2 Copyright (c) 2011,2012 Intel Corp.
4 This program is free software; you can redistribute it and/or modify
5 it under the terms of the GNU General Public License version 2 and
6 only version 2 as published by the Free Software Foundation.
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
14 #include <net/bluetooth/bluetooth.h>
15 #include <net/bluetooth/hci.h>
16 #include <net/bluetooth/hci_core.h>
17 #include <net/bluetooth/a2mp.h>
18 #include <net/bluetooth/amp.h>
19 #include <crypto/hash.h>
21 /* Remote AMP Controllers interface */
22 void amp_ctrl_get(struct amp_ctrl
*ctrl
)
24 BT_DBG("ctrl %p orig refcnt %d", ctrl
,
25 atomic_read(&ctrl
->kref
.refcount
));
27 kref_get(&ctrl
->kref
);
30 static void amp_ctrl_destroy(struct kref
*kref
)
32 struct amp_ctrl
*ctrl
= container_of(kref
, struct amp_ctrl
, kref
);
34 BT_DBG("ctrl %p", ctrl
);
40 int amp_ctrl_put(struct amp_ctrl
*ctrl
)
42 BT_DBG("ctrl %p orig refcnt %d", ctrl
,
43 atomic_read(&ctrl
->kref
.refcount
));
45 return kref_put(&ctrl
->kref
, &_ctrl_destroy
);
48 struct amp_ctrl
*amp_ctrl_add(struct amp_mgr
*mgr
, u8 id
)
50 struct amp_ctrl
*ctrl
;
52 ctrl
= kzalloc(sizeof(*ctrl
), GFP_KERNEL
);
56 kref_init(&ctrl
->kref
);
59 mutex_lock(&mgr
->amp_ctrls_lock
);
60 list_add(&ctrl
->list
, &mgr
->amp_ctrls
);
61 mutex_unlock(&mgr
->amp_ctrls_lock
);
63 BT_DBG("mgr %p ctrl %p", mgr
, ctrl
);
68 void amp_ctrl_list_flush(struct amp_mgr
*mgr
)
70 struct amp_ctrl
*ctrl
, *n
;
72 BT_DBG("mgr %p", mgr
);
74 mutex_lock(&mgr
->amp_ctrls_lock
);
75 list_for_each_entry_safe(ctrl
, n
, &mgr
->amp_ctrls
, list
) {
76 list_del(&ctrl
->list
);
79 mutex_unlock(&mgr
->amp_ctrls_lock
);
82 struct amp_ctrl
*amp_ctrl_lookup(struct amp_mgr
*mgr
, u8 id
)
84 struct amp_ctrl
*ctrl
;
86 BT_DBG("mgr %p id %d", mgr
, id
);
88 mutex_lock(&mgr
->amp_ctrls_lock
);
89 list_for_each_entry(ctrl
, &mgr
->amp_ctrls
, list
) {
92 mutex_unlock(&mgr
->amp_ctrls_lock
);
96 mutex_unlock(&mgr
->amp_ctrls_lock
);
101 /* Physical Link interface */
102 static u8
__next_handle(struct amp_mgr
*mgr
)
104 if (++mgr
->handle
== 0)
110 struct hci_conn
*phylink_add(struct hci_dev
*hdev
, struct amp_mgr
*mgr
,
113 bdaddr_t
*dst
= mgr
->l2cap_conn
->dst
;
114 struct hci_conn
*hcon
;
116 hcon
= hci_conn_add(hdev
, AMP_LINK
, dst
);
120 hcon
->state
= BT_CONNECT
;
123 hcon
->handle
= __next_handle(mgr
);
124 hcon
->remote_id
= remote_id
;
130 /* AMP crypto key generation interface */
131 static int hmac_sha256(u8
*key
, u8 ksize
, char *plaintext
, u8 psize
, u8
*output
)
134 struct crypto_shash
*tfm
;
139 tfm
= crypto_alloc_shash("hmac(sha256)", 0, 0);
141 BT_DBG("crypto_alloc_ahash failed: err %ld", PTR_ERR(tfm
));
145 ret
= crypto_shash_setkey(tfm
, key
, ksize
);
147 BT_DBG("crypto_ahash_setkey failed: err %d", ret
);
150 struct shash_desc shash
;
151 char ctx
[crypto_shash_descsize(tfm
)];
154 desc
.shash
.tfm
= tfm
;
155 desc
.shash
.flags
= CRYPTO_TFM_REQ_MAY_SLEEP
;
157 ret
= crypto_shash_digest(&desc
.shash
, plaintext
, psize
,
161 crypto_free_shash(tfm
);
165 int phylink_gen_key(struct hci_conn
*conn
, u8
*data
, u8
*len
, u8
*type
)
167 struct hci_dev
*hdev
= conn
->hdev
;
168 struct link_key
*key
;
169 u8 keybuf
[HCI_AMP_LINK_KEY_SIZE
];
170 u8 gamp_key
[HCI_AMP_LINK_KEY_SIZE
];
173 if (!hci_conn_check_link_mode(conn
))
176 BT_DBG("conn %p key_type %d", conn
, conn
->key_type
);
179 if (conn
->key_type
< 3) {
180 BT_ERR("Legacy key type %d", conn
->key_type
);
184 *type
= conn
->key_type
;
185 *len
= HCI_AMP_LINK_KEY_SIZE
;
187 key
= hci_find_link_key(hdev
, &conn
->dst
);
189 BT_DBG("No Link key for conn %p dst %pMR", conn
, &conn
->dst
);
193 /* BR/EDR Link Key concatenated together with itself */
194 memcpy(&keybuf
[0], key
->val
, HCI_LINK_KEY_SIZE
);
195 memcpy(&keybuf
[HCI_LINK_KEY_SIZE
], key
->val
, HCI_LINK_KEY_SIZE
);
197 /* Derive Generic AMP Link Key (gamp) */
198 err
= hmac_sha256(keybuf
, HCI_AMP_LINK_KEY_SIZE
, "gamp", 4, gamp_key
);
200 BT_ERR("Could not derive Generic AMP Key: err %d", err
);
204 if (conn
->key_type
== HCI_LK_DEBUG_COMBINATION
) {
205 BT_DBG("Use Generic AMP Key (gamp)");
206 memcpy(data
, gamp_key
, HCI_AMP_LINK_KEY_SIZE
);
210 /* Derive Dedicated AMP Link Key: "802b" is 802.11 PAL keyID */
211 return hmac_sha256(gamp_key
, HCI_AMP_LINK_KEY_SIZE
, "802b", 4, data
);
214 void amp_read_loc_assoc_frag(struct hci_dev
*hdev
, u8 phy_handle
)
216 struct hci_cp_read_local_amp_assoc cp
;
217 struct amp_assoc
*loc_assoc
= &hdev
->loc_assoc
;
219 BT_DBG("%s handle %d", hdev
->name
, phy_handle
);
221 cp
.phy_handle
= phy_handle
;
222 cp
.max_len
= cpu_to_le16(hdev
->amp_assoc_size
);
223 cp
.len_so_far
= cpu_to_le16(loc_assoc
->offset
);
225 hci_send_cmd(hdev
, HCI_OP_READ_LOCAL_AMP_ASSOC
, sizeof(cp
), &cp
);
228 void amp_read_loc_assoc(struct hci_dev
*hdev
, struct amp_mgr
*mgr
)
230 struct hci_cp_read_local_amp_assoc cp
;
232 memset(&hdev
->loc_assoc
, 0, sizeof(struct amp_assoc
));
233 memset(&cp
, 0, sizeof(cp
));
235 cp
.max_len
= cpu_to_le16(hdev
->amp_assoc_size
);
237 mgr
->state
= READ_LOC_AMP_ASSOC
;
238 hci_send_cmd(hdev
, HCI_OP_READ_LOCAL_AMP_ASSOC
, sizeof(cp
), &cp
);
241 void amp_read_loc_assoc_final_data(struct hci_dev
*hdev
,
242 struct hci_conn
*hcon
)
244 struct hci_cp_read_local_amp_assoc cp
;
245 struct amp_mgr
*mgr
= hcon
->amp_mgr
;
247 cp
.phy_handle
= hcon
->handle
;
248 cp
.len_so_far
= cpu_to_le16(0);
249 cp
.max_len
= cpu_to_le16(hdev
->amp_assoc_size
);
251 mgr
->state
= READ_LOC_AMP_ASSOC_FINAL
;
253 /* Read Local AMP Assoc final link information data */
254 hci_send_cmd(hdev
, HCI_OP_READ_LOCAL_AMP_ASSOC
, sizeof(cp
), &cp
);
257 /* Write AMP Assoc data fragments, returns true with last fragment written*/
258 static bool amp_write_rem_assoc_frag(struct hci_dev
*hdev
,
259 struct hci_conn
*hcon
)
261 struct hci_cp_write_remote_amp_assoc
*cp
;
262 struct amp_mgr
*mgr
= hcon
->amp_mgr
;
263 struct amp_ctrl
*ctrl
;
266 ctrl
= amp_ctrl_lookup(mgr
, hcon
->remote_id
);
270 if (!ctrl
->assoc_rem_len
) {
271 BT_DBG("all fragments are written");
272 ctrl
->assoc_rem_len
= ctrl
->assoc_len
;
273 ctrl
->assoc_len_so_far
= 0;
279 frag_len
= min_t(u16
, 248, ctrl
->assoc_rem_len
);
280 len
= frag_len
+ sizeof(*cp
);
282 cp
= kzalloc(len
, GFP_KERNEL
);
288 BT_DBG("hcon %p ctrl %p frag_len %u assoc_len %u rem_len %u",
289 hcon
, ctrl
, frag_len
, ctrl
->assoc_len
, ctrl
->assoc_rem_len
);
291 cp
->phy_handle
= hcon
->handle
;
292 cp
->len_so_far
= cpu_to_le16(ctrl
->assoc_len_so_far
);
293 cp
->rem_len
= cpu_to_le16(ctrl
->assoc_rem_len
);
294 memcpy(cp
->frag
, ctrl
->assoc
, frag_len
);
296 ctrl
->assoc_len_so_far
+= frag_len
;
297 ctrl
->assoc_rem_len
-= frag_len
;
301 hci_send_cmd(hdev
, HCI_OP_WRITE_REMOTE_AMP_ASSOC
, len
, cp
);
308 void amp_write_rem_assoc_continue(struct hci_dev
*hdev
, u8 handle
)
310 struct hci_conn
*hcon
;
312 BT_DBG("%s phy handle 0x%2.2x", hdev
->name
, handle
);
314 hcon
= hci_conn_hash_lookup_handle(hdev
, handle
);
318 amp_write_rem_assoc_frag(hdev
, hcon
);
321 void amp_write_remote_assoc(struct hci_dev
*hdev
, u8 handle
)
323 struct hci_conn
*hcon
;
325 BT_DBG("%s phy handle 0x%2.2x", hdev
->name
, handle
);
327 hcon
= hci_conn_hash_lookup_handle(hdev
, handle
);
331 BT_DBG("%s phy handle 0x%2.2x hcon %p", hdev
->name
, handle
, hcon
);
333 amp_write_rem_assoc_frag(hdev
, hcon
);
336 void amp_create_phylink(struct hci_dev
*hdev
, struct amp_mgr
*mgr
,
337 struct hci_conn
*hcon
)
339 struct hci_cp_create_phy_link cp
;
341 cp
.phy_handle
= hcon
->handle
;
343 BT_DBG("%s hcon %p phy handle 0x%2.2x", hdev
->name
, hcon
,
346 if (phylink_gen_key(mgr
->l2cap_conn
->hcon
, cp
.key
, &cp
.key_len
,
348 BT_DBG("Cannot create link key");
352 hci_send_cmd(hdev
, HCI_OP_CREATE_PHY_LINK
, sizeof(cp
), &cp
);
355 void amp_accept_phylink(struct hci_dev
*hdev
, struct amp_mgr
*mgr
,
356 struct hci_conn
*hcon
)
358 struct hci_cp_accept_phy_link cp
;
360 cp
.phy_handle
= hcon
->handle
;
362 BT_DBG("%s hcon %p phy handle 0x%2.2x", hdev
->name
, hcon
,
365 if (phylink_gen_key(mgr
->l2cap_conn
->hcon
, cp
.key
, &cp
.key_len
,
367 BT_DBG("Cannot create link key");
371 hci_send_cmd(hdev
, HCI_OP_ACCEPT_PHY_LINK
, sizeof(cp
), &cp
);