xref: /linux/net/bluetooth/smp.c (revision 8b8eed05a1c650c27e78bc47d07f7d6c9ba779e8)
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
4 
5    This program is free software; you can redistribute it and/or modify
6    it under the terms of the GNU General Public License version 2 as
7    published by the Free Software Foundation;
8 
9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 
18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
20    SOFTWARE IS DISCLAIMED.
21 */
22 
23 #include <linux/debugfs.h>
24 #include <linux/scatterlist.h>
25 #include <crypto/aes.h>
26 #include <crypto/hash.h>
27 #include <crypto/kpp.h>
28 #include <crypto/utils.h>
29 
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/l2cap.h>
33 #include <net/bluetooth/mgmt.h>
34 
35 #include "ecdh_helper.h"
36 #include "smp.h"
37 
38 #define SMP_DEV(hdev) \
39 	((struct smp_dev *)((struct l2cap_chan *)((hdev)->smp_data))->data)
40 
41 /* Low-level debug macros to be used for stuff that we don't want
42  * accidentally in dmesg, i.e. the values of the various crypto keys
43  * and the inputs & outputs of crypto functions.
44  */
45 #ifdef DEBUG
46 #define SMP_DBG(fmt, ...) printk(KERN_DEBUG "%s: " fmt, __func__, \
47 				 ##__VA_ARGS__)
48 #else
49 #define SMP_DBG(fmt, ...) no_printk(KERN_DEBUG "%s: " fmt, __func__, \
50 				    ##__VA_ARGS__)
51 #endif
52 
53 #define SMP_ALLOW_CMD(smp, code)	set_bit(code, &smp->allow_cmd)
54 
55 /* Keys which are not distributed with Secure Connections */
56 #define SMP_SC_NO_DIST (SMP_DIST_ENC_KEY | SMP_DIST_LINK_KEY)
57 
58 #define SMP_TIMEOUT	msecs_to_jiffies(30000)
59 
60 #define ID_ADDR_TIMEOUT	msecs_to_jiffies(200)
61 
62 #define AUTH_REQ_MASK(dev)	(hci_dev_test_flag(dev, HCI_SC_ENABLED) ? \
63 				 0x3f : 0x07)
64 #define KEY_DIST_MASK		0x07
65 
66 /* Maximum message length that can be passed to aes_cmac */
67 #define CMAC_MSG_MAX	80
68 
69 enum {
70 	SMP_FLAG_TK_VALID,
71 	SMP_FLAG_CFM_PENDING,
72 	SMP_FLAG_MITM_AUTH,
73 	SMP_FLAG_COMPLETE,
74 	SMP_FLAG_INITIATOR,
75 	SMP_FLAG_SC,
76 	SMP_FLAG_REMOTE_PK,
77 	SMP_FLAG_DEBUG_KEY,
78 	SMP_FLAG_WAIT_USER,
79 	SMP_FLAG_DHKEY_PENDING,
80 	SMP_FLAG_REMOTE_OOB,
81 	SMP_FLAG_LOCAL_OOB,
82 	SMP_FLAG_CT2,
83 };
84 
85 struct smp_dev {
86 	/* Secure Connections OOB data */
87 	bool			local_oob;
88 	u8			local_pk[64];
89 	u8			local_rand[16];
90 	bool			debug_key;
91 
92 	struct crypto_shash	*tfm_cmac;
93 	struct crypto_kpp	*tfm_ecdh;
94 };
95 
96 struct smp_chan {
97 	struct l2cap_conn	*conn;
98 	struct delayed_work	security_timer;
99 	unsigned long           allow_cmd; /* Bitmask of allowed commands */
100 
101 	u8		preq[7]; /* SMP Pairing Request */
102 	u8		prsp[7]; /* SMP Pairing Response */
103 	u8		prnd[16]; /* SMP Pairing Random (local) */
104 	u8		rrnd[16]; /* SMP Pairing Random (remote) */
105 	u8		pcnf[16]; /* SMP Pairing Confirm */
106 	u8		tk[16]; /* SMP Temporary Key */
107 	u8		rr[16]; /* Remote OOB ra/rb value */
108 	u8		lr[16]; /* Local OOB ra/rb value */
109 	u8		enc_key_size;
110 	u8		remote_key_dist;
111 	bdaddr_t	id_addr;
112 	u8		id_addr_type;
113 	u8		irk[16];
114 	struct smp_csrk	*csrk;
115 	struct smp_csrk	*responder_csrk;
116 	struct smp_ltk	*ltk;
117 	struct smp_ltk	*responder_ltk;
118 	struct smp_irk	*remote_irk;
119 	u8		*link_key;
120 	unsigned long	flags;
121 	u8		method;
122 	u8		passkey_round;
123 
124 	/* Secure Connections variables */
125 	u8			local_pk[64];
126 	u8			remote_pk[64];
127 	u8			dhkey[32];
128 	u8			mackey[16];
129 
130 	struct crypto_shash	*tfm_cmac;
131 	struct crypto_kpp	*tfm_ecdh;
132 };
133 
134 /* These debug key values are defined in the SMP section of the core
135  * specification. debug_pk is the public debug key and debug_sk the
136  * private debug key.
137  */
138 static const u8 debug_pk[64] = {
139 		0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
140 		0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
141 		0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
142 		0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20,
143 
144 		0x8b, 0xd2, 0x89, 0x15, 0xd0, 0x8e, 0x1c, 0x74,
145 		0x24, 0x30, 0xed, 0x8f, 0xc2, 0x45, 0x63, 0x76,
146 		0x5c, 0x15, 0x52, 0x5a, 0xbf, 0x9a, 0x32, 0x63,
147 		0x6d, 0xeb, 0x2a, 0x65, 0x49, 0x9c, 0x80, 0xdc,
148 };
149 
150 static const u8 debug_sk[32] = {
151 		0xbd, 0x1a, 0x3c, 0xcd, 0xa6, 0xb8, 0x99, 0x58,
152 		0x99, 0xb7, 0x40, 0xeb, 0x7b, 0x60, 0xff, 0x4a,
153 		0x50, 0x3f, 0x10, 0xd2, 0xe3, 0xb3, 0xc9, 0x74,
154 		0x38, 0x5f, 0xc5, 0xa3, 0xd4, 0xf6, 0x49, 0x3f,
155 };
156 
157 static inline void swap_buf(const u8 *src, u8 *dst, size_t len)
158 {
159 	size_t i;
160 
161 	for (i = 0; i < len; i++)
162 		dst[len - 1 - i] = src[i];
163 }
164 
165 /* The following functions map to the LE SC SMP crypto functions
166  * AES-CMAC, f4, f5, f6, g2 and h6.
167  */
168 
169 static int aes_cmac(struct crypto_shash *tfm, const u8 k[16], const u8 *m,
170 		    size_t len, u8 mac[16])
171 {
172 	uint8_t tmp[16], mac_msb[16], msg_msb[CMAC_MSG_MAX];
173 	int err;
174 
175 	if (len > CMAC_MSG_MAX)
176 		return -EFBIG;
177 
178 	if (!tfm) {
179 		BT_ERR("tfm %p", tfm);
180 		return -EINVAL;
181 	}
182 
183 	/* Swap key and message from LSB to MSB */
184 	swap_buf(k, tmp, 16);
185 	swap_buf(m, msg_msb, len);
186 
187 	SMP_DBG("msg (len %zu) %*phN", len, (int) len, m);
188 	SMP_DBG("key %16phN", k);
189 
190 	err = crypto_shash_setkey(tfm, tmp, 16);
191 	if (err) {
192 		BT_ERR("cipher setkey failed: %d", err);
193 		return err;
194 	}
195 
196 	err = crypto_shash_tfm_digest(tfm, msg_msb, len, mac_msb);
197 	if (err) {
198 		BT_ERR("Hash computation error %d", err);
199 		return err;
200 	}
201 
202 	swap_buf(mac_msb, mac, 16);
203 
204 	SMP_DBG("mac %16phN", mac);
205 
206 	return 0;
207 }
208 
209 static int smp_f4(struct crypto_shash *tfm_cmac, const u8 u[32],
210 		  const u8 v[32], const u8 x[16], u8 z, u8 res[16])
211 {
212 	u8 m[65];
213 	int err;
214 
215 	SMP_DBG("u %32phN", u);
216 	SMP_DBG("v %32phN", v);
217 	SMP_DBG("x %16phN z %02x", x, z);
218 
219 	m[0] = z;
220 	memcpy(m + 1, v, 32);
221 	memcpy(m + 33, u, 32);
222 
223 	err = aes_cmac(tfm_cmac, x, m, sizeof(m), res);
224 	if (err)
225 		return err;
226 
227 	SMP_DBG("res %16phN", res);
228 
229 	return err;
230 }
231 
232 static int smp_f5(struct crypto_shash *tfm_cmac, const u8 w[32],
233 		  const u8 n1[16], const u8 n2[16], const u8 a1[7],
234 		  const u8 a2[7], u8 mackey[16], u8 ltk[16])
235 {
236 	/* The btle, salt and length "magic" values are as defined in
237 	 * the SMP section of the Bluetooth core specification. In ASCII
238 	 * the btle value ends up being 'btle'. The salt is just a
239 	 * random number whereas length is the value 256 in little
240 	 * endian format.
241 	 */
242 	const u8 btle[4] = { 0x65, 0x6c, 0x74, 0x62 };
243 	const u8 salt[16] = { 0xbe, 0x83, 0x60, 0x5a, 0xdb, 0x0b, 0x37, 0x60,
244 			      0x38, 0xa5, 0xf5, 0xaa, 0x91, 0x83, 0x88, 0x6c };
245 	const u8 length[2] = { 0x00, 0x01 };
246 	u8 m[53], t[16];
247 	int err;
248 
249 	SMP_DBG("w %32phN", w);
250 	SMP_DBG("n1 %16phN n2 %16phN", n1, n2);
251 	SMP_DBG("a1 %7phN a2 %7phN", a1, a2);
252 
253 	err = aes_cmac(tfm_cmac, salt, w, 32, t);
254 	if (err)
255 		return err;
256 
257 	SMP_DBG("t %16phN", t);
258 
259 	memcpy(m, length, 2);
260 	memcpy(m + 2, a2, 7);
261 	memcpy(m + 9, a1, 7);
262 	memcpy(m + 16, n2, 16);
263 	memcpy(m + 32, n1, 16);
264 	memcpy(m + 48, btle, 4);
265 
266 	m[52] = 0; /* Counter */
267 
268 	err = aes_cmac(tfm_cmac, t, m, sizeof(m), mackey);
269 	if (err)
270 		return err;
271 
272 	SMP_DBG("mackey %16phN", mackey);
273 
274 	m[52] = 1; /* Counter */
275 
276 	err = aes_cmac(tfm_cmac, t, m, sizeof(m), ltk);
277 	if (err)
278 		return err;
279 
280 	SMP_DBG("ltk %16phN", ltk);
281 
282 	return 0;
283 }
284 
285 static int smp_f6(struct crypto_shash *tfm_cmac, const u8 w[16],
286 		  const u8 n1[16], const u8 n2[16], const u8 r[16],
287 		  const u8 io_cap[3], const u8 a1[7], const u8 a2[7],
288 		  u8 res[16])
289 {
290 	u8 m[65];
291 	int err;
292 
293 	SMP_DBG("w %16phN", w);
294 	SMP_DBG("n1 %16phN n2 %16phN", n1, n2);
295 	SMP_DBG("r %16phN io_cap %3phN a1 %7phN a2 %7phN", r, io_cap, a1, a2);
296 
297 	memcpy(m, a2, 7);
298 	memcpy(m + 7, a1, 7);
299 	memcpy(m + 14, io_cap, 3);
300 	memcpy(m + 17, r, 16);
301 	memcpy(m + 33, n2, 16);
302 	memcpy(m + 49, n1, 16);
303 
304 	err = aes_cmac(tfm_cmac, w, m, sizeof(m), res);
305 	if (err)
306 		return err;
307 
308 	SMP_DBG("res %16phN", res);
309 
310 	return err;
311 }
312 
313 static int smp_g2(struct crypto_shash *tfm_cmac, const u8 u[32], const u8 v[32],
314 		  const u8 x[16], const u8 y[16], u32 *val)
315 {
316 	u8 m[80], tmp[16];
317 	int err;
318 
319 	SMP_DBG("u %32phN", u);
320 	SMP_DBG("v %32phN", v);
321 	SMP_DBG("x %16phN y %16phN", x, y);
322 
323 	memcpy(m, y, 16);
324 	memcpy(m + 16, v, 32);
325 	memcpy(m + 48, u, 32);
326 
327 	err = aes_cmac(tfm_cmac, x, m, sizeof(m), tmp);
328 	if (err)
329 		return err;
330 
331 	*val = get_unaligned_le32(tmp);
332 	*val %= 1000000;
333 
334 	SMP_DBG("val %06u", *val);
335 
336 	return 0;
337 }
338 
339 static int smp_h6(struct crypto_shash *tfm_cmac, const u8 w[16],
340 		  const u8 key_id[4], u8 res[16])
341 {
342 	int err;
343 
344 	SMP_DBG("w %16phN key_id %4phN", w, key_id);
345 
346 	err = aes_cmac(tfm_cmac, w, key_id, 4, res);
347 	if (err)
348 		return err;
349 
350 	SMP_DBG("res %16phN", res);
351 
352 	return err;
353 }
354 
355 static int smp_h7(struct crypto_shash *tfm_cmac, const u8 w[16],
356 		  const u8 salt[16], u8 res[16])
357 {
358 	int err;
359 
360 	SMP_DBG("w %16phN salt %16phN", w, salt);
361 
362 	err = aes_cmac(tfm_cmac, salt, w, 16, res);
363 	if (err)
364 		return err;
365 
366 	SMP_DBG("res %16phN", res);
367 
368 	return err;
369 }
370 
371 /* The following functions map to the legacy SMP crypto functions e, c1,
372  * s1 and ah.
373  */
374 
375 static int smp_e(const u8 *k, u8 *r)
376 {
377 	struct crypto_aes_ctx ctx;
378 	uint8_t tmp[16], data[16];
379 	int err;
380 
381 	SMP_DBG("k %16phN r %16phN", k, r);
382 
383 	/* The most significant octet of key corresponds to k[0] */
384 	swap_buf(k, tmp, 16);
385 
386 	err = aes_expandkey(&ctx, tmp, 16);
387 	if (err) {
388 		BT_ERR("cipher setkey failed: %d", err);
389 		return err;
390 	}
391 
392 	/* Most significant octet of plaintextData corresponds to data[0] */
393 	swap_buf(r, data, 16);
394 
395 	aes_encrypt(&ctx, data, data);
396 
397 	/* Most significant octet of encryptedData corresponds to data[0] */
398 	swap_buf(data, r, 16);
399 
400 	SMP_DBG("r %16phN", r);
401 
402 	memzero_explicit(&ctx, sizeof(ctx));
403 	return err;
404 }
405 
406 static int smp_c1(const u8 k[16],
407 		  const u8 r[16], const u8 preq[7], const u8 pres[7], u8 _iat,
408 		  const bdaddr_t *ia, u8 _rat, const bdaddr_t *ra, u8 res[16])
409 {
410 	u8 p1[16], p2[16];
411 	int err;
412 
413 	SMP_DBG("k %16phN r %16phN", k, r);
414 	SMP_DBG("iat %u ia %6phN rat %u ra %6phN", _iat, ia, _rat, ra);
415 	SMP_DBG("preq %7phN pres %7phN", preq, pres);
416 
417 	memset(p1, 0, 16);
418 
419 	/* p1 = pres || preq || _rat || _iat */
420 	p1[0] = _iat;
421 	p1[1] = _rat;
422 	memcpy(p1 + 2, preq, 7);
423 	memcpy(p1 + 9, pres, 7);
424 
425 	SMP_DBG("p1 %16phN", p1);
426 
427 	/* res = r XOR p1 */
428 	crypto_xor_cpy(res, r, p1, sizeof(p1));
429 
430 	/* res = e(k, res) */
431 	err = smp_e(k, res);
432 	if (err) {
433 		BT_ERR("Encrypt data error");
434 		return err;
435 	}
436 
437 	/* p2 = padding || ia || ra */
438 	memcpy(p2, ra, 6);
439 	memcpy(p2 + 6, ia, 6);
440 	memset(p2 + 12, 0, 4);
441 
442 	SMP_DBG("p2 %16phN", p2);
443 
444 	/* res = res XOR p2 */
445 	crypto_xor(res, p2, sizeof(p2));
446 
447 	/* res = e(k, res) */
448 	err = smp_e(k, res);
449 	if (err)
450 		BT_ERR("Encrypt data error");
451 
452 	return err;
453 }
454 
455 static int smp_s1(const u8 k[16],
456 		  const u8 r1[16], const u8 r2[16], u8 _r[16])
457 {
458 	int err;
459 
460 	/* Just least significant octets from r1 and r2 are considered */
461 	memcpy(_r, r2, 8);
462 	memcpy(_r + 8, r1, 8);
463 
464 	err = smp_e(k, _r);
465 	if (err)
466 		BT_ERR("Encrypt data error");
467 
468 	return err;
469 }
470 
471 static int smp_ah(const u8 irk[16], const u8 r[3], u8 res[3])
472 {
473 	u8 _res[16];
474 	int err;
475 
476 	/* r' = padding || r */
477 	memcpy(_res, r, 3);
478 	memset(_res + 3, 0, 13);
479 
480 	err = smp_e(irk, _res);
481 	if (err) {
482 		BT_ERR("Encrypt error");
483 		return err;
484 	}
485 
486 	/* The output of the random address function ah is:
487 	 *	ah(k, r) = e(k, r') mod 2^24
488 	 * The output of the security function e is then truncated to 24 bits
489 	 * by taking the least significant 24 bits of the output of e as the
490 	 * result of ah.
491 	 */
492 	memcpy(res, _res, 3);
493 
494 	return 0;
495 }
496 
497 bool smp_irk_matches(struct hci_dev *hdev, const u8 irk[16],
498 		     const bdaddr_t *bdaddr)
499 {
500 	struct l2cap_chan *chan = hdev->smp_data;
501 	u8 hash[3];
502 	int err;
503 
504 	if (!chan || !chan->data)
505 		return false;
506 
507 	bt_dev_dbg(hdev, "RPA %pMR IRK %*phN", bdaddr, 16, irk);
508 
509 	err = smp_ah(irk, &bdaddr->b[3], hash);
510 	if (err)
511 		return false;
512 
513 	return !crypto_memneq(bdaddr->b, hash, 3);
514 }
515 
516 int smp_generate_rpa(struct hci_dev *hdev, const u8 irk[16], bdaddr_t *rpa)
517 {
518 	struct l2cap_chan *chan = hdev->smp_data;
519 	int err;
520 
521 	if (!chan || !chan->data)
522 		return -EOPNOTSUPP;
523 
524 	get_random_bytes(&rpa->b[3], 3);
525 
526 	rpa->b[5] &= 0x3f;	/* Clear two most significant bits */
527 	rpa->b[5] |= 0x40;	/* Set second most significant bit */
528 
529 	err = smp_ah(irk, &rpa->b[3], rpa->b);
530 	if (err < 0)
531 		return err;
532 
533 	bt_dev_dbg(hdev, "RPA %pMR", rpa);
534 
535 	return 0;
536 }
537 
538 int smp_generate_oob(struct hci_dev *hdev, u8 hash[16], u8 rand[16])
539 {
540 	struct l2cap_chan *chan = hdev->smp_data;
541 	struct smp_dev *smp;
542 	int err;
543 
544 	if (!chan || !chan->data)
545 		return -EOPNOTSUPP;
546 
547 	smp = chan->data;
548 
549 	if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) {
550 		bt_dev_dbg(hdev, "Using debug keys");
551 		err = set_ecdh_privkey(smp->tfm_ecdh, debug_sk);
552 		if (err)
553 			return err;
554 		memcpy(smp->local_pk, debug_pk, 64);
555 		smp->debug_key = true;
556 	} else {
557 		while (true) {
558 			/* Generate key pair for Secure Connections */
559 			err = generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk);
560 			if (err)
561 				return err;
562 
563 			/* This is unlikely, but we need to check that
564 			 * we didn't accidentally generate a debug key.
565 			 */
566 			if (crypto_memneq(smp->local_pk, debug_pk, 64))
567 				break;
568 		}
569 		smp->debug_key = false;
570 	}
571 
572 	SMP_DBG("OOB Public Key X: %32phN", smp->local_pk);
573 	SMP_DBG("OOB Public Key Y: %32phN", smp->local_pk + 32);
574 
575 	get_random_bytes(smp->local_rand, 16);
576 
577 	err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->local_pk,
578 		     smp->local_rand, 0, hash);
579 	if (err < 0)
580 		return err;
581 
582 	memcpy(rand, smp->local_rand, 16);
583 
584 	smp->local_oob = true;
585 
586 	return 0;
587 }
588 
589 static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
590 {
591 	struct l2cap_chan *chan = conn->smp;
592 	struct smp_chan *smp;
593 	struct kvec iv[2];
594 	struct msghdr msg;
595 
596 	if (!chan)
597 		return;
598 
599 	bt_dev_dbg(conn->hcon->hdev, "code 0x%2.2x", code);
600 
601 	iv[0].iov_base = &code;
602 	iv[0].iov_len = 1;
603 
604 	iv[1].iov_base = data;
605 	iv[1].iov_len = len;
606 
607 	memset(&msg, 0, sizeof(msg));
608 
609 	iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iv, 2, 1 + len);
610 
611 	l2cap_chan_send(chan, &msg, 1 + len);
612 
613 	if (!chan->data)
614 		return;
615 
616 	smp = chan->data;
617 
618 	cancel_delayed_work_sync(&smp->security_timer);
619 	schedule_delayed_work(&smp->security_timer, SMP_TIMEOUT);
620 }
621 
622 static u8 authreq_to_seclevel(u8 authreq)
623 {
624 	if (authreq & SMP_AUTH_MITM) {
625 		if (authreq & SMP_AUTH_SC)
626 			return BT_SECURITY_FIPS;
627 		else
628 			return BT_SECURITY_HIGH;
629 	} else {
630 		return BT_SECURITY_MEDIUM;
631 	}
632 }
633 
634 static __u8 seclevel_to_authreq(__u8 sec_level)
635 {
636 	switch (sec_level) {
637 	case BT_SECURITY_FIPS:
638 	case BT_SECURITY_HIGH:
639 		return SMP_AUTH_MITM | SMP_AUTH_BONDING;
640 	case BT_SECURITY_MEDIUM:
641 		return SMP_AUTH_BONDING;
642 	default:
643 		return SMP_AUTH_NONE;
644 	}
645 }
646 
647 static void build_pairing_cmd(struct l2cap_conn *conn,
648 			      struct smp_cmd_pairing *req,
649 			      struct smp_cmd_pairing *rsp, __u8 authreq)
650 {
651 	struct l2cap_chan *chan = conn->smp;
652 	struct smp_chan *smp = chan->data;
653 	struct hci_conn *hcon = conn->hcon;
654 	struct hci_dev *hdev = hcon->hdev;
655 	u8 local_dist = 0, remote_dist = 0, oob_flag = SMP_OOB_NOT_PRESENT;
656 
657 	if (hci_dev_test_flag(hdev, HCI_BONDABLE)) {
658 		local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
659 		remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
660 		authreq |= SMP_AUTH_BONDING;
661 	} else {
662 		authreq &= ~SMP_AUTH_BONDING;
663 	}
664 
665 	if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING))
666 		remote_dist |= SMP_DIST_ID_KEY;
667 
668 	if (hci_dev_test_flag(hdev, HCI_PRIVACY))
669 		local_dist |= SMP_DIST_ID_KEY;
670 
671 	if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
672 	    (authreq & SMP_AUTH_SC)) {
673 		struct oob_data *oob_data;
674 		u8 bdaddr_type;
675 
676 		if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
677 			local_dist |= SMP_DIST_LINK_KEY;
678 			remote_dist |= SMP_DIST_LINK_KEY;
679 		}
680 
681 		if (hcon->dst_type == ADDR_LE_DEV_PUBLIC)
682 			bdaddr_type = BDADDR_LE_PUBLIC;
683 		else
684 			bdaddr_type = BDADDR_LE_RANDOM;
685 
686 		oob_data = hci_find_remote_oob_data(hdev, &hcon->dst,
687 						    bdaddr_type);
688 		if (oob_data && oob_data->present) {
689 			set_bit(SMP_FLAG_REMOTE_OOB, &smp->flags);
690 			oob_flag = SMP_OOB_PRESENT;
691 			memcpy(smp->rr, oob_data->rand256, 16);
692 			memcpy(smp->pcnf, oob_data->hash256, 16);
693 			SMP_DBG("OOB Remote Confirmation: %16phN", smp->pcnf);
694 			SMP_DBG("OOB Remote Random: %16phN", smp->rr);
695 		}
696 
697 	} else {
698 		authreq &= ~SMP_AUTH_SC;
699 	}
700 
701 	if (rsp == NULL) {
702 		req->io_capability = conn->hcon->io_capability;
703 		req->oob_flag = oob_flag;
704 		req->max_key_size = hdev->le_max_key_size;
705 		req->init_key_dist = local_dist;
706 		req->resp_key_dist = remote_dist;
707 		req->auth_req = (authreq & AUTH_REQ_MASK(hdev));
708 
709 		smp->remote_key_dist = remote_dist;
710 		return;
711 	}
712 
713 	rsp->io_capability = conn->hcon->io_capability;
714 	rsp->oob_flag = oob_flag;
715 	rsp->max_key_size = hdev->le_max_key_size;
716 	rsp->init_key_dist = req->init_key_dist & remote_dist;
717 	rsp->resp_key_dist = req->resp_key_dist & local_dist;
718 	rsp->auth_req = (authreq & AUTH_REQ_MASK(hdev));
719 
720 	smp->remote_key_dist = rsp->init_key_dist;
721 }
722 
723 static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
724 {
725 	struct l2cap_chan *chan = conn->smp;
726 	struct hci_dev *hdev = conn->hcon->hdev;
727 	struct smp_chan *smp = chan->data;
728 
729 	if (conn->hcon->pending_sec_level == BT_SECURITY_FIPS &&
730 	    max_key_size != SMP_MAX_ENC_KEY_SIZE)
731 		return SMP_ENC_KEY_SIZE;
732 
733 	if (max_key_size > hdev->le_max_key_size ||
734 	    max_key_size < SMP_MIN_ENC_KEY_SIZE)
735 		return SMP_ENC_KEY_SIZE;
736 
737 	smp->enc_key_size = max_key_size;
738 
739 	return 0;
740 }
741 
742 static void smp_chan_destroy(struct l2cap_conn *conn)
743 {
744 	struct l2cap_chan *chan = conn->smp;
745 	struct smp_chan *smp = chan->data;
746 	struct hci_conn *hcon = conn->hcon;
747 	bool complete;
748 
749 	BUG_ON(!smp);
750 
751 	cancel_delayed_work_sync(&smp->security_timer);
752 
753 	complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
754 	mgmt_smp_complete(hcon, complete);
755 
756 	kfree_sensitive(smp->csrk);
757 	kfree_sensitive(smp->responder_csrk);
758 	kfree_sensitive(smp->link_key);
759 
760 	crypto_free_shash(smp->tfm_cmac);
761 	crypto_free_kpp(smp->tfm_ecdh);
762 
763 	/* Ensure that we don't leave any debug key around if debug key
764 	 * support hasn't been explicitly enabled.
765 	 */
766 	if (smp->ltk && smp->ltk->type == SMP_LTK_P256_DEBUG &&
767 	    !hci_dev_test_flag(hcon->hdev, HCI_KEEP_DEBUG_KEYS)) {
768 		list_del_rcu(&smp->ltk->list);
769 		kfree_rcu(smp->ltk, rcu);
770 		smp->ltk = NULL;
771 	}
772 
773 	/* If pairing failed clean up any keys we might have */
774 	if (!complete) {
775 		if (smp->ltk) {
776 			list_del_rcu(&smp->ltk->list);
777 			kfree_rcu(smp->ltk, rcu);
778 		}
779 
780 		if (smp->responder_ltk) {
781 			list_del_rcu(&smp->responder_ltk->list);
782 			kfree_rcu(smp->responder_ltk, rcu);
783 		}
784 
785 		if (smp->remote_irk) {
786 			list_del_rcu(&smp->remote_irk->list);
787 			kfree_rcu(smp->remote_irk, rcu);
788 		}
789 	}
790 
791 	chan->data = NULL;
792 	kfree_sensitive(smp);
793 	hci_conn_drop(hcon);
794 }
795 
796 static void smp_failure(struct l2cap_conn *conn, u8 reason)
797 {
798 	struct hci_conn *hcon = conn->hcon;
799 	struct l2cap_chan *chan = conn->smp;
800 
801 	if (reason)
802 		smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
803 			     &reason);
804 
805 	mgmt_auth_failed(hcon, HCI_ERROR_AUTH_FAILURE);
806 
807 	if (chan->data)
808 		smp_chan_destroy(conn);
809 }
810 
811 #define JUST_WORKS	0x00
812 #define JUST_CFM	0x01
813 #define REQ_PASSKEY	0x02
814 #define CFM_PASSKEY	0x03
815 #define REQ_OOB		0x04
816 #define DSP_PASSKEY	0x05
817 #define OVERLAP		0xFF
818 
819 static const u8 gen_method[5][5] = {
820 	{ JUST_WORKS,  JUST_CFM,    REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
821 	{ JUST_WORKS,  JUST_CFM,    REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
822 	{ CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
823 	{ JUST_WORKS,  JUST_CFM,    JUST_WORKS,  JUST_WORKS, JUST_CFM    },
824 	{ CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP     },
825 };
826 
827 static const u8 sc_method[5][5] = {
828 	{ JUST_WORKS,  JUST_CFM,    REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
829 	{ JUST_WORKS,  CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
830 	{ DSP_PASSKEY, DSP_PASSKEY, REQ_PASSKEY, JUST_WORKS, DSP_PASSKEY },
831 	{ JUST_WORKS,  JUST_CFM,    JUST_WORKS,  JUST_WORKS, JUST_CFM    },
832 	{ DSP_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
833 };
834 
835 static u8 get_auth_method(struct smp_chan *smp, u8 local_io, u8 remote_io)
836 {
837 	/* If either side has unknown io_caps, use JUST_CFM (which gets
838 	 * converted later to JUST_WORKS if we're initiators.
839 	 */
840 	if (local_io > SMP_IO_KEYBOARD_DISPLAY ||
841 	    remote_io > SMP_IO_KEYBOARD_DISPLAY)
842 		return JUST_CFM;
843 
844 	if (test_bit(SMP_FLAG_SC, &smp->flags))
845 		return sc_method[remote_io][local_io];
846 
847 	return gen_method[remote_io][local_io];
848 }
849 
850 static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
851 						u8 local_io, u8 remote_io)
852 {
853 	struct hci_conn *hcon = conn->hcon;
854 	struct l2cap_chan *chan = conn->smp;
855 	struct smp_chan *smp = chan->data;
856 	u32 passkey = 0;
857 	int ret;
858 
859 	/* Initialize key for JUST WORKS */
860 	memset(smp->tk, 0, sizeof(smp->tk));
861 	clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
862 
863 	bt_dev_dbg(hcon->hdev, "auth:%u lcl:%u rem:%u", auth, local_io,
864 		   remote_io);
865 
866 	/* If neither side wants MITM, either "just" confirm an incoming
867 	 * request or use just-works for outgoing ones. The JUST_CFM
868 	 * will be converted to JUST_WORKS if necessary later in this
869 	 * function. If either side has MITM look up the method from the
870 	 * table.
871 	 */
872 	if (!(auth & SMP_AUTH_MITM))
873 		smp->method = JUST_CFM;
874 	else
875 		smp->method = get_auth_method(smp, local_io, remote_io);
876 
877 	/* Don't confirm locally initiated pairing attempts */
878 	if (smp->method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR,
879 						&smp->flags))
880 		smp->method = JUST_WORKS;
881 
882 	/* Don't bother user space with no IO capabilities */
883 	if (smp->method == JUST_CFM &&
884 	    hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
885 		smp->method = JUST_WORKS;
886 
887 	/* If Just Works, Continue with Zero TK and ask user-space for
888 	 * confirmation */
889 	if (smp->method == JUST_WORKS) {
890 		ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
891 						hcon->type,
892 						hcon->dst_type,
893 						passkey, 1);
894 		if (ret)
895 			return ret;
896 		set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
897 		return 0;
898 	}
899 
900 	/* If this function is used for SC -> legacy fallback we
901 	 * can only recover the just-works case.
902 	 */
903 	if (test_bit(SMP_FLAG_SC, &smp->flags))
904 		return -EINVAL;
905 
906 	/* Not Just Works/Confirm results in MITM Authentication */
907 	if (smp->method != JUST_CFM) {
908 		set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
909 		if (hcon->pending_sec_level < BT_SECURITY_HIGH)
910 			hcon->pending_sec_level = BT_SECURITY_HIGH;
911 	}
912 
913 	/* If both devices have Keyboard-Display I/O, the initiator
914 	 * Confirms and the responder Enters the passkey.
915 	 */
916 	if (smp->method == OVERLAP) {
917 		if (hcon->role == HCI_ROLE_MASTER)
918 			smp->method = CFM_PASSKEY;
919 		else
920 			smp->method = REQ_PASSKEY;
921 	}
922 
923 	/* Generate random passkey. */
924 	if (smp->method == CFM_PASSKEY) {
925 		memset(smp->tk, 0, sizeof(smp->tk));
926 		get_random_bytes(&passkey, sizeof(passkey));
927 		passkey %= 1000000;
928 		put_unaligned_le32(passkey, smp->tk);
929 		bt_dev_dbg(hcon->hdev, "PassKey: %u", passkey);
930 		set_bit(SMP_FLAG_TK_VALID, &smp->flags);
931 	}
932 
933 	if (smp->method == REQ_PASSKEY)
934 		ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
935 						hcon->type, hcon->dst_type);
936 	else if (smp->method == JUST_CFM)
937 		ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
938 						hcon->type, hcon->dst_type,
939 						passkey, 1);
940 	else
941 		ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
942 						hcon->type, hcon->dst_type,
943 						passkey, 0);
944 
945 	return ret;
946 }
947 
948 static u8 smp_confirm(struct smp_chan *smp)
949 {
950 	struct l2cap_conn *conn = smp->conn;
951 	struct smp_cmd_pairing_confirm cp;
952 	int ret;
953 
954 	bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
955 
956 	ret = smp_c1(smp->tk, smp->prnd, smp->preq, smp->prsp,
957 		     conn->hcon->init_addr_type, &conn->hcon->init_addr,
958 		     conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
959 		     cp.confirm_val);
960 	if (ret)
961 		return SMP_UNSPECIFIED;
962 
963 	clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
964 
965 	smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
966 
967 	if (conn->hcon->out)
968 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
969 	else
970 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
971 
972 	return 0;
973 }
974 
975 static u8 smp_random(struct smp_chan *smp)
976 {
977 	struct l2cap_conn *conn = smp->conn;
978 	struct hci_conn *hcon = conn->hcon;
979 	u8 confirm[16];
980 	int ret;
981 
982 	bt_dev_dbg(conn->hcon->hdev, "conn %p %s", conn,
983 		   conn->hcon->out ? "initiator" : "responder");
984 
985 	ret = smp_c1(smp->tk, smp->rrnd, smp->preq, smp->prsp,
986 		     hcon->init_addr_type, &hcon->init_addr,
987 		     hcon->resp_addr_type, &hcon->resp_addr, confirm);
988 	if (ret)
989 		return SMP_UNSPECIFIED;
990 
991 	if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) {
992 		bt_dev_err(hcon->hdev, "pairing failed "
993 			   "(confirmation values mismatch)");
994 		return SMP_CONFIRM_FAILED;
995 	}
996 
997 	if (hcon->out) {
998 		u8 stk[16];
999 		__le64 rand = 0;
1000 		__le16 ediv = 0;
1001 
1002 		smp_s1(smp->tk, smp->rrnd, smp->prnd, stk);
1003 
1004 		if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
1005 			return SMP_UNSPECIFIED;
1006 
1007 		hci_le_start_enc(hcon, ediv, rand, stk, smp->enc_key_size);
1008 		hcon->enc_key_size = smp->enc_key_size;
1009 		set_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
1010 	} else {
1011 		u8 stk[16], auth;
1012 		__le64 rand = 0;
1013 		__le16 ediv = 0;
1014 
1015 		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
1016 			     smp->prnd);
1017 
1018 		smp_s1(smp->tk, smp->prnd, smp->rrnd, stk);
1019 
1020 		if (hcon->pending_sec_level == BT_SECURITY_HIGH)
1021 			auth = 1;
1022 		else
1023 			auth = 0;
1024 
1025 		/* Even though there's no _RESPONDER suffix this is the
1026 		 * responder STK we're adding for later lookup (the initiator
1027 		 * STK never needs to be stored).
1028 		 */
1029 		hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
1030 			    SMP_STK, auth, stk, smp->enc_key_size, ediv, rand);
1031 	}
1032 
1033 	return 0;
1034 }
1035 
1036 static void smp_notify_keys(struct l2cap_conn *conn)
1037 {
1038 	struct l2cap_chan *chan = conn->smp;
1039 	struct smp_chan *smp = chan->data;
1040 	struct hci_conn *hcon = conn->hcon;
1041 	struct hci_dev *hdev = hcon->hdev;
1042 	struct smp_cmd_pairing *req = (void *) &smp->preq[1];
1043 	struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
1044 	bool persistent;
1045 
1046 	if (hcon->type == ACL_LINK) {
1047 		if (hcon->key_type == HCI_LK_DEBUG_COMBINATION)
1048 			persistent = false;
1049 		else
1050 			persistent = !test_bit(HCI_CONN_FLUSH_KEY,
1051 					       &hcon->flags);
1052 	} else {
1053 		/* The LTKs, IRKs and CSRKs should be persistent only if
1054 		 * both sides had the bonding bit set in their
1055 		 * authentication requests.
1056 		 */
1057 		persistent = !!((req->auth_req & rsp->auth_req) &
1058 				SMP_AUTH_BONDING);
1059 	}
1060 
1061 	if (smp->remote_irk) {
1062 		mgmt_new_irk(hdev, smp->remote_irk, persistent);
1063 
1064 		/* Now that user space can be considered to know the
1065 		 * identity address track the connection based on it
1066 		 * from now on (assuming this is an LE link).
1067 		 */
1068 		if (hcon->type == LE_LINK) {
1069 			bacpy(&hcon->dst, &smp->remote_irk->bdaddr);
1070 			hcon->dst_type = smp->remote_irk->addr_type;
1071 			/* Use a short delay to make sure the new address is
1072 			 * propagated _before_ the channels.
1073 			 */
1074 			queue_delayed_work(hdev->workqueue,
1075 					   &conn->id_addr_timer,
1076 					   ID_ADDR_TIMEOUT);
1077 		}
1078 	}
1079 
1080 	if (smp->csrk) {
1081 		smp->csrk->bdaddr_type = hcon->dst_type;
1082 		bacpy(&smp->csrk->bdaddr, &hcon->dst);
1083 		mgmt_new_csrk(hdev, smp->csrk, persistent);
1084 	}
1085 
1086 	if (smp->responder_csrk) {
1087 		smp->responder_csrk->bdaddr_type = hcon->dst_type;
1088 		bacpy(&smp->responder_csrk->bdaddr, &hcon->dst);
1089 		mgmt_new_csrk(hdev, smp->responder_csrk, persistent);
1090 	}
1091 
1092 	if (smp->ltk) {
1093 		smp->ltk->bdaddr_type = hcon->dst_type;
1094 		bacpy(&smp->ltk->bdaddr, &hcon->dst);
1095 		mgmt_new_ltk(hdev, smp->ltk, persistent);
1096 	}
1097 
1098 	if (smp->responder_ltk) {
1099 		smp->responder_ltk->bdaddr_type = hcon->dst_type;
1100 		bacpy(&smp->responder_ltk->bdaddr, &hcon->dst);
1101 		mgmt_new_ltk(hdev, smp->responder_ltk, persistent);
1102 	}
1103 
1104 	if (smp->link_key) {
1105 		struct link_key *key;
1106 		u8 type;
1107 
1108 		if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags))
1109 			type = HCI_LK_DEBUG_COMBINATION;
1110 		else if (hcon->sec_level == BT_SECURITY_FIPS)
1111 			type = HCI_LK_AUTH_COMBINATION_P256;
1112 		else
1113 			type = HCI_LK_UNAUTH_COMBINATION_P256;
1114 
1115 		key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst,
1116 				       smp->link_key, type, 0, &persistent);
1117 		if (key) {
1118 			mgmt_new_link_key(hdev, key, persistent);
1119 
1120 			/* Don't keep debug keys around if the relevant
1121 			 * flag is not set.
1122 			 */
1123 			if (!hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS) &&
1124 			    key->type == HCI_LK_DEBUG_COMBINATION) {
1125 				list_del_rcu(&key->list);
1126 				kfree_rcu(key, rcu);
1127 			}
1128 		}
1129 	}
1130 }
1131 
1132 static void sc_add_ltk(struct smp_chan *smp)
1133 {
1134 	struct hci_conn *hcon = smp->conn->hcon;
1135 	u8 key_type, auth;
1136 
1137 	if (test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags))
1138 		key_type = SMP_LTK_P256_DEBUG;
1139 	else
1140 		key_type = SMP_LTK_P256;
1141 
1142 	if (hcon->pending_sec_level == BT_SECURITY_FIPS)
1143 		auth = 1;
1144 	else
1145 		auth = 0;
1146 
1147 	smp->ltk = hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
1148 			       key_type, auth, smp->tk, smp->enc_key_size,
1149 			       0, 0);
1150 }
1151 
1152 static void sc_generate_link_key(struct smp_chan *smp)
1153 {
1154 	/* From core spec. Spells out in ASCII as 'lebr'. */
1155 	const u8 lebr[4] = { 0x72, 0x62, 0x65, 0x6c };
1156 
1157 	smp->link_key = kzalloc(16, GFP_KERNEL);
1158 	if (!smp->link_key)
1159 		return;
1160 
1161 	if (test_bit(SMP_FLAG_CT2, &smp->flags)) {
1162 		/* SALT = 0x000000000000000000000000746D7031 */
1163 		const u8 salt[16] = { 0x31, 0x70, 0x6d, 0x74 };
1164 
1165 		if (smp_h7(smp->tfm_cmac, smp->tk, salt, smp->link_key)) {
1166 			kfree_sensitive(smp->link_key);
1167 			smp->link_key = NULL;
1168 			return;
1169 		}
1170 	} else {
1171 		/* From core spec. Spells out in ASCII as 'tmp1'. */
1172 		const u8 tmp1[4] = { 0x31, 0x70, 0x6d, 0x74 };
1173 
1174 		if (smp_h6(smp->tfm_cmac, smp->tk, tmp1, smp->link_key)) {
1175 			kfree_sensitive(smp->link_key);
1176 			smp->link_key = NULL;
1177 			return;
1178 		}
1179 	}
1180 
1181 	if (smp_h6(smp->tfm_cmac, smp->link_key, lebr, smp->link_key)) {
1182 		kfree_sensitive(smp->link_key);
1183 		smp->link_key = NULL;
1184 		return;
1185 	}
1186 }
1187 
1188 static void smp_allow_key_dist(struct smp_chan *smp)
1189 {
1190 	/* Allow the first expected phase 3 PDU. The rest of the PDUs
1191 	 * will be allowed in each PDU handler to ensure we receive
1192 	 * them in the correct order.
1193 	 */
1194 	if (smp->remote_key_dist & SMP_DIST_ENC_KEY)
1195 		SMP_ALLOW_CMD(smp, SMP_CMD_ENCRYPT_INFO);
1196 	else if (smp->remote_key_dist & SMP_DIST_ID_KEY)
1197 		SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
1198 	else if (smp->remote_key_dist & SMP_DIST_SIGN)
1199 		SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
1200 }
1201 
1202 static void sc_generate_ltk(struct smp_chan *smp)
1203 {
1204 	/* From core spec. Spells out in ASCII as 'brle'. */
1205 	const u8 brle[4] = { 0x65, 0x6c, 0x72, 0x62 };
1206 	struct hci_conn *hcon = smp->conn->hcon;
1207 	struct hci_dev *hdev = hcon->hdev;
1208 	struct link_key *key;
1209 
1210 	key = hci_find_link_key(hdev, &hcon->dst);
1211 	if (!key) {
1212 		bt_dev_err(hdev, "no Link Key found to generate LTK");
1213 		return;
1214 	}
1215 
1216 	if (key->type == HCI_LK_DEBUG_COMBINATION)
1217 		set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
1218 
1219 	if (test_bit(SMP_FLAG_CT2, &smp->flags)) {
1220 		/* SALT = 0x000000000000000000000000746D7032 */
1221 		const u8 salt[16] = { 0x32, 0x70, 0x6d, 0x74 };
1222 
1223 		if (smp_h7(smp->tfm_cmac, key->val, salt, smp->tk))
1224 			return;
1225 	} else {
1226 		/* From core spec. Spells out in ASCII as 'tmp2'. */
1227 		const u8 tmp2[4] = { 0x32, 0x70, 0x6d, 0x74 };
1228 
1229 		if (smp_h6(smp->tfm_cmac, key->val, tmp2, smp->tk))
1230 			return;
1231 	}
1232 
1233 	if (smp_h6(smp->tfm_cmac, smp->tk, brle, smp->tk))
1234 		return;
1235 
1236 	sc_add_ltk(smp);
1237 }
1238 
1239 static void smp_distribute_keys(struct smp_chan *smp)
1240 {
1241 	struct smp_cmd_pairing *req, *rsp;
1242 	struct l2cap_conn *conn = smp->conn;
1243 	struct hci_conn *hcon = conn->hcon;
1244 	struct hci_dev *hdev = hcon->hdev;
1245 	__u8 *keydist;
1246 
1247 	bt_dev_dbg(hdev, "conn %p", conn);
1248 
1249 	rsp = (void *) &smp->prsp[1];
1250 
1251 	/* The responder sends its keys first */
1252 	if (hcon->out && (smp->remote_key_dist & KEY_DIST_MASK)) {
1253 		smp_allow_key_dist(smp);
1254 		return;
1255 	}
1256 
1257 	req = (void *) &smp->preq[1];
1258 
1259 	if (hcon->out) {
1260 		keydist = &rsp->init_key_dist;
1261 		*keydist &= req->init_key_dist;
1262 	} else {
1263 		keydist = &rsp->resp_key_dist;
1264 		*keydist &= req->resp_key_dist;
1265 	}
1266 
1267 	if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1268 		if (hcon->type == LE_LINK && (*keydist & SMP_DIST_LINK_KEY))
1269 			sc_generate_link_key(smp);
1270 		if (hcon->type == ACL_LINK && (*keydist & SMP_DIST_ENC_KEY))
1271 			sc_generate_ltk(smp);
1272 
1273 		/* Clear the keys which are generated but not distributed */
1274 		*keydist &= ~SMP_SC_NO_DIST;
1275 	}
1276 
1277 	bt_dev_dbg(hdev, "keydist 0x%x", *keydist);
1278 
1279 	if (*keydist & SMP_DIST_ENC_KEY) {
1280 		struct smp_cmd_encrypt_info enc;
1281 		struct smp_cmd_initiator_ident ident;
1282 		struct smp_ltk *ltk;
1283 		u8 authenticated;
1284 		__le16 ediv;
1285 		__le64 rand;
1286 
1287 		/* Make sure we generate only the significant amount of
1288 		 * bytes based on the encryption key size, and set the rest
1289 		 * of the value to zeroes.
1290 		 */
1291 		get_random_bytes(enc.ltk, smp->enc_key_size);
1292 		memset(enc.ltk + smp->enc_key_size, 0,
1293 		       sizeof(enc.ltk) - smp->enc_key_size);
1294 
1295 		get_random_bytes(&ediv, sizeof(ediv));
1296 		get_random_bytes(&rand, sizeof(rand));
1297 
1298 		smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
1299 
1300 		authenticated = hcon->sec_level == BT_SECURITY_HIGH;
1301 		ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type,
1302 				  SMP_LTK_RESPONDER, authenticated, enc.ltk,
1303 				  smp->enc_key_size, ediv, rand);
1304 		smp->responder_ltk = ltk;
1305 
1306 		ident.ediv = ediv;
1307 		ident.rand = rand;
1308 
1309 		smp_send_cmd(conn, SMP_CMD_INITIATOR_IDENT, sizeof(ident),
1310 			     &ident);
1311 
1312 		*keydist &= ~SMP_DIST_ENC_KEY;
1313 	}
1314 
1315 	if (*keydist & SMP_DIST_ID_KEY) {
1316 		struct smp_cmd_ident_addr_info addrinfo;
1317 		struct smp_cmd_ident_info idinfo;
1318 
1319 		memcpy(idinfo.irk, hdev->irk, sizeof(idinfo.irk));
1320 
1321 		smp_send_cmd(conn, SMP_CMD_IDENT_INFO, sizeof(idinfo), &idinfo);
1322 
1323 		/* The hci_conn contains the local identity address
1324 		 * after the connection has been established.
1325 		 *
1326 		 * This is true even when the connection has been
1327 		 * established using a resolvable random address.
1328 		 */
1329 		bacpy(&addrinfo.bdaddr, &hcon->src);
1330 		addrinfo.addr_type = hcon->src_type;
1331 
1332 		smp_send_cmd(conn, SMP_CMD_IDENT_ADDR_INFO, sizeof(addrinfo),
1333 			     &addrinfo);
1334 
1335 		*keydist &= ~SMP_DIST_ID_KEY;
1336 	}
1337 
1338 	if (*keydist & SMP_DIST_SIGN) {
1339 		struct smp_cmd_sign_info sign;
1340 		struct smp_csrk *csrk;
1341 
1342 		/* Generate a new random key */
1343 		get_random_bytes(sign.csrk, sizeof(sign.csrk));
1344 
1345 		csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1346 		if (csrk) {
1347 			if (hcon->sec_level > BT_SECURITY_MEDIUM)
1348 				csrk->type = MGMT_CSRK_LOCAL_AUTHENTICATED;
1349 			else
1350 				csrk->type = MGMT_CSRK_LOCAL_UNAUTHENTICATED;
1351 			memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
1352 		}
1353 		smp->responder_csrk = csrk;
1354 
1355 		smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1356 
1357 		*keydist &= ~SMP_DIST_SIGN;
1358 	}
1359 
1360 	/* If there are still keys to be received wait for them */
1361 	if (smp->remote_key_dist & KEY_DIST_MASK) {
1362 		smp_allow_key_dist(smp);
1363 		return;
1364 	}
1365 
1366 	set_bit(SMP_FLAG_COMPLETE, &smp->flags);
1367 	smp_notify_keys(conn);
1368 
1369 	smp_chan_destroy(conn);
1370 }
1371 
1372 static void smp_timeout(struct work_struct *work)
1373 {
1374 	struct smp_chan *smp = container_of(work, struct smp_chan,
1375 					    security_timer.work);
1376 	struct l2cap_conn *conn = smp->conn;
1377 
1378 	bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
1379 
1380 	hci_disconnect(conn->hcon, HCI_ERROR_REMOTE_USER_TERM);
1381 }
1382 
1383 static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
1384 {
1385 	struct hci_conn *hcon = conn->hcon;
1386 	struct l2cap_chan *chan = conn->smp;
1387 	struct smp_chan *smp;
1388 
1389 	smp = kzalloc(sizeof(*smp), GFP_ATOMIC);
1390 	if (!smp)
1391 		return NULL;
1392 
1393 	smp->tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0);
1394 	if (IS_ERR(smp->tfm_cmac)) {
1395 		bt_dev_err(hcon->hdev, "Unable to create CMAC crypto context");
1396 		goto zfree_smp;
1397 	}
1398 
1399 	smp->tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0);
1400 	if (IS_ERR(smp->tfm_ecdh)) {
1401 		bt_dev_err(hcon->hdev, "Unable to create ECDH crypto context");
1402 		goto free_shash;
1403 	}
1404 
1405 	smp->conn = conn;
1406 	chan->data = smp;
1407 
1408 	SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_FAIL);
1409 
1410 	INIT_DELAYED_WORK(&smp->security_timer, smp_timeout);
1411 
1412 	hci_conn_hold(hcon);
1413 
1414 	return smp;
1415 
1416 free_shash:
1417 	crypto_free_shash(smp->tfm_cmac);
1418 zfree_smp:
1419 	kfree_sensitive(smp);
1420 	return NULL;
1421 }
1422 
1423 static int sc_mackey_and_ltk(struct smp_chan *smp, u8 mackey[16], u8 ltk[16])
1424 {
1425 	struct hci_conn *hcon = smp->conn->hcon;
1426 	u8 *na, *nb, a[7], b[7];
1427 
1428 	if (hcon->out) {
1429 		na   = smp->prnd;
1430 		nb   = smp->rrnd;
1431 	} else {
1432 		na   = smp->rrnd;
1433 		nb   = smp->prnd;
1434 	}
1435 
1436 	memcpy(a, &hcon->init_addr, 6);
1437 	memcpy(b, &hcon->resp_addr, 6);
1438 	a[6] = hcon->init_addr_type;
1439 	b[6] = hcon->resp_addr_type;
1440 
1441 	return smp_f5(smp->tfm_cmac, smp->dhkey, na, nb, a, b, mackey, ltk);
1442 }
1443 
1444 static void sc_dhkey_check(struct smp_chan *smp)
1445 {
1446 	struct hci_conn *hcon = smp->conn->hcon;
1447 	struct smp_cmd_dhkey_check check;
1448 	u8 a[7], b[7], *local_addr, *remote_addr;
1449 	u8 io_cap[3], r[16];
1450 
1451 	memcpy(a, &hcon->init_addr, 6);
1452 	memcpy(b, &hcon->resp_addr, 6);
1453 	a[6] = hcon->init_addr_type;
1454 	b[6] = hcon->resp_addr_type;
1455 
1456 	if (hcon->out) {
1457 		local_addr = a;
1458 		remote_addr = b;
1459 		memcpy(io_cap, &smp->preq[1], 3);
1460 	} else {
1461 		local_addr = b;
1462 		remote_addr = a;
1463 		memcpy(io_cap, &smp->prsp[1], 3);
1464 	}
1465 
1466 	memset(r, 0, sizeof(r));
1467 
1468 	if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
1469 		put_unaligned_le32(hcon->passkey_notify, r);
1470 
1471 	if (smp->method == REQ_OOB)
1472 		memcpy(r, smp->rr, 16);
1473 
1474 	smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap,
1475 	       local_addr, remote_addr, check.e);
1476 
1477 	smp_send_cmd(smp->conn, SMP_CMD_DHKEY_CHECK, sizeof(check), &check);
1478 }
1479 
1480 static u8 sc_passkey_send_confirm(struct smp_chan *smp)
1481 {
1482 	struct l2cap_conn *conn = smp->conn;
1483 	struct hci_conn *hcon = conn->hcon;
1484 	struct smp_cmd_pairing_confirm cfm;
1485 	u8 r;
1486 
1487 	r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01);
1488 	r |= 0x80;
1489 
1490 	get_random_bytes(smp->prnd, sizeof(smp->prnd));
1491 
1492 	if (smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd, r,
1493 		   cfm.confirm_val))
1494 		return SMP_UNSPECIFIED;
1495 
1496 	smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm);
1497 
1498 	return 0;
1499 }
1500 
1501 static u8 sc_passkey_round(struct smp_chan *smp, u8 smp_op)
1502 {
1503 	struct l2cap_conn *conn = smp->conn;
1504 	struct hci_conn *hcon = conn->hcon;
1505 	struct hci_dev *hdev = hcon->hdev;
1506 	u8 cfm[16], r;
1507 
1508 	/* Ignore the PDU if we've already done 20 rounds (0 - 19) */
1509 	if (smp->passkey_round >= 20)
1510 		return 0;
1511 
1512 	switch (smp_op) {
1513 	case SMP_CMD_PAIRING_RANDOM:
1514 		r = ((hcon->passkey_notify >> smp->passkey_round) & 0x01);
1515 		r |= 0x80;
1516 
1517 		if (smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk,
1518 			   smp->rrnd, r, cfm))
1519 			return SMP_UNSPECIFIED;
1520 
1521 		if (crypto_memneq(smp->pcnf, cfm, 16))
1522 			return SMP_CONFIRM_FAILED;
1523 
1524 		smp->passkey_round++;
1525 
1526 		if (smp->passkey_round == 20) {
1527 			/* Generate MacKey and LTK */
1528 			if (sc_mackey_and_ltk(smp, smp->mackey, smp->tk))
1529 				return SMP_UNSPECIFIED;
1530 		}
1531 
1532 		/* The round is only complete when the initiator
1533 		 * receives pairing random.
1534 		 */
1535 		if (!hcon->out) {
1536 			smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
1537 				     sizeof(smp->prnd), smp->prnd);
1538 			if (smp->passkey_round == 20)
1539 				SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
1540 			else
1541 				SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1542 			return 0;
1543 		}
1544 
1545 		/* Start the next round */
1546 		if (smp->passkey_round != 20)
1547 			return sc_passkey_round(smp, 0);
1548 
1549 		/* Passkey rounds are complete - start DHKey Check */
1550 		sc_dhkey_check(smp);
1551 		SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
1552 
1553 		break;
1554 
1555 	case SMP_CMD_PAIRING_CONFIRM:
1556 		if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) {
1557 			set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
1558 			return 0;
1559 		}
1560 
1561 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
1562 
1563 		if (hcon->out) {
1564 			smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
1565 				     sizeof(smp->prnd), smp->prnd);
1566 			return 0;
1567 		}
1568 
1569 		return sc_passkey_send_confirm(smp);
1570 
1571 	case SMP_CMD_PUBLIC_KEY:
1572 	default:
1573 		/* Initiating device starts the round */
1574 		if (!hcon->out)
1575 			return 0;
1576 
1577 		bt_dev_dbg(hdev, "Starting passkey round %u",
1578 			   smp->passkey_round + 1);
1579 
1580 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1581 
1582 		return sc_passkey_send_confirm(smp);
1583 	}
1584 
1585 	return 0;
1586 }
1587 
1588 static int sc_user_reply(struct smp_chan *smp, u16 mgmt_op, __le32 passkey)
1589 {
1590 	struct l2cap_conn *conn = smp->conn;
1591 	struct hci_conn *hcon = conn->hcon;
1592 	u8 smp_op;
1593 
1594 	clear_bit(SMP_FLAG_WAIT_USER, &smp->flags);
1595 
1596 	switch (mgmt_op) {
1597 	case MGMT_OP_USER_PASSKEY_NEG_REPLY:
1598 		smp_failure(smp->conn, SMP_PASSKEY_ENTRY_FAILED);
1599 		return 0;
1600 	case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1601 		smp_failure(smp->conn, SMP_NUMERIC_COMP_FAILED);
1602 		return 0;
1603 	case MGMT_OP_USER_PASSKEY_REPLY:
1604 		hcon->passkey_notify = le32_to_cpu(passkey);
1605 		smp->passkey_round = 0;
1606 
1607 		if (test_and_clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags))
1608 			smp_op = SMP_CMD_PAIRING_CONFIRM;
1609 		else
1610 			smp_op = 0;
1611 
1612 		if (sc_passkey_round(smp, smp_op))
1613 			return -EIO;
1614 
1615 		return 0;
1616 	}
1617 
1618 	/* Initiator sends DHKey check first */
1619 	if (hcon->out) {
1620 		sc_dhkey_check(smp);
1621 		SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
1622 	} else if (test_and_clear_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags)) {
1623 		sc_dhkey_check(smp);
1624 		sc_add_ltk(smp);
1625 	}
1626 
1627 	return 0;
1628 }
1629 
1630 int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
1631 {
1632 	struct l2cap_conn *conn = hcon->l2cap_data;
1633 	struct l2cap_chan *chan;
1634 	struct smp_chan *smp;
1635 	u32 value;
1636 	int err;
1637 
1638 	if (!conn)
1639 		return -ENOTCONN;
1640 
1641 	bt_dev_dbg(conn->hcon->hdev, "");
1642 
1643 	chan = conn->smp;
1644 	if (!chan)
1645 		return -ENOTCONN;
1646 
1647 	l2cap_chan_lock(chan);
1648 	if (!chan->data) {
1649 		err = -ENOTCONN;
1650 		goto unlock;
1651 	}
1652 
1653 	smp = chan->data;
1654 
1655 	if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1656 		err = sc_user_reply(smp, mgmt_op, passkey);
1657 		goto unlock;
1658 	}
1659 
1660 	switch (mgmt_op) {
1661 	case MGMT_OP_USER_PASSKEY_REPLY:
1662 		value = le32_to_cpu(passkey);
1663 		memset(smp->tk, 0, sizeof(smp->tk));
1664 		bt_dev_dbg(conn->hcon->hdev, "PassKey: %u", value);
1665 		put_unaligned_le32(value, smp->tk);
1666 		fallthrough;
1667 	case MGMT_OP_USER_CONFIRM_REPLY:
1668 		set_bit(SMP_FLAG_TK_VALID, &smp->flags);
1669 		break;
1670 	case MGMT_OP_USER_PASSKEY_NEG_REPLY:
1671 	case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1672 		smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
1673 		err = 0;
1674 		goto unlock;
1675 	default:
1676 		smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED);
1677 		err = -EOPNOTSUPP;
1678 		goto unlock;
1679 	}
1680 
1681 	err = 0;
1682 
1683 	/* If it is our turn to send Pairing Confirm, do so now */
1684 	if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
1685 		u8 rsp = smp_confirm(smp);
1686 		if (rsp)
1687 			smp_failure(conn, rsp);
1688 	}
1689 
1690 unlock:
1691 	l2cap_chan_unlock(chan);
1692 	return err;
1693 }
1694 
1695 static void build_bredr_pairing_cmd(struct smp_chan *smp,
1696 				    struct smp_cmd_pairing *req,
1697 				    struct smp_cmd_pairing *rsp)
1698 {
1699 	struct l2cap_conn *conn = smp->conn;
1700 	struct hci_dev *hdev = conn->hcon->hdev;
1701 	u8 local_dist = 0, remote_dist = 0;
1702 
1703 	if (hci_dev_test_flag(hdev, HCI_BONDABLE)) {
1704 		local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
1705 		remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
1706 	}
1707 
1708 	if (hci_dev_test_flag(hdev, HCI_RPA_RESOLVING))
1709 		remote_dist |= SMP_DIST_ID_KEY;
1710 
1711 	if (hci_dev_test_flag(hdev, HCI_PRIVACY))
1712 		local_dist |= SMP_DIST_ID_KEY;
1713 
1714 	if (!rsp) {
1715 		memset(req, 0, sizeof(*req));
1716 
1717 		req->auth_req        = SMP_AUTH_CT2;
1718 		req->init_key_dist   = local_dist;
1719 		req->resp_key_dist   = remote_dist;
1720 		req->max_key_size    = conn->hcon->enc_key_size;
1721 
1722 		smp->remote_key_dist = remote_dist;
1723 
1724 		return;
1725 	}
1726 
1727 	memset(rsp, 0, sizeof(*rsp));
1728 
1729 	rsp->auth_req        = SMP_AUTH_CT2;
1730 	rsp->max_key_size    = conn->hcon->enc_key_size;
1731 	rsp->init_key_dist   = req->init_key_dist & remote_dist;
1732 	rsp->resp_key_dist   = req->resp_key_dist & local_dist;
1733 
1734 	smp->remote_key_dist = rsp->init_key_dist;
1735 }
1736 
1737 static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
1738 {
1739 	struct smp_cmd_pairing rsp, *req = (void *) skb->data;
1740 	struct l2cap_chan *chan = conn->smp;
1741 	struct hci_dev *hdev = conn->hcon->hdev;
1742 	struct smp_chan *smp;
1743 	u8 key_size, auth, sec_level;
1744 	int ret;
1745 
1746 	bt_dev_dbg(hdev, "conn %p", conn);
1747 
1748 	if (skb->len < sizeof(*req))
1749 		return SMP_INVALID_PARAMS;
1750 
1751 	if (conn->hcon->role != HCI_ROLE_SLAVE)
1752 		return SMP_CMD_NOTSUPP;
1753 
1754 	if (!chan->data)
1755 		smp = smp_chan_create(conn);
1756 	else
1757 		smp = chan->data;
1758 
1759 	if (!smp)
1760 		return SMP_UNSPECIFIED;
1761 
1762 	/* We didn't start the pairing, so match remote */
1763 	auth = req->auth_req & AUTH_REQ_MASK(hdev);
1764 
1765 	if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
1766 	    (auth & SMP_AUTH_BONDING))
1767 		return SMP_PAIRING_NOTSUPP;
1768 
1769 	if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC))
1770 		return SMP_AUTH_REQUIREMENTS;
1771 
1772 	smp->preq[0] = SMP_CMD_PAIRING_REQ;
1773 	memcpy(&smp->preq[1], req, sizeof(*req));
1774 	skb_pull(skb, sizeof(*req));
1775 
1776 	/* If the remote side's OOB flag is set it means it has
1777 	 * successfully received our local OOB data - therefore set the
1778 	 * flag to indicate that local OOB is in use.
1779 	 */
1780 	if (req->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob)
1781 		set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags);
1782 
1783 	/* SMP over BR/EDR requires special treatment */
1784 	if (conn->hcon->type == ACL_LINK) {
1785 		/* We must have a BR/EDR SC link */
1786 		if (!test_bit(HCI_CONN_AES_CCM, &conn->hcon->flags) &&
1787 		    !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
1788 			return SMP_CROSS_TRANSP_NOT_ALLOWED;
1789 
1790 		set_bit(SMP_FLAG_SC, &smp->flags);
1791 
1792 		build_bredr_pairing_cmd(smp, req, &rsp);
1793 
1794 		if (req->auth_req & SMP_AUTH_CT2)
1795 			set_bit(SMP_FLAG_CT2, &smp->flags);
1796 
1797 		key_size = min(req->max_key_size, rsp.max_key_size);
1798 		if (check_enc_key_size(conn, key_size))
1799 			return SMP_ENC_KEY_SIZE;
1800 
1801 		/* Clear bits which are generated but not distributed */
1802 		smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1803 
1804 		smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1805 		memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
1806 		smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
1807 
1808 		smp_distribute_keys(smp);
1809 		return 0;
1810 	}
1811 
1812 	build_pairing_cmd(conn, req, &rsp, auth);
1813 
1814 	if (rsp.auth_req & SMP_AUTH_SC) {
1815 		set_bit(SMP_FLAG_SC, &smp->flags);
1816 
1817 		if (rsp.auth_req & SMP_AUTH_CT2)
1818 			set_bit(SMP_FLAG_CT2, &smp->flags);
1819 	}
1820 
1821 	if (conn->hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
1822 		sec_level = BT_SECURITY_MEDIUM;
1823 	else
1824 		sec_level = authreq_to_seclevel(auth);
1825 
1826 	if (sec_level > conn->hcon->pending_sec_level)
1827 		conn->hcon->pending_sec_level = sec_level;
1828 
1829 	/* If we need MITM check that it can be achieved */
1830 	if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1831 		u8 method;
1832 
1833 		method = get_auth_method(smp, conn->hcon->io_capability,
1834 					 req->io_capability);
1835 		if (method == JUST_WORKS || method == JUST_CFM)
1836 			return SMP_AUTH_REQUIREMENTS;
1837 	}
1838 
1839 	key_size = min(req->max_key_size, rsp.max_key_size);
1840 	if (check_enc_key_size(conn, key_size))
1841 		return SMP_ENC_KEY_SIZE;
1842 
1843 	get_random_bytes(smp->prnd, sizeof(smp->prnd));
1844 
1845 	smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1846 	memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
1847 
1848 	smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
1849 
1850 	clear_bit(SMP_FLAG_INITIATOR, &smp->flags);
1851 
1852 	/* Strictly speaking we shouldn't allow Pairing Confirm for the
1853 	 * SC case, however some implementations incorrectly copy RFU auth
1854 	 * req bits from our security request, which may create a false
1855 	 * positive SC enablement.
1856 	 */
1857 	SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
1858 
1859 	if (test_bit(SMP_FLAG_SC, &smp->flags)) {
1860 		SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY);
1861 		/* Clear bits which are generated but not distributed */
1862 		smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1863 		/* Wait for Public Key from Initiating Device */
1864 		return 0;
1865 	}
1866 
1867 	/* Request setup of TK */
1868 	ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
1869 	if (ret)
1870 		return SMP_UNSPECIFIED;
1871 
1872 	return 0;
1873 }
1874 
1875 static u8 sc_send_public_key(struct smp_chan *smp)
1876 {
1877 	struct hci_dev *hdev = smp->conn->hcon->hdev;
1878 
1879 	bt_dev_dbg(hdev, "");
1880 
1881 	if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) {
1882 		struct l2cap_chan *chan = hdev->smp_data;
1883 		struct smp_dev *smp_dev;
1884 
1885 		if (!chan || !chan->data)
1886 			return SMP_UNSPECIFIED;
1887 
1888 		smp_dev = chan->data;
1889 
1890 		memcpy(smp->local_pk, smp_dev->local_pk, 64);
1891 		memcpy(smp->lr, smp_dev->local_rand, 16);
1892 
1893 		if (smp_dev->debug_key)
1894 			set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
1895 
1896 		goto done;
1897 	}
1898 
1899 	if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) {
1900 		bt_dev_dbg(hdev, "Using debug keys");
1901 		if (set_ecdh_privkey(smp->tfm_ecdh, debug_sk))
1902 			return SMP_UNSPECIFIED;
1903 		memcpy(smp->local_pk, debug_pk, 64);
1904 		set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
1905 	} else {
1906 		while (true) {
1907 			/* Generate key pair for Secure Connections */
1908 			if (generate_ecdh_keys(smp->tfm_ecdh, smp->local_pk))
1909 				return SMP_UNSPECIFIED;
1910 
1911 			/* This is unlikely, but we need to check that
1912 			 * we didn't accidentally generate a debug key.
1913 			 */
1914 			if (crypto_memneq(smp->local_pk, debug_pk, 64))
1915 				break;
1916 		}
1917 	}
1918 
1919 done:
1920 	SMP_DBG("Local Public Key X: %32phN", smp->local_pk);
1921 	SMP_DBG("Local Public Key Y: %32phN", smp->local_pk + 32);
1922 
1923 	smp_send_cmd(smp->conn, SMP_CMD_PUBLIC_KEY, 64, smp->local_pk);
1924 
1925 	return 0;
1926 }
1927 
1928 static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
1929 {
1930 	struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
1931 	struct l2cap_chan *chan = conn->smp;
1932 	struct smp_chan *smp = chan->data;
1933 	struct hci_dev *hdev = conn->hcon->hdev;
1934 	u8 key_size, auth;
1935 	int ret;
1936 
1937 	bt_dev_dbg(hdev, "conn %p", conn);
1938 
1939 	if (skb->len < sizeof(*rsp))
1940 		return SMP_INVALID_PARAMS;
1941 
1942 	if (conn->hcon->role != HCI_ROLE_MASTER)
1943 		return SMP_CMD_NOTSUPP;
1944 
1945 	skb_pull(skb, sizeof(*rsp));
1946 
1947 	req = (void *) &smp->preq[1];
1948 
1949 	key_size = min(req->max_key_size, rsp->max_key_size);
1950 	if (check_enc_key_size(conn, key_size))
1951 		return SMP_ENC_KEY_SIZE;
1952 
1953 	auth = rsp->auth_req & AUTH_REQ_MASK(hdev);
1954 
1955 	if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC))
1956 		return SMP_AUTH_REQUIREMENTS;
1957 
1958 	/* If the remote side's OOB flag is set it means it has
1959 	 * successfully received our local OOB data - therefore set the
1960 	 * flag to indicate that local OOB is in use.
1961 	 */
1962 	if (rsp->oob_flag == SMP_OOB_PRESENT && SMP_DEV(hdev)->local_oob)
1963 		set_bit(SMP_FLAG_LOCAL_OOB, &smp->flags);
1964 
1965 	smp->prsp[0] = SMP_CMD_PAIRING_RSP;
1966 	memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
1967 
1968 	/* Update remote key distribution in case the remote cleared
1969 	 * some bits that we had enabled in our request.
1970 	 */
1971 	smp->remote_key_dist &= rsp->resp_key_dist;
1972 
1973 	if ((req->auth_req & SMP_AUTH_CT2) && (auth & SMP_AUTH_CT2))
1974 		set_bit(SMP_FLAG_CT2, &smp->flags);
1975 
1976 	/* For BR/EDR this means we're done and can start phase 3 */
1977 	if (conn->hcon->type == ACL_LINK) {
1978 		/* Clear bits which are generated but not distributed */
1979 		smp->remote_key_dist &= ~SMP_SC_NO_DIST;
1980 		smp_distribute_keys(smp);
1981 		return 0;
1982 	}
1983 
1984 	if ((req->auth_req & SMP_AUTH_SC) && (auth & SMP_AUTH_SC))
1985 		set_bit(SMP_FLAG_SC, &smp->flags);
1986 	else if (conn->hcon->pending_sec_level > BT_SECURITY_HIGH)
1987 		conn->hcon->pending_sec_level = BT_SECURITY_HIGH;
1988 
1989 	/* If we need MITM check that it can be achieved */
1990 	if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
1991 		u8 method;
1992 
1993 		method = get_auth_method(smp, req->io_capability,
1994 					 rsp->io_capability);
1995 		if (method == JUST_WORKS || method == JUST_CFM)
1996 			return SMP_AUTH_REQUIREMENTS;
1997 	}
1998 
1999 	get_random_bytes(smp->prnd, sizeof(smp->prnd));
2000 
2001 	/* Update remote key distribution in case the remote cleared
2002 	 * some bits that we had enabled in our request.
2003 	 */
2004 	smp->remote_key_dist &= rsp->resp_key_dist;
2005 
2006 	if (test_bit(SMP_FLAG_SC, &smp->flags)) {
2007 		/* Clear bits which are generated but not distributed */
2008 		smp->remote_key_dist &= ~SMP_SC_NO_DIST;
2009 		SMP_ALLOW_CMD(smp, SMP_CMD_PUBLIC_KEY);
2010 		return sc_send_public_key(smp);
2011 	}
2012 
2013 	auth |= req->auth_req;
2014 
2015 	ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
2016 	if (ret)
2017 		return SMP_UNSPECIFIED;
2018 
2019 	set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2020 
2021 	/* Can't compose response until we have been confirmed */
2022 	if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
2023 		return smp_confirm(smp);
2024 
2025 	return 0;
2026 }
2027 
2028 static u8 sc_check_confirm(struct smp_chan *smp)
2029 {
2030 	struct l2cap_conn *conn = smp->conn;
2031 
2032 	bt_dev_dbg(conn->hcon->hdev, "");
2033 
2034 	if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
2035 		return sc_passkey_round(smp, SMP_CMD_PAIRING_CONFIRM);
2036 
2037 	if (conn->hcon->out) {
2038 		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
2039 			     smp->prnd);
2040 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2041 	}
2042 
2043 	return 0;
2044 }
2045 
2046 /* Work-around for some implementations that incorrectly copy RFU bits
2047  * from our security request and thereby create the impression that
2048  * we're doing SC when in fact the remote doesn't support it.
2049  */
2050 static int fixup_sc_false_positive(struct smp_chan *smp)
2051 {
2052 	struct l2cap_conn *conn = smp->conn;
2053 	struct hci_conn *hcon = conn->hcon;
2054 	struct hci_dev *hdev = hcon->hdev;
2055 	struct smp_cmd_pairing *req, *rsp;
2056 	u8 auth;
2057 
2058 	/* The issue is only observed when we're in responder role */
2059 	if (hcon->out)
2060 		return SMP_UNSPECIFIED;
2061 
2062 	if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
2063 		bt_dev_err(hdev, "refusing legacy fallback in SC-only mode");
2064 		return SMP_UNSPECIFIED;
2065 	}
2066 
2067 	bt_dev_err(hdev, "trying to fall back to legacy SMP");
2068 
2069 	req = (void *) &smp->preq[1];
2070 	rsp = (void *) &smp->prsp[1];
2071 
2072 	/* Rebuild key dist flags which may have been cleared for SC */
2073 	smp->remote_key_dist = (req->init_key_dist & rsp->resp_key_dist);
2074 
2075 	auth = req->auth_req & AUTH_REQ_MASK(hdev);
2076 
2077 	if (tk_request(conn, 0, auth, rsp->io_capability, req->io_capability)) {
2078 		bt_dev_err(hdev, "failed to fall back to legacy SMP");
2079 		return SMP_UNSPECIFIED;
2080 	}
2081 
2082 	clear_bit(SMP_FLAG_SC, &smp->flags);
2083 
2084 	return 0;
2085 }
2086 
2087 static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
2088 {
2089 	struct l2cap_chan *chan = conn->smp;
2090 	struct smp_chan *smp = chan->data;
2091 	struct hci_conn *hcon = conn->hcon;
2092 	struct hci_dev *hdev = hcon->hdev;
2093 
2094 	bt_dev_dbg(hdev, "conn %p %s", conn,
2095 		   hcon->out ? "initiator" : "responder");
2096 
2097 	if (skb->len < sizeof(smp->pcnf))
2098 		return SMP_INVALID_PARAMS;
2099 
2100 	memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
2101 	skb_pull(skb, sizeof(smp->pcnf));
2102 
2103 	if (test_bit(SMP_FLAG_SC, &smp->flags)) {
2104 		int ret;
2105 
2106 		/* Public Key exchange must happen before any other steps */
2107 		if (test_bit(SMP_FLAG_REMOTE_PK, &smp->flags))
2108 			return sc_check_confirm(smp);
2109 
2110 		bt_dev_err(hdev, "Unexpected SMP Pairing Confirm");
2111 
2112 		ret = fixup_sc_false_positive(smp);
2113 		if (ret)
2114 			return ret;
2115 	}
2116 
2117 	if (conn->hcon->out) {
2118 		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
2119 			     smp->prnd);
2120 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2121 		return 0;
2122 	}
2123 
2124 	if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
2125 		return smp_confirm(smp);
2126 
2127 	set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
2128 
2129 	return 0;
2130 }
2131 
2132 static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
2133 {
2134 	struct l2cap_chan *chan = conn->smp;
2135 	struct smp_chan *smp = chan->data;
2136 	struct hci_conn *hcon = conn->hcon;
2137 	u8 *pkax, *pkbx, *na, *nb, confirm_hint;
2138 	u32 passkey;
2139 	int err;
2140 
2141 	bt_dev_dbg(hcon->hdev, "conn %p", conn);
2142 
2143 	if (skb->len < sizeof(smp->rrnd))
2144 		return SMP_INVALID_PARAMS;
2145 
2146 	memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
2147 	skb_pull(skb, sizeof(smp->rrnd));
2148 
2149 	if (!test_bit(SMP_FLAG_SC, &smp->flags))
2150 		return smp_random(smp);
2151 
2152 	if (hcon->out) {
2153 		pkax = smp->local_pk;
2154 		pkbx = smp->remote_pk;
2155 		na   = smp->prnd;
2156 		nb   = smp->rrnd;
2157 	} else {
2158 		pkax = smp->remote_pk;
2159 		pkbx = smp->local_pk;
2160 		na   = smp->rrnd;
2161 		nb   = smp->prnd;
2162 	}
2163 
2164 	if (smp->method == REQ_OOB) {
2165 		if (!hcon->out)
2166 			smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
2167 				     sizeof(smp->prnd), smp->prnd);
2168 		SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
2169 		goto mackey_and_ltk;
2170 	}
2171 
2172 	/* Passkey entry has special treatment */
2173 	if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
2174 		return sc_passkey_round(smp, SMP_CMD_PAIRING_RANDOM);
2175 
2176 	if (hcon->out) {
2177 		u8 cfm[16];
2178 
2179 		err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->local_pk,
2180 			     smp->rrnd, 0, cfm);
2181 		if (err)
2182 			return SMP_UNSPECIFIED;
2183 
2184 		if (crypto_memneq(smp->pcnf, cfm, 16))
2185 			return SMP_CONFIRM_FAILED;
2186 	} else {
2187 		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
2188 			     smp->prnd);
2189 		SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
2190 
2191 		/* Only Just-Works pairing requires extra checks */
2192 		if (smp->method != JUST_WORKS)
2193 			goto mackey_and_ltk;
2194 
2195 		/* If there already exists long term key in local host, leave
2196 		 * the decision to user space since the remote device could
2197 		 * be legitimate or malicious.
2198 		 */
2199 		if (hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
2200 				 hcon->role)) {
2201 			/* Set passkey to 0. The value can be any number since
2202 			 * it'll be ignored anyway.
2203 			 */
2204 			passkey = 0;
2205 			confirm_hint = 1;
2206 			goto confirm;
2207 		}
2208 	}
2209 
2210 mackey_and_ltk:
2211 	/* Generate MacKey and LTK */
2212 	err = sc_mackey_and_ltk(smp, smp->mackey, smp->tk);
2213 	if (err)
2214 		return SMP_UNSPECIFIED;
2215 
2216 	if (smp->method == REQ_OOB) {
2217 		if (hcon->out) {
2218 			sc_dhkey_check(smp);
2219 			SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
2220 		}
2221 		return 0;
2222 	}
2223 
2224 	err = smp_g2(smp->tfm_cmac, pkax, pkbx, na, nb, &passkey);
2225 	if (err)
2226 		return SMP_UNSPECIFIED;
2227 
2228 	confirm_hint = 0;
2229 
2230 confirm:
2231 	if (smp->method == JUST_WORKS)
2232 		confirm_hint = 1;
2233 
2234 	err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, hcon->type,
2235 					hcon->dst_type, passkey, confirm_hint);
2236 	if (err)
2237 		return SMP_UNSPECIFIED;
2238 
2239 	set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
2240 
2241 	return 0;
2242 }
2243 
2244 static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
2245 {
2246 	struct smp_ltk *key;
2247 	struct hci_conn *hcon = conn->hcon;
2248 
2249 	key = hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role);
2250 	if (!key)
2251 		return false;
2252 
2253 	if (smp_ltk_sec_level(key) < sec_level)
2254 		return false;
2255 
2256 	if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
2257 		return true;
2258 
2259 	hci_le_start_enc(hcon, key->ediv, key->rand, key->val, key->enc_size);
2260 	hcon->enc_key_size = key->enc_size;
2261 
2262 	/* We never store STKs for initiator role, so clear this flag */
2263 	clear_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags);
2264 
2265 	return true;
2266 }
2267 
2268 bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level,
2269 			     enum smp_key_pref key_pref)
2270 {
2271 	if (sec_level == BT_SECURITY_LOW)
2272 		return true;
2273 
2274 	/* If we're encrypted with an STK but the caller prefers using
2275 	 * LTK claim insufficient security. This way we allow the
2276 	 * connection to be re-encrypted with an LTK, even if the LTK
2277 	 * provides the same level of security. Only exception is if we
2278 	 * don't have an LTK (e.g. because of key distribution bits).
2279 	 */
2280 	if (key_pref == SMP_USE_LTK &&
2281 	    test_bit(HCI_CONN_STK_ENCRYPT, &hcon->flags) &&
2282 	    hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role))
2283 		return false;
2284 
2285 	if (hcon->sec_level >= sec_level)
2286 		return true;
2287 
2288 	return false;
2289 }
2290 
2291 static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
2292 {
2293 	struct smp_cmd_security_req *rp = (void *) skb->data;
2294 	struct smp_cmd_pairing cp;
2295 	struct hci_conn *hcon = conn->hcon;
2296 	struct hci_dev *hdev = hcon->hdev;
2297 	struct smp_chan *smp;
2298 	u8 sec_level, auth;
2299 
2300 	bt_dev_dbg(hdev, "conn %p", conn);
2301 
2302 	if (skb->len < sizeof(*rp))
2303 		return SMP_INVALID_PARAMS;
2304 
2305 	if (hcon->role != HCI_ROLE_MASTER)
2306 		return SMP_CMD_NOTSUPP;
2307 
2308 	auth = rp->auth_req & AUTH_REQ_MASK(hdev);
2309 
2310 	if (hci_dev_test_flag(hdev, HCI_SC_ONLY) && !(auth & SMP_AUTH_SC))
2311 		return SMP_AUTH_REQUIREMENTS;
2312 
2313 	if (hcon->io_capability == HCI_IO_NO_INPUT_OUTPUT)
2314 		sec_level = BT_SECURITY_MEDIUM;
2315 	else
2316 		sec_level = authreq_to_seclevel(auth);
2317 
2318 	if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) {
2319 		/* If link is already encrypted with sufficient security we
2320 		 * still need refresh encryption as per Core Spec 5.0 Vol 3,
2321 		 * Part H 2.4.6
2322 		 */
2323 		smp_ltk_encrypt(conn, hcon->sec_level);
2324 		return 0;
2325 	}
2326 
2327 	if (sec_level > hcon->pending_sec_level)
2328 		hcon->pending_sec_level = sec_level;
2329 
2330 	if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
2331 		return 0;
2332 
2333 	smp = smp_chan_create(conn);
2334 	if (!smp)
2335 		return SMP_UNSPECIFIED;
2336 
2337 	if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
2338 	    (auth & SMP_AUTH_BONDING))
2339 		return SMP_PAIRING_NOTSUPP;
2340 
2341 	skb_pull(skb, sizeof(*rp));
2342 
2343 	memset(&cp, 0, sizeof(cp));
2344 	build_pairing_cmd(conn, &cp, NULL, auth);
2345 
2346 	smp->preq[0] = SMP_CMD_PAIRING_REQ;
2347 	memcpy(&smp->preq[1], &cp, sizeof(cp));
2348 
2349 	smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
2350 	SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
2351 
2352 	return 0;
2353 }
2354 
2355 int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
2356 {
2357 	struct l2cap_conn *conn = hcon->l2cap_data;
2358 	struct l2cap_chan *chan;
2359 	struct smp_chan *smp;
2360 	__u8 authreq;
2361 	int ret;
2362 
2363 	bt_dev_dbg(hcon->hdev, "conn %p hcon %p level 0x%2.2x", conn, hcon,
2364 		   sec_level);
2365 
2366 	/* This may be NULL if there's an unexpected disconnection */
2367 	if (!conn)
2368 		return 1;
2369 
2370 	if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED))
2371 		return 1;
2372 
2373 	if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK))
2374 		return 1;
2375 
2376 	if (sec_level > hcon->pending_sec_level)
2377 		hcon->pending_sec_level = sec_level;
2378 
2379 	if (hcon->role == HCI_ROLE_MASTER)
2380 		if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
2381 			return 0;
2382 
2383 	chan = conn->smp;
2384 	if (!chan) {
2385 		bt_dev_err(hcon->hdev, "security requested but not available");
2386 		return 1;
2387 	}
2388 
2389 	l2cap_chan_lock(chan);
2390 
2391 	/* If SMP is already in progress ignore this request */
2392 	if (chan->data) {
2393 		ret = 0;
2394 		goto unlock;
2395 	}
2396 
2397 	smp = smp_chan_create(conn);
2398 	if (!smp) {
2399 		ret = 1;
2400 		goto unlock;
2401 	}
2402 
2403 	authreq = seclevel_to_authreq(sec_level);
2404 
2405 	if (hci_dev_test_flag(hcon->hdev, HCI_SC_ENABLED)) {
2406 		authreq |= SMP_AUTH_SC;
2407 		if (hci_dev_test_flag(hcon->hdev, HCI_SSP_ENABLED))
2408 			authreq |= SMP_AUTH_CT2;
2409 	}
2410 
2411 	/* Don't attempt to set MITM if setting is overridden by debugfs
2412 	 * Needed to pass certification test SM/MAS/PKE/BV-01-C
2413 	 */
2414 	if (!hci_dev_test_flag(hcon->hdev, HCI_FORCE_NO_MITM)) {
2415 		/* Require MITM if IO Capability allows or the security level
2416 		 * requires it.
2417 		 */
2418 		if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
2419 		    hcon->pending_sec_level > BT_SECURITY_MEDIUM)
2420 			authreq |= SMP_AUTH_MITM;
2421 	}
2422 
2423 	if (hcon->role == HCI_ROLE_MASTER) {
2424 		struct smp_cmd_pairing cp;
2425 
2426 		build_pairing_cmd(conn, &cp, NULL, authreq);
2427 		smp->preq[0] = SMP_CMD_PAIRING_REQ;
2428 		memcpy(&smp->preq[1], &cp, sizeof(cp));
2429 
2430 		smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
2431 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
2432 	} else {
2433 		struct smp_cmd_security_req cp;
2434 		cp.auth_req = authreq;
2435 		smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
2436 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_REQ);
2437 	}
2438 
2439 	set_bit(SMP_FLAG_INITIATOR, &smp->flags);
2440 	ret = 0;
2441 
2442 unlock:
2443 	l2cap_chan_unlock(chan);
2444 	return ret;
2445 }
2446 
2447 int smp_cancel_and_remove_pairing(struct hci_dev *hdev, bdaddr_t *bdaddr,
2448 				  u8 addr_type)
2449 {
2450 	struct hci_conn *hcon;
2451 	struct l2cap_conn *conn;
2452 	struct l2cap_chan *chan;
2453 	struct smp_chan *smp;
2454 	int err;
2455 
2456 	err = hci_remove_ltk(hdev, bdaddr, addr_type);
2457 	hci_remove_irk(hdev, bdaddr, addr_type);
2458 
2459 	hcon = hci_conn_hash_lookup_le(hdev, bdaddr, addr_type);
2460 	if (!hcon)
2461 		goto done;
2462 
2463 	conn = hcon->l2cap_data;
2464 	if (!conn)
2465 		goto done;
2466 
2467 	chan = conn->smp;
2468 	if (!chan)
2469 		goto done;
2470 
2471 	l2cap_chan_lock(chan);
2472 
2473 	smp = chan->data;
2474 	if (smp) {
2475 		/* Set keys to NULL to make sure smp_failure() does not try to
2476 		 * remove and free already invalidated rcu list entries. */
2477 		smp->ltk = NULL;
2478 		smp->responder_ltk = NULL;
2479 		smp->remote_irk = NULL;
2480 
2481 		if (test_bit(SMP_FLAG_COMPLETE, &smp->flags))
2482 			smp_failure(conn, 0);
2483 		else
2484 			smp_failure(conn, SMP_UNSPECIFIED);
2485 		err = 0;
2486 	}
2487 
2488 	l2cap_chan_unlock(chan);
2489 
2490 done:
2491 	return err;
2492 }
2493 
2494 static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
2495 {
2496 	struct smp_cmd_encrypt_info *rp = (void *) skb->data;
2497 	struct l2cap_chan *chan = conn->smp;
2498 	struct smp_chan *smp = chan->data;
2499 
2500 	bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
2501 
2502 	if (skb->len < sizeof(*rp))
2503 		return SMP_INVALID_PARAMS;
2504 
2505 	/* Pairing is aborted if any blocked keys are distributed */
2506 	if (hci_is_blocked_key(conn->hcon->hdev, HCI_BLOCKED_KEY_TYPE_LTK,
2507 			       rp->ltk)) {
2508 		bt_dev_warn_ratelimited(conn->hcon->hdev,
2509 					"LTK blocked for %pMR",
2510 					&conn->hcon->dst);
2511 		return SMP_INVALID_PARAMS;
2512 	}
2513 
2514 	SMP_ALLOW_CMD(smp, SMP_CMD_INITIATOR_IDENT);
2515 
2516 	skb_pull(skb, sizeof(*rp));
2517 
2518 	memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
2519 
2520 	return 0;
2521 }
2522 
2523 static int smp_cmd_initiator_ident(struct l2cap_conn *conn, struct sk_buff *skb)
2524 {
2525 	struct smp_cmd_initiator_ident *rp = (void *)skb->data;
2526 	struct l2cap_chan *chan = conn->smp;
2527 	struct smp_chan *smp = chan->data;
2528 	struct hci_dev *hdev = conn->hcon->hdev;
2529 	struct hci_conn *hcon = conn->hcon;
2530 	struct smp_ltk *ltk;
2531 	u8 authenticated;
2532 
2533 	bt_dev_dbg(hdev, "conn %p", conn);
2534 
2535 	if (skb->len < sizeof(*rp))
2536 		return SMP_INVALID_PARAMS;
2537 
2538 	/* Mark the information as received */
2539 	smp->remote_key_dist &= ~SMP_DIST_ENC_KEY;
2540 
2541 	if (smp->remote_key_dist & SMP_DIST_ID_KEY)
2542 		SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_INFO);
2543 	else if (smp->remote_key_dist & SMP_DIST_SIGN)
2544 		SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
2545 
2546 	skb_pull(skb, sizeof(*rp));
2547 
2548 	authenticated = (hcon->sec_level == BT_SECURITY_HIGH);
2549 	ltk = hci_add_ltk(hdev, &hcon->dst, hcon->dst_type, SMP_LTK,
2550 			  authenticated, smp->tk, smp->enc_key_size,
2551 			  rp->ediv, rp->rand);
2552 	smp->ltk = ltk;
2553 	if (!(smp->remote_key_dist & KEY_DIST_MASK))
2554 		smp_distribute_keys(smp);
2555 
2556 	return 0;
2557 }
2558 
2559 static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
2560 {
2561 	struct smp_cmd_ident_info *info = (void *) skb->data;
2562 	struct l2cap_chan *chan = conn->smp;
2563 	struct smp_chan *smp = chan->data;
2564 
2565 	bt_dev_dbg(conn->hcon->hdev, "");
2566 
2567 	if (skb->len < sizeof(*info))
2568 		return SMP_INVALID_PARAMS;
2569 
2570 	/* Pairing is aborted if any blocked keys are distributed */
2571 	if (hci_is_blocked_key(conn->hcon->hdev, HCI_BLOCKED_KEY_TYPE_IRK,
2572 			       info->irk)) {
2573 		bt_dev_warn_ratelimited(conn->hcon->hdev,
2574 					"Identity key blocked for %pMR",
2575 					&conn->hcon->dst);
2576 		return SMP_INVALID_PARAMS;
2577 	}
2578 
2579 	SMP_ALLOW_CMD(smp, SMP_CMD_IDENT_ADDR_INFO);
2580 
2581 	skb_pull(skb, sizeof(*info));
2582 
2583 	memcpy(smp->irk, info->irk, 16);
2584 
2585 	return 0;
2586 }
2587 
2588 static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
2589 				   struct sk_buff *skb)
2590 {
2591 	struct smp_cmd_ident_addr_info *info = (void *) skb->data;
2592 	struct l2cap_chan *chan = conn->smp;
2593 	struct smp_chan *smp = chan->data;
2594 	struct hci_conn *hcon = conn->hcon;
2595 	bdaddr_t rpa;
2596 
2597 	bt_dev_dbg(hcon->hdev, "");
2598 
2599 	if (skb->len < sizeof(*info))
2600 		return SMP_INVALID_PARAMS;
2601 
2602 	/* Mark the information as received */
2603 	smp->remote_key_dist &= ~SMP_DIST_ID_KEY;
2604 
2605 	if (smp->remote_key_dist & SMP_DIST_SIGN)
2606 		SMP_ALLOW_CMD(smp, SMP_CMD_SIGN_INFO);
2607 
2608 	skb_pull(skb, sizeof(*info));
2609 
2610 	/* Strictly speaking the Core Specification (4.1) allows sending
2611 	 * an empty address which would force us to rely on just the IRK
2612 	 * as "identity information". However, since such
2613 	 * implementations are not known of and in order to not over
2614 	 * complicate our implementation, simply pretend that we never
2615 	 * received an IRK for such a device.
2616 	 *
2617 	 * The Identity Address must also be a Static Random or Public
2618 	 * Address, which hci_is_identity_address() checks for.
2619 	 */
2620 	if (!bacmp(&info->bdaddr, BDADDR_ANY) ||
2621 	    !hci_is_identity_address(&info->bdaddr, info->addr_type)) {
2622 		bt_dev_err(hcon->hdev, "ignoring IRK with no identity address");
2623 		goto distribute;
2624 	}
2625 
2626 	/* Drop IRK if peer is using identity address during pairing but is
2627 	 * providing different address as identity information.
2628 	 *
2629 	 * Microsoft Surface Precision Mouse is known to have this bug.
2630 	 */
2631 	if (hci_is_identity_address(&hcon->dst, hcon->dst_type) &&
2632 	    (bacmp(&info->bdaddr, &hcon->dst) ||
2633 	     info->addr_type != hcon->dst_type)) {
2634 		bt_dev_err(hcon->hdev,
2635 			   "ignoring IRK with invalid identity address");
2636 		goto distribute;
2637 	}
2638 
2639 	bacpy(&smp->id_addr, &info->bdaddr);
2640 	smp->id_addr_type = info->addr_type;
2641 
2642 	if (hci_bdaddr_is_rpa(&hcon->dst, hcon->dst_type))
2643 		bacpy(&rpa, &hcon->dst);
2644 	else
2645 		bacpy(&rpa, BDADDR_ANY);
2646 
2647 	smp->remote_irk = hci_add_irk(conn->hcon->hdev, &smp->id_addr,
2648 				      smp->id_addr_type, smp->irk, &rpa);
2649 
2650 distribute:
2651 	if (!(smp->remote_key_dist & KEY_DIST_MASK))
2652 		smp_distribute_keys(smp);
2653 
2654 	return 0;
2655 }
2656 
2657 static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
2658 {
2659 	struct smp_cmd_sign_info *rp = (void *) skb->data;
2660 	struct l2cap_chan *chan = conn->smp;
2661 	struct smp_chan *smp = chan->data;
2662 	struct smp_csrk *csrk;
2663 
2664 	bt_dev_dbg(conn->hcon->hdev, "conn %p", conn);
2665 
2666 	if (skb->len < sizeof(*rp))
2667 		return SMP_INVALID_PARAMS;
2668 
2669 	/* Mark the information as received */
2670 	smp->remote_key_dist &= ~SMP_DIST_SIGN;
2671 
2672 	skb_pull(skb, sizeof(*rp));
2673 
2674 	csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
2675 	if (csrk) {
2676 		if (conn->hcon->sec_level > BT_SECURITY_MEDIUM)
2677 			csrk->type = MGMT_CSRK_REMOTE_AUTHENTICATED;
2678 		else
2679 			csrk->type = MGMT_CSRK_REMOTE_UNAUTHENTICATED;
2680 		memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
2681 	}
2682 	smp->csrk = csrk;
2683 	smp_distribute_keys(smp);
2684 
2685 	return 0;
2686 }
2687 
2688 static u8 sc_select_method(struct smp_chan *smp)
2689 {
2690 	struct l2cap_conn *conn = smp->conn;
2691 	struct hci_conn *hcon = conn->hcon;
2692 	struct smp_cmd_pairing *local, *remote;
2693 	u8 local_mitm, remote_mitm, local_io, remote_io, method;
2694 
2695 	if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags) ||
2696 	    test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags))
2697 		return REQ_OOB;
2698 
2699 	/* The preq/prsp contain the raw Pairing Request/Response PDUs
2700 	 * which are needed as inputs to some crypto functions. To get
2701 	 * the "struct smp_cmd_pairing" from them we need to skip the
2702 	 * first byte which contains the opcode.
2703 	 */
2704 	if (hcon->out) {
2705 		local = (void *) &smp->preq[1];
2706 		remote = (void *) &smp->prsp[1];
2707 	} else {
2708 		local = (void *) &smp->prsp[1];
2709 		remote = (void *) &smp->preq[1];
2710 	}
2711 
2712 	local_io = local->io_capability;
2713 	remote_io = remote->io_capability;
2714 
2715 	local_mitm = (local->auth_req & SMP_AUTH_MITM);
2716 	remote_mitm = (remote->auth_req & SMP_AUTH_MITM);
2717 
2718 	/* If either side wants MITM, look up the method from the table,
2719 	 * otherwise use JUST WORKS.
2720 	 */
2721 	if (local_mitm || remote_mitm)
2722 		method = get_auth_method(smp, local_io, remote_io);
2723 	else
2724 		method = JUST_WORKS;
2725 
2726 	/* Don't confirm locally initiated pairing attempts */
2727 	if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
2728 		method = JUST_WORKS;
2729 
2730 	return method;
2731 }
2732 
2733 static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
2734 {
2735 	struct smp_cmd_public_key *key = (void *) skb->data;
2736 	struct hci_conn *hcon = conn->hcon;
2737 	struct l2cap_chan *chan = conn->smp;
2738 	struct smp_chan *smp = chan->data;
2739 	struct hci_dev *hdev = hcon->hdev;
2740 	struct crypto_kpp *tfm_ecdh;
2741 	struct smp_cmd_pairing_confirm cfm;
2742 	int err;
2743 
2744 	bt_dev_dbg(hdev, "conn %p", conn);
2745 
2746 	if (skb->len < sizeof(*key))
2747 		return SMP_INVALID_PARAMS;
2748 
2749 	/* Check if remote and local public keys are the same and debug key is
2750 	 * not in use.
2751 	 */
2752 	if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&
2753 	    !crypto_memneq(key, smp->local_pk, 64)) {
2754 		bt_dev_err(hdev, "Remote and local public keys are identical");
2755 		return SMP_UNSPECIFIED;
2756 	}
2757 
2758 	memcpy(smp->remote_pk, key, 64);
2759 
2760 	if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) {
2761 		err = smp_f4(smp->tfm_cmac, smp->remote_pk, smp->remote_pk,
2762 			     smp->rr, 0, cfm.confirm_val);
2763 		if (err)
2764 			return SMP_UNSPECIFIED;
2765 
2766 		if (crypto_memneq(cfm.confirm_val, smp->pcnf, 16))
2767 			return SMP_CONFIRM_FAILED;
2768 	}
2769 
2770 	/* Non-initiating device sends its public key after receiving
2771 	 * the key from the initiating device.
2772 	 */
2773 	if (!hcon->out) {
2774 		err = sc_send_public_key(smp);
2775 		if (err)
2776 			return err;
2777 	}
2778 
2779 	SMP_DBG("Remote Public Key X: %32phN", smp->remote_pk);
2780 	SMP_DBG("Remote Public Key Y: %32phN", smp->remote_pk + 32);
2781 
2782 	/* Compute the shared secret on the same crypto tfm on which the private
2783 	 * key was set/generated.
2784 	 */
2785 	if (test_bit(SMP_FLAG_LOCAL_OOB, &smp->flags)) {
2786 		struct l2cap_chan *hchan = hdev->smp_data;
2787 		struct smp_dev *smp_dev;
2788 
2789 		if (!hchan || !hchan->data)
2790 			return SMP_UNSPECIFIED;
2791 
2792 		smp_dev = hchan->data;
2793 
2794 		tfm_ecdh = smp_dev->tfm_ecdh;
2795 	} else {
2796 		tfm_ecdh = smp->tfm_ecdh;
2797 	}
2798 
2799 	if (compute_ecdh_secret(tfm_ecdh, smp->remote_pk, smp->dhkey))
2800 		return SMP_UNSPECIFIED;
2801 
2802 	SMP_DBG("DHKey %32phN", smp->dhkey);
2803 
2804 	set_bit(SMP_FLAG_REMOTE_PK, &smp->flags);
2805 
2806 	smp->method = sc_select_method(smp);
2807 
2808 	bt_dev_dbg(hdev, "selected method 0x%02x", smp->method);
2809 
2810 	/* JUST_WORKS and JUST_CFM result in an unauthenticated key */
2811 	if (smp->method == JUST_WORKS || smp->method == JUST_CFM)
2812 		hcon->pending_sec_level = BT_SECURITY_MEDIUM;
2813 	else
2814 		hcon->pending_sec_level = BT_SECURITY_FIPS;
2815 
2816 	if (!crypto_memneq(debug_pk, smp->remote_pk, 64))
2817 		set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
2818 
2819 	if (smp->method == DSP_PASSKEY) {
2820 		get_random_bytes(&hcon->passkey_notify,
2821 				 sizeof(hcon->passkey_notify));
2822 		hcon->passkey_notify %= 1000000;
2823 		hcon->passkey_entered = 0;
2824 		smp->passkey_round = 0;
2825 		if (mgmt_user_passkey_notify(hdev, &hcon->dst, hcon->type,
2826 					     hcon->dst_type,
2827 					     hcon->passkey_notify,
2828 					     hcon->passkey_entered))
2829 			return SMP_UNSPECIFIED;
2830 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
2831 		return sc_passkey_round(smp, SMP_CMD_PUBLIC_KEY);
2832 	}
2833 
2834 	if (smp->method == REQ_OOB) {
2835 		if (hcon->out)
2836 			smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM,
2837 				     sizeof(smp->prnd), smp->prnd);
2838 
2839 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2840 
2841 		return 0;
2842 	}
2843 
2844 	if (hcon->out)
2845 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
2846 
2847 	if (smp->method == REQ_PASSKEY) {
2848 		if (mgmt_user_passkey_request(hdev, &hcon->dst, hcon->type,
2849 					      hcon->dst_type))
2850 			return SMP_UNSPECIFIED;
2851 		SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_CONFIRM);
2852 		set_bit(SMP_FLAG_WAIT_USER, &smp->flags);
2853 		return 0;
2854 	}
2855 
2856 	/* The Initiating device waits for the non-initiating device to
2857 	 * send the confirm value.
2858 	 */
2859 	if (conn->hcon->out)
2860 		return 0;
2861 
2862 	err = smp_f4(smp->tfm_cmac, smp->local_pk, smp->remote_pk, smp->prnd,
2863 		     0, cfm.confirm_val);
2864 	if (err)
2865 		return SMP_UNSPECIFIED;
2866 
2867 	smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cfm), &cfm);
2868 	SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RANDOM);
2869 
2870 	return 0;
2871 }
2872 
2873 static int smp_cmd_dhkey_check(struct l2cap_conn *conn, struct sk_buff *skb)
2874 {
2875 	struct smp_cmd_dhkey_check *check = (void *) skb->data;
2876 	struct l2cap_chan *chan = conn->smp;
2877 	struct hci_conn *hcon = conn->hcon;
2878 	struct smp_chan *smp = chan->data;
2879 	u8 a[7], b[7], *local_addr, *remote_addr;
2880 	u8 io_cap[3], r[16], e[16];
2881 	int err;
2882 
2883 	bt_dev_dbg(hcon->hdev, "conn %p", conn);
2884 
2885 	if (skb->len < sizeof(*check))
2886 		return SMP_INVALID_PARAMS;
2887 
2888 	memcpy(a, &hcon->init_addr, 6);
2889 	memcpy(b, &hcon->resp_addr, 6);
2890 	a[6] = hcon->init_addr_type;
2891 	b[6] = hcon->resp_addr_type;
2892 
2893 	if (hcon->out) {
2894 		local_addr = a;
2895 		remote_addr = b;
2896 		memcpy(io_cap, &smp->prsp[1], 3);
2897 	} else {
2898 		local_addr = b;
2899 		remote_addr = a;
2900 		memcpy(io_cap, &smp->preq[1], 3);
2901 	}
2902 
2903 	memset(r, 0, sizeof(r));
2904 
2905 	if (smp->method == REQ_PASSKEY || smp->method == DSP_PASSKEY)
2906 		put_unaligned_le32(hcon->passkey_notify, r);
2907 	else if (smp->method == REQ_OOB)
2908 		memcpy(r, smp->lr, 16);
2909 
2910 	err = smp_f6(smp->tfm_cmac, smp->mackey, smp->rrnd, smp->prnd, r,
2911 		     io_cap, remote_addr, local_addr, e);
2912 	if (err)
2913 		return SMP_UNSPECIFIED;
2914 
2915 	if (crypto_memneq(check->e, e, 16))
2916 		return SMP_DHKEY_CHECK_FAILED;
2917 
2918 	if (!hcon->out) {
2919 		if (test_bit(SMP_FLAG_WAIT_USER, &smp->flags)) {
2920 			set_bit(SMP_FLAG_DHKEY_PENDING, &smp->flags);
2921 			return 0;
2922 		}
2923 
2924 		/* Responder sends DHKey check as response to initiator */
2925 		sc_dhkey_check(smp);
2926 	}
2927 
2928 	sc_add_ltk(smp);
2929 
2930 	if (hcon->out) {
2931 		hci_le_start_enc(hcon, 0, 0, smp->tk, smp->enc_key_size);
2932 		hcon->enc_key_size = smp->enc_key_size;
2933 	}
2934 
2935 	return 0;
2936 }
2937 
2938 static int smp_cmd_keypress_notify(struct l2cap_conn *conn,
2939 				   struct sk_buff *skb)
2940 {
2941 	struct smp_cmd_keypress_notify *kp = (void *) skb->data;
2942 
2943 	bt_dev_dbg(conn->hcon->hdev, "value 0x%02x", kp->value);
2944 
2945 	return 0;
2946 }
2947 
2948 static int smp_sig_channel(struct l2cap_chan *chan, struct sk_buff *skb)
2949 {
2950 	struct l2cap_conn *conn = chan->conn;
2951 	struct hci_conn *hcon = conn->hcon;
2952 	struct smp_chan *smp;
2953 	__u8 code, reason;
2954 	int err = 0;
2955 
2956 	if (skb->len < 1)
2957 		return -EILSEQ;
2958 
2959 	if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED)) {
2960 		reason = SMP_PAIRING_NOTSUPP;
2961 		goto done;
2962 	}
2963 
2964 	code = skb->data[0];
2965 	skb_pull(skb, sizeof(code));
2966 
2967 	smp = chan->data;
2968 
2969 	if (code > SMP_CMD_MAX)
2970 		goto drop;
2971 
2972 	if (smp && !test_and_clear_bit(code, &smp->allow_cmd))
2973 		goto drop;
2974 
2975 	/* If we don't have a context the only allowed commands are
2976 	 * pairing request and security request.
2977 	 */
2978 	if (!smp && code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ)
2979 		goto drop;
2980 
2981 	switch (code) {
2982 	case SMP_CMD_PAIRING_REQ:
2983 		reason = smp_cmd_pairing_req(conn, skb);
2984 		break;
2985 
2986 	case SMP_CMD_PAIRING_FAIL:
2987 		smp_failure(conn, 0);
2988 		err = -EPERM;
2989 		break;
2990 
2991 	case SMP_CMD_PAIRING_RSP:
2992 		reason = smp_cmd_pairing_rsp(conn, skb);
2993 		break;
2994 
2995 	case SMP_CMD_SECURITY_REQ:
2996 		reason = smp_cmd_security_req(conn, skb);
2997 		break;
2998 
2999 	case SMP_CMD_PAIRING_CONFIRM:
3000 		reason = smp_cmd_pairing_confirm(conn, skb);
3001 		break;
3002 
3003 	case SMP_CMD_PAIRING_RANDOM:
3004 		reason = smp_cmd_pairing_random(conn, skb);
3005 		break;
3006 
3007 	case SMP_CMD_ENCRYPT_INFO:
3008 		reason = smp_cmd_encrypt_info(conn, skb);
3009 		break;
3010 
3011 	case SMP_CMD_INITIATOR_IDENT:
3012 		reason = smp_cmd_initiator_ident(conn, skb);
3013 		break;
3014 
3015 	case SMP_CMD_IDENT_INFO:
3016 		reason = smp_cmd_ident_info(conn, skb);
3017 		break;
3018 
3019 	case SMP_CMD_IDENT_ADDR_INFO:
3020 		reason = smp_cmd_ident_addr_info(conn, skb);
3021 		break;
3022 
3023 	case SMP_CMD_SIGN_INFO:
3024 		reason = smp_cmd_sign_info(conn, skb);
3025 		break;
3026 
3027 	case SMP_CMD_PUBLIC_KEY:
3028 		reason = smp_cmd_public_key(conn, skb);
3029 		break;
3030 
3031 	case SMP_CMD_DHKEY_CHECK:
3032 		reason = smp_cmd_dhkey_check(conn, skb);
3033 		break;
3034 
3035 	case SMP_CMD_KEYPRESS_NOTIFY:
3036 		reason = smp_cmd_keypress_notify(conn, skb);
3037 		break;
3038 
3039 	default:
3040 		bt_dev_dbg(hcon->hdev, "Unknown command code 0x%2.2x", code);
3041 		reason = SMP_CMD_NOTSUPP;
3042 		goto done;
3043 	}
3044 
3045 done:
3046 	if (!err) {
3047 		if (reason)
3048 			smp_failure(conn, reason);
3049 		kfree_skb(skb);
3050 	}
3051 
3052 	return err;
3053 
3054 drop:
3055 	bt_dev_err(hcon->hdev, "unexpected SMP command 0x%02x from %pMR",
3056 		   code, &hcon->dst);
3057 	kfree_skb(skb);
3058 	return 0;
3059 }
3060 
3061 static void smp_teardown_cb(struct l2cap_chan *chan, int err)
3062 {
3063 	struct l2cap_conn *conn = chan->conn;
3064 
3065 	bt_dev_dbg(conn->hcon->hdev, "chan %p", chan);
3066 
3067 	if (chan->data)
3068 		smp_chan_destroy(conn);
3069 
3070 	conn->smp = NULL;
3071 	l2cap_chan_put(chan);
3072 }
3073 
3074 static void bredr_pairing(struct l2cap_chan *chan)
3075 {
3076 	struct l2cap_conn *conn = chan->conn;
3077 	struct hci_conn *hcon = conn->hcon;
3078 	struct hci_dev *hdev = hcon->hdev;
3079 	struct smp_cmd_pairing req;
3080 	struct smp_chan *smp;
3081 
3082 	bt_dev_dbg(hdev, "chan %p", chan);
3083 
3084 	/* Only new pairings are interesting */
3085 	if (!test_bit(HCI_CONN_NEW_LINK_KEY, &hcon->flags))
3086 		return;
3087 
3088 	/* Don't bother if we're not encrypted */
3089 	if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
3090 		return;
3091 
3092 	/* Only initiator may initiate SMP over BR/EDR */
3093 	if (hcon->role != HCI_ROLE_MASTER)
3094 		return;
3095 
3096 	/* Secure Connections support must be enabled */
3097 	if (!hci_dev_test_flag(hdev, HCI_SC_ENABLED))
3098 		return;
3099 
3100 	/* BR/EDR must use Secure Connections for SMP */
3101 	if (!test_bit(HCI_CONN_AES_CCM, &hcon->flags) &&
3102 	    !hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
3103 		return;
3104 
3105 	/* If our LE support is not enabled don't do anything */
3106 	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
3107 		return;
3108 
3109 	/* Don't bother if remote LE support is not enabled */
3110 	if (!lmp_host_le_capable(hcon))
3111 		return;
3112 
3113 	/* Remote must support SMP fixed chan for BR/EDR */
3114 	if (!(conn->remote_fixed_chan & L2CAP_FC_SMP_BREDR))
3115 		return;
3116 
3117 	/* Don't bother if SMP is already ongoing */
3118 	if (chan->data)
3119 		return;
3120 
3121 	smp = smp_chan_create(conn);
3122 	if (!smp) {
3123 		bt_dev_err(hdev, "unable to create SMP context for BR/EDR");
3124 		return;
3125 	}
3126 
3127 	set_bit(SMP_FLAG_SC, &smp->flags);
3128 
3129 	bt_dev_dbg(hdev, "starting SMP over BR/EDR");
3130 
3131 	/* Prepare and send the BR/EDR SMP Pairing Request */
3132 	build_bredr_pairing_cmd(smp, &req, NULL);
3133 
3134 	smp->preq[0] = SMP_CMD_PAIRING_REQ;
3135 	memcpy(&smp->preq[1], &req, sizeof(req));
3136 
3137 	smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(req), &req);
3138 	SMP_ALLOW_CMD(smp, SMP_CMD_PAIRING_RSP);
3139 }
3140 
3141 static void smp_resume_cb(struct l2cap_chan *chan)
3142 {
3143 	struct smp_chan *smp = chan->data;
3144 	struct l2cap_conn *conn = chan->conn;
3145 	struct hci_conn *hcon = conn->hcon;
3146 
3147 	bt_dev_dbg(hcon->hdev, "chan %p", chan);
3148 
3149 	if (hcon->type == ACL_LINK) {
3150 		bredr_pairing(chan);
3151 		return;
3152 	}
3153 
3154 	if (!smp)
3155 		return;
3156 
3157 	if (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
3158 		return;
3159 
3160 	cancel_delayed_work(&smp->security_timer);
3161 
3162 	smp_distribute_keys(smp);
3163 }
3164 
3165 static void smp_ready_cb(struct l2cap_chan *chan)
3166 {
3167 	struct l2cap_conn *conn = chan->conn;
3168 	struct hci_conn *hcon = conn->hcon;
3169 
3170 	bt_dev_dbg(hcon->hdev, "chan %p", chan);
3171 
3172 	/* No need to call l2cap_chan_hold() here since we already own
3173 	 * the reference taken in smp_new_conn_cb(). This is just the
3174 	 * first time that we tie it to a specific pointer. The code in
3175 	 * l2cap_core.c ensures that there's no risk this function wont
3176 	 * get called if smp_new_conn_cb was previously called.
3177 	 */
3178 	conn->smp = chan;
3179 
3180 	if (hcon->type == ACL_LINK && test_bit(HCI_CONN_ENCRYPT, &hcon->flags))
3181 		bredr_pairing(chan);
3182 }
3183 
3184 static int smp_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
3185 {
3186 	int err;
3187 
3188 	bt_dev_dbg(chan->conn->hcon->hdev, "chan %p", chan);
3189 
3190 	err = smp_sig_channel(chan, skb);
3191 	if (err) {
3192 		struct smp_chan *smp = chan->data;
3193 
3194 		if (smp)
3195 			cancel_delayed_work_sync(&smp->security_timer);
3196 
3197 		hci_disconnect(chan->conn->hcon, HCI_ERROR_AUTH_FAILURE);
3198 	}
3199 
3200 	return err;
3201 }
3202 
3203 static struct sk_buff *smp_alloc_skb_cb(struct l2cap_chan *chan,
3204 					unsigned long hdr_len,
3205 					unsigned long len, int nb)
3206 {
3207 	struct sk_buff *skb;
3208 
3209 	skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
3210 	if (!skb)
3211 		return ERR_PTR(-ENOMEM);
3212 
3213 	skb->priority = HCI_PRIO_MAX;
3214 	bt_cb(skb)->l2cap.chan = chan;
3215 
3216 	return skb;
3217 }
3218 
3219 static const struct l2cap_ops smp_chan_ops = {
3220 	.name			= "Security Manager",
3221 	.ready			= smp_ready_cb,
3222 	.recv			= smp_recv_cb,
3223 	.alloc_skb		= smp_alloc_skb_cb,
3224 	.teardown		= smp_teardown_cb,
3225 	.resume			= smp_resume_cb,
3226 
3227 	.new_connection		= l2cap_chan_no_new_connection,
3228 	.state_change		= l2cap_chan_no_state_change,
3229 	.close			= l2cap_chan_no_close,
3230 	.defer			= l2cap_chan_no_defer,
3231 	.suspend		= l2cap_chan_no_suspend,
3232 	.set_shutdown		= l2cap_chan_no_set_shutdown,
3233 	.get_sndtimeo		= l2cap_chan_no_get_sndtimeo,
3234 };
3235 
3236 static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
3237 {
3238 	struct l2cap_chan *chan;
3239 
3240 	BT_DBG("pchan %p", pchan);
3241 
3242 	chan = l2cap_chan_create();
3243 	if (!chan)
3244 		return NULL;
3245 
3246 	chan->chan_type	= pchan->chan_type;
3247 	chan->ops	= &smp_chan_ops;
3248 	chan->scid	= pchan->scid;
3249 	chan->dcid	= chan->scid;
3250 	chan->imtu	= pchan->imtu;
3251 	chan->omtu	= pchan->omtu;
3252 	chan->mode	= pchan->mode;
3253 
3254 	/* Other L2CAP channels may request SMP routines in order to
3255 	 * change the security level. This means that the SMP channel
3256 	 * lock must be considered in its own category to avoid lockdep
3257 	 * warnings.
3258 	 */
3259 	atomic_set(&chan->nesting, L2CAP_NESTING_SMP);
3260 
3261 	BT_DBG("created chan %p", chan);
3262 
3263 	return chan;
3264 }
3265 
3266 static const struct l2cap_ops smp_root_chan_ops = {
3267 	.name			= "Security Manager Root",
3268 	.new_connection		= smp_new_conn_cb,
3269 
3270 	/* None of these are implemented for the root channel */
3271 	.close			= l2cap_chan_no_close,
3272 	.alloc_skb		= l2cap_chan_no_alloc_skb,
3273 	.recv			= l2cap_chan_no_recv,
3274 	.state_change		= l2cap_chan_no_state_change,
3275 	.teardown		= l2cap_chan_no_teardown,
3276 	.ready			= l2cap_chan_no_ready,
3277 	.defer			= l2cap_chan_no_defer,
3278 	.suspend		= l2cap_chan_no_suspend,
3279 	.resume			= l2cap_chan_no_resume,
3280 	.set_shutdown		= l2cap_chan_no_set_shutdown,
3281 	.get_sndtimeo		= l2cap_chan_no_get_sndtimeo,
3282 };
3283 
3284 static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid)
3285 {
3286 	struct l2cap_chan *chan;
3287 	struct smp_dev *smp;
3288 	struct crypto_shash *tfm_cmac;
3289 	struct crypto_kpp *tfm_ecdh;
3290 
3291 	if (cid == L2CAP_CID_SMP_BREDR) {
3292 		smp = NULL;
3293 		goto create_chan;
3294 	}
3295 
3296 	smp = kzalloc(sizeof(*smp), GFP_KERNEL);
3297 	if (!smp)
3298 		return ERR_PTR(-ENOMEM);
3299 
3300 	tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0);
3301 	if (IS_ERR(tfm_cmac)) {
3302 		bt_dev_err(hdev, "Unable to create CMAC crypto context");
3303 		kfree_sensitive(smp);
3304 		return ERR_CAST(tfm_cmac);
3305 	}
3306 
3307 	tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0);
3308 	if (IS_ERR(tfm_ecdh)) {
3309 		bt_dev_err(hdev, "Unable to create ECDH crypto context");
3310 		crypto_free_shash(tfm_cmac);
3311 		kfree_sensitive(smp);
3312 		return ERR_CAST(tfm_ecdh);
3313 	}
3314 
3315 	smp->local_oob = false;
3316 	smp->tfm_cmac = tfm_cmac;
3317 	smp->tfm_ecdh = tfm_ecdh;
3318 
3319 create_chan:
3320 	chan = l2cap_chan_create();
3321 	if (!chan) {
3322 		if (smp) {
3323 			crypto_free_shash(smp->tfm_cmac);
3324 			crypto_free_kpp(smp->tfm_ecdh);
3325 			kfree_sensitive(smp);
3326 		}
3327 		return ERR_PTR(-ENOMEM);
3328 	}
3329 
3330 	chan->data = smp;
3331 
3332 	l2cap_add_scid(chan, cid);
3333 
3334 	l2cap_chan_set_defaults(chan);
3335 
3336 	if (cid == L2CAP_CID_SMP) {
3337 		u8 bdaddr_type;
3338 
3339 		hci_copy_identity_address(hdev, &chan->src, &bdaddr_type);
3340 
3341 		if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
3342 			chan->src_type = BDADDR_LE_PUBLIC;
3343 		else
3344 			chan->src_type = BDADDR_LE_RANDOM;
3345 	} else {
3346 		bacpy(&chan->src, &hdev->bdaddr);
3347 		chan->src_type = BDADDR_BREDR;
3348 	}
3349 
3350 	chan->state = BT_LISTEN;
3351 	chan->mode = L2CAP_MODE_BASIC;
3352 	chan->imtu = L2CAP_DEFAULT_MTU;
3353 	chan->ops = &smp_root_chan_ops;
3354 
3355 	/* Set correct nesting level for a parent/listening channel */
3356 	atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
3357 
3358 	return chan;
3359 }
3360 
3361 static void smp_del_chan(struct l2cap_chan *chan)
3362 {
3363 	struct smp_dev *smp;
3364 
3365 	BT_DBG("chan %p", chan);
3366 
3367 	smp = chan->data;
3368 	if (smp) {
3369 		chan->data = NULL;
3370 		crypto_free_shash(smp->tfm_cmac);
3371 		crypto_free_kpp(smp->tfm_ecdh);
3372 		kfree_sensitive(smp);
3373 	}
3374 
3375 	l2cap_chan_put(chan);
3376 }
3377 
3378 int smp_force_bredr(struct hci_dev *hdev, bool enable)
3379 {
3380 	if (enable == hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
3381 		return -EALREADY;
3382 
3383 	if (enable) {
3384 		struct l2cap_chan *chan;
3385 
3386 		chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR);
3387 		if (IS_ERR(chan))
3388 			return PTR_ERR(chan);
3389 
3390 		hdev->smp_bredr_data = chan;
3391 	} else {
3392 		struct l2cap_chan *chan;
3393 
3394 		chan = hdev->smp_bredr_data;
3395 		hdev->smp_bredr_data = NULL;
3396 		smp_del_chan(chan);
3397 	}
3398 
3399 	hci_dev_change_flag(hdev, HCI_FORCE_BREDR_SMP);
3400 
3401 	return 0;
3402 }
3403 
3404 int smp_register(struct hci_dev *hdev)
3405 {
3406 	struct l2cap_chan *chan;
3407 
3408 	bt_dev_dbg(hdev, "");
3409 
3410 	/* If the controller does not support Low Energy operation, then
3411 	 * there is also no need to register any SMP channel.
3412 	 */
3413 	if (!lmp_le_capable(hdev))
3414 		return 0;
3415 
3416 	if (WARN_ON(hdev->smp_data)) {
3417 		chan = hdev->smp_data;
3418 		hdev->smp_data = NULL;
3419 		smp_del_chan(chan);
3420 	}
3421 
3422 	chan = smp_add_cid(hdev, L2CAP_CID_SMP);
3423 	if (IS_ERR(chan))
3424 		return PTR_ERR(chan);
3425 
3426 	hdev->smp_data = chan;
3427 
3428 	if (!lmp_sc_capable(hdev)) {
3429 		/* Flag can be already set here (due to power toggle) */
3430 		if (!hci_dev_test_flag(hdev, HCI_FORCE_BREDR_SMP))
3431 			return 0;
3432 	}
3433 
3434 	if (WARN_ON(hdev->smp_bredr_data)) {
3435 		chan = hdev->smp_bredr_data;
3436 		hdev->smp_bredr_data = NULL;
3437 		smp_del_chan(chan);
3438 	}
3439 
3440 	chan = smp_add_cid(hdev, L2CAP_CID_SMP_BREDR);
3441 	if (IS_ERR(chan)) {
3442 		int err = PTR_ERR(chan);
3443 		chan = hdev->smp_data;
3444 		hdev->smp_data = NULL;
3445 		smp_del_chan(chan);
3446 		return err;
3447 	}
3448 
3449 	hdev->smp_bredr_data = chan;
3450 
3451 	return 0;
3452 }
3453 
3454 void smp_unregister(struct hci_dev *hdev)
3455 {
3456 	struct l2cap_chan *chan;
3457 
3458 	if (hdev->smp_bredr_data) {
3459 		chan = hdev->smp_bredr_data;
3460 		hdev->smp_bredr_data = NULL;
3461 		smp_del_chan(chan);
3462 	}
3463 
3464 	if (hdev->smp_data) {
3465 		chan = hdev->smp_data;
3466 		hdev->smp_data = NULL;
3467 		smp_del_chan(chan);
3468 	}
3469 }
3470 
3471 #if IS_ENABLED(CONFIG_BT_SELFTEST_SMP)
3472 
3473 static int __init test_debug_key(struct crypto_kpp *tfm_ecdh)
3474 {
3475 	u8 pk[64];
3476 	int err;
3477 
3478 	err = set_ecdh_privkey(tfm_ecdh, debug_sk);
3479 	if (err)
3480 		return err;
3481 
3482 	err = generate_ecdh_public_key(tfm_ecdh, pk);
3483 	if (err)
3484 		return err;
3485 
3486 	if (crypto_memneq(pk, debug_pk, 64))
3487 		return -EINVAL;
3488 
3489 	return 0;
3490 }
3491 
3492 static int __init test_ah(void)
3493 {
3494 	const u8 irk[16] = {
3495 			0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3496 			0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3497 	const u8 r[3] = { 0x94, 0x81, 0x70 };
3498 	const u8 exp[3] = { 0xaa, 0xfb, 0x0d };
3499 	u8 res[3];
3500 	int err;
3501 
3502 	err = smp_ah(irk, r, res);
3503 	if (err)
3504 		return err;
3505 
3506 	if (crypto_memneq(res, exp, 3))
3507 		return -EINVAL;
3508 
3509 	return 0;
3510 }
3511 
3512 static int __init test_c1(void)
3513 {
3514 	const u8 k[16] = {
3515 			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3516 			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
3517 	const u8 r[16] = {
3518 			0xe0, 0x2e, 0x70, 0xc6, 0x4e, 0x27, 0x88, 0x63,
3519 			0x0e, 0x6f, 0xad, 0x56, 0x21, 0xd5, 0x83, 0x57 };
3520 	const u8 preq[7] = { 0x01, 0x01, 0x00, 0x00, 0x10, 0x07, 0x07 };
3521 	const u8 pres[7] = { 0x02, 0x03, 0x00, 0x00, 0x08, 0x00, 0x05 };
3522 	const u8 _iat = 0x01;
3523 	const u8 _rat = 0x00;
3524 	const bdaddr_t ra = { { 0xb6, 0xb5, 0xb4, 0xb3, 0xb2, 0xb1 } };
3525 	const bdaddr_t ia = { { 0xa6, 0xa5, 0xa4, 0xa3, 0xa2, 0xa1 } };
3526 	const u8 exp[16] = {
3527 			0x86, 0x3b, 0xf1, 0xbe, 0xc5, 0x4d, 0xa7, 0xd2,
3528 			0xea, 0x88, 0x89, 0x87, 0xef, 0x3f, 0x1e, 0x1e };
3529 	u8 res[16];
3530 	int err;
3531 
3532 	err = smp_c1(k, r, preq, pres, _iat, &ia, _rat, &ra, res);
3533 	if (err)
3534 		return err;
3535 
3536 	if (crypto_memneq(res, exp, 16))
3537 		return -EINVAL;
3538 
3539 	return 0;
3540 }
3541 
3542 static int __init test_s1(void)
3543 {
3544 	const u8 k[16] = {
3545 			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3546 			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
3547 	const u8 r1[16] = {
3548 			0x88, 0x77, 0x66, 0x55, 0x44, 0x33, 0x22, 0x11 };
3549 	const u8 r2[16] = {
3550 			0x00, 0xff, 0xee, 0xdd, 0xcc, 0xbb, 0xaa, 0x99 };
3551 	const u8 exp[16] = {
3552 			0x62, 0xa0, 0x6d, 0x79, 0xae, 0x16, 0x42, 0x5b,
3553 			0x9b, 0xf4, 0xb0, 0xe8, 0xf0, 0xe1, 0x1f, 0x9a };
3554 	u8 res[16];
3555 	int err;
3556 
3557 	err = smp_s1(k, r1, r2, res);
3558 	if (err)
3559 		return err;
3560 
3561 	if (crypto_memneq(res, exp, 16))
3562 		return -EINVAL;
3563 
3564 	return 0;
3565 }
3566 
3567 static int __init test_f4(struct crypto_shash *tfm_cmac)
3568 {
3569 	const u8 u[32] = {
3570 			0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
3571 			0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
3572 			0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
3573 			0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 };
3574 	const u8 v[32] = {
3575 			0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b,
3576 			0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59,
3577 			0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90,
3578 			0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 };
3579 	const u8 x[16] = {
3580 			0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3581 			0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3582 	const u8 z = 0x00;
3583 	const u8 exp[16] = {
3584 			0x2d, 0x87, 0x74, 0xa9, 0xbe, 0xa1, 0xed, 0xf1,
3585 			0x1c, 0xbd, 0xa9, 0x07, 0xf1, 0x16, 0xc9, 0xf2 };
3586 	u8 res[16];
3587 	int err;
3588 
3589 	err = smp_f4(tfm_cmac, u, v, x, z, res);
3590 	if (err)
3591 		return err;
3592 
3593 	if (crypto_memneq(res, exp, 16))
3594 		return -EINVAL;
3595 
3596 	return 0;
3597 }
3598 
3599 static int __init test_f5(struct crypto_shash *tfm_cmac)
3600 {
3601 	const u8 w[32] = {
3602 			0x98, 0xa6, 0xbf, 0x73, 0xf3, 0x34, 0x8d, 0x86,
3603 			0xf1, 0x66, 0xf8, 0xb4, 0x13, 0x6b, 0x79, 0x99,
3604 			0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3605 			0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3606 	const u8 n1[16] = {
3607 			0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3608 			0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3609 	const u8 n2[16] = {
3610 			0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3611 			0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3612 	const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 };
3613 	const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 };
3614 	const u8 exp_ltk[16] = {
3615 			0x38, 0x0a, 0x75, 0x94, 0xb5, 0x22, 0x05, 0x98,
3616 			0x23, 0xcd, 0xd7, 0x69, 0x11, 0x79, 0x86, 0x69 };
3617 	const u8 exp_mackey[16] = {
3618 			0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd,
3619 			0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 };
3620 	u8 mackey[16], ltk[16];
3621 	int err;
3622 
3623 	err = smp_f5(tfm_cmac, w, n1, n2, a1, a2, mackey, ltk);
3624 	if (err)
3625 		return err;
3626 
3627 	if (crypto_memneq(mackey, exp_mackey, 16))
3628 		return -EINVAL;
3629 
3630 	if (crypto_memneq(ltk, exp_ltk, 16))
3631 		return -EINVAL;
3632 
3633 	return 0;
3634 }
3635 
3636 static int __init test_f6(struct crypto_shash *tfm_cmac)
3637 {
3638 	const u8 w[16] = {
3639 			0x20, 0x6e, 0x63, 0xce, 0x20, 0x6a, 0x3f, 0xfd,
3640 			0x02, 0x4a, 0x08, 0xa1, 0x76, 0xf1, 0x65, 0x29 };
3641 	const u8 n1[16] = {
3642 			0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3643 			0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3644 	const u8 n2[16] = {
3645 			0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3646 			0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3647 	const u8 r[16] = {
3648 			0xc8, 0x0f, 0x2d, 0x0c, 0xd2, 0x42, 0xda, 0x08,
3649 			0x54, 0xbb, 0x53, 0xb4, 0x3b, 0x34, 0xa3, 0x12 };
3650 	const u8 io_cap[3] = { 0x02, 0x01, 0x01 };
3651 	const u8 a1[7] = { 0xce, 0xbf, 0x37, 0x37, 0x12, 0x56, 0x00 };
3652 	const u8 a2[7] = { 0xc1, 0xcf, 0x2d, 0x70, 0x13, 0xa7, 0x00 };
3653 	const u8 exp[16] = {
3654 			0x61, 0x8f, 0x95, 0xda, 0x09, 0x0b, 0x6c, 0xd2,
3655 			0xc5, 0xe8, 0xd0, 0x9c, 0x98, 0x73, 0xc4, 0xe3 };
3656 	u8 res[16];
3657 	int err;
3658 
3659 	err = smp_f6(tfm_cmac, w, n1, n2, r, io_cap, a1, a2, res);
3660 	if (err)
3661 		return err;
3662 
3663 	if (crypto_memneq(res, exp, 16))
3664 		return -EINVAL;
3665 
3666 	return 0;
3667 }
3668 
3669 static int __init test_g2(struct crypto_shash *tfm_cmac)
3670 {
3671 	const u8 u[32] = {
3672 			0xe6, 0x9d, 0x35, 0x0e, 0x48, 0x01, 0x03, 0xcc,
3673 			0xdb, 0xfd, 0xf4, 0xac, 0x11, 0x91, 0xf4, 0xef,
3674 			0xb9, 0xa5, 0xf9, 0xe9, 0xa7, 0x83, 0x2c, 0x5e,
3675 			0x2c, 0xbe, 0x97, 0xf2, 0xd2, 0x03, 0xb0, 0x20 };
3676 	const u8 v[32] = {
3677 			0xfd, 0xc5, 0x7f, 0xf4, 0x49, 0xdd, 0x4f, 0x6b,
3678 			0xfb, 0x7c, 0x9d, 0xf1, 0xc2, 0x9a, 0xcb, 0x59,
3679 			0x2a, 0xe7, 0xd4, 0xee, 0xfb, 0xfc, 0x0a, 0x90,
3680 			0x9a, 0xbb, 0xf6, 0x32, 0x3d, 0x8b, 0x18, 0x55 };
3681 	const u8 x[16] = {
3682 			0xab, 0xae, 0x2b, 0x71, 0xec, 0xb2, 0xff, 0xff,
3683 			0x3e, 0x73, 0x77, 0xd1, 0x54, 0x84, 0xcb, 0xd5 };
3684 	const u8 y[16] = {
3685 			0xcf, 0xc4, 0x3d, 0xff, 0xf7, 0x83, 0x65, 0x21,
3686 			0x6e, 0x5f, 0xa7, 0x25, 0xcc, 0xe7, 0xe8, 0xa6 };
3687 	const u32 exp_val = 0x2f9ed5ba % 1000000;
3688 	u32 val;
3689 	int err;
3690 
3691 	err = smp_g2(tfm_cmac, u, v, x, y, &val);
3692 	if (err)
3693 		return err;
3694 
3695 	if (val != exp_val)
3696 		return -EINVAL;
3697 
3698 	return 0;
3699 }
3700 
3701 static int __init test_h6(struct crypto_shash *tfm_cmac)
3702 {
3703 	const u8 w[16] = {
3704 			0x9b, 0x7d, 0x39, 0x0a, 0xa6, 0x10, 0x10, 0x34,
3705 			0x05, 0xad, 0xc8, 0x57, 0xa3, 0x34, 0x02, 0xec };
3706 	const u8 key_id[4] = { 0x72, 0x62, 0x65, 0x6c };
3707 	const u8 exp[16] = {
3708 			0x99, 0x63, 0xb1, 0x80, 0xe2, 0xa9, 0xd3, 0xe8,
3709 			0x1c, 0xc9, 0x6d, 0xe7, 0x02, 0xe1, 0x9a, 0x2d };
3710 	u8 res[16];
3711 	int err;
3712 
3713 	err = smp_h6(tfm_cmac, w, key_id, res);
3714 	if (err)
3715 		return err;
3716 
3717 	if (crypto_memneq(res, exp, 16))
3718 		return -EINVAL;
3719 
3720 	return 0;
3721 }
3722 
3723 static char test_smp_buffer[32];
3724 
3725 static ssize_t test_smp_read(struct file *file, char __user *user_buf,
3726 			     size_t count, loff_t *ppos)
3727 {
3728 	return simple_read_from_buffer(user_buf, count, ppos, test_smp_buffer,
3729 				       strlen(test_smp_buffer));
3730 }
3731 
3732 static const struct file_operations test_smp_fops = {
3733 	.open		= simple_open,
3734 	.read		= test_smp_read,
3735 	.llseek		= default_llseek,
3736 };
3737 
3738 static int __init run_selftests(struct crypto_shash *tfm_cmac,
3739 				struct crypto_kpp *tfm_ecdh)
3740 {
3741 	ktime_t calltime, delta, rettime;
3742 	unsigned long long duration;
3743 	int err;
3744 
3745 	calltime = ktime_get();
3746 
3747 	err = test_debug_key(tfm_ecdh);
3748 	if (err) {
3749 		BT_ERR("debug_key test failed");
3750 		goto done;
3751 	}
3752 
3753 	err = test_ah();
3754 	if (err) {
3755 		BT_ERR("smp_ah test failed");
3756 		goto done;
3757 	}
3758 
3759 	err = test_c1();
3760 	if (err) {
3761 		BT_ERR("smp_c1 test failed");
3762 		goto done;
3763 	}
3764 
3765 	err = test_s1();
3766 	if (err) {
3767 		BT_ERR("smp_s1 test failed");
3768 		goto done;
3769 	}
3770 
3771 	err = test_f4(tfm_cmac);
3772 	if (err) {
3773 		BT_ERR("smp_f4 test failed");
3774 		goto done;
3775 	}
3776 
3777 	err = test_f5(tfm_cmac);
3778 	if (err) {
3779 		BT_ERR("smp_f5 test failed");
3780 		goto done;
3781 	}
3782 
3783 	err = test_f6(tfm_cmac);
3784 	if (err) {
3785 		BT_ERR("smp_f6 test failed");
3786 		goto done;
3787 	}
3788 
3789 	err = test_g2(tfm_cmac);
3790 	if (err) {
3791 		BT_ERR("smp_g2 test failed");
3792 		goto done;
3793 	}
3794 
3795 	err = test_h6(tfm_cmac);
3796 	if (err) {
3797 		BT_ERR("smp_h6 test failed");
3798 		goto done;
3799 	}
3800 
3801 	rettime = ktime_get();
3802 	delta = ktime_sub(rettime, calltime);
3803 	duration = (unsigned long long) ktime_to_ns(delta) >> 10;
3804 
3805 	BT_INFO("SMP test passed in %llu usecs", duration);
3806 
3807 done:
3808 	if (!err)
3809 		snprintf(test_smp_buffer, sizeof(test_smp_buffer),
3810 			 "PASS (%llu usecs)\n", duration);
3811 	else
3812 		snprintf(test_smp_buffer, sizeof(test_smp_buffer), "FAIL\n");
3813 
3814 	debugfs_create_file("selftest_smp", 0444, bt_debugfs, NULL,
3815 			    &test_smp_fops);
3816 
3817 	return err;
3818 }
3819 
3820 int __init bt_selftest_smp(void)
3821 {
3822 	struct crypto_shash *tfm_cmac;
3823 	struct crypto_kpp *tfm_ecdh;
3824 	int err;
3825 
3826 	tfm_cmac = crypto_alloc_shash("cmac(aes)", 0, 0);
3827 	if (IS_ERR(tfm_cmac)) {
3828 		BT_ERR("Unable to create CMAC crypto context");
3829 		return PTR_ERR(tfm_cmac);
3830 	}
3831 
3832 	tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0);
3833 	if (IS_ERR(tfm_ecdh)) {
3834 		BT_ERR("Unable to create ECDH crypto context");
3835 		crypto_free_shash(tfm_cmac);
3836 		return PTR_ERR(tfm_ecdh);
3837 	}
3838 
3839 	err = run_selftests(tfm_cmac, tfm_ecdh);
3840 
3841 	crypto_free_shash(tfm_cmac);
3842 	crypto_free_kpp(tfm_ecdh);
3843 
3844 	return err;
3845 }
3846 
3847 #endif
3848