<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/net/bluetooth/smp.h, branch v4.14-rc5</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>Bluetooth: SMP: Add support for H7 crypto function and CT2 auth flag</title>
<updated>2016-12-08T06:50:24+00:00</updated>
<author>
<name>Johan Hedberg</name>
<email>johan.hedberg@intel.com</email>
</author>
<published>2016-12-08T06:32:54+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a62da6f14db79bd7ea435ab095e998b31b3dbb22'/>
<id>a62da6f14db79bd7ea435ab095e998b31b3dbb22</id>
<content type='text'>
Bluetooth 5.0 introduces a new H7 key generation function that's used
when both sides of the pairing set the CT2 authentication flag to 1.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Bluetooth 5.0 introduces a new H7 key generation function that's used
when both sides of the pairing set the CT2 authentication flag to 1.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Bluetooth: Fix crash in SMP when unpairing</title>
<updated>2015-10-22T07:02:03+00:00</updated>
<author>
<name>Johan Hedberg</name>
<email>johan.hedberg@intel.com</email>
</author>
<published>2015-10-22T06:38:35+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c81d555a264bde740adc314f3931046994534106'/>
<id>c81d555a264bde740adc314f3931046994534106</id>
<content type='text'>
When unpairing the keys stored in hci_dev are removed. If SMP is
ongoing the SMP context will also have references to these keys, so
removing them from the hci_dev lists will make the pointers invalid.
This can result in the following type of crashes:

 BUG: unable to handle kernel paging request at 6b6b6b6b
 IP: [&lt;c11f26be&gt;] __list_del_entry+0x44/0x71
 *pde = 00000000
 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
 Modules linked in: hci_uart btqca btusb btintel btbcm btrtl hci_vhci rfcomm bluetooth_6lowpan bluetooth
 CPU: 0 PID: 723 Comm: kworker/u5:0 Not tainted 4.3.0-rc3+ #1379
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014
 Workqueue: hci0 hci_rx_work [bluetooth]
 task: f19da940 ti: f1a94000 task.ti: f1a94000
 EIP: 0060:[&lt;c11f26be&gt;] EFLAGS: 00010202 CPU: 0
 EIP is at __list_del_entry+0x44/0x71
 EAX: c0088d20 EBX: f30fcac0 ECX: 6b6b6b6b EDX: 6b6b6b6b
 ESI: f4b60000 EDI: c0088d20 EBP: f1a95d90 ESP: f1a95d8c
  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
 CR0: 8005003b CR2: 6b6b6b6b CR3: 319e5000 CR4: 00000690
 Stack:
  f30fcac0 f1a95db0 f82dc3e1 f1bfc000 00000000 c106524f f1bfc000 f30fd020
  f1a95dc0 f1a95dd0 f82dcbdb f1a95de0 f82dcbdb 00000067 f1bfc000 f30fd020
  f1a95de0 f1a95df0 f82d1126 00000067 f82d1126 00000006 f30fd020 f1bfc000
 Call Trace:
  [&lt;f82dc3e1&gt;] smp_chan_destroy+0x192/0x240 [bluetooth]
  [&lt;c106524f&gt;] ? trace_hardirqs_on_caller+0x14e/0x169
  [&lt;f82dcbdb&gt;] smp_teardown_cb+0x47/0x64 [bluetooth]
  [&lt;f82dcbdb&gt;] ? smp_teardown_cb+0x47/0x64 [bluetooth]
  [&lt;f82d1126&gt;] l2cap_chan_del+0x5d/0x14d [bluetooth]
  [&lt;f82d1126&gt;] ? l2cap_chan_del+0x5d/0x14d [bluetooth]
  [&lt;f82d40ef&gt;] l2cap_conn_del+0x109/0x17b [bluetooth]
  [&lt;f82d40ef&gt;] ? l2cap_conn_del+0x109/0x17b [bluetooth]
  [&lt;f82c0205&gt;] ? hci_event_packet+0x5b1/0x2092 [bluetooth]
  [&lt;f82d41aa&gt;] l2cap_disconn_cfm+0x49/0x50 [bluetooth]
  [&lt;f82d41aa&gt;] ? l2cap_disconn_cfm+0x49/0x50 [bluetooth]
  [&lt;f82c0228&gt;] hci_event_packet+0x5d4/0x2092 [bluetooth]
  [&lt;c1332c16&gt;] ? skb_release_data+0x6a/0x95
  [&lt;f82ce5d4&gt;] ? hci_send_to_monitor+0xe7/0xf4 [bluetooth]
  [&lt;c1409708&gt;] ? _raw_spin_unlock_irqrestore+0x44/0x57
  [&lt;f82b3bb0&gt;] hci_rx_work+0xf1/0x28b [bluetooth]
  [&lt;f82b3bb0&gt;] ? hci_rx_work+0xf1/0x28b [bluetooth]
  [&lt;c10635a0&gt;] ? __lock_is_held+0x2e/0x44
  [&lt;c104772e&gt;] process_one_work+0x232/0x432
  [&lt;c1071ddc&gt;] ? rcu_read_lock_sched_held+0x50/0x5a
  [&lt;c104772e&gt;] ? process_one_work+0x232/0x432
  [&lt;c1047d48&gt;] worker_thread+0x1b8/0x255
  [&lt;c1047b90&gt;] ? rescuer_thread+0x23c/0x23c
  [&lt;c104bb71&gt;] kthread+0x91/0x96
  [&lt;c14096a7&gt;] ? _raw_spin_unlock_irq+0x27/0x44
  [&lt;c1409d61&gt;] ret_from_kernel_thread+0x21/0x30
  [&lt;c104bae0&gt;] ? kthread_parkme+0x1e/0x1e

To solve the issue, introduce a new smp_cancel_pairing() API that can
be used to clean up the SMP state before touching the hci_dev lists.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When unpairing the keys stored in hci_dev are removed. If SMP is
ongoing the SMP context will also have references to these keys, so
removing them from the hci_dev lists will make the pointers invalid.
This can result in the following type of crashes:

 BUG: unable to handle kernel paging request at 6b6b6b6b
 IP: [&lt;c11f26be&gt;] __list_del_entry+0x44/0x71
 *pde = 00000000
 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
 Modules linked in: hci_uart btqca btusb btintel btbcm btrtl hci_vhci rfcomm bluetooth_6lowpan bluetooth
 CPU: 0 PID: 723 Comm: kworker/u5:0 Not tainted 4.3.0-rc3+ #1379
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014
 Workqueue: hci0 hci_rx_work [bluetooth]
 task: f19da940 ti: f1a94000 task.ti: f1a94000
 EIP: 0060:[&lt;c11f26be&gt;] EFLAGS: 00010202 CPU: 0
 EIP is at __list_del_entry+0x44/0x71
 EAX: c0088d20 EBX: f30fcac0 ECX: 6b6b6b6b EDX: 6b6b6b6b
 ESI: f4b60000 EDI: c0088d20 EBP: f1a95d90 ESP: f1a95d8c
  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
 CR0: 8005003b CR2: 6b6b6b6b CR3: 319e5000 CR4: 00000690
 Stack:
  f30fcac0 f1a95db0 f82dc3e1 f1bfc000 00000000 c106524f f1bfc000 f30fd020
  f1a95dc0 f1a95dd0 f82dcbdb f1a95de0 f82dcbdb 00000067 f1bfc000 f30fd020
  f1a95de0 f1a95df0 f82d1126 00000067 f82d1126 00000006 f30fd020 f1bfc000
 Call Trace:
  [&lt;f82dc3e1&gt;] smp_chan_destroy+0x192/0x240 [bluetooth]
  [&lt;c106524f&gt;] ? trace_hardirqs_on_caller+0x14e/0x169
  [&lt;f82dcbdb&gt;] smp_teardown_cb+0x47/0x64 [bluetooth]
  [&lt;f82dcbdb&gt;] ? smp_teardown_cb+0x47/0x64 [bluetooth]
  [&lt;f82d1126&gt;] l2cap_chan_del+0x5d/0x14d [bluetooth]
  [&lt;f82d1126&gt;] ? l2cap_chan_del+0x5d/0x14d [bluetooth]
  [&lt;f82d40ef&gt;] l2cap_conn_del+0x109/0x17b [bluetooth]
  [&lt;f82d40ef&gt;] ? l2cap_conn_del+0x109/0x17b [bluetooth]
  [&lt;f82c0205&gt;] ? hci_event_packet+0x5b1/0x2092 [bluetooth]
  [&lt;f82d41aa&gt;] l2cap_disconn_cfm+0x49/0x50 [bluetooth]
  [&lt;f82d41aa&gt;] ? l2cap_disconn_cfm+0x49/0x50 [bluetooth]
  [&lt;f82c0228&gt;] hci_event_packet+0x5d4/0x2092 [bluetooth]
  [&lt;c1332c16&gt;] ? skb_release_data+0x6a/0x95
  [&lt;f82ce5d4&gt;] ? hci_send_to_monitor+0xe7/0xf4 [bluetooth]
  [&lt;c1409708&gt;] ? _raw_spin_unlock_irqrestore+0x44/0x57
  [&lt;f82b3bb0&gt;] hci_rx_work+0xf1/0x28b [bluetooth]
  [&lt;f82b3bb0&gt;] ? hci_rx_work+0xf1/0x28b [bluetooth]
  [&lt;c10635a0&gt;] ? __lock_is_held+0x2e/0x44
  [&lt;c104772e&gt;] process_one_work+0x232/0x432
  [&lt;c1071ddc&gt;] ? rcu_read_lock_sched_held+0x50/0x5a
  [&lt;c104772e&gt;] ? process_one_work+0x232/0x432
  [&lt;c1047d48&gt;] worker_thread+0x1b8/0x255
  [&lt;c1047b90&gt;] ? rescuer_thread+0x23c/0x23c
  [&lt;c104bb71&gt;] kthread+0x91/0x96
  [&lt;c14096a7&gt;] ? _raw_spin_unlock_irq+0x27/0x44
  [&lt;c1409d61&gt;] ret_from_kernel_thread+0x21/0x30
  [&lt;c104bae0&gt;] ? kthread_parkme+0x1e/0x1e

To solve the issue, introduce a new smp_cancel_pairing() API that can
be used to clean up the SMP state before touching the hci_dev lists.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Bluetooth: Add function for generating LE SC out-of-band data</title>
<updated>2015-03-16T08:31:27+00:00</updated>
<author>
<name>Marcel Holtmann</name>
<email>marcel@holtmann.org</email>
</author>
<published>2015-03-16T08:10:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=60a27d653d972584e5e98ab3558c62c3d3bc547a'/>
<id>60a27d653d972584e5e98ab3558c62c3d3bc547a</id>
<content type='text'>
This patch adds a smp_generate_oob function that allows to create
local out-of-band data that can be used for pairing and also provides
the confirmation and random value.

Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This patch adds a smp_generate_oob function that allows to create
local out-of-band data that can be used for pairing and also provides
the confirmation and random value.

Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Bluetooth: Add skeleton for SMP self-tests</title>
<updated>2014-12-30T07:54:33+00:00</updated>
<author>
<name>Johan Hedberg</name>
<email>johan.hedberg@intel.com</email>
</author>
<published>2014-12-30T07:50:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=0a2b0f0452e2499a1037305fcfc314d0cdeb5260'/>
<id>0a2b0f0452e2499a1037305fcfc314d0cdeb5260</id>
<content type='text'>
This patch adds the initial skeleton and kernel config option for SMP
self-tests.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This patch adds the initial skeleton and kernel config option for SMP
self-tests.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Bluetooth: Fix missing const declarations in SMP functions</title>
<updated>2014-12-03T15:51:21+00:00</updated>
<author>
<name>Johan Hedberg</name>
<email>johan.hedberg@intel.com</email>
</author>
<published>2014-12-02T11:37:41+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=cd0827976205f842cc722f48a1427c9b77c3ca28'/>
<id>cd0827976205f842cc722f48a1427c9b77c3ca28</id>
<content type='text'>
Several SMP functions take read-only data. This patch fixes the
declaration of these parameters to use the const specifier as
appropriate.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Several SMP functions take read-only data. This patch fixes the
declaration of these parameters to use the const specifier as
appropriate.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Bluetooth: Set the correct security level for SC LTKs</title>
<updated>2014-12-03T15:51:15+00:00</updated>
<author>
<name>Johan Hedberg</name>
<email>johan.hedberg@intel.com</email>
</author>
<published>2014-05-23T10:36:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8f5eeca321b4a618550a0c4c2d3da935aa7073b0'/>
<id>8f5eeca321b4a618550a0c4c2d3da935aa7073b0</id>
<content type='text'>
When the looked-up LTK is one generated by Secure Connections pairing
the security level it gives is BT_SECURITY_FIPS. This patch updates the
LTK request event handler to correctly set this level.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When the looked-up LTK is one generated by Secure Connections pairing
the security level it gives is BT_SECURITY_FIPS. This patch updates the
LTK request event handler to correctly set this level.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Bluetooth: Add mgmt support for LE Secure Connections LTK types</title>
<updated>2014-12-03T15:51:15+00:00</updated>
<author>
<name>Johan Hedberg</name>
<email>johan.hedberg@intel.com</email>
</author>
<published>2014-05-23T10:15:37+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=23fb8de376181a30c35195351ec6230167098b48'/>
<id>23fb8de376181a30c35195351ec6230167098b48</id>
<content type='text'>
We need a dedicated LTK type for LTK resulting from a Secure Connections
based SMP pairing. This patch adds a new define for it and ensures that
both the New LTK event as well as the Load LTKs command supports it.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
We need a dedicated LTK type for LTK resulting from a Secure Connections
based SMP pairing. This patch adds a new define for it and ensures that
both the New LTK event as well as the Load LTKs command supports it.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Bluetooth: Add basic SMP defines for LE Secure Connections</title>
<updated>2014-12-03T15:51:14+00:00</updated>
<author>
<name>Johan Hedberg</name>
<email>johan.hedberg@intel.com</email>
</author>
<published>2014-05-08T11:02:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=e65392e2ccbea210da1d8d8571de0d9821c42e7c'/>
<id>e65392e2ccbea210da1d8d8571de0d9821c42e7c</id>
<content type='text'>
This patch adds basic SMP defines for commands, error codes and PDU
definitions for the LE Secure Connections feature.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This patch adds basic SMP defines for commands, error codes and PDU
definitions for the LE Secure Connections feature.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Bluetooth: Add key preference parameter to smp_sufficient_security</title>
<updated>2014-11-15T00:46:49+00:00</updated>
<author>
<name>Johan Hedberg</name>
<email>johan.hedberg@intel.com</email>
</author>
<published>2014-11-13T08:55:18+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=35dc6f834c9dc888391c7b700130d0831a907ca1'/>
<id>35dc6f834c9dc888391c7b700130d0831a907ca1</id>
<content type='text'>
So far smp_sufficient_security() has returned false if we're encrypted
with an STK but do have an LTK available. However, for the sake of LE
CoC servers we do want to let the incoming connection through even
though we're only encrypted with the STK.

This patch adds a key preference parameter to smp_sufficient_security()
with two possible values (enum used instead of bool for readability).

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
So far smp_sufficient_security() has returned false if we're encrypted
with an STK but do have an LTK available. However, for the sake of LE
CoC servers we do want to let the incoming connection through even
though we're only encrypted with the STK.

This patch adds a key preference parameter to smp_sufficient_security()
with two possible values (enum used instead of bool for readability).

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Bluetooth: Add smp_ltk_sec_level() helper function</title>
<updated>2014-09-11T00:45:24+00:00</updated>
<author>
<name>Johan Hedberg</name>
<email>johan.hedberg@intel.com</email>
</author>
<published>2014-09-11T00:37:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a6f7833ca353d50de46e3532afebe4abfc5dc4d9'/>
<id>a6f7833ca353d50de46e3532afebe4abfc5dc4d9</id>
<content type='text'>
There are several places that need to determine the security level that
an LTK can provide. This patch adds a convenience function for this to
help make the code more readable.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
There are several places that need to determine the security level that
an LTK can provide. This patch adds a convenience function for this to
help make the code more readable.

Signed-off-by: Johan Hedberg &lt;johan.hedberg@intel.com&gt;
Signed-off-by: Marcel Holtmann &lt;marcel@holtmann.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
