Patched in Tegra support.

1 files changed, 184 insertions, 491 deletions

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 68a9587c969..c45dd737cdd 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -20,19 +20,15 @@
    SOFTWARE IS DISCLAIMED.
 */
 
-#include <linux/crypto.h>
-#include <linux/scatterlist.h>
-#include <crypto/b128ops.h>
-
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/l2cap.h>
-#include <net/bluetooth/mgmt.h>
 #include <net/bluetooth/smp.h>
+#include <linux/crypto.h>
+#include <linux/scatterlist.h>
+#include <crypto/b128ops.h>
 
-#define SMP_TIMEOUT     msecs_to_jiffies(30000)
-
-#define AUTH_REQ_MASK   0x07
+#define SMP_TIMEOUT 30000 /* 30 seconds */
 
 static inline void swap128(u8 src[16], u8 dst[16])
 {
@@ -167,7 +163,7 @@ static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
 
         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
         lh->len = cpu_to_le16(sizeof(code) + dlen);
-        lh->cid = __constant_cpu_to_le16(L2CAP_CID_SMP);
+        lh->cid = cpu_to_le16(L2CAP_CID_SMP);
 
         memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
 
@@ -185,28 +181,16 @@ static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
         if (!skb)
                 return;
 
-        skb->priority = HCI_PRIO_MAX;
-        hci_send_acl(conn->hchan, skb, 0);
-
-        cancel_delayed_work_sync(&conn->security_timer);
-        schedule_delayed_work(&conn->security_timer, SMP_TIMEOUT);
+        hci_send_acl(conn->hcon, skb, 0);
 }
 
-static __u8 authreq_to_seclevel(__u8 authreq)
+static __u8 seclevel_to_authreq(__u8 level)
 {
-        if (authreq & SMP_AUTH_MITM)
-                return BT_SECURITY_HIGH;
-        else
-                return BT_SECURITY_MEDIUM;
-}
-
-static __u8 seclevel_to_authreq(__u8 sec_level)
-{
-        switch (sec_level) {
+        switch (level) {
         case BT_SECURITY_HIGH:
-                return SMP_AUTH_MITM | SMP_AUTH_BONDING;
-        case BT_SECURITY_MEDIUM:
-                return SMP_AUTH_BONDING;
+                /* Right now we don't support bonding */
+                return SMP_AUTH_MITM;
+
         default:
                 return SMP_AUTH_NONE;
         }
@@ -217,351 +201,39 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
                                 struct smp_cmd_pairing *rsp,
                                 __u8 authreq)
 {
-        u8 dist_keys = 0;
+        u8 dist_keys;
 
-        if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
-                dist_keys = SMP_DIST_ENC_KEY;
+        dist_keys = 0;
+        if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->flags)) {
+                dist_keys = SMP_DIST_ENC_KEY | SMP_DIST_ID_KEY | SMP_DIST_SIGN;
                 authreq |= SMP_AUTH_BONDING;
-        } else {
-                authreq &= ~SMP_AUTH_BONDING;
         }
 
         if (rsp == NULL) {
                 req->io_capability = conn->hcon->io_capability;
                 req->oob_flag = SMP_OOB_NOT_PRESENT;
                 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
-                req->init_key_dist = 0;
+                req->init_key_dist = dist_keys;
                 req->resp_key_dist = dist_keys;
-                req->auth_req = (authreq & AUTH_REQ_MASK);
+                req->auth_req = authreq;
                 return;
         }
 
         rsp->io_capability = conn->hcon->io_capability;
         rsp->oob_flag = SMP_OOB_NOT_PRESENT;
         rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
-        rsp->init_key_dist = 0;
+        rsp->init_key_dist = req->init_key_dist & dist_keys;
         rsp->resp_key_dist = req->resp_key_dist & dist_keys;
-        rsp->auth_req = (authreq & AUTH_REQ_MASK);
+        rsp->auth_req = authreq;
 }
 
 static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
 {
-        struct smp_chan *smp = conn->smp_chan;
-
         if ((max_key_size > SMP_MAX_ENC_KEY_SIZE) ||
                         (max_key_size < SMP_MIN_ENC_KEY_SIZE))
                 return SMP_ENC_KEY_SIZE;
 
-        smp->enc_key_size = max_key_size;
-
-        return 0;
-}
-
-static void smp_failure(struct l2cap_conn *conn, u8 reason, u8 send)
-{
-        struct hci_conn *hcon = conn->hcon;
-
-        if (send)
-                smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
-                                                                &reason);
-
-        clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->hcon->flags);
-        mgmt_auth_failed(conn->hcon->hdev, conn->dst, hcon->type,
-                         hcon->dst_type, HCI_ERROR_AUTH_FAILURE);
-
-        cancel_delayed_work_sync(&conn->security_timer);
-
-        if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
-                smp_chan_destroy(conn);
-}
-
-#define JUST_WORKS      0x00
-#define JUST_CFM        0x01
-#define REQ_PASSKEY     0x02
-#define CFM_PASSKEY     0x03
-#define REQ_OOB         0x04
-#define OVERLAP         0xFF
-
-static const u8 gen_method[5][5] = {
-        { JUST_WORKS,  JUST_CFM,    REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
-        { JUST_WORKS,  JUST_CFM,    REQ_PASSKEY, JUST_WORKS, REQ_PASSKEY },
-        { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, CFM_PASSKEY },
-        { JUST_WORKS,  JUST_CFM,    JUST_WORKS,  JUST_WORKS, JUST_CFM    },
-        { CFM_PASSKEY, CFM_PASSKEY, REQ_PASSKEY, JUST_WORKS, OVERLAP     },
-};
-
-static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
-                                                u8 local_io, u8 remote_io)
-{
-        struct hci_conn *hcon = conn->hcon;
-        struct smp_chan *smp = conn->smp_chan;
-        u8 method;
-        u32 passkey = 0;
-        int ret = 0;
-
-        /* Initialize key for JUST WORKS */
-        memset(smp->tk, 0, sizeof(smp->tk));
-        clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
-
-        BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
-
-        /* If neither side wants MITM, use JUST WORKS */
-        /* If either side has unknown io_caps, use JUST WORKS */
-        /* Otherwise, look up method from the table */
-        if (!(auth & SMP_AUTH_MITM) ||
-                        local_io > SMP_IO_KEYBOARD_DISPLAY ||
-                        remote_io > SMP_IO_KEYBOARD_DISPLAY)
-                method = JUST_WORKS;
-        else
-                method = gen_method[remote_io][local_io];
-
-        /* If not bonding, don't ask user to confirm a Zero TK */
-        if (!(auth & SMP_AUTH_BONDING) && method == JUST_CFM)
-                method = JUST_WORKS;
-
-        /* If Just Works, Continue with Zero TK */
-        if (method == JUST_WORKS) {
-                set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
-                return 0;
-        }
-
-        /* Not Just Works/Confirm results in MITM Authentication */
-        if (method != JUST_CFM)
-                set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
-
-        /* If both devices have Keyoard-Display I/O, the master
-         * Confirms and the slave Enters the passkey.
-         */
-        if (method == OVERLAP) {
-                if (hcon->link_mode & HCI_LM_MASTER)
-                        method = CFM_PASSKEY;
-                else
-                        method = REQ_PASSKEY;
-        }
-
-        /* Generate random passkey. Not valid until confirmed. */
-        if (method == CFM_PASSKEY) {
-                u8 key[16];
-
-                memset(key, 0, sizeof(key));
-                get_random_bytes(&passkey, sizeof(passkey));
-                passkey %= 1000000;
-                put_unaligned_le32(passkey, key);
-                swap128(key, smp->tk);
-                BT_DBG("PassKey: %d", passkey);
-        }
-
-        hci_dev_lock(hcon->hdev);
-
-        if (method == REQ_PASSKEY)
-                ret = mgmt_user_passkey_request(hcon->hdev, conn->dst,
-                                                hcon->type, hcon->dst_type);
-        else
-                ret = mgmt_user_confirm_request(hcon->hdev, conn->dst,
-                                                hcon->type, hcon->dst_type,
-                                                cpu_to_le32(passkey), 0);
-
-        hci_dev_unlock(hcon->hdev);
-
-        return ret;
-}
-
-static void confirm_work(struct work_struct *work)
-{
-        struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
-        struct l2cap_conn *conn = smp->conn;
-        struct crypto_blkcipher *tfm;
-        struct smp_cmd_pairing_confirm cp;
-        int ret;
-        u8 res[16], reason;
-
-        BT_DBG("conn %p", conn);
-
-        tfm = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(tfm)) {
-                reason = SMP_UNSPECIFIED;
-                goto error;
-        }
-
-        smp->tfm = tfm;
-
-        if (conn->hcon->out)
-                ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp, 0,
-                             conn->src, conn->hcon->dst_type, conn->dst, res);
-        else
-                ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
-                             conn->hcon->dst_type, conn->dst, 0, conn->src,
-                             res);
-        if (ret) {
-                reason = SMP_UNSPECIFIED;
-                goto error;
-        }
-
-        clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
-
-        swap128(res, cp.confirm_val);
-        smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
-
-        return;
-
-error:
-        smp_failure(conn, reason, 1);
-}
-
-static void random_work(struct work_struct *work)
-{
-        struct smp_chan *smp = container_of(work, struct smp_chan, random);
-        struct l2cap_conn *conn = smp->conn;
-        struct hci_conn *hcon = conn->hcon;
-        struct crypto_blkcipher *tfm = smp->tfm;
-        u8 reason, confirm[16], res[16], key[16];
-        int ret;
-
-        if (IS_ERR_OR_NULL(tfm)) {
-                reason = SMP_UNSPECIFIED;
-                goto error;
-        }
-
-        BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
-
-        if (hcon->out)
-                ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp, 0,
-                             conn->src, hcon->dst_type, conn->dst, res);
-        else
-                ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
-                             hcon->dst_type, conn->dst, 0, conn->src, res);
-        if (ret) {
-                reason = SMP_UNSPECIFIED;
-                goto error;
-        }
-
-        swap128(res, confirm);
-
-        if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
-                BT_ERR("Pairing failed (confirmation values mismatch)");
-                reason = SMP_CONFIRM_FAILED;
-                goto error;
-        }
-
-        if (hcon->out) {
-                u8 stk[16], rand[8];
-                __le16 ediv;
-
-                memset(rand, 0, sizeof(rand));
-                ediv = 0;
-
-                smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
-                swap128(key, stk);
-
-                memset(stk + smp->enc_key_size, 0,
-                       SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
-
-                if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
-                        reason = SMP_UNSPECIFIED;
-                        goto error;
-                }
-
-                hci_le_start_enc(hcon, ediv, rand, stk);
-                hcon->enc_key_size = smp->enc_key_size;
-        } else {
-                u8 stk[16], r[16], rand[8];
-                __le16 ediv;
-
-                memset(rand, 0, sizeof(rand));
-                ediv = 0;
-
-                swap128(smp->prnd, r);
-                smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
-
-                smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
-                swap128(key, stk);
-
-                memset(stk + smp->enc_key_size, 0,
-                                SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
-
-                hci_add_ltk(hcon->hdev, conn->dst, hcon->dst_type,
-                            HCI_SMP_STK_SLAVE, 0, 0, stk, smp->enc_key_size,
-                            ediv, rand);
-        }
-
-        return;
-
-error:
-        smp_failure(conn, reason, 1);
-}
-
-static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
-{
-        struct smp_chan *smp;
-
-        smp = kzalloc(sizeof(struct smp_chan), GFP_ATOMIC);
-        if (!smp)
-                return NULL;
-
-        INIT_WORK(&smp->confirm, confirm_work);
-        INIT_WORK(&smp->random, random_work);
-
-        smp->conn = conn;
-        conn->smp_chan = smp;
-        conn->hcon->smp_conn = conn;
-
-        hci_conn_hold(conn->hcon);
-
-        return smp;
-}
-
-void smp_chan_destroy(struct l2cap_conn *conn)
-{
-        struct smp_chan *smp = conn->smp_chan;
-
-        BUG_ON(!smp);
-
-        if (smp->tfm)
-                crypto_free_blkcipher(smp->tfm);
-
-        kfree(smp);
-        conn->smp_chan = NULL;
-        conn->hcon->smp_conn = NULL;
-        hci_conn_put(conn->hcon);
-}
-
-int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
-{
-        struct l2cap_conn *conn = hcon->smp_conn;
-        struct smp_chan *smp;
-        u32 value;
-        u8 key[16];
-
-        BT_DBG("");
-
-        if (!conn)
-                return -ENOTCONN;
-
-        smp = conn->smp_chan;
-
-        switch (mgmt_op) {
-        case MGMT_OP_USER_PASSKEY_REPLY:
-                value = le32_to_cpu(passkey);
-                memset(key, 0, sizeof(key));
-                BT_DBG("PassKey: %d", value);
-                put_unaligned_le32(value, key);
-                swap128(key, smp->tk);
-                /* Fall Through */
-        case MGMT_OP_USER_CONFIRM_REPLY:
-                set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
-                break;
-        case MGMT_OP_USER_PASSKEY_NEG_REPLY:
-        case MGMT_OP_USER_CONFIRM_NEG_REPLY:
-                smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED, 1);
-                return 0;
-        default:
-                smp_failure(conn, SMP_PASSKEY_ENTRY_FAILED, 1);
-                return -EOPNOTSUPP;
-        }
-
-        /* If it is our turn to send Pairing Confirm, do so now */
-        if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
-                queue_work(hcon->hdev->workqueue, &smp->confirm);
+        conn->smp_key_size = max_key_size;
 
         return 0;
 }
@@ -569,53 +241,37 @@ int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
 static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
 {
         struct smp_cmd_pairing rsp, *req = (void *) skb->data;
-        struct smp_chan *smp;
         u8 key_size;
-        u8 auth = SMP_AUTH_NONE;
-        int ret;
 
         BT_DBG("conn %p", conn);
 
-        if (conn->hcon->link_mode & HCI_LM_MASTER)
-                return SMP_CMD_NOTSUPP;
-
-        if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
-                smp = smp_chan_create(conn);
-        else
-                smp = conn->smp_chan;
-
-        if (!smp)
-                return SMP_UNSPECIFIED;
-
-        smp->preq[0] = SMP_CMD_PAIRING_REQ;
-        memcpy(&smp->preq[1], req, sizeof(*req));
+        conn->preq[0] = SMP_CMD_PAIRING_REQ;
+        memcpy(&conn->preq[1], req, sizeof(*req));
         skb_pull(skb, sizeof(*req));
 
-        /* We didn't start the pairing, so match remote */
-        if (req->auth_req & SMP_AUTH_BONDING)
-                auth = req->auth_req;
+        if (req->oob_flag)
+                return SMP_OOB_NOT_AVAIL;
 
-        conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
-
-        build_pairing_cmd(conn, req, &rsp, auth);
+        /* We didn't start the pairing, so no requirements */
+        build_pairing_cmd(conn, req, &rsp, SMP_AUTH_NONE);
 
         key_size = min(req->max_key_size, rsp.max_key_size);
         if (check_enc_key_size(conn, key_size))
                 return SMP_ENC_KEY_SIZE;
 
-        ret = smp_rand(smp->prnd);
-        if (ret)
-                return SMP_UNSPECIFIED;
+        /* Just works */
+        memset(conn->tk, 0, sizeof(conn->tk));
 
-        smp->prsp[0] = SMP_CMD_PAIRING_RSP;
-        memcpy(&smp->prsp[1], &rsp, sizeof(rsp));
+        conn->prsp[0] = SMP_CMD_PAIRING_RSP;
+        memcpy(&conn->prsp[1], &rsp, sizeof(rsp));
 
         smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(rsp), &rsp);
 
-        /* Request setup of TK */
-        ret = tk_request(conn, 0, auth, rsp.io_capability, req->io_capability);
-        if (ret)
-                return SMP_UNSPECIFIED;
+        mod_timer(&conn->security_timer, jiffies +
+                                        msecs_to_jiffies(SMP_TIMEOUT));
+
+        mod_timer(&conn->security_timer, jiffies +
+                                        msecs_to_jiffies(SMP_TIMEOUT));
 
         return 0;
 }
@@ -623,149 +279,187 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
 static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
 {
         struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
-        struct smp_chan *smp = conn->smp_chan;
-        struct hci_dev *hdev = conn->hcon->hdev;
-        u8 key_size, auth = SMP_AUTH_NONE;
+        struct smp_cmd_pairing_confirm cp;
+        struct crypto_blkcipher *tfm = conn->hcon->hdev->tfm;
         int ret;
+        u8 res[16], key_size;
 
         BT_DBG("conn %p", conn);
 
-        if (!(conn->hcon->link_mode & HCI_LM_MASTER))
-                return SMP_CMD_NOTSUPP;
-
         skb_pull(skb, sizeof(*rsp));
 
-        req = (void *) &smp->preq[1];
+        req = (void *) &conn->preq[1];
 
         key_size = min(req->max_key_size, rsp->max_key_size);
         if (check_enc_key_size(conn, key_size))
                 return SMP_ENC_KEY_SIZE;
 
-        ret = smp_rand(smp->prnd);
-        if (ret)
-                return SMP_UNSPECIFIED;
-
-        smp->prsp[0] = SMP_CMD_PAIRING_RSP;
-        memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
+        if (rsp->oob_flag)
+                return SMP_OOB_NOT_AVAIL;
 
-        if ((req->auth_req & SMP_AUTH_BONDING) &&
-                        (rsp->auth_req & SMP_AUTH_BONDING))
-                auth = SMP_AUTH_BONDING;
+        /* Just works */
+        memset(conn->tk, 0, sizeof(conn->tk));
 
-        auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
+        conn->prsp[0] = SMP_CMD_PAIRING_RSP;
+        memcpy(&conn->prsp[1], rsp, sizeof(*rsp));
 
-        ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
+        ret = smp_rand(conn->prnd);
         if (ret)
                 return SMP_UNSPECIFIED;
 
-        set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
+        ret = smp_c1(tfm, conn->tk, conn->prnd, conn->preq, conn->prsp, 0,
+                        conn->src, conn->hcon->dst_type, conn->dst, res);
+        if (ret)
+                return SMP_UNSPECIFIED;
 
-        /* Can't compose response until we have been confirmed */
-        if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
-                return 0;
+        swap128(res, cp.confirm_val);
 
-        queue_work(hdev->workqueue, &smp->confirm);
+        smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
 
         return 0;
 }
 
 static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
 {
-        struct smp_chan *smp = conn->smp_chan;
-        struct hci_dev *hdev = conn->hcon->hdev;
+        struct crypto_blkcipher *tfm = conn->hcon->hdev->tfm;
 
         BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
 
-        memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
-        skb_pull(skb, sizeof(smp->pcnf));
+        memcpy(conn->pcnf, skb->data, sizeof(conn->pcnf));
+        skb_pull(skb, sizeof(conn->pcnf));
 
         if (conn->hcon->out) {
                 u8 random[16];
 
-                swap128(smp->prnd, random);
+                swap128(conn->prnd, random);
                 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
                                                                 random);
-        } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
-                queue_work(hdev->workqueue, &smp->confirm);
         } else {
-                set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
+                struct smp_cmd_pairing_confirm cp;
+                int ret;
+                u8 res[16];
+
+                ret = smp_rand(conn->prnd);
+                if (ret)
+                        return SMP_UNSPECIFIED;
+
+                ret = smp_c1(tfm, conn->tk, conn->prnd, conn->preq, conn->prsp,
+                                                conn->hcon->dst_type, conn->dst,
+                                                0, conn->src, res);
+                if (ret)
+                        return SMP_CONFIRM_FAILED;
+
+                swap128(res, cp.confirm_val);
+
+                smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
         }
 
+        mod_timer(&conn->security_timer, jiffies +
+                                        msecs_to_jiffies(SMP_TIMEOUT));
+
         return 0;
 }
 
 static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
 {
-        struct smp_chan *smp = conn->smp_chan;
-        struct hci_dev *hdev = conn->hcon->hdev;
+        struct hci_conn *hcon = conn->hcon;
+        struct crypto_blkcipher *tfm = hcon->hdev->tfm;
+        int ret;
+        u8 key[16], res[16], random[16], confirm[16];
 
-        BT_DBG("conn %p", conn);
+        swap128(skb->data, random);
+        skb_pull(skb, sizeof(random));
 
-        swap128(skb->data, smp->rrnd);
-        skb_pull(skb, sizeof(smp->rrnd));
+        if (conn->hcon->out)
+                ret = smp_c1(tfm, conn->tk, random, conn->preq, conn->prsp, 0,
+                                conn->src, conn->hcon->dst_type, conn->dst,
+                                res);
+        else
+                ret = smp_c1(tfm, conn->tk, random, conn->preq, conn->prsp,
+                                conn->hcon->dst_type, conn->dst, 0, conn->src,
+                                res);
+        if (ret)
+                return SMP_UNSPECIFIED;
 
-        queue_work(hdev->workqueue, &smp->random);
+        BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
 
-        return 0;
-}
+        swap128(res, confirm);
 
-static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
-{
-        struct smp_ltk *key;
-        struct hci_conn *hcon = conn->hcon;
+        if (memcmp(conn->pcnf, confirm, sizeof(conn->pcnf)) != 0) {
+                BT_ERR("Pairing failed (confirmation values mismatch)");
+                return SMP_CONFIRM_FAILED;
+        }
 
-        key = hci_find_ltk_by_addr(hcon->hdev, conn->dst, hcon->dst_type);
-        if (!key)
-                return 0;
+        if (conn->hcon->out) {
+                u8 stk[16], rand[8];
+                __le16 ediv;
 
-        if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
-                return 0;
+                memset(rand, 0, sizeof(rand));
+                ediv = 0;
 
-        if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
-                return 1;
+                smp_s1(tfm, conn->tk, random, conn->prnd, key);
+                swap128(key, stk);
 
-        hci_le_start_enc(hcon, key->ediv, key->rand, key->val);
-        hcon->enc_key_size = key->enc_size;
+                memset(stk + conn->smp_key_size, 0,
+                                SMP_MAX_ENC_KEY_SIZE - conn->smp_key_size);
 
-        return 1;
+                hci_le_start_enc(hcon, ediv, rand, stk);
+                hcon->enc_key_size = conn->smp_key_size;
+        } else {
+                u8 stk[16], r[16], rand[8];
+                __le16 ediv;
+
+                memset(rand, 0, sizeof(rand));
+                ediv = 0;
 
+                swap128(conn->prnd, r);
+                smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
+
+                smp_s1(tfm, conn->tk, conn->prnd, random, key);
+                swap128(key, stk);
+
+                memset(stk + conn->smp_key_size, 0,
+                                SMP_MAX_ENC_KEY_SIZE - conn->smp_key_size);
+
+                hci_add_ltk(conn->hcon->hdev, 0, conn->dst, conn->smp_key_size,
+                                                        ediv, rand, stk);
+        }
+
+        return 0;
 }
+
 static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 {
         struct smp_cmd_security_req *rp = (void *) skb->data;
         struct smp_cmd_pairing cp;
         struct hci_conn *hcon = conn->hcon;
-        struct smp_chan *smp;
 
         BT_DBG("conn %p", conn);
 
-        hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
-
-        if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
+        if (test_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend))
                 return 0;
 
-        if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
-                return 0;
-
-        smp = smp_chan_create(conn);
-
         skb_pull(skb, sizeof(*rp));
 
         memset(&cp, 0, sizeof(cp));
         build_pairing_cmd(conn, &cp, NULL, rp->auth_req);
 
-        smp->preq[0] = SMP_CMD_PAIRING_REQ;
-        memcpy(&smp->preq[1], &cp, sizeof(cp));
+        conn->preq[0] = SMP_CMD_PAIRING_REQ;
+        memcpy(&conn->preq[1], &cp, sizeof(cp));
 
         smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
 
+        mod_timer(&conn->security_timer, jiffies +
+                                        msecs_to_jiffies(SMP_TIMEOUT));
+
+        set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend);
+
         return 0;
 }
 
-int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
+int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
 {
-        struct l2cap_conn *conn = hcon->l2cap_data;
-        struct smp_chan *smp = conn->smp_chan;
+        struct hci_conn *hcon = conn->hcon;
         __u8 authreq;
 
         BT_DBG("conn %p hcon %p level 0x%2.2x", conn, hcon, sec_level);
@@ -773,31 +467,42 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
         if (!lmp_host_le_capable(hcon->hdev))
                 return 1;
 
-        if (sec_level == BT_SECURITY_LOW)
-                return 1;
-
-        if (hcon->sec_level >= sec_level)
+        if (IS_ERR(hcon->hdev->tfm))
                 return 1;
 
-        if (hcon->link_mode & HCI_LM_MASTER)
-                if (smp_ltk_encrypt(conn, sec_level))
-                        goto done;
-
-        if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
+        if (test_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend))
                 return 0;
 
-        smp = smp_chan_create(conn);
-        if (!smp)
+        if (sec_level == BT_SECURITY_LOW)
+                return 1;
+
+        if (hcon->sec_level >= sec_level)
                 return 1;
 
         authreq = seclevel_to_authreq(sec_level);
 
         if (hcon->link_mode & HCI_LM_MASTER) {
                 struct smp_cmd_pairing cp;
+                struct link_key *key;
+
+                key = hci_find_link_key_type(hcon->hdev, conn->dst,
+                                                        HCI_LK_SMP_LTK);
+                if (key) {
+                        struct key_master_id *master = (void *) key->data;
+
+                        hci_le_start_enc(hcon, master->ediv, master->rand,
+                                                                key->val);
+                        hcon->enc_key_size = key->pin_len;
+
+                        goto done;
+                }
 
                 build_pairing_cmd(conn, &cp, NULL, authreq);
-                smp->preq[0] = SMP_CMD_PAIRING_REQ;
-                memcpy(&smp->preq[1], &cp, sizeof(cp));
+                conn->preq[0] = SMP_CMD_PAIRING_REQ;
+                memcpy(&conn->preq[1], &cp, sizeof(cp));
+
+                mod_timer(&conn->security_timer, jiffies +
+                                        msecs_to_jiffies(SMP_TIMEOUT));
 
                 smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
         } else {
@@ -808,6 +513,7 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
 
 done:
         hcon->pending_sec_level = sec_level;
+        set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->pend);
 
         return 0;
 }
@@ -815,11 +521,10 @@ done:
 static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
 {
         struct smp_cmd_encrypt_info *rp = (void *) skb->data;
-        struct smp_chan *smp = conn->smp_chan;
 
         skb_pull(skb, sizeof(*rp));
 
-        memcpy(smp->tk, rp->ltk, sizeof(smp->tk));
+        memcpy(conn->tk, rp->ltk, sizeof(conn->tk));
 
         return 0;
 }
@@ -827,20 +532,13 @@ static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
 static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
 {
         struct smp_cmd_master_ident *rp = (void *) skb->data;
-        struct smp_chan *smp = conn->smp_chan;
-        struct hci_dev *hdev = conn->hcon->hdev;
-        struct hci_conn *hcon = conn->hcon;
-        u8 authenticated;
 
         skb_pull(skb, sizeof(*rp));
 
-        hci_dev_lock(hdev);
-        authenticated = (conn->hcon->sec_level == BT_SECURITY_HIGH);
-        hci_add_ltk(conn->hcon->hdev, conn->dst, hcon->dst_type,
-                    HCI_SMP_LTK, 1, authenticated, smp->tk, smp->enc_key_size,
-                    rp->ediv, rp->rand);
+        hci_add_ltk(conn->hcon->hdev, 1, conn->src, conn->smp_key_size,
+                                                rp->ediv, rp->rand, conn->tk);
+
         smp_distribute_keys(conn, 1);
-        hci_dev_unlock(hdev);
 
         return 0;
 }
@@ -857,6 +555,12 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
                 goto done;
         }
 
+        if (IS_ERR(conn->hcon->hdev->tfm)) {
+                err = PTR_ERR(conn->hcon->hdev->tfm);
+                reason = SMP_PAIRING_NOTSUPP;
+                goto done;
+        }
+
         skb_pull(skb, sizeof(code));
 
         switch (code) {
@@ -865,7 +569,6 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
                 break;
 
         case SMP_CMD_PAIRING_FAIL:
-                smp_failure(conn, skb->data[0], 0);
                 reason = 0;
                 err = -EPERM;
                 break;
@@ -911,7 +614,8 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
 
 done:
         if (reason)
-                smp_failure(conn, reason, 1);
+                smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(reason),
+                                                                &reason);
 
         kfree_skb(skb);
         return err;
@@ -920,21 +624,20 @@ done:
 int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
 {
         struct smp_cmd_pairing *req, *rsp;
-        struct smp_chan *smp = conn->smp_chan;
         __u8 *keydist;
 
         BT_DBG("conn %p force %d", conn, force);
 
-        if (!test_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
-                return 0;
+        if (IS_ERR(conn->hcon->hdev->tfm))
+                return PTR_ERR(conn->hcon->hdev->tfm);
 
-        rsp = (void *) &smp->prsp[1];
+        rsp = (void *) &conn->prsp[1];
 
         /* The responder sends its keys first */
         if (!force && conn->hcon->out && (rsp->resp_key_dist & 0x07))
                 return 0;
 
-        req = (void *) &smp->preq[1];
+        req = (void *) &conn->preq[1];
 
         if (conn->hcon->out) {
                 keydist = &rsp->init_key_dist;
@@ -950,8 +653,6 @@ int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
         if (*keydist & SMP_DIST_ENC_KEY) {
                 struct smp_cmd_encrypt_info enc;
                 struct smp_cmd_master_ident ident;
-                struct hci_conn *hcon = conn->hcon;
-                u8 authenticated;
                 __le16 ediv;
 
                 get_random_bytes(enc.ltk, sizeof(enc.ltk));
@@ -960,12 +661,10 @@ int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
 
                 smp_send_cmd(conn, SMP_CMD_ENCRYPT_INFO, sizeof(enc), &enc);
 
-                authenticated = hcon->sec_level == BT_SECURITY_HIGH;
-                hci_add_ltk(conn->hcon->hdev, conn->dst, hcon->dst_type,
-                            HCI_SMP_LTK_SLAVE, 1, authenticated,
-                            enc.ltk, smp->enc_key_size, ediv, ident.rand);
+                hci_add_ltk(conn->hcon->hdev, 1, conn->dst, conn->smp_key_size,
+                                                ediv, ident.rand, enc.ltk);
 
-                ident.ediv = ediv;
+                ident.ediv = cpu_to_le16(ediv);
 
                 smp_send_cmd(conn, SMP_CMD_MASTER_IDENT, sizeof(ident), &ident);
 
@@ -1002,11 +701,5 @@ int smp_distribute_keys(struct l2cap_conn *conn, __u8 force)
                 *keydist &= ~SMP_DIST_SIGN;
         }
 
-        if (conn->hcon->out || force) {
-                clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags);
-                cancel_delayed_work_sync(&conn->security_timer);
-                smp_chan_destroy(conn);
-        }
-
         return 0;
 }