1299		authenticated = hcon->sec_level == BT_SECURITY_HIGH;
1300		ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
1301				  SMP_LTK_RESPONDER, authenticated, enc.ltk,
1302				  smp->enc_key_size, ediv, rand);
1303		smp->responder_ltk = ltk;
1304
1305		ident.ediv = ediv;
1306		ident.rand = rand;
1307
1308		smp_send_cmd(conn, SMP_CMD_INITIATOR_IDENT, sizeof(ident),
1309			     &ident);
1310
1311		*keydist &= ~SMP_DIST_ENC_KEY;
1312	}
1313
1314	if (*keydist & SMP_DIST_ID_KEY) {
1315		struct smp_cmd_ident_addr_info addrinfo;
1316		struct smp_cmd_ident_info idinfo;
1317
1318		memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
1319
1320		smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1321
1322		/* The hci_conn contains the local identity address
1323		 * after the connection has been established.
1324		 *
1325		 * This is true even when the connection has been
1326		 * established using a resolvable random address.
1327		 */
1328		bacpy(&addrinfo.bdaddr, &hcon->src);
1329		addrinfo.addr_type = hcon->src_type;
1330
1331		smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
1332			     &addrinfo);
1333
1334		*keydist &= ~SMP_DIST_ID_KEY;
1335	}
1336
1337	if (*keydist & SMP_DIST_SIGN) {
1338		struct smp_cmd_sign_info sign;
1339		struct smp_csrk *csrk;
1340
1341		/* Generate a new random key */
1342		get_random_bytes(sign.csrk, sizeof(sign.csrk));
1343
1344		csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1345		if (csrk) {
1346			if (hcon->sec_level > BT_SECURITY_MEDIUM)
1347				csrk->type = MGMT_CSRK_LOCAL_AUTHENTICATED;
1348			else
1349				csrk->type = MGMT_CSRK_LOCAL_UNAUTHENTICATED;
1350			memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
1351		}
1352		smp->responder_csrk = csrk;
1353
1354		smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1355
1356		*keydist &= ~SMP_DIST_SIGN;
1357	}
1358
1359	/* If there are still keys to be received wait for them */
1360	if (smp->remote_key_dist & KEY_DIST_MASK) {
1361		smp_allow_key_dist(smp);
1362		return;
1363	}
1364
1365	set_bit(SMP_FLAG_COMPLETE, &smp->flags);
1366	smp_notify_keys(conn);
1367
1368	smp_chan_destroy(conn);
1369}
1370
1371static void smp_timeout(struct work_struct *work)
1372{
1373	struct smp_chan *smp = container_of(work, struct smp_chan,
1374					    security_timer.work);
1375	struct l2cap_conn *conn = smp->conn;
1376
1377	bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
1378
1379	hci_disconnect(conn->hcon, HCI_ERROR_AUTH_FAILURE);
1380}
1381
1382static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
1383{
1384	struct hci_conn *hcon = conn->hcon;
1385	struct l2cap_chan *chan = conn->smp;
1386	struct smp_chan *smp;
1387
1388	smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
1389	if (!smp)
1390		return NULL;
1391
1392	smp->tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0);
1393	if (IS_ERR(smp->tfm_cmac)) {
1394		bt_dev_err(hcon->hdev, "Unable to create CMAC crypto context");
1395		goto zfree_smp;
1396	}
1397
1398	smp->tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0);
1399	if (IS_ERR(smp->tfm_ecdh)) {
1400		bt_dev_err(hcon->hdev, "Unable to create ECDH crypto context");
1401		goto free_shash;
1402	}
1403
1404	smp->conn = conn;
1405	chan->data = smp;
1406
1407	SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_FAIL);
1408
1409	INIT_DELAYED_WORK(&smp->security_timer, smp_timeout);
1410
1411	hci_conn_hold(hcon);
1412
1413	return smp;
1414
1415free_shash:
1416	crypto_free_shash(smp->tfm_cmac);
1417zfree_smp:
1418	kfree_sensitive(smp);
1419	return NULL;
1420}
1421
1422static int sc_mackey_and_ltk(struct smp_chan *smp, u8 mackey[16], u8 ltk[16])
1423{
1424	struct hci_conn *hcon = smp->conn->hcon;
1425	u8 *na, *nb, a[7], b[7];
1426
1427	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
1428		na   = smp->prnd;
1429		nb   = smp->rrnd;
1430	} else {
1431		na   = smp->rrnd;
1432		nb   = smp->prnd;
1433	}
1434
1435	memcpy(a, &hcon->init_addr, 6);
1436	memcpy(b, &hcon->resp_addr, 6);
1437	a[6] = hcon->init_addr_type;
1438	b[6] = hcon->resp_addr_type;
1439
1440	return smp_f5(smp->tfm_cmac, smp->dhkey, na, nb, a, b, mackey, ltk);
1441}
1442
1443static void sc_dhkey_check(struct smp_chan *smp)
1444{
1445	struct hci_conn *hcon = smp->conn->hcon;
1446	struct smp_cmd_dhkey_check check;
1447	u8 a[7], b[7], *local_addr, *remote_addr;
1448	u8 io_cap[3], r[16];
1449
1450	memcpy(a, &hcon->init_addr, 6);
1451	memcpy(b, &hcon->resp_addr, 6);
1452	a[6] = hcon->init_addr_type;
1453	b[6] = hcon->resp_addr_type;
1454
1455	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
1456		local_addr = a;
1457		remote_addr = b;
1458		memcpy(io_cap, &smp->preq[1], 3);
1459	} else {
1460		local_addr = b;
1461		remote_addr = a;
1462		memcpy(io_cap, &smp->prsp[1], 3);
1463	}
1464
1465	memset(r, 0, sizeof(r));
1466
1467	if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
1468		put_unaligned_le32(hcon->passkey_notify, r);
1469
1470	if (smp->method == REQ_OOB)
1471		memcpy(r, smp->rr, 16);
1472
1473	smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap,
1474	       local_addr, remote_addr, check.e);
1475
1476	smp_send_cmd(smp->conn, SMP_CMD_DHKEY_CHECK, sizeof(check), &check);
1477}
1478
1479static u8 sc_passkey_send_confirm(struct smp_chan *smp)
1480{
1481	struct l2cap_conn *conn = smp->conn;
1482	struct hci_conn *hcon = conn->hcon;
1483	struct smp_cmd_pairing_confirm cfm;
1484	u8 r;
1485
1486	r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01);
1487	r |= 0x80;
1488
1489	get_random_bytes(smp->prnd, sizeof(smp->prnd));
1490
1491	if (smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd, r,
1492		   cfm.confirm_val))
1493		return SMP_UNSPECIFIED;
1494
1495	smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm);
1496
1497	return 0;
1498}
1499
1500static u8 sc_passkey_round(struct smp_chan *smp, u8 smp_op)
1501{
1502	struct l2cap_conn *conn = smp->conn;
1503	struct hci_conn *hcon = conn->hcon;
1504	struct hci_dev *hdev = hcon->hdev;
1505	u8 cfm[16], r;
1506
1507	/* Ignore the PDU if we've already done 20 rounds (0 - 19) */
1508	if (smp->passkey_round >= 20)
1509		return 0;
1510
1511	switch (smp_op) {
1512	case SMP_CMD_PAIRING_RANDOM:
1513		r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01);
1514		r |= 0x80;
1515
1516		if (smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk,
1517			   smp->rrnd, r, cfm))
1518			return SMP_UNSPECIFIED;
1519
1520		if (crypto_memneq(smp->pcnf, cfm, 16))
1521			return SMP_CONFIRM_FAILED;
1522
1523		smp->passkey_round++;
1524
1525		if (smp->passkey_round == 20) {
1526			/* Generate MacKey and LTK */
1527			if (sc_mackey_and_ltk(smp, smp->mackey, smp->tk))
1528				return SMP_UNSPECIFIED;
1529		}
1530
1531		/* The round is only complete when the initiator
1532		 * receives pairing random.
1533		 */
1534		if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
1535			smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
1536				     sizeof(smp->prnd), smp->prnd);
1537			if (smp->passkey_round == 20)
1538				SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
1539			else
1540				SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1541			return 0;
1542		}
1543
1544		/* Start the next round */
1545		if (smp->passkey_round != 20)
1546			return sc_passkey_round(smp, 0);
1547
1548		/* Passkey rounds are complete - start DHKey Check */
1549		sc_dhkey_check(smp);
1550		SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
1551
1552		break;
1553
1554	case SMP_CMD_PAIRING_CONFIRM:
1555		if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) {
1556			set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
1557			return 0;
1558		}
1559
1560		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
1561
1562		if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
1563			smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
1564				     sizeof(smp->prnd), smp->prnd);
1565			return 0;
1566		}
1567
1568		return sc_passkey_send_confirm(smp);
1569
1570	case SMP_CMD_PUBLIC_KEY:
1571	default:
1572		/* Initiating device starts the round */
1573		if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags))
1574			return 0;
1575
1576		bt_dev_dbg(hdev, "Starting passkey round %u",
1577			   smp->passkey_round + 1);
1578
1579		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1580
1581		return sc_passkey_send_confirm(smp);
1582	}
1583
1584	return 0;
1585}
1586
1587static int sc_user_reply(struct smp_chan *smp, u16 mgmt_op, __le32 passkey)
1588{
1589	struct l2cap_conn *conn = smp->conn;
1590	struct hci_conn *hcon = conn->hcon;
1591	u8 smp_op;
1592
1593	clear_bit(SMP_FLAG_WAIT_USER, &smp->flags);
1594
1595	switch (mgmt_op) {
1596	case MGMT_OP_USER_PASSKEY_NEG_REPLY:
1597		smp_failure(smp->conn, SMP_PASSKEY_ENTRY_FAILED);
1598		return 0;
1599	case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1600		smp_failure(smp->conn, SMP_NUMERIC_COMP_FAILED);
1601		return 0;
1602	case MGMT_OP_USER_PASSKEY_REPLY:
1603		hcon->passkey_notify = le32_to_cpu(passkey);
1604		smp->passkey_round = 0;
1605
1606		if (test_and_clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags))
1607			smp_op = SMP_CMD_PAIRING_CONFIRM;
1608		else
1609			smp_op = 0;
1610
1611		if (sc_passkey_round(smp, smp_op))
1612			return -EIO;
1613
1614		return 0;
1615	}
1616
1617	/* Initiator sends DHKey check first */
1618	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
1619		sc_dhkey_check(smp);
1620		SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
1621	} else if (test_and_clear_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags)) {
1622		sc_dhkey_check(smp);
1623		sc_add_ltk(smp);
1624	}
1625
1626	return 0;
1627}
1628
1629int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
1630{
1631	struct l2cap_conn *conn = hcon->l2cap_data;
1632	struct l2cap_chan *chan;
1633	struct smp_chan *smp;
1634	u32 value;
1635	int err;
1636
1637	if (!conn)
1638		return -ENOTCONN;
1639
1640	bt_dev_dbg(conn->hcon->hdev, "");
1641
1642	chan = conn->smp;
1643	if (!chan)
1644		return -ENOTCONN;
1645
1646	l2cap_chan_lock(chan);
1647	if (!chan->data) {
1648		err = -ENOTCONN;
1649		goto unlock;
1650	}
1651
1652	smp = chan->data;
1653
1654	if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1655		err = sc_user_reply(smp, mgmt_op, passkey);
1656		goto unlock;
1657	}
1658
1659	switch (mgmt_op) {
1660	case MGMT_OP_USER_PASSKEY_REPLY:
1661		value = le32_to_cpu(passkey);
1662		memset(smp->tk, 0, sizeof(smp->tk));
1663		bt_dev_dbg(conn->hcon->hdev, "PassKey: %u", value);
1664		put_unaligned_le32(value, smp->tk);
1665		fallthrough;
1666	case MGMT_OP_USER_CONFIRM_REPLY:
1667		set_bit(SMP_FLAG_TK_VALID, &smp->flags);
1668		break;
1669	case MGMT_OP_USER_PASSKEY_NEG_REPLY:
1670	case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1671		smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
1672		err = 0;
1673		goto unlock;
1674	default:
1675		smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
1676		err = -EOPNOTSUPP;
1677		goto unlock;
1678	}
1679
1680	err = 0;
1681
1682	/* If it is our turn to send Pairing Confirm, do so now */
1683	if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
1684		u8 rsp = smp_confirm(smp);
1685		if (rsp)
1686			smp_failure(conn, rsp);
1687	}
1688
1689unlock:
1690	l2cap_chan_unlock(chan);
1691	return err;
1692}
1693
1694static void build_bredr_pairing_cmd(struct smp_chan *smp,
1695				    struct smp_cmd_pairing *req,
1696				    struct smp_cmd_pairing *rsp)
1697{
1698	struct l2cap_conn *conn = smp->conn;
1699	struct hci_dev *hdev = conn->hcon->hdev;
1700	u8 local_dist = 0, remote_dist = 0;
1701
1702	if (hci_dev_test_flag(hdev, HCI_BONDABLE)) {
1703		local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
1704		remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
1705	}
1706
1707	if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING))
1708		remote_dist |= SMP_DIST_ID_KEY;
1709
1710	if (hci_dev_test_flag(hdev, HCI_PRIVACY))
1711		local_dist |= SMP_DIST_ID_KEY;
1712
1713	if (!rsp) {
1714		memset(req, 0, sizeof(*req));
1715
1716		req->auth_req        = SMP_AUTH_CT2;
1717		req->init_key_dist   = local_dist;
1718		req->resp_key_dist   = remote_dist;
1719		req->max_key_size    = conn->hcon->enc_key_size;
1720
1721		smp->remote_key_dist = remote_dist;
1722
1723		return;
1724	}
1725
1726	memset(rsp, 0, sizeof(*rsp));
1727
1728	rsp->auth_req        = SMP_AUTH_CT2;
1729	rsp->max_key_size    = conn->hcon->enc_key_size;
1730	rsp->init_key_dist   = req->init_key_dist & remote_dist;
1731	rsp->resp_key_dist   = req->resp_key_dist & local_dist;
1732
1733	smp->remote_key_dist = rsp->init_key_dist;
1734}
1735
1736static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
1737{
1738	struct smp_cmd_pairing rsp, *req = (void *) skb->data;
1739	struct l2cap_chan *chan = conn->smp;
1740	struct hci_dev *hdev = conn->hcon->hdev;
1741	struct smp_chan *smp = chan->data;
1742	u8 key_size, auth, sec_level;
1743	int ret;
1744
1745	bt_dev_dbg(hdev, "conn %p", conn);
1746
1747	if (skb->len < sizeof(*req))
1748		return SMP_INVALID_PARAMS;
1749
1750	if (smp && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
1751		return SMP_CMD_NOTSUPP;
1752
1753	if (!smp) {
1754		smp = smp_chan_create(conn);
1755		if (!smp)
1756			return SMP_UNSPECIFIED;
1757	}
1758
1759	/* We didn't start the pairing, so match remote */
1760	auth = req->auth_req & AUTH_REQ_MASK(hdev);
1761
1762	if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
1763	    (auth & SMP_AUTH_BONDING))
1764		return SMP_PAIRING_NOTSUPP;
1765
1766	if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC))
1767		return SMP_AUTH_REQUIREMENTS;
1768
1769	smp->preq[0] = SMP_CMD_PAIRING_REQ;
1770	memcpy(&smp->preq[1], req, sizeof(*req));
1771	skb_pull(skb, sizeof(*req));
1772
1773	/* If the remote side's OOB flag is set it means it has
1774	 * successfully received our local OOB data - therefore set the
1775	 * flag to indicate that local OOB is in use.
1776	 */
1777	if (req->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob)
1778		set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags);
1779
1780	/* SMP over BR/EDR requires special treatment */
1781	if (conn->hcon->type == ACL_LINK) {
1782		/* We must have a BR/EDR SC link */
1783		if (!test_bit(HCI_CONN_AES_CCM, &conn->hcon->flags) &&
1784		    !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
1785			return SMP_CROSS_TRANSP_NOT_ALLOWED;
1786
1787		set_bit(SMP_FLAG_SC, &smp->flags);
1788
1789		build_bredr_pairing_cmd(smp, req, &rsp);
1790
1791		if (req->auth_req & SMP_AUTH_CT2)
1792			set_bit(SMP_FLAG_CT2, &smp->flags);
1793
1794		key_size = min(req->max_key_size, rsp.max_key_size);
1795		if (check_enc_key_size(conn, key_size))
1796			return SMP_ENC_KEY_SIZE;
1797
1798		/* Clear bits which are generated but not distributed */
1799		smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1800
1801		smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1802		memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
1803		smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
1804
1805		smp_distribute_keys(smp);
1806		return 0;
1807	}
1808
1809	build_pairing_cmd(conn, req, &rsp, auth);
1810
1811	if (rsp.auth_req & SMP_AUTH_SC) {
1812		set_bit(SMP_FLAG_SC, &smp->flags);
1813
1814		if (rsp.auth_req & SMP_AUTH_CT2)
1815			set_bit(SMP_FLAG_CT2, &smp->flags);
1816	}
1817
1818	if (conn->hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
1819		sec_level = BT_SECURITY_MEDIUM;
1820	else
1821		sec_level = authreq_to_seclevel(auth);
1822
1823	if (sec_level > conn->hcon->pending_sec_level)
1824		conn->hcon->pending_sec_level = sec_level;
1825
1826	/* If we need MITM check that it can be achieved. */
1827	if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1828		u8 method;
1829
1830		method = get_auth_method(smp, conn->hcon->io_capability,
1831					 req->io_capability);
1832		if (method == JUST_WORKS || method == JUST_CFM)
1833			return SMP_AUTH_REQUIREMENTS;
1834
1835		/* Force MITM bit if it isn't set by the initiator. */
1836		auth |= SMP_AUTH_MITM;
1837		rsp.auth_req |= SMP_AUTH_MITM;
1838	}
1839
1840	key_size = min(req->max_key_size, rsp.max_key_size);
1841	if (check_enc_key_size(conn, key_size))
1842		return SMP_ENC_KEY_SIZE;
1843
1844	get_random_bytes(smp->prnd, sizeof(smp->prnd));
1845
1846	smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1847	memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
1848
1849	smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
1850
1851	clear_bit(SMP_FLAG_INITIATOR, &smp->flags);
1852
1853	/* Strictly speaking we shouldn't allow Pairing Confirm for the
1854	 * SC case, however some implementations incorrectly copy RFU auth
1855	 * req bits from our security request, which may create a false
1856	 * positive SC enablement.
1857	 */
1858	SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1859
1860	if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1861		SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY);
1862		/* Clear bits which are generated but not distributed */
1863		smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1864		/* Wait for Public Key from Initiating Device */
1865		return 0;
1866	}
1867
1868	/* Request setup of TK */
1869	ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
1870	if (ret)
1871		return SMP_UNSPECIFIED;
1872
1873	return 0;
1874}
1875
1876static u8 sc_send_public_key(struct smp_chan *smp)
1877{
1878	struct hci_dev *hdev = smp->conn->hcon->hdev;
1879
1880	bt_dev_dbg(hdev, "");
1881
1882	if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) {
1883		struct l2cap_chan *chan = hdev->smp_data;
1884		struct smp_dev *smp_dev;
1885
1886		if (!chan || !chan->data)
1887			return SMP_UNSPECIFIED;
1888
1889		smp_dev = chan->data;
1890
1891		memcpy(smp->local_pk, smp_dev->local_pk, 64);
1892		memcpy(smp->lr, smp_dev->local_rand, 16);
1893
1894		if (smp_dev->debug_key)
1895			set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
1896
1897		goto done;
1898	}
1899
1900	if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) {
1901		bt_dev_dbg(hdev, "Using debug keys");
1902		if (set_ecdh_privkey(smp->tfm_ecdh, debug_sk))
1903			return SMP_UNSPECIFIED;
1904		memcpy(smp->local_pk, debug_pk, 64);
1905		set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
1906	} else {
1907		while (true) {
1908			/* Generate key pair for Secure Connections */
1909			if (generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk))
1910				return SMP_UNSPECIFIED;
1911
1912			/* This is unlikely, but we need to check that
1913			 * we didn't accidentally generate a debug key.
1914			 */
1915			if (crypto_memneq(smp->local_pk, debug_pk, 64))
1916				break;
1917		}
1918	}
1919
1920done:
1921	SMP_DBG("Local Public Key X: %32phN", smp->local_pk);
1922	SMP_DBG("Local Public Key Y: %32phN", smp->local_pk + 32);
1923
1924	smp_send_cmd(smp->conn, SMP_CMD_PUBLIC_KEY, 64, smp->local_pk);
1925
1926	return 0;
1927}
1928
1929static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
1930{
1931	struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1932	struct l2cap_chan *chan = conn->smp;
1933	struct smp_chan *smp = chan->data;
1934	struct hci_dev *hdev = conn->hcon->hdev;
1935	u8 key_size, auth;
1936	int ret;
1937
1938	bt_dev_dbg(hdev, "conn %p", conn);
1939
1940	if (skb->len < sizeof(*rsp))
1941		return SMP_INVALID_PARAMS;
1942
1943	if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags))
1944		return SMP_CMD_NOTSUPP;
1945
1946	skb_pull(skb, sizeof(*rsp));
1947
1948	req = (void *) &smp->preq[1];
1949
1950	key_size = min(req->max_key_size, rsp->max_key_size);
1951	if (check_enc_key_size(conn, key_size))
1952		return SMP_ENC_KEY_SIZE;
1953
1954	auth = rsp->auth_req & AUTH_REQ_MASK(hdev);
1955
1956	if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC))
1957		return SMP_AUTH_REQUIREMENTS;
1958
1959	/* If the remote side's OOB flag is set it means it has
1960	 * successfully received our local OOB data - therefore set the
1961	 * flag to indicate that local OOB is in use.
1962	 */
1963	if (rsp->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob)
1964		set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags);
1965
1966	smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1967	memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
1968
1969	/* Update remote key distribution in case the remote cleared
1970	 * some bits that we had enabled in our request.
1971	 */
1972	smp->remote_key_dist &= rsp->resp_key_dist;
1973
1974	if ((req->auth_req & SMP_AUTH_CT2) && (auth & SMP_AUTH_CT2))
1975		set_bit(SMP_FLAG_CT2, &smp->flags);
1976
1977	/* For BR/EDR this means we're done and can start phase 3 */
1978	if (conn->hcon->type == ACL_LINK) {
1979		/* Clear bits which are generated but not distributed */
1980		smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1981		smp_distribute_keys(smp);
1982		return 0;
1983	}
1984
1985	if ((req->auth_req & SMP_AUTH_SC) && (auth & SMP_AUTH_SC))
1986		set_bit(SMP_FLAG_SC, &smp->flags);
1987	else if (conn->hcon->pending_sec_level > BT_SECURITY_HIGH)
1988		conn->hcon->pending_sec_level = BT_SECURITY_HIGH;
1989
1990	/* If we need MITM check that it can be achieved */
1991	if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1992		u8 method;
1993
1994		method = get_auth_method(smp, req->io_capability,
1995					 rsp->io_capability);
1996		if (method == JUST_WORKS || method == JUST_CFM)
1997			return SMP_AUTH_REQUIREMENTS;
1998	}
1999
2000	get_random_bytes(smp->prnd, sizeof(smp->prnd));
2001
2002	/* Update remote key distribution in case the remote cleared
2003	 * some bits that we had enabled in our request.
2004	 */
2005	smp->remote_key_dist &= rsp->resp_key_dist;
2006
2007	if (test_bit(SMP_FLAG_SC, &smp->flags)) {
2008		/* Clear bits which are generated but not distributed */
2009		smp->remote_key_dist &= ~SMP_SC_NO_DIST;
2010		SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY);
2011		return sc_send_public_key(smp);
2012	}
2013
2014	auth |= req->auth_req;
2015
2016	ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2017	if (ret)
2018		return SMP_UNSPECIFIED;
2019
2020	set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2021
2022	/* Can't compose response until we have been confirmed */
2023	if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
2024		return smp_confirm(smp);
2025
2026	return 0;
2027}
2028
2029static u8 sc_check_confirm(struct smp_chan *smp)
2030{
2031	struct l2cap_conn *conn = smp->conn;
2032
2033	bt_dev_dbg(conn->hcon->hdev, "");
2034
2035	if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
2036		return sc_passkey_round(smp, SMP_CMD_PAIRING_CONFIRM);
2037
2038	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2039		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
2040			     smp->prnd);
2041		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2042	}
2043
2044	return 0;
2045}
2046
2047/* Work-around for some implementations that incorrectly copy RFU bits
2048 * from our security request and thereby create the impression that
2049 * we're doing SC when in fact the remote doesn't support it.
2050 */
2051static int fixup_sc_false_positive(struct smp_chan *smp)
2052{
2053	struct l2cap_conn *conn = smp->conn;
2054	struct hci_conn *hcon = conn->hcon;
2055	struct hci_dev *hdev = hcon->hdev;
2056	struct smp_cmd_pairing *req, *rsp;
2057	u8 auth;
2058
2059	/* The issue is only observed when we're in responder role */
2060	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
2061		return SMP_UNSPECIFIED;
2062
2063	if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
2064		bt_dev_err(hdev, "refusing legacy fallback in SC-only mode");
2065		return SMP_UNSPECIFIED;
2066	}
2067
2068	bt_dev_err(hdev, "trying to fall back to legacy SMP");
2069
2070	req = (void *) &smp->preq[1];
2071	rsp = (void *) &smp->prsp[1];
2072
2073	/* Rebuild key dist flags which may have been cleared for SC */
2074	smp->remote_key_dist = (req->init_key_dist & rsp->resp_key_dist);
2075
2076	auth = req->auth_req & AUTH_REQ_MASK(hdev);
2077
2078	if (tk_request(conn, 0, auth, rsp->io_capability, req->io_capability)) {
2079		bt_dev_err(hdev, "failed to fall back to legacy SMP");
2080		return SMP_UNSPECIFIED;
2081	}
2082
2083	clear_bit(SMP_FLAG_SC, &smp->flags);
2084
2085	return 0;
2086}
2087
2088static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
2089{
2090	struct l2cap_chan *chan = conn->smp;
2091	struct smp_chan *smp = chan->data;
2092	struct hci_conn *hcon = conn->hcon;
2093	struct hci_dev *hdev = hcon->hdev;
2094
2095	bt_dev_dbg(hdev, "conn %p %s", conn,
2096		   test_bit(SMP_FLAG_INITIATOR, &smp->flags) ? "initiator" :
2097		   "responder");
2098
2099	if (skb->len < sizeof(smp->pcnf))
2100		return SMP_INVALID_PARAMS;
2101
2102	memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
2103	skb_pull(skb, sizeof(smp->pcnf));
2104
2105	if (test_bit(SMP_FLAG_SC, &smp->flags)) {
2106		int ret;
2107
2108		/* Public Key exchange must happen before any other steps */
2109		if (test_bit(SMP_FLAG_REMOTE_PK, &smp->flags))
2110			return sc_check_confirm(smp);
2111
2112		bt_dev_err(hdev, "Unexpected SMP Pairing Confirm");
2113
2114		ret = fixup_sc_false_positive(smp);
2115		if (ret)
2116			return ret;
2117	}
2118
2119	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2120		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
2121			     smp->prnd);
2122		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2123		return 0;
2124	}
2125
2126	if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
2127		return smp_confirm(smp);
2128
2129	set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2130
2131	return 0;
2132}
2133
2134static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
2135{
2136	struct l2cap_chan *chan = conn->smp;
2137	struct smp_chan *smp = chan->data;
2138	struct hci_conn *hcon = conn->hcon;
2139	u8 *pkax, *pkbx, *na, *nb, confirm_hint;
2140	u32 passkey = 0;
2141	int err;
2142
2143	bt_dev_dbg(hcon->hdev, "conn %p", conn);
2144
2145	if (skb->len < sizeof(smp->rrnd))
2146		return SMP_INVALID_PARAMS;
2147
2148	memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
2149	skb_pull(skb, sizeof(smp->rrnd));
2150
2151	if (!test_bit(SMP_FLAG_SC, &smp->flags))
2152		return smp_random(smp);
2153
2154	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2155		pkax = smp->local_pk;
2156		pkbx = smp->remote_pk;
2157		na   = smp->prnd;
2158		nb   = smp->rrnd;
2159	} else {
2160		pkax = smp->remote_pk;
2161		pkbx = smp->local_pk;
2162		na   = smp->rrnd;
2163		nb   = smp->prnd;
2164	}
2165
2166	if (smp->method == REQ_OOB) {
2167		if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags))
2168			smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
2169				     sizeof(smp->prnd), smp->prnd);
2170		SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
2171		goto mackey_and_ltk;
2172	}
2173
2174	/* Passkey entry has special treatment */
2175	if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
2176		return sc_passkey_round(smp, SMP_CMD_PAIRING_RANDOM);
2177
2178	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2179		u8 cfm[16];
2180
2181		err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk,
2182			     smp->rrnd, 0, cfm);
2183		if (err)
2184			return SMP_UNSPECIFIED;
2185
2186		if (crypto_memneq(smp->pcnf, cfm, 16))
2187			return SMP_CONFIRM_FAILED;
2188	} else {
2189		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
2190			     smp->prnd);
2191		SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
2192	}
2193
2194mackey_and_ltk:
2195	/* Generate MacKey and LTK */
2196	err = sc_mackey_and_ltk(smp, smp->mackey, smp->tk);
2197	if (err)
2198		return SMP_UNSPECIFIED;
2199
2200	if (smp->method == REQ_OOB) {
2201		if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2202			sc_dhkey_check(smp);
2203			SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
2204		}
2205		return 0;
2206	}
2207
2208	err = smp_g2(smp->tfm_cmac, pkax, pkbx, na, nb, &passkey);
2209	if (err)
2210		return SMP_UNSPECIFIED;
2211
2212	/* Always require user confirmation for Just-Works pairing to prevent
2213	 * impersonation attacks, or in case of a legitimate device that is
2214	 * repairing use the confirmation as acknowledgment to proceed with the
2215	 * creation of new keys.
2216	 */
2217	confirm_hint = smp->method == JUST_WORKS ? 1 : 0;
2218
2219	err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, hcon->type,
2220					hcon->dst_type, passkey, confirm_hint);
2221	if (err)
2222		return SMP_UNSPECIFIED;
2223
2224	set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
2225
2226	return 0;
2227}
2228
2229static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
2230{
2231	struct smp_ltk *key;
2232	struct hci_conn *hcon = conn->hcon;
2233
2234	key = hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role);
2235	if (!key)
2236		return false;
2237
2238	if (smp_ltk_sec_level(key) < sec_level)
2239		return false;
2240
2241	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
2242		return true;
2243
2244	hci_le_start_enc(hcon, key->ediv, key->rand, key->val, key->enc_size);
2245	hcon->enc_key_size = key->enc_size;
2246
2247	/* We never store STKs for initiator role, so clear this flag */
2248	clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
2249
2250	return true;
2251}
2252
2253bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level,
2254			     enum smp_key_pref key_pref)
2255{
2256	if (sec_level == BT_SECURITY_LOW)
2257		return true;
2258
2259	/* If we're encrypted with an STK but the caller prefers using
2260	 * LTK claim insufficient security. This way we allow the
2261	 * connection to be re-encrypted with an LTK, even if the LTK
2262	 * provides the same level of security. Only exception is if we
2263	 * don't have an LTK (e.g. because of key distribution bits).
2264	 */
2265	if (key_pref == SMP_USE_LTK &&
2266	    test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) &&
2267	    hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role))
2268		return false;
2269
2270	if (hcon->sec_level >= sec_level)
2271		return true;
2272
2273	return false;
2274}
2275
2276static void smp_send_pairing_req(struct smp_chan *smp, __u8 auth)
2277{
2278	struct smp_cmd_pairing cp;
2279
2280	if (smp->conn->hcon->type == ACL_LINK)
2281		build_bredr_pairing_cmd(smp, &cp, NULL);
2282	else
2283		build_pairing_cmd(smp->conn, &cp, NULL, auth);
2284
2285	smp->preq[0] = SMP_CMD_PAIRING_REQ;
2286	memcpy(&smp->preq[1], &cp, sizeof(cp));
2287
2288	smp_send_cmd(smp->conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
2289	SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
2290
2291	set_bit(SMP_FLAG_INITIATOR, &smp->flags);
2292}
2293
2294static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
2295{
2296	struct smp_cmd_security_req *rp = (void *) skb->data;
2297	struct hci_conn *hcon = conn->hcon;
2298	struct hci_dev *hdev = hcon->hdev;
2299	struct smp_chan *smp;
2300	u8 sec_level, auth;
2301
2302	bt_dev_dbg(hdev, "conn %p", conn);
2303
2304	if (skb->len < sizeof(*rp))
2305		return SMP_INVALID_PARAMS;
2306
2307	if (hcon->role != HCI_ROLE_MASTER)
2308		return SMP_CMD_NOTSUPP;
2309
2310	auth = rp->auth_req & AUTH_REQ_MASK(hdev);
2311
2312	if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC))
2313		return SMP_AUTH_REQUIREMENTS;
2314
2315	if (hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
2316		sec_level = BT_SECURITY_MEDIUM;
2317	else
2318		sec_level = authreq_to_seclevel(auth);
2319
2320	if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) {
2321		/* If link is already encrypted with sufficient security we
2322		 * still need refresh encryption as per Core Spec 5.0 Vol 3,
2323		 * Part H 2.4.6
2324		 */
2325		smp_ltk_encrypt(conn, hcon->sec_level);
2326		return 0;
2327	}
2328
2329	if (sec_level > hcon->pending_sec_level)
2330		hcon->pending_sec_level = sec_level;
2331
2332	if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
2333		return 0;
2334
2335	smp = smp_chan_create(conn);
2336	if (!smp)
2337		return SMP_UNSPECIFIED;
2338
2339	if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
2340	    (auth & SMP_AUTH_BONDING))
2341		return SMP_PAIRING_NOTSUPP;
2342
2343	skb_pull(skb, sizeof(*rp));
2344
2345	smp_send_pairing_req(smp, auth);
2346
2347	return 0;
2348}
2349
2350static void smp_send_security_req(struct smp_chan *smp, __u8 auth)
2351{
2352	struct smp_cmd_security_req cp;
2353
2354	cp.auth_req = auth;
2355	smp_send_cmd(smp->conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
2356	SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_REQ);
2357
2358	clear_bit(SMP_FLAG_INITIATOR, &smp->flags);
2359}
2360
2361int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
2362{
2363	struct l2cap_conn *conn = hcon->l2cap_data;
2364	struct l2cap_chan *chan;
2365	struct smp_chan *smp;
2366	__u8 authreq;
2367	int ret;
2368
2369	bt_dev_dbg(hcon->hdev, "conn %p hcon %p level 0x%2.2x", conn, hcon,
2370		   sec_level);
2371
2372	/* This may be NULL if there's an unexpected disconnection */
2373	if (!conn)
2374		return 1;
2375
2376	if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED))
2377		return 1;
2378
2379	if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK))
2380		return 1;
2381
2382	if (sec_level > hcon->pending_sec_level)
2383		hcon->pending_sec_level = sec_level;
2384
2385	if (hcon->role == HCI_ROLE_MASTER)
2386		if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
2387			return 0;
2388
2389	chan = conn->smp;
2390	if (!chan) {
2391		bt_dev_err(hcon->hdev, "security requested but not available");
2392		return 1;
2393	}
2394
2395	l2cap_chan_lock(chan);
2396
2397	/* If SMP is already in progress ignore this request */
2398	if (chan->data) {
2399		ret = 0;
2400		goto unlock;
2401	}
2402
2403	smp = smp_chan_create(conn);
2404	if (!smp) {
2405		ret = 1;
2406		goto unlock;
2407	}
2408
2409	authreq = seclevel_to_authreq(sec_level);
2410
2411	if (hci_dev_test_flag(hcon->hdev, HCI_SC_ENABLED)) {
2412		authreq |= SMP_AUTH_SC;
2413		if (hci_dev_test_flag(hcon->hdev, HCI_SSP_ENABLED))
2414			authreq |= SMP_AUTH_CT2;
2415	}
2416
2417	/* Don't attempt to set MITM if setting is overridden by debugfs
2418	 * Needed to pass certification test SM/MAS/PKE/BV-01-C
2419	 */
2420	if (!hci_dev_test_flag(hcon->hdev, HCI_FORCE_NO_MITM)) {
2421		/* Require MITM if IO Capability allows or the security level
2422		 * requires it.
2423		 */
2424		if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
2425		    hcon->pending_sec_level > BT_SECURITY_MEDIUM)
2426			authreq |= SMP_AUTH_MITM;
2427	}
2428
2429	if (hcon->role == HCI_ROLE_MASTER)
2430		smp_send_pairing_req(smp, authreq);
2431	else
2432		smp_send_security_req(smp, authreq);
2433
2434	ret = 0;
2435
2436unlock:
2437	l2cap_chan_unlock(chan);
2438	return ret;
2439}
2440
2441int smp_cancel_and_remove_pairing(struct hci_dev *hdev, bdaddr_t *bdaddr,
2442				  u8 addr_type)
2443{
2444	struct hci_conn *hcon;
2445	struct l2cap_conn *conn;
2446	struct l2cap_chan *chan;
2447	struct smp_chan *smp;
2448	int err;
2449
2450	err = hci_remove_ltk(hdev, bdaddr, addr_type);
2451	hci_remove_irk(hdev, bdaddr, addr_type);
2452
2453	hcon = hci_conn_hash_lookup_le(hdev, bdaddr, addr_type);
2454	if (!hcon)
2455		goto done;
2456
2457	conn = hcon->l2cap_data;
2458	if (!conn)
2459		goto done;
2460
2461	chan = conn->smp;
2462	if (!chan)
2463		goto done;
2464
2465	l2cap_chan_lock(chan);
2466
2467	smp = chan->data;
2468	if (smp) {
2469		/* Set keys to NULL to make sure smp_failure() does not try to
2470		 * remove and free already invalidated rcu list entries. */
2471		smp->ltk = NULL;
2472		smp->responder_ltk = NULL;
2473		smp->remote_irk = NULL;
2474
2475		if (test_bit(SMP_FLAG_COMPLETE, &smp->flags))
2476			smp_failure(conn, 0);
2477		else
2478			smp_failure(conn, SMP_UNSPECIFIED);
2479		err = 0;
2480	}
2481
2482	l2cap_chan_unlock(chan);
2483
2484done:
2485	return err;
2486}
2487
2488static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
2489{
2490	struct smp_cmd_encrypt_info *rp = (void *) skb->data;
2491	struct l2cap_chan *chan = conn->smp;
2492	struct smp_chan *smp = chan->data;
2493
2494	bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
2495
2496	if (skb->len < sizeof(*rp))
2497		return SMP_INVALID_PARAMS;
2498
2499	/* Pairing is aborted if any blocked keys are distributed */
2500	if (hci_is_blocked_key(conn->hcon->hdev, HCI_BLOCKED_KEY_TYPE_LTK,
2501			       rp->ltk)) {
2502		bt_dev_warn_ratelimited(conn->hcon->hdev,
2503					"LTK blocked for %pMR",
2504					&conn->hcon->dst);
2505		return SMP_INVALID_PARAMS;
2506	}
2507
2508	SMP_ALLOW_CMD(smp, SMP_CMD_INITIATOR_IDENT);
2509
2510	skb_pull(skb, sizeof(*rp));
2511
2512	memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
2513
2514	return 0;
2515}
2516
2517static int smp_cmd_initiator_ident(struct l2cap_conn *conn, struct sk_buff *skb)
2518{
2519	struct smp_cmd_initiator_ident *rp = (void *)skb->data;
2520	struct l2cap_chan *chan = conn->smp;
2521	struct smp_chan *smp = chan->data;
2522	struct hci_dev *hdev = conn->hcon->hdev;
2523	struct hci_conn *hcon = conn->hcon;
2524	struct smp_ltk *ltk;
2525	u8 authenticated;
2526
2527	bt_dev_dbg(hdev, "conn %p", conn);
2528
2529	if (skb->len < sizeof(*rp))
2530		return SMP_INVALID_PARAMS;
2531
2532	/* Mark the information as received */
2533	smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
2534
2535	if (smp->remote_key_dist & SMP_DIST_ID_KEY)
2536		SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
2537	else if (smp->remote_key_dist & SMP_DIST_SIGN)
2538		SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
2539
2540	skb_pull(skb, sizeof(*rp));
2541
2542	authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
2543	ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK,
2544			  authenticated, smp->tk, smp->enc_key_size,
2545			  rp->ediv, rp->rand);
2546	smp->ltk = ltk;
2547	if (!(smp->remote_key_dist & KEY_DIST_MASK))
2548		smp_distribute_keys(smp);
2549
2550	return 0;
2551}
2552
2553static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
2554{
2555	struct smp_cmd_ident_info *info = (void *) skb->data;
2556	struct l2cap_chan *chan = conn->smp;
2557	struct smp_chan *smp = chan->data;
2558
2559	bt_dev_dbg(conn->hcon->hdev, "");
2560
2561	if (skb->len < sizeof(*info))
2562		return SMP_INVALID_PARAMS;
2563
2564	/* Pairing is aborted if any blocked keys are distributed */
2565	if (hci_is_blocked_key(conn->hcon->hdev, HCI_BLOCKED_KEY_TYPE_IRK,
2566			       info->irk)) {
2567		bt_dev_warn_ratelimited(conn->hcon->hdev,
2568					"Identity key blocked for %pMR",
2569					&conn->hcon->dst);
2570		return SMP_INVALID_PARAMS;
2571	}
2572
2573	SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_ADDR_INFO);
2574
2575	skb_pull(skb, sizeof(*info));
2576
2577	memcpy(smp->irk, info->irk, 16);
2578
2579	return 0;
2580}
2581
2582static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
2583				   struct sk_buff *skb)
2584{
2585	struct smp_cmd_ident_addr_info *info = (void *) skb->data;
2586	struct l2cap_chan *chan = conn->smp;
2587	struct smp_chan *smp = chan->data;
2588	struct hci_conn *hcon = conn->hcon;
2589	bdaddr_t rpa;
2590
2591	bt_dev_dbg(hcon->hdev, "");
2592
2593	if (skb->len < sizeof(*info))
2594		return SMP_INVALID_PARAMS;
2595
2596	/* Mark the information as received */
2597	smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
2598
2599	if (smp->remote_key_dist & SMP_DIST_SIGN)
2600		SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
2601
2602	skb_pull(skb, sizeof(*info));
2603
2604	/* Strictly speaking the Core Specification (4.1) allows sending
2605	 * an empty address which would force us to rely on just the IRK
2606	 * as "identity information". However, since such
2607	 * implementations are not known of and in order to not over
2608	 * complicate our implementation, simply pretend that we never
2609	 * received an IRK for such a device.
2610	 *
2611	 * The Identity Address must also be a Static Random or Public
2612	 * Address, which hci_is_identity_address() checks for.
2613	 */
2614	if (!bacmp(&info->bdaddr, BDADDR_ANY) ||
2615	    !hci_is_identity_address(&info->bdaddr, info->addr_type)) {
2616		bt_dev_err(hcon->hdev, "ignoring IRK with no identity address");
2617		goto distribute;
2618	}
2619
2620	/* Drop IRK if peer is using identity address during pairing but is
2621	 * providing different address as identity information.
2622	 *
2623	 * Microsoft Surface Precision Mouse is known to have this bug.
2624	 */
2625	if (hci_is_identity_address(&hcon->dst, hcon->dst_type) &&
2626	    (bacmp(&info->bdaddr, &hcon->dst) ||
2627	     info->addr_type != hcon->dst_type)) {
2628		bt_dev_err(hcon->hdev,
2629			   "ignoring IRK with invalid identity address");
2630		goto distribute;
2631	}
2632
2633	bacpy(&smp->id_addr, &info->bdaddr);
2634	smp->id_addr_type = info->addr_type;
2635
2636	if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
2637		bacpy(&rpa, &hcon->dst);
2638	else
2639		bacpy(&rpa, BDADDR_ANY);
2640
2641	smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
2642				      smp->id_addr_type, smp->irk, &rpa);
2643
2644distribute:
2645	if (!(smp->remote_key_dist & KEY_DIST_MASK))
2646		smp_distribute_keys(smp);
2647
2648	return 0;
2649}
2650
2651static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
2652{
2653	struct smp_cmd_sign_info *rp = (void *) skb->data;
2654	struct l2cap_chan *chan = conn->smp;
2655	struct smp_chan *smp = chan->data;
2656	struct smp_csrk *csrk;
2657
2658	bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
2659
2660	if (skb->len < sizeof(*rp))
2661		return SMP_INVALID_PARAMS;
2662
2663	/* Mark the information as received */
2664	smp->remote_key_dist &= ~SMP_DIST_SIGN;
2665
2666	skb_pull(skb, sizeof(*rp));
2667
2668	csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
2669	if (csrk) {
2670		if (conn->hcon->sec_level > BT_SECURITY_MEDIUM)
2671			csrk->type = MGMT_CSRK_REMOTE_AUTHENTICATED;
2672		else
2673			csrk->type = MGMT_CSRK_REMOTE_UNAUTHENTICATED;
2674		memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
2675	}
2676	smp->csrk = csrk;
2677	smp_distribute_keys(smp);
2678
2679	return 0;
2680}
2681
2682static u8 sc_select_method(struct smp_chan *smp)
2683{
2684	struct smp_cmd_pairing *local, *remote;
2685	u8 local_mitm, remote_mitm, local_io, remote_io, method;
2686
2687	if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags) ||
2688	    test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags))
2689		return REQ_OOB;
2690
2691	/* The preq/prsp contain the raw Pairing Request/Response PDUs
2692	 * which are needed as inputs to some crypto functions. To get
2693	 * the "struct smp_cmd_pairing" from them we need to skip the
2694	 * first byte which contains the opcode.
2695	 */
2696	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2697		local = (void *) &smp->preq[1];
2698		remote = (void *) &smp->prsp[1];
2699	} else {
2700		local = (void *) &smp->prsp[1];
2701		remote = (void *) &smp->preq[1];
2702	}
2703
2704	local_io = local->io_capability;
2705	remote_io = remote->io_capability;
2706
2707	local_mitm = (local->auth_req & SMP_AUTH_MITM);
2708	remote_mitm = (remote->auth_req & SMP_AUTH_MITM);
2709
2710	/* If either side wants MITM, look up the method from the table,
2711	 * otherwise use JUST WORKS.
2712	 */
2713	if (local_mitm || remote_mitm)
2714		method = get_auth_method(smp, local_io, remote_io);
2715	else
2716		method = JUST_WORKS;
2717
2718	/* Don't confirm locally initiated pairing attempts */
2719	if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
2720		method = JUST_WORKS;
2721
2722	return method;
2723}
2724
2725static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
2726{
2727	struct smp_cmd_public_key *key = (void *) skb->data;
2728	struct hci_conn *hcon = conn->hcon;
2729	struct l2cap_chan *chan = conn->smp;
2730	struct smp_chan *smp = chan->data;
2731	struct hci_dev *hdev = hcon->hdev;
2732	struct crypto_kpp *tfm_ecdh;
2733	struct smp_cmd_pairing_confirm cfm;
2734	int err;
2735
2736	bt_dev_dbg(hdev, "conn %p", conn);
2737
2738	if (skb->len < sizeof(*key))
2739		return SMP_INVALID_PARAMS;
2740
2741	/* Check if remote and local public keys are the same and debug key is
2742	 * not in use.
2743	 */
2744	if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&
2745	    !crypto_memneq(key, smp->local_pk, 64)) {
2746		bt_dev_err(hdev, "Remote and local public keys are identical");
2747		return SMP_DHKEY_CHECK_FAILED;
2748	}
2749
2750	memcpy(smp->remote_pk, key, 64);
2751
2752	if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) {
2753		err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->remote_pk,
2754			     smp->rr, 0, cfm.confirm_val);
2755		if (err)
2756			return SMP_UNSPECIFIED;
2757
2758		if (crypto_memneq(cfm.confirm_val, smp->pcnf, 16))
2759			return SMP_CONFIRM_FAILED;
2760	}
2761
2762	/* Non-initiating device sends its public key after receiving
2763	 * the key from the initiating device.
2764	 */
2765	if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2766		err = sc_send_public_key(smp);
2767		if (err)
2768			return err;
2769	}
2770
2771	SMP_DBG("Remote Public Key X: %32phN", smp->remote_pk);
2772	SMP_DBG("Remote Public Key Y: %32phN", smp->remote_pk + 32);
2773
2774	/* Compute the shared secret on the same crypto tfm on which the private
2775	 * key was set/generated.
2776	 */
2777	if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) {
2778		struct l2cap_chan *hchan = hdev->smp_data;
2779		struct smp_dev *smp_dev;
2780
2781		if (!hchan || !hchan->data)
2782			return SMP_UNSPECIFIED;
2783
2784		smp_dev = hchan->data;
2785
2786		tfm_ecdh = smp_dev->tfm_ecdh;
2787	} else {
2788		tfm_ecdh = smp->tfm_ecdh;
2789	}
2790
2791	if (compute_ecdh_secret(tfm_ecdh, smp->remote_pk, smp->dhkey))
2792		return SMP_UNSPECIFIED;
2793
2794	SMP_DBG("DHKey %32phN", smp->dhkey);
2795
2796	set_bit(SMP_FLAG_REMOTE_PK, &smp->flags);
2797
2798	smp->method = sc_select_method(smp);
2799
2800	bt_dev_dbg(hdev, "selected method 0x%02x", smp->method);
2801
2802	/* JUST_WORKS and JUST_CFM result in an unauthenticated key */
2803	if (smp->method == JUST_WORKS || smp->method == JUST_CFM)
2804		hcon->pending_sec_level = BT_SECURITY_MEDIUM;
2805	else
2806		hcon->pending_sec_level = BT_SECURITY_FIPS;
2807
2808	if (!crypto_memneq(debug_pk, smp->remote_pk, 64))
2809		set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
2810
2811	if (smp->method == DSP_PASSKEY) {
2812		get_random_bytes(&hcon->passkey_notify,
2813				 sizeof(hcon->passkey_notify));
2814		hcon->passkey_notify %= 1000000;
2815		hcon->passkey_entered = 0;
2816		smp->passkey_round = 0;
2817		if (mgmt_user_passkey_notify(hdev, &hcon->dst, hcon->type,
2818					     hcon->dst_type,
2819					     hcon->passkey_notify,
2820					     hcon->passkey_entered))
2821			return SMP_UNSPECIFIED;
2822		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
2823		return sc_passkey_round(smp, SMP_CMD_PUBLIC_KEY);
2824	}
2825
2826	if (smp->method == REQ_OOB) {
2827		if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
2828			smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
2829				     sizeof(smp->prnd), smp->prnd);
2830
2831		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2832
2833		return 0;
2834	}
2835
2836	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
2837		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
2838
2839	if (smp->method == REQ_PASSKEY) {
2840		if (mgmt_user_passkey_request(hdev, &hcon->dst, hcon->type,
2841					      hcon->dst_type))
2842			return SMP_UNSPECIFIED;
2843		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
2844		set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
2845		return 0;
2846	}
2847
2848	/* The Initiating device waits for the non-initiating device to
2849	 * send the confirm value.
2850	 */
2851	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags))
2852		return 0;
2853
2854	err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd,
2855		     0, cfm.confirm_val);
2856	if (err)
2857		return SMP_UNSPECIFIED;
2858
2859	smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm);
2860	SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2861
2862	return 0;
2863}
2864
2865static int smp_cmd_dhkey_check(struct l2cap_conn *conn, struct sk_buff *skb)
2866{
2867	struct smp_cmd_dhkey_check *check = (void *) skb->data;
2868	struct l2cap_chan *chan = conn->smp;
2869	struct hci_conn *hcon = conn->hcon;
2870	struct smp_chan *smp = chan->data;
2871	u8 a[7], b[7], *local_addr, *remote_addr;
2872	u8 io_cap[3], r[16], e[16];
2873	int err;
2874
2875	bt_dev_dbg(hcon->hdev, "conn %p", conn);
2876
2877	if (skb->len < sizeof(*check))
2878		return SMP_INVALID_PARAMS;
2879
2880	memcpy(a, &hcon->init_addr, 6);
2881	memcpy(b, &hcon->resp_addr, 6);
2882	a[6] = hcon->init_addr_type;
2883	b[6] = hcon->resp_addr_type;
2884
2885	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2886		local_addr = a;
2887		remote_addr = b;
2888		memcpy(io_cap, &smp->prsp[1], 3);
2889	} else {
2890		local_addr = b;
2891		remote_addr = a;
2892		memcpy(io_cap, &smp->preq[1], 3);
2893	}
2894
2895	memset(r, 0, sizeof(r));
2896
2897	if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
2898		put_unaligned_le32(hcon->passkey_notify, r);
2899	else if (smp->method == REQ_OOB)
2900		memcpy(r, smp->lr, 16);
2901
2902	err = smp_f6(smp->tfm_cmac, smp->mackey, smp->rrnd, smp->prnd, r,
2903		     io_cap, remote_addr, local_addr, e);
2904	if (err)
2905		return SMP_UNSPECIFIED;
2906
2907	if (crypto_memneq(check->e, e, 16))
2908		return SMP_DHKEY_CHECK_FAILED;
2909
2910	if (!test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2911		if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) {
2912			set_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags);
2913			return 0;
2914		}
2915
2916		/* Responder sends DHKey check as response to initiator */
2917		sc_dhkey_check(smp);
2918	}
2919
2920	sc_add_ltk(smp);
2921
2922	if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
2923		hci_le_start_enc(hcon, 0, 0, smp->tk, smp->enc_key_size);
2924		hcon->enc_key_size = smp->enc_key_size;
2925	}
2926
2927	return 0;
2928}
2929
2930static int smp_cmd_keypress_notify(struct l2cap_conn *conn,
2931				   struct sk_buff *skb)
2932{
2933	struct smp_cmd_keypress_notify *kp = (void *) skb->data;
2934
2935	bt_dev_dbg(conn->hcon->hdev, "value 0x%02x", kp->value);
2936
2937	return 0;
2938}
2939
2940static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb)
2941{
2942	struct l2cap_conn *conn = chan->conn;
2943	struct hci_conn *hcon = conn->hcon;
2944	struct smp_chan *smp;
2945	__u8 code, reason;
2946	int err = 0;
2947
2948	if (skb->len < 1)
2949		return -EILSEQ;
2950
2951	if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED)) {
2952		reason = SMP_PAIRING_NOTSUPP;
2953		goto done;
2954	}
2955
2956	code = skb->data[0];
2957	skb_pull(skb, sizeof(code));
2958
2959	smp = chan->data;
2960
2961	if (code > SMP_CMD_MAX)
2962		goto drop;
2963
2964	if (smp && !test_and_clear_bit(code, &smp->allow_cmd)) {
2965		/* If there is a context and the command is not allowed consider
2966		 * it a failure so the session is cleanup properly.
2967		 */
2968		switch (code) {
2969		case SMP_CMD_IDENT_INFO:
2970		case SMP_CMD_IDENT_ADDR_INFO:
2971		case SMP_CMD_SIGN_INFO:
2972			/* 3.6.1. Key distribution and generation
2973			 *
2974			 * A device may reject a distributed key by sending the
2975			 * Pairing Failed command with the reason set to
2976			 * "Key Rejected".
2977			 */
2978			smp_failure(conn, SMP_KEY_REJECTED);
2979			break;
2980		}
2981		goto drop;
2982	}
2983
2984	/* If we don't have a context the only allowed commands are
2985	 * pairing request and security request.
2986	 */
2987	if (!smp && code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ)
2988		goto drop;
2989
2990	switch (code) {
2991	case SMP_CMD_PAIRING_REQ:
2992		reason = smp_cmd_pairing_req(conn, skb);
2993		break;
2994
2995	case SMP_CMD_PAIRING_FAIL:
2996		smp_failure(conn, 0);
2997		err = -EPERM;
2998		break;
2999
3000	case SMP_CMD_PAIRING_RSP:
3001		reason = smp_cmd_pairing_rsp(conn, skb);
3002		break;
3003
3004	case SMP_CMD_SECURITY_REQ:
3005		reason = smp_cmd_security_req(conn, skb);
3006		break;
3007
3008	case SMP_CMD_PAIRING_CONFIRM:
3009		reason = smp_cmd_pairing_confirm(conn, skb);
3010		break;
3011
3012	case SMP_CMD_PAIRING_RANDOM:
3013		reason = smp_cmd_pairing_random(conn, skb);
3014		break;
3015
3016	case SMP_CMD_ENCRYPT_INFO:
3017		reason = smp_cmd_encrypt_info(conn, skb);
3018		break;
3019
3020	case SMP_CMD_INITIATOR_IDENT:
3021		reason = smp_cmd_initiator_ident(conn, skb);
3022		break;
3023
3024	case SMP_CMD_IDENT_INFO:
3025		reason = smp_cmd_ident_info(conn, skb);
3026		break;
3027
3028	case SMP_CMD_IDENT_ADDR_INFO:
3029		reason = smp_cmd_ident_addr_info(conn, skb);
3030		break;
3031
3032	case SMP_CMD_SIGN_INFO:
3033		reason = smp_cmd_sign_info(conn, skb);
3034		break;
3035
3036	case SMP_CMD_PUBLIC_KEY:
3037		reason = smp_cmd_public_key(conn, skb);
3038		break;
3039
3040	case SMP_CMD_DHKEY_CHECK:
3041		reason = smp_cmd_dhkey_check(conn, skb);
3042		break;
3043
3044	case SMP_CMD_KEYPRESS_NOTIFY:
3045		reason = smp_cmd_keypress_notify(conn, skb);
3046		break;
3047
3048	default:
3049		bt_dev_dbg(hcon->hdev, "Unknown command code 0x%2.2x", code);
3050		reason = SMP_CMD_NOTSUPP;
3051		goto done;
3052	}
3053
3054done:
3055	if (!err) {
3056		if (reason)
3057			smp_failure(conn, reason);
3058		kfree_skb(skb);
3059	}
3060
3061	return err;
3062
3063drop:
3064	bt_dev_err(hcon->hdev, "unexpected SMP command 0x%02x from %pMR",
3065		   code, &hcon->dst);
3066	kfree_skb(skb);
3067	return 0;
3068}
3069
3070static void smp_teardown_cb(struct l2cap_chan *chan, int err)
3071{
3072	struct l2cap_conn *conn = chan->conn;
3073
3074	bt_dev_dbg(conn->hcon->hdev, "chan %p", chan);
3075
3076	if (chan->data)
3077		smp_chan_destroy(conn);
3078
3079	conn->smp = NULL;
3080	l2cap_chan_put(chan);
3081}
3082
3083static void bredr_pairing(struct l2cap_chan *chan)
3084{
3085	struct l2cap_conn *conn = chan->conn;
3086	struct hci_conn *hcon = conn->hcon;
3087	struct hci_dev *hdev = hcon->hdev;
3088	struct smp_chan *smp;
3089
3090	bt_dev_dbg(hdev, "chan %p", chan);
3091
3092	/* Only new pairings are interesting */
3093	if (!test_bit(HCI_CONN_NEW_LINK_KEY, &hcon->flags))
3094		return;
3095
3096	/* Don't bother if we're not encrypted */
3097	if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
3098		return;
3099
3100	/* Only initiator may initiate SMP over BR/EDR */
3101	if (hcon->role != HCI_ROLE_MASTER)
3102		return;
3103
3104	/* Secure Connections support must be enabled */
3105	if (!hci_dev_test_flag(hdev, HCI_SC_ENABLED))
3106		return;
3107
3108	/* BR/EDR must use Secure Connections for SMP */
3109	if (!test_bit(HCI_CONN_AES_CCM, &hcon->flags) &&
3110	    !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
3111		return;
3112
3113	/* If our LE support is not enabled don't do anything */
3114	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
3115		return;
3116
3117	/* Don't bother if remote LE support is not enabled */
3118	if (!lmp_host_le_capable(hcon))
3119		return;
3120
3121	/* Remote must support SMP fixed chan for BR/EDR */
3122	if (!(conn->remote_fixed_chan & L2CAP_FC_SMP_BREDR))
3123		return;
3124
3125	/* Don't bother if SMP is already ongoing */
3126	if (chan->data)
3127		return;
3128
3129	smp = smp_chan_create(conn);
3130	if (!smp) {
3131		bt_dev_err(hdev, "unable to create SMP context for BR/EDR");
3132		return;
3133	}
3134
3135	set_bit(SMP_FLAG_SC, &smp->flags);
3136
3137	bt_dev_dbg(hdev, "starting SMP over BR/EDR");
3138
3139	smp_send_pairing_req(smp, 0x00);
3140}
3141
3142static void smp_resume_cb(struct l2cap_chan *chan)
3143{
3144	struct smp_chan *smp = chan->data;
3145	struct l2cap_conn *conn = chan->conn;
3146	struct hci_conn *hcon = conn->hcon;
3147
3148	bt_dev_dbg(hcon->hdev, "chan %p", chan);
3149
3150	if (hcon->type == ACL_LINK) {
3151		bredr_pairing(chan);
3152		return;
3153	}
3154
3155	if (!smp)
3156		return;
3157
3158	if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
3159		return;
3160
3161	cancel_delayed_work(&smp->security_timer);
3162
3163	smp_distribute_keys(smp);
3164}
3165
3166static void smp_ready_cb(struct l2cap_chan *chan)
3167{
3168	struct l2cap_conn *conn = chan->conn;
3169	struct hci_conn *hcon = conn->hcon;
3170
3171	bt_dev_dbg(hcon->hdev, "chan %p", chan);
3172
3173	/* No need to call l2cap_chan_hold() here since we already own
3174	 * the reference taken in smp_new_conn_cb(). This is just the
3175	 * first time that we tie it to a specific pointer. The code in
3176	 * l2cap_core.c ensures that there's no risk this function won't
3177	 * get called if smp_new_conn_cb was previously called.
3178	 */
3179	conn->smp = chan;
3180
3181	if (hcon->type == ACL_LINK && test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
3182		bredr_pairing(chan);
3183}
3184
3185static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
3186{
3187	int err;
3188
3189	bt_dev_dbg(chan->conn->hcon->hdev, "chan %p", chan);
3190
3191	err = smp_sig_channel(chan, skb);
3192	if (err) {
3193		struct smp_chan *smp = chan->data;
3194
3195		if (smp)
3196			cancel_delayed_work_sync(&smp->security_timer);
3197
3198		hci_disconnect(chan->conn->hcon, HCI_ERROR_AUTH_FAILURE);
3199	}
3200
3201	return err;
3202}
3203
3204static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan,
3205					unsigned long hdr_len,
3206					unsigned long len, int nb)
3207{
3208	struct sk_buff *skb;
3209
3210	skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
3211	if (!skb)
3212		return ERR_PTR(-ENOMEM);
3213
3214	skb->priority = HCI_PRIO_MAX;
3215	bt_cb(skb)->l2cap.chan = chan;
3216
3217	return skb;
3218}
3219
3220static const struct l2cap_ops smp_chan_ops = {
3221	.name			= "Security Manager",
3222	.ready			= smp_ready_cb,
3223	.recv			= smp_recv_cb,
3224	.alloc_skb		= smp_alloc_skb_cb,
3225	.teardown		= smp_teardown_cb,
3226	.resume			= smp_resume_cb,
3227
3228	.new_connection		= l2cap_chan_no_new_connection,
3229	.state_change		= l2cap_chan_no_state_change,
3230	.close			= l2cap_chan_no_close,
3231	.defer			= l2cap_chan_no_defer,
3232	.suspend		= l2cap_chan_no_suspend,
3233	.set_shutdown		= l2cap_chan_no_set_shutdown,
3234	.get_sndtimeo		= l2cap_chan_no_get_sndtimeo,
3235};
3236
3237static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
3238{
3239	struct l2cap_chan *chan;
3240
3241	BT_DBG("pchan %p", pchan);
3242
3243	chan = l2cap_chan_create();
3244	if (!chan)
3245		return NULL;
3246
3247	chan->chan_type	= pchan->chan_type;
3248	chan->ops	= &smp_chan_ops;
3249	chan->scid	= pchan->scid;
3250	chan->dcid	= chan->scid;
3251	chan->imtu	= pchan->imtu;
3252	chan->omtu	= pchan->omtu;
3253	chan->mode	= pchan->mode;
3254
3255	/* Other L2CAP channels may request SMP routines in order to
3256	 * change the security level. This means that the SMP channel
3257	 * lock must be considered in its own category to avoid lockdep
3258	 * warnings.
3259	 */
3260	atomic_set(&chan->nesting, L2CAP_NESTING_SMP);
3261
3262	BT_DBG("created chan %p", chan);
3263
3264	return chan;
3265}
3266
3267static const struct l2cap_ops smp_root_chan_ops = {
3268	.name			= "Security Manager Root",
3269	.new_connection		= smp_new_conn_cb,
3270
3271	/* None of these are implemented for the root channel */
3272	.close			= l2cap_chan_no_close,
3273	.alloc_skb		= l2cap_chan_no_alloc_skb,
3274	.recv			= l2cap_chan_no_recv,
3275	.state_change		= l2cap_chan_no_state_change,
3276	.teardown		= l2cap_chan_no_teardown,
3277	.ready			= l2cap_chan_no_ready,
3278	.defer			= l2cap_chan_no_defer,
3279	.suspend		= l2cap_chan_no_suspend,
3280	.resume			= l2cap_chan_no_resume,
3281	.set_shutdown		= l2cap_chan_no_set_shutdown,
3282	.get_sndtimeo		= l2cap_chan_no_get_sndtimeo,
3283};
3284
3285static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid)
3286{
3287	struct l2cap_chan *chan;
3288	struct smp_dev *smp;
3289	struct crypto_shash *tfm_cmac;
3290	struct crypto_kpp *tfm_ecdh;
3291
3292	if (cid == L2CAP_CID_SMP_BREDR) {
3293		smp = NULL;
3294		goto create_chan;
3295	}
3296
3297	smp = kzalloc(sizeof(*smp), GFP_KERNEL);
3298	if (!smp)
3299		return ERR_PTR(-ENOMEM);
3300
3301	tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0);
3302	if (IS_ERR(tfm_cmac)) {
3303		bt_dev_err(hdev, "Unable to create CMAC crypto context");
3304		kfree_sensitive(smp);
3305		return ERR_CAST(tfm_cmac);
3306	}
3307
3308	tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0);
3309	if (IS_ERR(tfm_ecdh)) {
3310		bt_dev_err(hdev, "Unable to create ECDH crypto context");
3311		crypto_free_shash(tfm_cmac);
3312		kfree_sensitive(smp);
3313		return ERR_CAST(tfm_ecdh);
3314	}
3315
3316	smp->local_oob = false;
3317	smp->tfm_cmac = tfm_cmac;
3318	smp->tfm_ecdh = tfm_ecdh;
3319
3320create_chan:
3321	chan = l2cap_chan_create();
3322	if (!chan) {
3323		if (smp) {
3324			crypto_free_shash(smp->tfm_cmac);
3325			crypto_free_kpp(smp->tfm_ecdh);
3326			kfree_sensitive(smp);
3327		}
3328		return ERR_PTR(-ENOMEM);
3329	}
3330
3331	chan->data = smp;
3332
3333	l2cap_add_scid(chan, cid);
3334
3335	l2cap_chan_set_defaults(chan);
3336
3337	if (cid == L2CAP_CID_SMP) {
3338		u8 bdaddr_type;
3339
3340		hci_copy_identity_address(hdev, &chan->src, &bdaddr_type);
3341
3342		if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
3343			chan->src_type = BDADDR_LE_PUBLIC;
3344		else
3345			chan->src_type = BDADDR_LE_RANDOM;
3346	} else {
3347		bacpy(&chan->src, &hdev->bdaddr);
3348		chan->src_type = BDADDR_BREDR;
3349	}
3350
3351	chan->state = BT_LISTEN;
3352	chan->mode = L2CAP_MODE_BASIC;
3353	chan->imtu = L2CAP_DEFAULT_MTU;
3354	chan->ops = &smp_root_chan_ops;
3355
3356	/* Set correct nesting level for a parent/listening channel */
3357	atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
3358
3359	return chan;
3360}
3361
3362static void smp_del_chan(struct l2cap_chan *chan)
3363{
3364	struct smp_dev *smp;
3365
3366	BT_DBG("chan %p", chan);
3367
3368	smp = chan->data;
3369	if (smp) {
3370		chan->data = NULL;
3371		crypto_free_shash(smp->tfm_cmac);
3372		crypto_free_kpp(smp->tfm_ecdh);
3373		kfree_sensitive(smp);
3374	}
3375
3376	l2cap_chan_put(chan);
3377}
3378
3379int smp_force_bredr(struct hci_dev *hdev, bool enable)
3380{
3381	if (enable == hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
3382		return -EALREADY;
3383
3384	if (enable) {
3385		struct l2cap_chan *chan;
3386
3387		chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR);
3388		if (IS_ERR(chan))
3389			return PTR_ERR(chan);
3390
3391		hdev->smp_bredr_data = chan;
3392	} else {
3393		struct l2cap_chan *chan;
3394
3395		chan = hdev->smp_bredr_data;
3396		hdev->smp_bredr_data = NULL;
3397		smp_del_chan(chan);
3398	}
3399
3400	hci_dev_change_flag(hdev, HCI_FORCE_BREDR_SMP);
3401
3402	return 0;
3403}
3404
3405int smp_register(struct hci_dev *hdev)
3406{
3407	struct l2cap_chan *chan;
3408
3409	bt_dev_dbg(hdev, "");
3410
3411	/* If the controller does not support Low Energy operation, then
3412	 * there is also no need to register any SMP channel.
3413	 */
3414	if (!lmp_le_capable(hdev))
3415		return 0;
3416
3417	if (WARN_ON(hdev->smp_data)) {
3418		chan = hdev->smp_data;
3419		hdev->smp_data = NULL;
3420		smp_del_chan(chan);
3421	}
3422
3423	chan = smp_add_cid(hdev, L2CAP_CID_SMP);
3424	if (IS_ERR(chan))
3425		return PTR_ERR(chan);
3426
3427	hdev->smp_data = chan;
3428
3429	if (!lmp_sc_capable(hdev)) {
3430		/* Flag can be already set here (due to power toggle) */
3431		if (!hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
3432			return 0;
3433	}
3434
3435	if (WARN_ON(hdev->smp_bredr_data)) {
3436		chan = hdev->smp_bredr_data;
3437		hdev->smp_bredr_data = NULL;
3438		smp_del_chan(chan);
3439	}
3440
3441	chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR);
3442	if (IS_ERR(chan)) {
3443		int err = PTR_ERR(chan);
3444		chan = hdev->smp_data;
3445		hdev->smp_data = NULL;
3446		smp_del_chan(chan);
3447		return err;
3448	}
3449
3450	hdev->smp_bredr_data = chan;
3451
3452	return 0;
3453}
3454
3455void smp_unregister(struct hci_dev *hdev)
3456{
3457	struct l2cap_chan *chan;
3458
3459	if (hdev->smp_bredr_data) {
3460		chan = hdev->smp_bredr_data;
3461		hdev->smp_bredr_data = NULL;
3462		smp_del_chan(chan);
3463	}
3464
3465	if (hdev->smp_data) {
3466		chan = hdev->smp_data;
3467		hdev->smp_data = NULL;
3468		smp_del_chan(chan);
3469	}
3470}
3471
3472#if IS_ENABLED(CONFIG_BT_SELFTEST_SMP)
3473
3474static int __init test_debug_key(struct crypto_kpp *tfm_ecdh)
3475{
3476	u8 pk[64];
3477	int err;
3478
3479	err = set_ecdh_privkey(tfm_ecdh, debug_sk);
3480	if (err)
3481		return err;
3482
3483	err = generate_ecdh_public_key(tfm_ecdh, pk);
3484	if (err)
3485		return err;
3486
3487	if (crypto_memneq(pk, debug_pk, 64))
3488		return -EINVAL;
3489
3490	return 0;
3491}
3492
3493static int __init test_ah(void)
3494{
3495	const u8 irk[16] = {
3496			0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3497			0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3498	const u8 r[3] = { 0x94, 0x81, 0x70 };
3499	const u8 exp[3] = { 0xaa, 0xfb, 0x0d };
3500	u8 res[3];
3501	int err;
3502
3503	err = smp_ah(irk, r, res);
3504	if (err)
3505		return err;
3506
3507	if (crypto_memneq(res, exp, 3))
3508		return -EINVAL;
3509
3510	return 0;
3511}
3512
3513static int __init test_c1(void)
3514{
3515	const u8 k[16] = {
3516			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3517			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
3518	const u8 r[16] = {
3519			0xe0, 0x2e, 0x70, 0xc6, 0x4e, 0x27, 0x88, 0x63,
3520			0x0e, 0x6f, 0xad, 0x56, 0x21, 0xd5, 0x83, 0x57 };
3521	const u8 preq[7] = { 0x01, 0x01, 0x00, 0x00, 0x10, 0x07, 0x07 };
3522	const u8 pres[7] = { 0x02, 0x03, 0x00, 0x00, 0x08, 0x00, 0x05 };
3523	const u8 _iat = 0x01;
3524	const u8 _rat = 0x00;
3525	const bdaddr_t ra = { { 0xb6, 0xb5, 0xb4, 0xb3, 0xb2, 0xb1 } };
3526	const bdaddr_t ia = { { 0xa6, 0xa5, 0xa4, 0xa3, 0xa2, 0xa1 } };
3527	const u8 exp[16] = {
3528			0x86, 0x3b, 0xf1, 0xbe, 0xc5, 0x4d, 0xa7, 0xd2,
3529			0xea, 0x88, 0x89, 0x87, 0xef, 0x3f, 0x1e, 0x1e };
3530	u8 res[16];
3531	int err;
3532
3533	err = smp_c1(k, r, preq, pres, _iat, &ia, _rat, &ra, res);
3534	if (err)
3535		return err;
3536
3537	if (crypto_memneq(res, exp, 16))
3538		return -EINVAL;
3539
3540	return 0;
3541}
3542
3543static int __init test_s1(void)
3544{
3545	const u8 k[16] = {
3546			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3547			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
3548	const u8 r1[16] = {
3549			0x88, 0x77, 0x66, 0x55, 0x44, 0x33, 0x22, 0x11 };
3550	const u8 r2[16] = {
3551			0x00, 0xff, 0xee, 0xdd, 0xcc, 0xbb, 0xaa, 0x99 };
3552	const u8 exp[16] = {
3553			0x62, 0xa0, 0x6d, 0x79, 0xae, 0x16, 0x42, 0x5b,
3554			0x9b, 0xf4, 0xb0, 0xe8, 0xf0, 0xe1, 0x1f, 0x9a };
3555	u8 res[16];
3556	int err;
3557
3558	err = smp_s1(k, r1, r2, res);
3559	if (err)
3560		return err;
3561
3562	if (crypto_memneq(res, exp, 16))
3563		return -EINVAL;
3564
3565	return 0;
3566}
3567
3568static int __init test_f4(struct crypto_shash *tfm_cmac)
3569{
3570	const u8 u[32] = {
3571			0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
3572			0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
3573			0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
3574			0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 };
3575	const u8 v[32] = {
3576			0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b,
3577			0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59,
3578			0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90,
3579			0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 };
3580	const u8 x[16] = {
3581			0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3582			0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3583	const u8 z = 0x00;
3584	const u8 exp[16] = {
3585			0x2d, 0x87, 0x74, 0xa9, 0xbe, 0xa1, 0xed, 0xf1,
3586			0x1c, 0xbd, 0xa9, 0x07, 0xf1, 0x16, 0xc9, 0xf2 };
3587	u8 res[16];
3588	int err;
3589
3590	err = smp_f4(tfm_cmac, u, v, x, z, res);
3591	if (err)
3592		return err;
3593
3594	if (crypto_memneq(res, exp, 16))
3595		return -EINVAL;
3596
3597	return 0;
3598}
3599
3600static int __init test_f5(struct crypto_shash *tfm_cmac)
3601{
3602	const u8 w[32] = {
3603			0x98, 0xa6, 0xbf, 0x73, 0xf3, 0x34, 0x8d, 0x86,
3604			0xf1, 0x66, 0xf8, 0xb4, 0x13, 0x6b, 0x79, 0x99,
3605			0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3606			0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3607	const u8 n1[16] = {
3608			0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3609			0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3610	const u8 n2[16] = {
3611			0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3612			0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3613	const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 };
3614	const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 };
3615	const u8 exp_ltk[16] = {
3616			0x38, 0x0a, 0x75, 0x94, 0xb5, 0x22, 0x05, 0x98,
3617			0x23, 0xcd, 0xd7, 0x69, 0x11, 0x79, 0x86, 0x69 };
3618	const u8 exp_mackey[16] = {
3619			0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd,
3620			0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 };
3621	u8 mackey[16], ltk[16];
3622	int err;
3623
3624	err = smp_f5(tfm_cmac, w, n1, n2, a1, a2, mackey, ltk);
3625	if (err)
3626		return err;
3627
3628	if (crypto_memneq(mackey, exp_mackey, 16))
3629		return -EINVAL;
3630
3631	if (crypto_memneq(ltk, exp_ltk, 16))
3632		return -EINVAL;
3633
3634	return 0;
3635}
3636
3637static int __init test_f6(struct crypto_shash *tfm_cmac)
3638{
3639	const u8 w[16] = {
3640			0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd,
3641			0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 };
3642	const u8 n1[16] = {
3643			0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3644			0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3645	const u8 n2[16] = {
3646			0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3647			0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3648	const u8 r[16] = {
3649			0xc8, 0x0f, 0x2d, 0x0c, 0xd2, 0x42, 0xda, 0x08,
3650			0x54, 0xbb, 0x53, 0xb4, 0x3b, 0x34, 0xa3, 0x12 };
3651	const u8 io_cap[3] = { 0x02, 0x01, 0x01 };
3652	const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 };
3653	const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 };
3654	const u8 exp[16] = {
3655			0x61, 0x8f, 0x95, 0xda, 0x09, 0x0b, 0x6c, 0xd2,
3656			0xc5, 0xe8, 0xd0, 0x9c, 0x98, 0x73, 0xc4, 0xe3 };
3657	u8 res[16];
3658	int err;
3659
3660	err = smp_f6(tfm_cmac, w, n1, n2, r, io_cap, a1, a2, res);
3661	if (err)
3662		return err;
3663
3664	if (crypto_memneq(res, exp, 16))
3665		return -EINVAL;
3666
3667	return 0;
3668}
3669
3670static int __init test_g2(struct crypto_shash *tfm_cmac)
3671{
3672	const u8 u[32] = {
3673			0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
3674			0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
3675			0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
3676			0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 };
3677	const u8 v[32] = {
3678			0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b,
3679			0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59,
3680			0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90,
3681			0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 };
3682	const u8 x[16] = {
3683			0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3684			0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3685	const u8 y[16] = {
3686			0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3687			0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3688	const u32 exp_val = 0x2f9ed5ba % 1000000;
3689	u32 val;
3690	int err;
3691
3692	err = smp_g2(tfm_cmac, u, v, x, y, &val);
3693	if (err)
3694		return err;
3695
3696	if (val != exp_val)
3697		return -EINVAL;
3698
3699	return 0;
3700}
3701
3702static int __init test_h6(struct crypto_shash *tfm_cmac)
3703{
3704	const u8 w[16] = {
3705			0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3706			0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3707	const u8 key_id[4] = { 0x72, 0x62, 0x65, 0x6c };
3708	const u8 exp[16] = {
3709			0x99, 0x63, 0xb1, 0x80, 0xe2, 0xa9, 0xd3, 0xe8,
3710			0x1c, 0xc9, 0x6d, 0xe7, 0x02, 0xe1, 0x9a, 0x2d };
3711	u8 res[16];
3712	int err;
3713
3714	err = smp_h6(tfm_cmac, w, key_id, res);
3715	if (err)
3716		return err;
3717
3718	if (crypto_memneq(res, exp, 16))
3719		return -EINVAL;
3720
3721	return 0;
3722}
3723
3724static char test_smp_buffer[32];
3725
3726static ssize_t test_smp_read(struct file *file, char __user *user_buf,
3727			     size_t count, loff_t *ppos)
3728{
3729	return simple_read_from_buffer(user_buf, count, ppos, test_smp_buffer,
3730				       strlen(test_smp_buffer));
3731}
3732
3733static const struct file_operations test_smp_fops = {
3734	.open		= simple_open,
3735	.read		= test_smp_read,
3736	.llseek		= default_llseek,
3737};
3738
3739static int __init run_selftests(struct crypto_shash *tfm_cmac,
3740				struct crypto_kpp *tfm_ecdh)
3741{
3742	ktime_t calltime, delta, rettime;
3743	unsigned long long duration;
3744	int err;
3745
3746	calltime = ktime_get();
3747
3748	err = test_debug_key(tfm_ecdh);
3749	if (err) {
3750		BT_ERR("debug_key test failed");
3751		goto done;
3752	}
3753
3754	err = test_ah();
3755	if (err) {
3756		BT_ERR("smp_ah test failed");
3757		goto done;
3758	}
3759
3760	err = test_c1();
3761	if (err) {
3762		BT_ERR("smp_c1 test failed");
3763		goto done;
3764	}
3765
3766	err = test_s1();
3767	if (err) {
3768		BT_ERR("smp_s1 test failed");
3769		goto done;
3770	}
3771
3772	err = test_f4(tfm_cmac);
3773	if (err) {
3774		BT_ERR("smp_f4 test failed");
3775		goto done;
3776	}
3777
3778	err = test_f5(tfm_cmac);
3779	if (err) {
3780		BT_ERR("smp_f5 test failed");
3781		goto done;
3782	}
3783
3784	err = test_f6(tfm_cmac);
3785	if (err) {
3786		BT_ERR("smp_f6 test failed");
3787		goto done;
3788	}
3789
3790	err = test_g2(tfm_cmac);
3791	if (err) {
3792		BT_ERR("smp_g2 test failed");
3793		goto done;
3794	}
3795
3796	err = test_h6(tfm_cmac);
3797	if (err) {
3798		BT_ERR("smp_h6 test failed");
3799		goto done;
3800	}
3801
3802	rettime = ktime_get();
3803	delta = ktime_sub(rettime, calltime);
3804	duration = (unsigned long long) ktime_to_ns(delta) >> 10;
3805
3806	BT_INFO("SMP test passed in %llu usecs", duration);
3807
3808done:
3809	if (!err)
3810		snprintf(test_smp_buffer, sizeof(test_smp_buffer),
3811			 "PASS (%llu usecs)\n", duration);
3812	else
3813		snprintf(test_smp_buffer, sizeof(test_smp_buffer), "FAIL\n");
3814
3815	debugfs_create_file("selftest_smp", 0444, bt_debugfs, NULL,
3816			    &test_smp_fops);
3817
3818	return err;
3819}
3820
3821int __init bt_selftest_smp(void)
3822{
3823	struct crypto_shash *tfm_cmac;
3824	struct crypto_kpp *tfm_ecdh;
3825	int err;
3826
3827	tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0);
3828	if (IS_ERR(tfm_cmac)) {
3829		BT_ERR("Unable to create CMAC crypto context");
3830		return PTR_ERR(tfm_cmac);
3831	}
3832
3833	tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0);
3834	if (IS_ERR(tfm_ecdh)) {
3835		BT_ERR("Unable to create ECDH crypto context");
3836		crypto_free_shash(tfm_cmac);
3837		return PTR_ERR(tfm_ecdh);
3838	}
3839
3840	err = run_selftests(tfm_cmac, tfm_ecdh);
3841
3842	crypto_free_shash(tfm_cmac);
3843	crypto_free_kpp(tfm_ecdh);
3844
3845	return err;
3846}
3847
3848#endif