aboutsummaryrefslogtreecommitdiffstats
path: root/net/bluetooth
diff options
context:
space:
mode:
authorJohn W. Linville <linville@tuxdriver.com>2014-03-21 14:02:04 -0400
committerJohn W. Linville <linville@tuxdriver.com>2014-03-21 14:02:04 -0400
commit49c0ca17ee8dd3530f688052d4eb2ae6d3e55119 (patch)
tree251a4c566723b60505234a18ed864763ad0d0506 /net/bluetooth
parenta85ae0e97879f51bccd8511668b07d346d98b3eb (diff)
parent67b3bd4e65f0854aca70e0134d59b1daede49504 (diff)
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
Diffstat (limited to 'net/bluetooth')
-rw-r--r--net/bluetooth/6lowpan.h21
-rw-r--r--net/bluetooth/Kconfig8
-rw-r--r--net/bluetooth/Makefile3
-rw-r--r--net/bluetooth/a2mp.c12
-rw-r--r--net/bluetooth/hci_conn.c37
-rw-r--r--net/bluetooth/hci_core.c14
-rw-r--r--net/bluetooth/hci_event.c27
-rw-r--r--net/bluetooth/hci_sock.c16
-rw-r--r--net/bluetooth/l2cap_core.c90
-rw-r--r--net/bluetooth/l2cap_sock.c6
-rw-r--r--net/bluetooth/mgmt.c83
-rw-r--r--net/bluetooth/rfcomm/core.c4
-rw-r--r--net/bluetooth/sco.c10
-rw-r--r--net/bluetooth/smp.c208
-rw-r--r--net/bluetooth/smp.h4
15 files changed, 360 insertions, 183 deletions
diff --git a/net/bluetooth/6lowpan.h b/net/bluetooth/6lowpan.h
index 680eac808d74..5d281f1eaf55 100644
--- a/net/bluetooth/6lowpan.h
+++ b/net/bluetooth/6lowpan.h
@@ -14,13 +14,34 @@
14#ifndef __6LOWPAN_H 14#ifndef __6LOWPAN_H
15#define __6LOWPAN_H 15#define __6LOWPAN_H
16 16
17#include <linux/errno.h>
17#include <linux/skbuff.h> 18#include <linux/skbuff.h>
18#include <net/bluetooth/l2cap.h> 19#include <net/bluetooth/l2cap.h>
19 20
21#if IS_ENABLED(CONFIG_BT_6LOWPAN)
20int bt_6lowpan_recv(struct l2cap_conn *conn, struct sk_buff *skb); 22int bt_6lowpan_recv(struct l2cap_conn *conn, struct sk_buff *skb);
21int bt_6lowpan_add_conn(struct l2cap_conn *conn); 23int bt_6lowpan_add_conn(struct l2cap_conn *conn);
22int bt_6lowpan_del_conn(struct l2cap_conn *conn); 24int bt_6lowpan_del_conn(struct l2cap_conn *conn);
23int bt_6lowpan_init(void); 25int bt_6lowpan_init(void);
24void bt_6lowpan_cleanup(void); 26void bt_6lowpan_cleanup(void);
27#else
28static int bt_6lowpan_recv(struct l2cap_conn *conn, struct sk_buff *skb)
29{
30 return -EOPNOTSUPP;
31}
32static int bt_6lowpan_add_conn(struct l2cap_conn *conn)
33{
34 return -EOPNOTSUPP;
35}
36int bt_6lowpan_del_conn(struct l2cap_conn *conn)
37{
38 return -EOPNOTSUPP;
39}
40static int bt_6lowpan_init(void)
41{
42 return -EOPNOTSUPP;
43}
44static void bt_6lowpan_cleanup(void) { }
45#endif
25 46
26#endif /* __6LOWPAN_H */ 47#endif /* __6LOWPAN_H */
diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig
index 985b56070d26..06ec14499ca1 100644
--- a/net/bluetooth/Kconfig
+++ b/net/bluetooth/Kconfig
@@ -6,13 +6,13 @@ menuconfig BT
6 tristate "Bluetooth subsystem support" 6 tristate "Bluetooth subsystem support"
7 depends on NET && !S390 7 depends on NET && !S390
8 depends on RFKILL || !RFKILL 8 depends on RFKILL || !RFKILL
9 select 6LOWPAN_IPHC if BT_6LOWPAN
9 select CRC16 10 select CRC16
10 select CRYPTO 11 select CRYPTO
11 select CRYPTO_BLKCIPHER 12 select CRYPTO_BLKCIPHER
12 select CRYPTO_AES 13 select CRYPTO_AES
13 select CRYPTO_ECB 14 select CRYPTO_ECB
14 select CRYPTO_SHA256 15 select CRYPTO_SHA256
15 select 6LOWPAN_IPHC
16 help 16 help
17 Bluetooth is low-cost, low-power, short-range wireless technology. 17 Bluetooth is low-cost, low-power, short-range wireless technology.
18 It was designed as a replacement for cables and other short-range 18 It was designed as a replacement for cables and other short-range
@@ -40,6 +40,12 @@ menuconfig BT
40 to Bluetooth kernel modules are provided in the BlueZ packages. For 40 to Bluetooth kernel modules are provided in the BlueZ packages. For
41 more information, see <http://www.bluez.org/>. 41 more information, see <http://www.bluez.org/>.
42 42
43config BT_6LOWPAN
44 bool "Bluetooth 6LoWPAN support"
45 depends on BT && IPV6
46 help
47 IPv6 compression over Bluetooth.
48
43source "net/bluetooth/rfcomm/Kconfig" 49source "net/bluetooth/rfcomm/Kconfig"
44 50
45source "net/bluetooth/bnep/Kconfig" 51source "net/bluetooth/bnep/Kconfig"
diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile
index 80cb215826e8..ca51246b1016 100644
--- a/net/bluetooth/Makefile
+++ b/net/bluetooth/Makefile
@@ -10,6 +10,7 @@ obj-$(CONFIG_BT_HIDP) += hidp/
10 10
11bluetooth-y := af_bluetooth.o hci_core.o hci_conn.o hci_event.o mgmt.o \ 11bluetooth-y := af_bluetooth.o hci_core.o hci_conn.o hci_event.o mgmt.o \
12 hci_sock.o hci_sysfs.o l2cap_core.o l2cap_sock.o smp.o sco.o lib.o \ 12 hci_sock.o hci_sysfs.o l2cap_core.o l2cap_sock.o smp.o sco.o lib.o \
13 a2mp.o amp.o 6lowpan.o 13 a2mp.o amp.o
14bluetooth-$(CONFIG_BT_6LOWPAN) += 6lowpan.o
14 15
15subdir-ccflags-y += -D__CHECK_ENDIAN__ 16subdir-ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index f986b9968bdb..9514cc9e850c 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -162,7 +162,7 @@ static int a2mp_discover_req(struct amp_mgr *mgr, struct sk_buff *skb,
162 return -ENOMEM; 162 return -ENOMEM;
163 } 163 }
164 164
165 rsp->mtu = __constant_cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU); 165 rsp->mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU);
166 rsp->ext_feat = 0; 166 rsp->ext_feat = 0;
167 167
168 __a2mp_add_cl(mgr, rsp->cl); 168 __a2mp_add_cl(mgr, rsp->cl);
@@ -649,7 +649,7 @@ static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
649 if (err) { 649 if (err) {
650 struct a2mp_cmd_rej rej; 650 struct a2mp_cmd_rej rej;
651 651
652 rej.reason = __constant_cpu_to_le16(0); 652 rej.reason = cpu_to_le16(0);
653 hdr = (void *) skb->data; 653 hdr = (void *) skb->data;
654 654
655 BT_DBG("Send A2MP Rej: cmd 0x%2.2x err %d", hdr->code, err); 655 BT_DBG("Send A2MP Rej: cmd 0x%2.2x err %d", hdr->code, err);
@@ -695,7 +695,13 @@ static void a2mp_chan_state_change_cb(struct l2cap_chan *chan, int state,
695static struct sk_buff *a2mp_chan_alloc_skb_cb(struct l2cap_chan *chan, 695static struct sk_buff *a2mp_chan_alloc_skb_cb(struct l2cap_chan *chan,
696 unsigned long len, int nb) 696 unsigned long len, int nb)
697{ 697{
698 return bt_skb_alloc(len, GFP_KERNEL); 698 struct sk_buff *skb;
699
700 skb = bt_skb_alloc(len, GFP_KERNEL);
701 if (!skb)
702 return ERR_PTR(-ENOMEM);
703
704 return skb;
699} 705}
700 706
701static struct l2cap_ops a2mp_chan_ops = { 707static struct l2cap_ops a2mp_chan_ops = {
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 7c713c4675ba..d958e2dca52f 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -82,7 +82,7 @@ static void hci_acl_create_connection(struct hci_conn *conn)
82 cp.pscan_rep_mode = ie->data.pscan_rep_mode; 82 cp.pscan_rep_mode = ie->data.pscan_rep_mode;
83 cp.pscan_mode = ie->data.pscan_mode; 83 cp.pscan_mode = ie->data.pscan_mode;
84 cp.clock_offset = ie->data.clock_offset | 84 cp.clock_offset = ie->data.clock_offset |
85 __constant_cpu_to_le16(0x8000); 85 cpu_to_le16(0x8000);
86 } 86 }
87 87
88 memcpy(conn->dev_class, ie->data.dev_class, 3); 88 memcpy(conn->dev_class, ie->data.dev_class, 3);
@@ -182,8 +182,8 @@ bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
182 182
183 cp.handle = cpu_to_le16(handle); 183 cp.handle = cpu_to_le16(handle);
184 184
185 cp.tx_bandwidth = __constant_cpu_to_le32(0x00001f40); 185 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
186 cp.rx_bandwidth = __constant_cpu_to_le32(0x00001f40); 186 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
187 cp.voice_setting = cpu_to_le16(conn->setting); 187 cp.voice_setting = cpu_to_le16(conn->setting);
188 188
189 switch (conn->setting & SCO_AIRMODE_MASK) { 189 switch (conn->setting & SCO_AIRMODE_MASK) {
@@ -225,8 +225,8 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
225 cp.conn_interval_max = cpu_to_le16(max); 225 cp.conn_interval_max = cpu_to_le16(max);
226 cp.conn_latency = cpu_to_le16(latency); 226 cp.conn_latency = cpu_to_le16(latency);
227 cp.supervision_timeout = cpu_to_le16(to_multiplier); 227 cp.supervision_timeout = cpu_to_le16(to_multiplier);
228 cp.min_ce_len = __constant_cpu_to_le16(0x0000); 228 cp.min_ce_len = cpu_to_le16(0x0000);
229 cp.max_ce_len = __constant_cpu_to_le16(0x0000); 229 cp.max_ce_len = cpu_to_le16(0x0000);
230 230
231 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp); 231 hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
232} 232}
@@ -337,9 +337,9 @@ static void hci_conn_idle(struct work_struct *work)
337 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) { 337 if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
338 struct hci_cp_sniff_subrate cp; 338 struct hci_cp_sniff_subrate cp;
339 cp.handle = cpu_to_le16(conn->handle); 339 cp.handle = cpu_to_le16(conn->handle);
340 cp.max_latency = __constant_cpu_to_le16(0); 340 cp.max_latency = cpu_to_le16(0);
341 cp.min_remote_timeout = __constant_cpu_to_le16(0); 341 cp.min_remote_timeout = cpu_to_le16(0);
342 cp.min_local_timeout = __constant_cpu_to_le16(0); 342 cp.min_local_timeout = cpu_to_le16(0);
343 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp); 343 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
344 } 344 }
345 345
@@ -348,8 +348,8 @@ static void hci_conn_idle(struct work_struct *work)
348 cp.handle = cpu_to_le16(conn->handle); 348 cp.handle = cpu_to_le16(conn->handle);
349 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval); 349 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
350 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval); 350 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
351 cp.attempt = __constant_cpu_to_le16(4); 351 cp.attempt = cpu_to_le16(4);
352 cp.timeout = __constant_cpu_to_le16(1); 352 cp.timeout = cpu_to_le16(1);
353 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp); 353 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
354 } 354 }
355} 355}
@@ -596,9 +596,9 @@ static void hci_req_add_le_create_conn(struct hci_request *req,
596 cp.own_address_type = own_addr_type; 596 cp.own_address_type = own_addr_type;
597 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval); 597 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
598 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval); 598 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
599 cp.supervision_timeout = __constant_cpu_to_le16(0x002a); 599 cp.supervision_timeout = cpu_to_le16(0x002a);
600 cp.min_ce_len = __constant_cpu_to_le16(0x0000); 600 cp.min_ce_len = cpu_to_le16(0x0000);
601 cp.max_ce_len = __constant_cpu_to_le16(0x0000); 601 cp.max_ce_len = cpu_to_le16(0x0000);
602 602
603 hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp); 603 hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
604 604
@@ -781,6 +781,17 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
781{ 781{
782 BT_DBG("hcon %p", conn); 782 BT_DBG("hcon %p", conn);
783 783
784 /* In Secure Connections Only mode, it is required that Secure
785 * Connections is used and the link is encrypted with AES-CCM
786 * using a P-256 authenticated combination key.
787 */
788 if (test_bit(HCI_SC_ONLY, &conn->hdev->flags)) {
789 if (!hci_conn_sc_enabled(conn) ||
790 !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
791 conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
792 return 0;
793 }
794
784 if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT)) 795 if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
785 return 0; 796 return 0;
786 797
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 8bbfdea9cbec..1c6ffaa8902f 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1349,7 +1349,7 @@ static void bredr_setup(struct hci_request *req)
1349 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type); 1349 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1350 1350
1351 /* Connection accept timeout ~20 secs */ 1351 /* Connection accept timeout ~20 secs */
1352 param = __constant_cpu_to_le16(0x7d00); 1352 param = cpu_to_le16(0x7d00);
1353 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param); 1353 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
1354 1354
1355 /* AVM Berlin (31), aka "BlueFRITZ!", reports version 1.2, 1355 /* AVM Berlin (31), aka "BlueFRITZ!", reports version 1.2,
@@ -5270,7 +5270,7 @@ void hci_req_add_le_passive_scan(struct hci_request *req)
5270 5270
5271 memset(&enable_cp, 0, sizeof(enable_cp)); 5271 memset(&enable_cp, 0, sizeof(enable_cp));
5272 enable_cp.enable = LE_SCAN_ENABLE; 5272 enable_cp.enable = LE_SCAN_ENABLE;
5273 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE; 5273 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
5274 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp), 5274 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
5275 &enable_cp); 5275 &enable_cp);
5276} 5276}
@@ -5313,10 +5313,6 @@ void hci_update_background_scan(struct hci_dev *hdev)
5313 * keep the background scan running. 5313 * keep the background scan running.
5314 */ 5314 */
5315 5315
5316 /* If controller is already scanning we are done. */
5317 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
5318 return;
5319
5320 /* If controller is connecting, we should not start scanning 5316 /* If controller is connecting, we should not start scanning
5321 * since some controllers are not able to scan and connect at 5317 * since some controllers are not able to scan and connect at
5322 * the same time. 5318 * the same time.
@@ -5325,6 +5321,12 @@ void hci_update_background_scan(struct hci_dev *hdev)
5325 if (conn) 5321 if (conn)
5326 return; 5322 return;
5327 5323
5324 /* If controller is currently scanning, we stop it to ensure we
5325 * don't miss any advertising (due to duplicates filter).
5326 */
5327 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
5328 hci_req_add_le_scan_disable(&req);
5329
5328 hci_req_add_le_passive_scan(&req); 5330 hci_req_add_le_passive_scan(&req);
5329 5331
5330 BT_DBG("%s starting background scanning", hdev->name); 5332 BT_DBG("%s starting background scanning", hdev->name);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index c3b0a08f5ab4..a6a3d32553c5 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1924,9 +1924,9 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1924 bacpy(&cp.bdaddr, &ev->bdaddr); 1924 bacpy(&cp.bdaddr, &ev->bdaddr);
1925 cp.pkt_type = cpu_to_le16(conn->pkt_type); 1925 cp.pkt_type = cpu_to_le16(conn->pkt_type);
1926 1926
1927 cp.tx_bandwidth = __constant_cpu_to_le32(0x00001f40); 1927 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
1928 cp.rx_bandwidth = __constant_cpu_to_le32(0x00001f40); 1928 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
1929 cp.max_latency = __constant_cpu_to_le16(0xffff); 1929 cp.max_latency = cpu_to_le16(0xffff);
1930 cp.content_format = cpu_to_le16(hdev->voice_setting); 1930 cp.content_format = cpu_to_le16(hdev->voice_setting);
1931 cp.retrans_effort = 0xff; 1931 cp.retrans_effort = 0xff;
1932 1932
@@ -2183,6 +2183,18 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2183 if (!ev->status) 2183 if (!ev->status)
2184 conn->state = BT_CONNECTED; 2184 conn->state = BT_CONNECTED;
2185 2185
2186 /* In Secure Connections Only mode, do not allow any
2187 * connections that are not encrypted with AES-CCM
2188 * using a P-256 authenticated combination key.
2189 */
2190 if (test_bit(HCI_SC_ONLY, &hdev->dev_flags) &&
2191 (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2192 conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2193 hci_proto_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2194 hci_conn_drop(conn);
2195 goto unlock;
2196 }
2197
2186 hci_proto_connect_cfm(conn, ev->status); 2198 hci_proto_connect_cfm(conn, ev->status);
2187 hci_conn_drop(conn); 2199 hci_conn_drop(conn);
2188 } else 2200 } else
@@ -3157,6 +3169,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3157 case 0x1c: /* SCO interval rejected */ 3169 case 0x1c: /* SCO interval rejected */
3158 case 0x1a: /* Unsupported Remote Feature */ 3170 case 0x1a: /* Unsupported Remote Feature */
3159 case 0x1f: /* Unspecified error */ 3171 case 0x1f: /* Unspecified error */
3172 case 0x20: /* Unsupported LMP Parameter value */
3160 if (conn->out) { 3173 if (conn->out) {
3161 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) | 3174 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3162 (hdev->esco_type & EDR_ESCO_MASK); 3175 (hdev->esco_type & EDR_ESCO_MASK);
@@ -3961,7 +3974,13 @@ static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3961 3974
3962 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp); 3975 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3963 3976
3964 if (ltk->type & HCI_SMP_STK) { 3977 /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
3978 * temporary key used to encrypt a connection following
3979 * pairing. It is used during the Encrypted Session Setup to
3980 * distribute the keys. Later, security can be re-established
3981 * using a distributed LTK.
3982 */
3983 if (ltk->type == HCI_SMP_STK_SLAVE) {
3965 list_del(&ltk->list); 3984 list_del(&ltk->list);
3966 kfree(ltk); 3985 kfree(ltk);
3967 } 3986 }
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 68e51a84e72d..b9a418e578e0 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -211,22 +211,22 @@ void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
211 211
212 switch (bt_cb(skb)->pkt_type) { 212 switch (bt_cb(skb)->pkt_type) {
213 case HCI_COMMAND_PKT: 213 case HCI_COMMAND_PKT:
214 opcode = __constant_cpu_to_le16(HCI_MON_COMMAND_PKT); 214 opcode = cpu_to_le16(HCI_MON_COMMAND_PKT);
215 break; 215 break;
216 case HCI_EVENT_PKT: 216 case HCI_EVENT_PKT:
217 opcode = __constant_cpu_to_le16(HCI_MON_EVENT_PKT); 217 opcode = cpu_to_le16(HCI_MON_EVENT_PKT);
218 break; 218 break;
219 case HCI_ACLDATA_PKT: 219 case HCI_ACLDATA_PKT:
220 if (bt_cb(skb)->incoming) 220 if (bt_cb(skb)->incoming)
221 opcode = __constant_cpu_to_le16(HCI_MON_ACL_RX_PKT); 221 opcode = cpu_to_le16(HCI_MON_ACL_RX_PKT);
222 else 222 else
223 opcode = __constant_cpu_to_le16(HCI_MON_ACL_TX_PKT); 223 opcode = cpu_to_le16(HCI_MON_ACL_TX_PKT);
224 break; 224 break;
225 case HCI_SCODATA_PKT: 225 case HCI_SCODATA_PKT:
226 if (bt_cb(skb)->incoming) 226 if (bt_cb(skb)->incoming)
227 opcode = __constant_cpu_to_le16(HCI_MON_SCO_RX_PKT); 227 opcode = cpu_to_le16(HCI_MON_SCO_RX_PKT);
228 else 228 else
229 opcode = __constant_cpu_to_le16(HCI_MON_SCO_TX_PKT); 229 opcode = cpu_to_le16(HCI_MON_SCO_TX_PKT);
230 break; 230 break;
231 default: 231 default:
232 return; 232 return;
@@ -319,7 +319,7 @@ static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
319 bacpy(&ni->bdaddr, &hdev->bdaddr); 319 bacpy(&ni->bdaddr, &hdev->bdaddr);
320 memcpy(ni->name, hdev->name, 8); 320 memcpy(ni->name, hdev->name, 8);
321 321
322 opcode = __constant_cpu_to_le16(HCI_MON_NEW_INDEX); 322 opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
323 break; 323 break;
324 324
325 case HCI_DEV_UNREG: 325 case HCI_DEV_UNREG:
@@ -327,7 +327,7 @@ static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
327 if (!skb) 327 if (!skb)
328 return NULL; 328 return NULL;
329 329
330 opcode = __constant_cpu_to_le16(HCI_MON_DEL_INDEX); 330 opcode = cpu_to_le16(HCI_MON_DEL_INDEX);
331 break; 331 break;
332 332
333 default: 333 default:
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9ed2168fa59f..a1e5bb7d06e8 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -665,7 +665,7 @@ static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
665 rsp.scid = cpu_to_le16(chan->dcid); 665 rsp.scid = cpu_to_le16(chan->dcid);
666 rsp.dcid = cpu_to_le16(chan->scid); 666 rsp.dcid = cpu_to_le16(chan->scid);
667 rsp.result = cpu_to_le16(result); 667 rsp.result = cpu_to_le16(result);
668 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO); 668 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
669 669
670 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp); 670 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
671} 671}
@@ -727,7 +727,7 @@ static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
727 } 727 }
728 break; 728 break;
729 case L2CAP_CHAN_CONN_LESS: 729 case L2CAP_CHAN_CONN_LESS:
730 if (chan->psm == __constant_cpu_to_le16(L2CAP_PSM_3DSP)) { 730 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
731 if (chan->sec_level == BT_SECURITY_LOW) 731 if (chan->sec_level == BT_SECURITY_LOW)
732 chan->sec_level = BT_SECURITY_SDP; 732 chan->sec_level = BT_SECURITY_SDP;
733 } 733 }
@@ -738,7 +738,7 @@ static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
738 return HCI_AT_NO_BONDING; 738 return HCI_AT_NO_BONDING;
739 break; 739 break;
740 case L2CAP_CHAN_CONN_ORIENTED: 740 case L2CAP_CHAN_CONN_ORIENTED:
741 if (chan->psm == __constant_cpu_to_le16(L2CAP_PSM_SDP)) { 741 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
742 if (chan->sec_level == BT_SECURITY_LOW) 742 if (chan->sec_level == BT_SECURITY_LOW)
743 chan->sec_level = BT_SECURITY_SDP; 743 chan->sec_level = BT_SECURITY_SDP;
744 744
@@ -1273,7 +1273,7 @@ static void l2cap_do_start(struct l2cap_chan *chan)
1273 } 1273 }
1274 } else { 1274 } else {
1275 struct l2cap_info_req req; 1275 struct l2cap_info_req req;
1276 req.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK); 1276 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1277 1277
1278 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 1278 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1279 conn->info_ident = l2cap_get_ident(conn); 1279 conn->info_ident = l2cap_get_ident(conn);
@@ -1370,18 +1370,18 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
1370 1370
1371 if (l2cap_chan_check_security(chan)) { 1371 if (l2cap_chan_check_security(chan)) {
1372 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 1372 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
1373 rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND); 1373 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1374 rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHOR_PEND); 1374 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
1375 chan->ops->defer(chan); 1375 chan->ops->defer(chan);
1376 1376
1377 } else { 1377 } else {
1378 l2cap_state_change(chan, BT_CONFIG); 1378 l2cap_state_change(chan, BT_CONFIG);
1379 rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS); 1379 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1380 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO); 1380 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1381 } 1381 }
1382 } else { 1382 } else {
1383 rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND); 1383 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1384 rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHEN_PEND); 1384 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1385 } 1385 }
1386 1386
1387 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 1387 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
@@ -2895,9 +2895,9 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
2895 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen); 2895 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
2896 2896
2897 if (conn->hcon->type == LE_LINK) 2897 if (conn->hcon->type == LE_LINK)
2898 lh->cid = __constant_cpu_to_le16(L2CAP_CID_LE_SIGNALING); 2898 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2899 else 2899 else
2900 lh->cid = __constant_cpu_to_le16(L2CAP_CID_SIGNALING); 2900 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
2901 2901
2902 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE); 2902 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2903 cmd->code = code; 2903 cmd->code = code;
@@ -3010,8 +3010,8 @@ static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
3010 efs.stype = chan->local_stype; 3010 efs.stype = chan->local_stype;
3011 efs.msdu = cpu_to_le16(chan->local_msdu); 3011 efs.msdu = cpu_to_le16(chan->local_msdu);
3012 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime); 3012 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3013 efs.acc_lat = __constant_cpu_to_le32(L2CAP_DEFAULT_ACC_LAT); 3013 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
3014 efs.flush_to = __constant_cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO); 3014 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
3015 break; 3015 break;
3016 3016
3017 case L2CAP_MODE_STREAMING: 3017 case L2CAP_MODE_STREAMING:
@@ -3152,8 +3152,8 @@ static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3152 rfc->retrans_timeout = cpu_to_le16((u16) ertm_to); 3152 rfc->retrans_timeout = cpu_to_le16((u16) ertm_to);
3153 rfc->monitor_timeout = rfc->retrans_timeout; 3153 rfc->monitor_timeout = rfc->retrans_timeout;
3154 } else { 3154 } else {
3155 rfc->retrans_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO); 3155 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3156 rfc->monitor_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO); 3156 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
3157 } 3157 }
3158} 3158}
3159 3159
@@ -3285,7 +3285,7 @@ done:
3285 } 3285 }
3286 3286
3287 req->dcid = cpu_to_le16(chan->dcid); 3287 req->dcid = cpu_to_le16(chan->dcid);
3288 req->flags = __constant_cpu_to_le16(0); 3288 req->flags = cpu_to_le16(0);
3289 3289
3290 return ptr - data; 3290 return ptr - data;
3291} 3291}
@@ -3499,7 +3499,7 @@ done:
3499 } 3499 }
3500 rsp->scid = cpu_to_le16(chan->dcid); 3500 rsp->scid = cpu_to_le16(chan->dcid);
3501 rsp->result = cpu_to_le16(result); 3501 rsp->result = cpu_to_le16(result);
3502 rsp->flags = __constant_cpu_to_le16(0); 3502 rsp->flags = cpu_to_le16(0);
3503 3503
3504 return ptr - data; 3504 return ptr - data;
3505} 3505}
@@ -3608,7 +3608,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3608 } 3608 }
3609 3609
3610 req->dcid = cpu_to_le16(chan->dcid); 3610 req->dcid = cpu_to_le16(chan->dcid);
3611 req->flags = __constant_cpu_to_le16(0); 3611 req->flags = cpu_to_le16(0);
3612 3612
3613 return ptr - data; 3613 return ptr - data;
3614} 3614}
@@ -3639,7 +3639,7 @@ void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
3639 rsp.mtu = cpu_to_le16(chan->imtu); 3639 rsp.mtu = cpu_to_le16(chan->imtu);
3640 rsp.mps = cpu_to_le16(chan->mps); 3640 rsp.mps = cpu_to_le16(chan->mps);
3641 rsp.credits = cpu_to_le16(chan->rx_credits); 3641 rsp.credits = cpu_to_le16(chan->rx_credits);
3642 rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS); 3642 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3643 3643
3644 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), 3644 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
3645 &rsp); 3645 &rsp);
@@ -3654,8 +3654,8 @@ void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
3654 3654
3655 rsp.scid = cpu_to_le16(chan->dcid); 3655 rsp.scid = cpu_to_le16(chan->dcid);
3656 rsp.dcid = cpu_to_le16(chan->scid); 3656 rsp.dcid = cpu_to_le16(chan->scid);
3657 rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS); 3657 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3658 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO); 3658 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
3659 3659
3660 if (chan->hs_hcon) 3660 if (chan->hs_hcon)
3661 rsp_code = L2CAP_CREATE_CHAN_RSP; 3661 rsp_code = L2CAP_CREATE_CHAN_RSP;
@@ -3684,8 +3684,8 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
3684 u16 txwin_ext = chan->ack_win; 3684 u16 txwin_ext = chan->ack_win;
3685 struct l2cap_conf_rfc rfc = { 3685 struct l2cap_conf_rfc rfc = {
3686 .mode = chan->mode, 3686 .mode = chan->mode,
3687 .retrans_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO), 3687 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3688 .monitor_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO), 3688 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
3689 .max_pdu_size = cpu_to_le16(chan->imtu), 3689 .max_pdu_size = cpu_to_le16(chan->imtu),
3690 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW), 3690 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3691 }; 3691 };
@@ -3776,7 +3776,7 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
3776 l2cap_chan_lock(pchan); 3776 l2cap_chan_lock(pchan);
3777 3777
3778 /* Check if the ACL is secure enough (if not SDP) */ 3778 /* Check if the ACL is secure enough (if not SDP) */
3779 if (psm != __constant_cpu_to_le16(L2CAP_PSM_SDP) && 3779 if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
3780 !hci_conn_check_link_mode(conn->hcon)) { 3780 !hci_conn_check_link_mode(conn->hcon)) {
3781 conn->disc_reason = HCI_ERROR_AUTH_FAILURE; 3781 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
3782 result = L2CAP_CR_SEC_BLOCK; 3782 result = L2CAP_CR_SEC_BLOCK;
@@ -3861,7 +3861,7 @@ sendresp:
3861 3861
3862 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) { 3862 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
3863 struct l2cap_info_req info; 3863 struct l2cap_info_req info;
3864 info.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK); 3864 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3865 3865
3866 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 3866 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
3867 conn->info_ident = l2cap_get_ident(conn); 3867 conn->info_ident = l2cap_get_ident(conn);
@@ -4010,7 +4010,7 @@ static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
4010{ 4010{
4011 struct l2cap_cmd_rej_cid rej; 4011 struct l2cap_cmd_rej_cid rej;
4012 4012
4013 rej.reason = __constant_cpu_to_le16(L2CAP_REJ_INVALID_CID); 4013 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
4014 rej.scid = __cpu_to_le16(scid); 4014 rej.scid = __cpu_to_le16(scid);
4015 rej.dcid = __cpu_to_le16(dcid); 4015 rej.dcid = __cpu_to_le16(dcid);
4016 4016
@@ -4342,8 +4342,8 @@ static inline int l2cap_information_req(struct l2cap_conn *conn,
4342 u8 buf[8]; 4342 u8 buf[8];
4343 u32 feat_mask = l2cap_feat_mask; 4343 u32 feat_mask = l2cap_feat_mask;
4344 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf; 4344 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4345 rsp->type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK); 4345 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4346 rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS); 4346 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4347 if (!disable_ertm) 4347 if (!disable_ertm)
4348 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING 4348 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
4349 | L2CAP_FEAT_FCS; 4349 | L2CAP_FEAT_FCS;
@@ -4363,15 +4363,15 @@ static inline int l2cap_information_req(struct l2cap_conn *conn,
4363 else 4363 else
4364 l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP; 4364 l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
4365 4365
4366 rsp->type = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN); 4366 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4367 rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS); 4367 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4368 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan)); 4368 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
4369 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf), 4369 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4370 buf); 4370 buf);
4371 } else { 4371 } else {
4372 struct l2cap_info_rsp rsp; 4372 struct l2cap_info_rsp rsp;
4373 rsp.type = cpu_to_le16(type); 4373 rsp.type = cpu_to_le16(type);
4374 rsp.result = __constant_cpu_to_le16(L2CAP_IR_NOTSUPP); 4374 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
4375 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp), 4375 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4376 &rsp); 4376 &rsp);
4377 } 4377 }
@@ -4416,7 +4416,7 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn,
4416 4416
4417 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) { 4417 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
4418 struct l2cap_info_req req; 4418 struct l2cap_info_req req;
4419 req.type = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN); 4419 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4420 4420
4421 conn->info_ident = l2cap_get_ident(conn); 4421 conn->info_ident = l2cap_get_ident(conn);
4422 4422
@@ -4510,8 +4510,8 @@ static int l2cap_create_channel_req(struct l2cap_conn *conn,
4510error: 4510error:
4511 rsp.dcid = 0; 4511 rsp.dcid = 0;
4512 rsp.scid = cpu_to_le16(scid); 4512 rsp.scid = cpu_to_le16(scid);
4513 rsp.result = __constant_cpu_to_le16(L2CAP_CR_BAD_AMP); 4513 rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP);
4514 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO); 4514 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
4515 4515
4516 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP, 4516 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
4517 sizeof(rsp), &rsp); 4517 sizeof(rsp), &rsp);
@@ -4575,7 +4575,7 @@ static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
4575 BT_DBG("conn %p, icid 0x%4.4x", conn, icid); 4575 BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
4576 4576
4577 cfm.icid = cpu_to_le16(icid); 4577 cfm.icid = cpu_to_le16(icid);
4578 cfm.result = __constant_cpu_to_le16(L2CAP_MC_UNCONFIRMED); 4578 cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED);
4579 4579
4580 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM, 4580 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
4581 sizeof(cfm), &cfm); 4581 sizeof(cfm), &cfm);
@@ -4758,12 +4758,12 @@ static void l2cap_do_create(struct l2cap_chan *chan, int result,
4758 4758
4759 if (result == L2CAP_CR_SUCCESS) { 4759 if (result == L2CAP_CR_SUCCESS) {
4760 /* Send successful response */ 4760 /* Send successful response */
4761 rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS); 4761 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
4762 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO); 4762 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
4763 } else { 4763 } else {
4764 /* Send negative response */ 4764 /* Send negative response */
4765 rsp.result = __constant_cpu_to_le16(L2CAP_CR_NO_MEM); 4765 rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM);
4766 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO); 4766 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
4767 } 4767 }
4768 4768
4769 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP, 4769 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
@@ -4891,7 +4891,7 @@ static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
4891 chan = l2cap_get_chan_by_dcid(conn, icid); 4891 chan = l2cap_get_chan_by_dcid(conn, icid);
4892 if (!chan) { 4892 if (!chan) {
4893 rsp.icid = cpu_to_le16(icid); 4893 rsp.icid = cpu_to_le16(icid);
4894 rsp.result = __constant_cpu_to_le16(L2CAP_MR_NOT_ALLOWED); 4894 rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
4895 l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP, 4895 l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
4896 sizeof(rsp), &rsp); 4896 sizeof(rsp), &rsp);
4897 return 0; 4897 return 0;
@@ -5235,9 +5235,9 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
5235 5235
5236 err = l2cap_check_conn_param(min, max, latency, to_multiplier); 5236 err = l2cap_check_conn_param(min, max, latency, to_multiplier);
5237 if (err) 5237 if (err)
5238 rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_REJECTED); 5238 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
5239 else 5239 else
5240 rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED); 5240 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
5241 5241
5242 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP, 5242 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
5243 sizeof(rsp), &rsp); 5243 sizeof(rsp), &rsp);
@@ -5650,7 +5650,7 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
5650 5650
5651 BT_ERR("Wrong link type (%d)", err); 5651 BT_ERR("Wrong link type (%d)", err);
5652 5652
5653 rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); 5653 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5654 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ, 5654 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
5655 sizeof(rej), &rej); 5655 sizeof(rej), &rej);
5656 } 5656 }
@@ -5695,7 +5695,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
5695 5695
5696 BT_ERR("Wrong link type (%d)", err); 5696 BT_ERR("Wrong link type (%d)", err);
5697 5697
5698 rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); 5698 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5699 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, 5699 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
5700 sizeof(rej), &rej); 5700 sizeof(rej), &rej);
5701 } 5701 }
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index b247f9d27fed..33cd5615ff1e 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -111,7 +111,7 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
111 if (bdaddr_type_is_le(la.l2_bdaddr_type)) { 111 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
112 /* We only allow ATT user space socket */ 112 /* We only allow ATT user space socket */
113 if (la.l2_cid && 113 if (la.l2_cid &&
114 la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT)) 114 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
115 return -EINVAL; 115 return -EINVAL;
116 } 116 }
117 117
@@ -209,7 +209,7 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
209 * ATT. Anything else is an invalid combination. 209 * ATT. Anything else is an invalid combination.
210 */ 210 */
211 if (chan->scid != L2CAP_CID_ATT || 211 if (chan->scid != L2CAP_CID_ATT ||
212 la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT)) 212 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
213 return -EINVAL; 213 return -EINVAL;
214 214
215 /* We don't have the hdev available here to make a 215 /* We don't have the hdev available here to make a
@@ -227,7 +227,7 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
227 if (bdaddr_type_is_le(la.l2_bdaddr_type)) { 227 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
228 /* We only allow ATT user space socket */ 228 /* We only allow ATT user space socket */
229 if (la.l2_cid && 229 if (la.l2_cid &&
230 la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT)) 230 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
231 return -EINVAL; 231 return -EINVAL;
232 } 232 }
233 233
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 98e9df3556e7..96670f581bb0 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -108,6 +108,7 @@ static const u16 mgmt_events[] = {
108 MGMT_EV_DEVICE_UNPAIRED, 108 MGMT_EV_DEVICE_UNPAIRED,
109 MGMT_EV_PASSKEY_NOTIFY, 109 MGMT_EV_PASSKEY_NOTIFY,
110 MGMT_EV_NEW_IRK, 110 MGMT_EV_NEW_IRK,
111 MGMT_EV_NEW_CSRK,
111}; 112};
112 113
113#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 114#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
@@ -212,7 +213,7 @@ static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
212 213
213 hdr = (void *) skb_put(skb, sizeof(*hdr)); 214 hdr = (void *) skb_put(skb, sizeof(*hdr));
214 215
215 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS); 216 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
216 hdr->index = cpu_to_le16(index); 217 hdr->index = cpu_to_le16(index);
217 hdr->len = cpu_to_le16(sizeof(*ev)); 218 hdr->len = cpu_to_le16(sizeof(*ev));
218 219
@@ -243,7 +244,7 @@ static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
243 244
244 hdr = (void *) skb_put(skb, sizeof(*hdr)); 245 hdr = (void *) skb_put(skb, sizeof(*hdr));
245 246
246 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE); 247 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
247 hdr->index = cpu_to_le16(index); 248 hdr->index = cpu_to_le16(index);
248 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len); 249 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
249 250
@@ -269,7 +270,7 @@ static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
269 BT_DBG("sock %p", sk); 270 BT_DBG("sock %p", sk);
270 271
271 rp.version = MGMT_VERSION; 272 rp.version = MGMT_VERSION;
272 rp.revision = __constant_cpu_to_le16(MGMT_REVISION); 273 rp.revision = cpu_to_le16(MGMT_REVISION);
273 274
274 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp, 275 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
275 sizeof(rp)); 276 sizeof(rp));
@@ -293,8 +294,8 @@ static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
293 if (!rp) 294 if (!rp)
294 return -ENOMEM; 295 return -ENOMEM;
295 296
296 rp->num_commands = __constant_cpu_to_le16(num_commands); 297 rp->num_commands = cpu_to_le16(num_commands);
297 rp->num_events = __constant_cpu_to_le16(num_events); 298 rp->num_events = cpu_to_le16(num_events);
298 299
299 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++) 300 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
300 put_unaligned_le16(mgmt_commands[i], opcode); 301 put_unaligned_le16(mgmt_commands[i], opcode);
@@ -857,8 +858,8 @@ static void enable_advertising(struct hci_request *req)
857 return; 858 return;
858 859
859 memset(&cp, 0, sizeof(cp)); 860 memset(&cp, 0, sizeof(cp));
860 cp.min_interval = __constant_cpu_to_le16(0x0800); 861 cp.min_interval = cpu_to_le16(0x0800);
861 cp.max_interval = __constant_cpu_to_le16(0x0800); 862 cp.max_interval = cpu_to_le16(0x0800);
862 cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND; 863 cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
863 cp.own_address_type = own_addr_type; 864 cp.own_address_type = own_addr_type;
864 cp.channel_map = hdev->le_adv_channel_map; 865 cp.channel_map = hdev->le_adv_channel_map;
@@ -1180,7 +1181,7 @@ static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
1180 if (hdev) 1181 if (hdev)
1181 hdr->index = cpu_to_le16(hdev->id); 1182 hdr->index = cpu_to_le16(hdev->id);
1182 else 1183 else
1183 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE); 1184 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
1184 hdr->len = cpu_to_le16(data_len); 1185 hdr->len = cpu_to_le16(data_len);
1185 1186
1186 if (data) 1187 if (data)
@@ -1492,15 +1493,15 @@ static void write_fast_connectable(struct hci_request *req, bool enable)
1492 type = PAGE_SCAN_TYPE_INTERLACED; 1493 type = PAGE_SCAN_TYPE_INTERLACED;
1493 1494
1494 /* 160 msec page scan interval */ 1495 /* 160 msec page scan interval */
1495 acp.interval = __constant_cpu_to_le16(0x0100); 1496 acp.interval = cpu_to_le16(0x0100);
1496 } else { 1497 } else {
1497 type = PAGE_SCAN_TYPE_STANDARD; /* default */ 1498 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1498 1499
1499 /* default 1.28 sec page scan */ 1500 /* default 1.28 sec page scan */
1500 acp.interval = __constant_cpu_to_le16(0x0800); 1501 acp.interval = cpu_to_le16(0x0800);
1501 } 1502 }
1502 1503
1503 acp.window = __constant_cpu_to_le16(0x0012); 1504 acp.window = cpu_to_le16(0x0012);
1504 1505
1505 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval || 1506 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1506 __cpu_to_le16(hdev->page_scan_window) != acp.window) 1507 __cpu_to_le16(hdev->page_scan_window) != acp.window)
@@ -2351,7 +2352,7 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2351 sizeof(struct mgmt_link_key_info); 2352 sizeof(struct mgmt_link_key_info);
2352 if (expected_len != len) { 2353 if (expected_len != len) {
2353 BT_ERR("load_link_keys: expected %u bytes, got %u bytes", 2354 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2354 len, expected_len); 2355 expected_len, len);
2355 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2356 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2356 MGMT_STATUS_INVALID_PARAMS); 2357 MGMT_STATUS_INVALID_PARAMS);
2357 } 2358 }
@@ -2761,11 +2762,23 @@ static struct pending_cmd *find_pairing(struct hci_conn *conn)
2761 2762
2762static void pairing_complete(struct pending_cmd *cmd, u8 status) 2763static void pairing_complete(struct pending_cmd *cmd, u8 status)
2763{ 2764{
2765 const struct mgmt_cp_pair_device *cp = cmd->param;
2764 struct mgmt_rp_pair_device rp; 2766 struct mgmt_rp_pair_device rp;
2765 struct hci_conn *conn = cmd->user_data; 2767 struct hci_conn *conn = cmd->user_data;
2766 2768
2767 bacpy(&rp.addr.bdaddr, &conn->dst); 2769 /* If we had a pairing failure we might have already received
2768 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 2770 * the remote Identity Address Information and updated the
2771 * hci_conn variables with it, however we would not yet have
2772 * notified user space of the resolved identity. Therefore, use
2773 * the address given in the Pair Device command in case the
2774 * pairing failed.
2775 */
2776 if (status) {
2777 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
2778 } else {
2779 bacpy(&rp.addr.bdaddr, &conn->dst);
2780 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2781 }
2769 2782
2770 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status, 2783 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2771 &rp, sizeof(rp)); 2784 &rp, sizeof(rp));
@@ -4427,7 +4440,7 @@ static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4427 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info); 4440 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4428 if (expected_len != len) { 4441 if (expected_len != len) {
4429 BT_ERR("load_irks: expected %u bytes, got %u bytes", 4442 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4430 len, expected_len); 4443 expected_len, len);
4431 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 4444 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4432 MGMT_STATUS_INVALID_PARAMS); 4445 MGMT_STATUS_INVALID_PARAMS);
4433 } 4446 }
@@ -4507,7 +4520,7 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4507 sizeof(struct mgmt_ltk_info); 4520 sizeof(struct mgmt_ltk_info);
4508 if (expected_len != len) { 4521 if (expected_len != len) {
4509 BT_ERR("load_keys: expected %u bytes, got %u bytes", 4522 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4510 len, expected_len); 4523 expected_len, len);
4511 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 4524 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4512 MGMT_STATUS_INVALID_PARAMS); 4525 MGMT_STATUS_INVALID_PARAMS);
4513 } 4526 }
@@ -5004,7 +5017,7 @@ void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
5004 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 5017 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
5005} 5018}
5006 5019
5007void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key) 5020void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
5008{ 5021{
5009 struct mgmt_ev_new_long_term_key ev; 5022 struct mgmt_ev_new_long_term_key ev;
5010 5023
@@ -5025,7 +5038,7 @@ void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key)
5025 (key->bdaddr.b[5] & 0xc0) != 0xc0) 5038 (key->bdaddr.b[5] & 0xc0) != 0xc0)
5026 ev.store_hint = 0x00; 5039 ev.store_hint = 0x00;
5027 else 5040 else
5028 ev.store_hint = 0x01; 5041 ev.store_hint = persistent;
5029 5042
5030 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 5043 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5031 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 5044 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
@@ -5072,6 +5085,36 @@ void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
5072 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 5085 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
5073} 5086}
5074 5087
5088void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
5089 bool persistent)
5090{
5091 struct mgmt_ev_new_csrk ev;
5092
5093 memset(&ev, 0, sizeof(ev));
5094
5095 /* Devices using resolvable or non-resolvable random addresses
5096 * without providing an indentity resolving key don't require
5097 * to store signature resolving keys. Their addresses will change
5098 * the next time around.
5099 *
5100 * Only when a remote device provides an identity address
5101 * make sure the signature resolving key is stored. So allow
5102 * static random and public addresses here.
5103 */
5104 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5105 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
5106 ev.store_hint = 0x00;
5107 else
5108 ev.store_hint = persistent;
5109
5110 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
5111 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
5112 ev.key.master = csrk->master;
5113 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
5114
5115 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
5116}
5117
5075static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data, 5118static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
5076 u8 data_len) 5119 u8 data_len)
5077{ 5120{
@@ -5665,9 +5708,9 @@ void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5665 5708
5666 ev->rssi = rssi; 5709 ev->rssi = rssi;
5667 if (cfm_name) 5710 if (cfm_name)
5668 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME); 5711 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
5669 if (!ssp) 5712 if (!ssp)
5670 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING); 5713 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
5671 5714
5672 if (eir_len > 0) 5715 if (eir_len > 0)
5673 memcpy(ev->eir, eir, eir_len); 5716 memcpy(ev->eir, eir, eir_len);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 21e15318937c..633cceeb943e 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -768,7 +768,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
768 768
769 bacpy(&addr.l2_bdaddr, dst); 769 bacpy(&addr.l2_bdaddr, dst);
770 addr.l2_family = AF_BLUETOOTH; 770 addr.l2_family = AF_BLUETOOTH;
771 addr.l2_psm = __constant_cpu_to_le16(RFCOMM_PSM); 771 addr.l2_psm = cpu_to_le16(RFCOMM_PSM);
772 addr.l2_cid = 0; 772 addr.l2_cid = 0;
773 addr.l2_bdaddr_type = BDADDR_BREDR; 773 addr.l2_bdaddr_type = BDADDR_BREDR;
774 *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK); 774 *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
@@ -2032,7 +2032,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
2032 /* Bind socket */ 2032 /* Bind socket */
2033 bacpy(&addr.l2_bdaddr, ba); 2033 bacpy(&addr.l2_bdaddr, ba);
2034 addr.l2_family = AF_BLUETOOTH; 2034 addr.l2_family = AF_BLUETOOTH;
2035 addr.l2_psm = __constant_cpu_to_le16(RFCOMM_PSM); 2035 addr.l2_psm = cpu_to_le16(RFCOMM_PSM);
2036 addr.l2_cid = 0; 2036 addr.l2_cid = 0;
2037 addr.l2_bdaddr_type = BDADDR_BREDR; 2037 addr.l2_bdaddr_type = BDADDR_BREDR;
2038 err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr)); 2038 err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 24fa3964b3c8..ab1e6fcca4c5 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -676,20 +676,20 @@ static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
676 bacpy(&cp.bdaddr, &conn->dst); 676 bacpy(&cp.bdaddr, &conn->dst);
677 cp.pkt_type = cpu_to_le16(conn->pkt_type); 677 cp.pkt_type = cpu_to_le16(conn->pkt_type);
678 678
679 cp.tx_bandwidth = __constant_cpu_to_le32(0x00001f40); 679 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
680 cp.rx_bandwidth = __constant_cpu_to_le32(0x00001f40); 680 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
681 cp.content_format = cpu_to_le16(setting); 681 cp.content_format = cpu_to_le16(setting);
682 682
683 switch (setting & SCO_AIRMODE_MASK) { 683 switch (setting & SCO_AIRMODE_MASK) {
684 case SCO_AIRMODE_TRANSP: 684 case SCO_AIRMODE_TRANSP:
685 if (conn->pkt_type & ESCO_2EV3) 685 if (conn->pkt_type & ESCO_2EV3)
686 cp.max_latency = __constant_cpu_to_le16(0x0008); 686 cp.max_latency = cpu_to_le16(0x0008);
687 else 687 else
688 cp.max_latency = __constant_cpu_to_le16(0x000D); 688 cp.max_latency = cpu_to_le16(0x000D);
689 cp.retrans_effort = 0x02; 689 cp.retrans_effort = 0x02;
690 break; 690 break;
691 case SCO_AIRMODE_CVSD: 691 case SCO_AIRMODE_CVSD:
692 cp.max_latency = __constant_cpu_to_le16(0xffff); 692 cp.max_latency = cpu_to_le16(0xffff);
693 cp.retrans_effort = 0xff; 693 cp.retrans_effort = 0xff;
694 break; 694 break;
695 } 695 }
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index f886bcae1b7e..2a7ee7f6cd8b 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -35,14 +35,14 @@
35 35
36#define AUTH_REQ_MASK 0x07 36#define AUTH_REQ_MASK 0x07
37 37
38static inline void swap128(u8 src[16], u8 dst[16]) 38static inline void swap128(const u8 src[16], u8 dst[16])
39{ 39{
40 int i; 40 int i;
41 for (i = 0; i < 16; i++) 41 for (i = 0; i < 16; i++)
42 dst[15 - i] = src[i]; 42 dst[15 - i] = src[i];
43} 43}
44 44
45static inline void swap56(u8 src[7], u8 dst[7]) 45static inline void swap56(const u8 src[7], u8 dst[7])
46{ 46{
47 int i; 47 int i;
48 for (i = 0; i < 7; i++) 48 for (i = 0; i < 7; i++)
@@ -53,6 +53,7 @@ static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
53{ 53{
54 struct blkcipher_desc desc; 54 struct blkcipher_desc desc;
55 struct scatterlist sg; 55 struct scatterlist sg;
56 uint8_t tmp[16], data[16];
56 int err; 57 int err;
57 58
58 if (tfm == NULL) { 59 if (tfm == NULL) {
@@ -63,34 +64,40 @@ static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
63 desc.tfm = tfm; 64 desc.tfm = tfm;
64 desc.flags = 0; 65 desc.flags = 0;
65 66
66 err = crypto_blkcipher_setkey(tfm, k, 16); 67 /* The most significant octet of key corresponds to k[0] */
68 swap128(k, tmp);
69
70 err = crypto_blkcipher_setkey(tfm, tmp, 16);
67 if (err) { 71 if (err) {
68 BT_ERR("cipher setkey failed: %d", err); 72 BT_ERR("cipher setkey failed: %d", err);
69 return err; 73 return err;
70 } 74 }
71 75
72 sg_init_one(&sg, r, 16); 76 /* Most significant octet of plaintextData corresponds to data[0] */
77 swap128(r, data);
78
79 sg_init_one(&sg, data, 16);
73 80
74 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16); 81 err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
75 if (err) 82 if (err)
76 BT_ERR("Encrypt data error %d", err); 83 BT_ERR("Encrypt data error %d", err);
77 84
85 /* Most significant octet of encryptedData corresponds to data[0] */
86 swap128(data, r);
87
78 return err; 88 return err;
79} 89}
80 90
81static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3]) 91static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
82{ 92{
83 u8 _res[16], k[16]; 93 u8 _res[16];
84 int err; 94 int err;
85 95
86 /* r' = padding || r */ 96 /* r' = padding || r */
87 memset(_res, 0, 13); 97 memcpy(_res, r, 3);
88 _res[13] = r[2]; 98 memset(_res + 3, 0, 13);
89 _res[14] = r[1];
90 _res[15] = r[0];
91 99
92 swap128(irk, k); 100 err = smp_e(tfm, irk, _res);
93 err = smp_e(tfm, k, _res);
94 if (err) { 101 if (err) {
95 BT_ERR("Encrypt error"); 102 BT_ERR("Encrypt error");
96 return err; 103 return err;
@@ -102,9 +109,7 @@ static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
102 * by taking the least significant 24 bits of the output of e as the 109 * by taking the least significant 24 bits of the output of e as the
103 * result of ah. 110 * result of ah.
104 */ 111 */
105 res[0] = _res[15]; 112 memcpy(res, _res, 3);
106 res[1] = _res[14];
107 res[2] = _res[13];
108 113
109 return 0; 114 return 0;
110} 115}
@@ -152,16 +157,15 @@ static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
152 memset(p1, 0, 16); 157 memset(p1, 0, 16);
153 158
154 /* p1 = pres || preq || _rat || _iat */ 159 /* p1 = pres || preq || _rat || _iat */
155 swap56(pres, p1); 160 p1[0] = _iat;
156 swap56(preq, p1 + 7); 161 p1[1] = _rat;
157 p1[14] = _rat; 162 memcpy(p1 + 2, preq, 7);
158 p1[15] = _iat; 163 memcpy(p1 + 9, pres, 7);
159
160 memset(p2, 0, 16);
161 164
162 /* p2 = padding || ia || ra */ 165 /* p2 = padding || ia || ra */
163 baswap((bdaddr_t *) (p2 + 4), ia); 166 memcpy(p2, ra, 6);
164 baswap((bdaddr_t *) (p2 + 10), ra); 167 memcpy(p2 + 6, ia, 6);
168 memset(p2 + 12, 0, 4);
165 169
166 /* res = r XOR p1 */ 170 /* res = r XOR p1 */
167 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1); 171 u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
@@ -190,8 +194,8 @@ static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
190 int err; 194 int err;
191 195
192 /* Just least significant octets from r1 and r2 are considered */ 196 /* Just least significant octets from r1 and r2 are considered */
193 memcpy(_r, r1 + 8, 8); 197 memcpy(_r, r2, 8);
194 memcpy(_r + 8, r2 + 8, 8); 198 memcpy(_r + 8, r1, 8);
195 199
196 err = smp_e(tfm, k, _r); 200 err = smp_e(tfm, k, _r);
197 if (err) 201 if (err)
@@ -218,7 +222,7 @@ static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
218 222
219 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE); 223 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
220 lh->len = cpu_to_le16(sizeof(code) + dlen); 224 lh->len = cpu_to_le16(sizeof(code) + dlen);
221 lh->cid = __constant_cpu_to_le16(L2CAP_CID_SMP); 225 lh->cid = cpu_to_le16(L2CAP_CID_SMP);
222 226
223 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code)); 227 memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
224 228
@@ -273,8 +277,8 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
273 u8 local_dist = 0, remote_dist = 0; 277 u8 local_dist = 0, remote_dist = 0;
274 278
275 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) { 279 if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
276 local_dist = SMP_DIST_ENC_KEY; 280 local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
277 remote_dist = SMP_DIST_ENC_KEY; 281 remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
278 authreq |= SMP_AUTH_BONDING; 282 authreq |= SMP_AUTH_BONDING;
279 } else { 283 } else {
280 authreq &= ~SMP_AUTH_BONDING; 284 authreq &= ~SMP_AUTH_BONDING;
@@ -403,16 +407,14 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
403 method = REQ_PASSKEY; 407 method = REQ_PASSKEY;
404 } 408 }
405 409
406 /* Generate random passkey. Not valid until confirmed. */ 410 /* Generate random passkey. */
407 if (method == CFM_PASSKEY) { 411 if (method == CFM_PASSKEY) {
408 u8 key[16]; 412 memset(smp->tk, 0, sizeof(smp->tk));
409
410 memset(key, 0, sizeof(key));
411 get_random_bytes(&passkey, sizeof(passkey)); 413 get_random_bytes(&passkey, sizeof(passkey));
412 passkey %= 1000000; 414 passkey %= 1000000;
413 put_unaligned_le32(passkey, key); 415 put_unaligned_le32(passkey, smp->tk);
414 swap128(key, smp->tk);
415 BT_DBG("PassKey: %d", passkey); 416 BT_DBG("PassKey: %d", passkey);
417 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
416 } 418 }
417 419
418 hci_dev_lock(hcon->hdev); 420 hci_dev_lock(hcon->hdev);
@@ -421,7 +423,7 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
421 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst, 423 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
422 hcon->type, hcon->dst_type); 424 hcon->type, hcon->dst_type);
423 else 425 else
424 ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, 426 ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
425 hcon->type, hcon->dst_type, 427 hcon->type, hcon->dst_type,
426 cpu_to_le32(passkey), 0); 428 cpu_to_le32(passkey), 0);
427 429
@@ -438,7 +440,7 @@ static void confirm_work(struct work_struct *work)
438 struct crypto_blkcipher *tfm = hdev->tfm_aes; 440 struct crypto_blkcipher *tfm = hdev->tfm_aes;
439 struct smp_cmd_pairing_confirm cp; 441 struct smp_cmd_pairing_confirm cp;
440 int ret; 442 int ret;
441 u8 res[16], reason; 443 u8 reason;
442 444
443 BT_DBG("conn %p", conn); 445 BT_DBG("conn %p", conn);
444 446
@@ -447,7 +449,8 @@ static void confirm_work(struct work_struct *work)
447 449
448 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp, 450 ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
449 conn->hcon->init_addr_type, &conn->hcon->init_addr, 451 conn->hcon->init_addr_type, &conn->hcon->init_addr,
450 conn->hcon->resp_addr_type, &conn->hcon->resp_addr, res); 452 conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
453 cp.confirm_val);
451 454
452 hci_dev_unlock(hdev); 455 hci_dev_unlock(hdev);
453 456
@@ -458,7 +461,6 @@ static void confirm_work(struct work_struct *work)
458 461
459 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags); 462 clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
460 463
461 swap128(res, cp.confirm_val);
462 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp); 464 smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
463 465
464 return; 466 return;
@@ -474,7 +476,7 @@ static void random_work(struct work_struct *work)
474 struct hci_conn *hcon = conn->hcon; 476 struct hci_conn *hcon = conn->hcon;
475 struct hci_dev *hdev = hcon->hdev; 477 struct hci_dev *hdev = hcon->hdev;
476 struct crypto_blkcipher *tfm = hdev->tfm_aes; 478 struct crypto_blkcipher *tfm = hdev->tfm_aes;
477 u8 reason, confirm[16], res[16], key[16]; 479 u8 reason, confirm[16];
478 int ret; 480 int ret;
479 481
480 if (IS_ERR_OR_NULL(tfm)) { 482 if (IS_ERR_OR_NULL(tfm)) {
@@ -489,7 +491,7 @@ static void random_work(struct work_struct *work)
489 491
490 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp, 492 ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
491 hcon->init_addr_type, &hcon->init_addr, 493 hcon->init_addr_type, &hcon->init_addr,
492 hcon->resp_addr_type, &hcon->resp_addr, res); 494 hcon->resp_addr_type, &hcon->resp_addr, confirm);
493 495
494 hci_dev_unlock(hdev); 496 hci_dev_unlock(hdev);
495 497
@@ -498,8 +500,6 @@ static void random_work(struct work_struct *work)
498 goto error; 500 goto error;
499 } 501 }
500 502
501 swap128(res, confirm);
502
503 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) { 503 if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
504 BT_ERR("Pairing failed (confirmation values mismatch)"); 504 BT_ERR("Pairing failed (confirmation values mismatch)");
505 reason = SMP_CONFIRM_FAILED; 505 reason = SMP_CONFIRM_FAILED;
@@ -511,8 +511,7 @@ static void random_work(struct work_struct *work)
511 __le64 rand = 0; 511 __le64 rand = 0;
512 __le16 ediv = 0; 512 __le16 ediv = 0;
513 513
514 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key); 514 smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, stk);
515 swap128(key, stk);
516 515
517 memset(stk + smp->enc_key_size, 0, 516 memset(stk + smp->enc_key_size, 0,
518 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size); 517 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
@@ -525,15 +524,14 @@ static void random_work(struct work_struct *work)
525 hci_le_start_enc(hcon, ediv, rand, stk); 524 hci_le_start_enc(hcon, ediv, rand, stk);
526 hcon->enc_key_size = smp->enc_key_size; 525 hcon->enc_key_size = smp->enc_key_size;
527 } else { 526 } else {
528 u8 stk[16], r[16]; 527 u8 stk[16];
529 __le64 rand = 0; 528 __le64 rand = 0;
530 __le16 ediv = 0; 529 __le16 ediv = 0;
531 530
532 swap128(smp->prnd, r); 531 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
533 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r); 532 smp->prnd);
534 533
535 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key); 534 smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, stk);
536 swap128(key, stk);
537 535
538 memset(stk + smp->enc_key_size, 0, 536 memset(stk + smp->enc_key_size, 0,
539 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size); 537 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
@@ -596,6 +594,9 @@ void smp_chan_destroy(struct l2cap_conn *conn)
596 complete = test_bit(SMP_FLAG_COMPLETE, &smp->smp_flags); 594 complete = test_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
597 mgmt_smp_complete(conn->hcon, complete); 595 mgmt_smp_complete(conn->hcon, complete);
598 596
597 kfree(smp->csrk);
598 kfree(smp->slave_csrk);
599
599 /* If pairing failed clean up any keys we might have */ 600 /* If pairing failed clean up any keys we might have */
600 if (!complete) { 601 if (!complete) {
601 if (smp->ltk) { 602 if (smp->ltk) {
@@ -625,7 +626,6 @@ int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
625 struct l2cap_conn *conn = hcon->smp_conn; 626 struct l2cap_conn *conn = hcon->smp_conn;
626 struct smp_chan *smp; 627 struct smp_chan *smp;
627 u32 value; 628 u32 value;
628 u8 key[16];
629 629
630 BT_DBG(""); 630 BT_DBG("");
631 631
@@ -637,10 +637,9 @@ int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
637 switch (mgmt_op) { 637 switch (mgmt_op) {
638 case MGMT_OP_USER_PASSKEY_REPLY: 638 case MGMT_OP_USER_PASSKEY_REPLY:
639 value = le32_to_cpu(passkey); 639 value = le32_to_cpu(passkey);
640 memset(key, 0, sizeof(key)); 640 memset(smp->tk, 0, sizeof(smp->tk));
641 BT_DBG("PassKey: %d", value); 641 BT_DBG("PassKey: %d", value);
642 put_unaligned_le32(value, key); 642 put_unaligned_le32(value, smp->tk);
643 swap128(key, smp->tk);
644 /* Fall Through */ 643 /* Fall Through */
645 case MGMT_OP_USER_CONFIRM_REPLY: 644 case MGMT_OP_USER_CONFIRM_REPLY:
646 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags); 645 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
@@ -745,6 +744,11 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
745 smp->prsp[0] = SMP_CMD_PAIRING_RSP; 744 smp->prsp[0] = SMP_CMD_PAIRING_RSP;
746 memcpy(&smp->prsp[1], rsp, sizeof(*rsp)); 745 memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
747 746
747 /* Update remote key distribution in case the remote cleared
748 * some bits that we had enabled in our request.
749 */
750 smp->remote_key_dist &= rsp->resp_key_dist;
751
748 if ((req->auth_req & SMP_AUTH_BONDING) && 752 if ((req->auth_req & SMP_AUTH_BONDING) &&
749 (rsp->auth_req & SMP_AUTH_BONDING)) 753 (rsp->auth_req & SMP_AUTH_BONDING))
750 auth = SMP_AUTH_BONDING; 754 auth = SMP_AUTH_BONDING;
@@ -758,10 +762,8 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
758 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags); 762 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
759 763
760 /* Can't compose response until we have been confirmed */ 764 /* Can't compose response until we have been confirmed */
761 if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) 765 if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
762 return 0; 766 queue_work(hdev->workqueue, &smp->confirm);
763
764 queue_work(hdev->workqueue, &smp->confirm);
765 767
766 return 0; 768 return 0;
767} 769}
@@ -779,17 +781,13 @@ static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
779 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf)); 781 memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
780 skb_pull(skb, sizeof(smp->pcnf)); 782 skb_pull(skb, sizeof(smp->pcnf));
781 783
782 if (conn->hcon->out) { 784 if (conn->hcon->out)
783 u8 random[16]; 785 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
784 786 smp->prnd);
785 swap128(smp->prnd, random); 787 else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
786 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
787 random);
788 } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
789 queue_work(hdev->workqueue, &smp->confirm); 788 queue_work(hdev->workqueue, &smp->confirm);
790 } else { 789 else
791 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags); 790 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
792 }
793 791
794 return 0; 792 return 0;
795} 793}
@@ -804,7 +802,7 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
804 if (skb->len < sizeof(smp->rrnd)) 802 if (skb->len < sizeof(smp->rrnd))
805 return SMP_UNSPECIFIED; 803 return SMP_UNSPECIFIED;
806 804
807 swap128(skb->data, smp->rrnd); 805 memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
808 skb_pull(skb, sizeof(smp->rrnd)); 806 skb_pull(skb, sizeof(smp->rrnd));
809 807
810 queue_work(hdev->workqueue, &smp->random); 808 queue_work(hdev->workqueue, &smp->random);
@@ -910,6 +908,12 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
910 908
911 authreq = seclevel_to_authreq(sec_level); 909 authreq = seclevel_to_authreq(sec_level);
912 910
911 /* hcon->auth_type is set by pair_device in mgmt.c. If the MITM
912 * flag is set we should also set it for the SMP request.
913 */
914 if ((hcon->auth_type & 0x01))
915 authreq |= SMP_AUTH_MITM;
916
913 if (hcon->link_mode & HCI_LM_MASTER) { 917 if (hcon->link_mode & HCI_LM_MASTER) {
914 struct smp_cmd_pairing cp; 918 struct smp_cmd_pairing cp;
915 919
@@ -1065,6 +1069,41 @@ static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
1065 return 0; 1069 return 0;
1066} 1070}
1067 1071
1072static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
1073{
1074 struct smp_cmd_sign_info *rp = (void *) skb->data;
1075 struct smp_chan *smp = conn->smp_chan;
1076 struct hci_dev *hdev = conn->hcon->hdev;
1077 struct smp_csrk *csrk;
1078
1079 BT_DBG("conn %p", conn);
1080
1081 if (skb->len < sizeof(*rp))
1082 return SMP_UNSPECIFIED;
1083
1084 /* Ignore this PDU if it wasn't requested */
1085 if (!(smp->remote_key_dist & SMP_DIST_SIGN))
1086 return 0;
1087
1088 /* Mark the information as received */
1089 smp->remote_key_dist &= ~SMP_DIST_SIGN;
1090
1091 skb_pull(skb, sizeof(*rp));
1092
1093 hci_dev_lock(hdev);
1094 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1095 if (csrk) {
1096 csrk->master = 0x01;
1097 memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
1098 }
1099 smp->csrk = csrk;
1100 if (!(smp->remote_key_dist & SMP_DIST_SIGN))
1101 smp_distribute_keys(conn);
1102 hci_dev_unlock(hdev);
1103
1104 return 0;
1105}
1106
1068int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb) 1107int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
1069{ 1108{
1070 struct hci_conn *hcon = conn->hcon; 1109 struct hci_conn *hcon = conn->hcon;
@@ -1147,8 +1186,7 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
1147 break; 1186 break;
1148 1187
1149 case SMP_CMD_SIGN_INFO: 1188 case SMP_CMD_SIGN_INFO:
1150 /* Just ignored */ 1189 reason = smp_cmd_sign_info(conn, skb);
1151 reason = 0;
1152 break; 1190 break;
1153 1191
1154 default: 1192 default:
@@ -1172,20 +1210,40 @@ static void smp_notify_keys(struct l2cap_conn *conn)
1172 struct smp_chan *smp = conn->smp_chan; 1210 struct smp_chan *smp = conn->smp_chan;
1173 struct hci_conn *hcon = conn->hcon; 1211 struct hci_conn *hcon = conn->hcon;
1174 struct hci_dev *hdev = hcon->hdev; 1212 struct hci_dev *hdev = hcon->hdev;
1213 struct smp_cmd_pairing *req = (void *) &smp->preq[1];
1214 struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
1215 bool persistent;
1175 1216
1176 if (smp->remote_irk) 1217 if (smp->remote_irk)
1177 mgmt_new_irk(hdev, smp->remote_irk); 1218 mgmt_new_irk(hdev, smp->remote_irk);
1178 1219
1220 /* The LTKs and CSRKs should be persistent only if both sides
1221 * had the bonding bit set in their authentication requests.
1222 */
1223 persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
1224
1225 if (smp->csrk) {
1226 smp->csrk->bdaddr_type = hcon->dst_type;
1227 bacpy(&smp->csrk->bdaddr, &hcon->dst);
1228 mgmt_new_csrk(hdev, smp->csrk, persistent);
1229 }
1230
1231 if (smp->slave_csrk) {
1232 smp->slave_csrk->bdaddr_type = hcon->dst_type;
1233 bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
1234 mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
1235 }
1236
1179 if (smp->ltk) { 1237 if (smp->ltk) {
1180 smp->ltk->bdaddr_type = hcon->dst_type; 1238 smp->ltk->bdaddr_type = hcon->dst_type;
1181 bacpy(&smp->ltk->bdaddr, &hcon->dst); 1239 bacpy(&smp->ltk->bdaddr, &hcon->dst);
1182 mgmt_new_ltk(hdev, smp->ltk); 1240 mgmt_new_ltk(hdev, smp->ltk, persistent);
1183 } 1241 }
1184 1242
1185 if (smp->slave_ltk) { 1243 if (smp->slave_ltk) {
1186 smp->slave_ltk->bdaddr_type = hcon->dst_type; 1244 smp->slave_ltk->bdaddr_type = hcon->dst_type;
1187 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst); 1245 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
1188 mgmt_new_ltk(hdev, smp->slave_ltk); 1246 mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
1189 } 1247 }
1190} 1248}
1191 1249
@@ -1274,10 +1332,18 @@ int smp_distribute_keys(struct l2cap_conn *conn)
1274 1332
1275 if (*keydist & SMP_DIST_SIGN) { 1333 if (*keydist & SMP_DIST_SIGN) {
1276 struct smp_cmd_sign_info sign; 1334 struct smp_cmd_sign_info sign;
1335 struct smp_csrk *csrk;
1277 1336
1278 /* Send a dummy key */ 1337 /* Generate a new random key */
1279 get_random_bytes(sign.csrk, sizeof(sign.csrk)); 1338 get_random_bytes(sign.csrk, sizeof(sign.csrk));
1280 1339
1340 csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
1341 if (csrk) {
1342 csrk->master = 0x00;
1343 memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
1344 }
1345 smp->slave_csrk = csrk;
1346
1281 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign); 1347 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
1282 1348
1283 *keydist &= ~SMP_DIST_SIGN; 1349 *keydist &= ~SMP_DIST_SIGN;
diff --git a/net/bluetooth/smp.h b/net/bluetooth/smp.h
index f55d83617218..b6913471815a 100644
--- a/net/bluetooth/smp.h
+++ b/net/bluetooth/smp.h
@@ -121,7 +121,7 @@ struct smp_cmd_security_req {
121#define SMP_FLAG_LTK_ENCRYPT 4 121#define SMP_FLAG_LTK_ENCRYPT 4
122#define SMP_FLAG_COMPLETE 5 122#define SMP_FLAG_COMPLETE 5
123 123
124#define SMP_REENCRYPT_TIMEOUT msecs_to_jiffies(250) 124#define SMP_REENCRYPT_TIMEOUT msecs_to_jiffies(500)
125 125
126struct smp_chan { 126struct smp_chan {
127 struct l2cap_conn *conn; 127 struct l2cap_conn *conn;
@@ -136,6 +136,8 @@ struct smp_chan {
136 bdaddr_t id_addr; 136 bdaddr_t id_addr;
137 u8 id_addr_type; 137 u8 id_addr_type;
138 u8 irk[16]; 138 u8 irk[16];
139 struct smp_csrk *csrk;
140 struct smp_csrk *slave_csrk;
139 struct smp_ltk *ltk; 141 struct smp_ltk *ltk;
140 struct smp_ltk *slave_ltk; 142 struct smp_ltk *slave_ltk;
141 struct smp_irk *remote_irk; 143 struct smp_irk *remote_irk;
generated by cgit v1.2.2 (git 2.25.0) at 2024-11-30 19:43:52 -0500