[PW_SID:1041603] Bluetooth: btnxpuart: Add secure interface support for NXP chipsets #3262
Conversation
This increases build coverage and allows to drop an #ifdef. Signed-off-by: Bastien Nocera <hadess@hadess.net> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Export hci_discovery_active() so it can be used by bluetooth drivers built as modules. Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
If USB autosuspend occurs while discovery is active, the ongoing HCI operation may not complete successfully. On some devices, this can leave discovery.state stuck in DISCOVERY_FINDING. Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This patch adds workflow files for ci: [sync.yml] - The workflow file for scheduled work - Sync the repo with upstream repo and rebase the workflow branch - Review the patches in the patchwork and creates the PR if needed [ci.yml] - The workflow file for CI tasks - Run CI tests when PR is created Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
This adds support for parsing firmware metadata TLVs to extract FW UUID and ECDSA Public Key from FW metadata for secure interface authentication. Signed-off-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
This adds a print for FW version after FW is downloaded, and a way to enable chip specific features. Currently, secure interface feature is enabled for AW693 chipset. Signed-off-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
This includes a placeholder nxp_authenticate_device() function if the chip supports secure interface feature. Signed-off-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
This adds nxp_authenticate_device() function that sets up cryptographic resources for TLS handshake authentication. Allocates SHA256 hash and ECDH-P256 key exchange with proper cleanup after handshake completion to maintain only traffic keys. Signed-off-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
Implement TLS handshake initiation for secure interface authentication. Includes ECDH public key generation, host hello message creation, and handshake hash computation for secure chip authentication. Signed-off-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
This implements device hello message processing to derive handshake traffic secrets: - Add HKDF-SHA256 functions for TLS 1.3 traffic secret derivation following RFC 5869/8446 - Extract device ECDH public key and compute shared secret using KPP API with host private key and device public key - Derive handshake traffic secret from ECDH shared secret following TLS 1.3 key schedule - Validate device hello message and update handshake hash state The handshake traffic secret enables decryption of the device_finish portion within the device_hello message. Signed-off-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
This implements secure device authentication during TLS 1.3-like handshake with ECDSA signature verification. The authentication flow: - Derive handshake traffic secret from ECDH shared secret - Decrypt device hello encrypted section using AES-GCM with traffic secret - Extract ECDSA public key from firmware metadata for verification - Verify device handshake signature to authenticate device identity - Validate device finished message using calculated verify data - Clear handshake traffic secret after successful authentication This ensures only devices with valid private keys can complete the handshake. Key components added: - AES-GCM encrypt/decrypt with traffic secret derived keys - ECDSA P-256 signature verification using kernel crypto API - X9.62 to P1363 signature format conversion - TLS 1.3 finished message verification - Secure memory cleanup of cryptographic material Signed-off-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
This completes the TLS handshake implementation by adding master secret derivation and traffic key generation. These traffic keys will be used to encrypt/decrypt sensitive HCI commands, response and events. Signed-off-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
This adds support for command encryption for sensitive HCI commands when secure interface is enabled. This commands containt sensitive data such as Link Key in plain text over UART lines. AES-GCM encryption is used to encrypt sensitive commands using encryption key and IV derived from traffic keys. Signed-off-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
This adds support for receiving and decrypting vendor events from secure NXP chip and forwarding the decrypted sensitive HCI events to the BT stack. The NXP BT chip encrypts the Link Key Notification event that is usually sent in plaintext over UART lines. Signed-off-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
This adds crypto dependencies (ECDSA, ECDH, AES-GCM, SHA256, HMAC) needed for TLS-based secure host interface authentication and encryption. Signed-off-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
|
CheckPatch |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
TestRunnerSetup |
|
TestRunner_l2cap-tester |
|
TestRunner_iso-tester |
|
TestRunner_bnep-tester |
|
TestRunner_mgmt-tester |
|
TestRunner_rfcomm-tester |
|
TestRunner_sco-tester |
|
TestRunner_ioctl-tester |
|
TestRunner_mesh-tester |
|
TestRunner_smp-tester |
|
TestRunner_userchan-tester |
|
IncrementalBuild |
github-actions
bot
force-pushed
the
workflow
branch
from
e7984f7 to
e352d45
Compare
This adds support for parsing firmware metadata TLVs to extract FW UUID and
ECDSA Public Key from FW metadata for secure interface authentication.
Signed-off-by: Neeraj Sanjay Kale neeraj.sanjaykale@nxp.com
v2: Fix sparse warnings. (kernel test robot)
drivers/bluetooth/btnxpuart.c | 133 ++++++++++++++++++++++++++++++++--
1 file changed, 125 insertions(+), 8 deletions(-)