// SPDX-License-Identifier: GPL-2.0

/*

* BlueZ - Bluetooth protocol stack for Linux

*

* Copyright (C) 2022 Intel Corporation

* Copyright 2023-2024 NXP

*/

#include <linux/module.h>

#include <linux/debugfs.h>

#include <linux/seq_file.h>

#include <linux/sched/signal.h>

#include <net/bluetooth/bluetooth.h>

#include <net/bluetooth/hci_core.h>

#include <net/bluetooth/iso.h>

#include "eir.h"

static const struct proto_ops iso_sock_ops;

static struct bt_sock_list iso_sk_list = {

.lock = __RW_LOCK_UNLOCKED(iso_sk_list.lock)

};

/* ---- ISO connections ---- */

struct iso_conn {

struct hci_conn *hcon;

/* @lock: spinlock protecting changes to iso_conn fields */

spinlock_t lock;

struct sock *sk;

struct delayed_work timeout_work;

struct sk_buff *rx_skb;

__u32 rx_len;

__u16 tx_sn;

struct kref ref;

};

#define iso_conn_lock(c) spin_lock(&(c)->lock)

#define iso_conn_unlock(c) spin_unlock(&(c)->lock)

static void iso_sock_close(struct sock *sk);

static void iso_sock_kill(struct sock *sk);

/* ----- ISO socket info ----- */

#define iso_pi(sk) ((struct iso_pinfo *)sk)

#define EIR_SERVICE_DATA_LENGTH 4

#define BASE_MAX_LENGTH (HCI_MAX_PER_AD_LENGTH - EIR_SERVICE_DATA_LENGTH)

#define EIR_BAA_SERVICE_UUID 0x1851

/* iso_pinfo flags values */

enum {

BT_SK_BIG_SYNC,

BT_SK_PA_SYNC,

};

struct iso_pinfo {

struct bt_sock bt;

bdaddr_t src;

__u8 src_type;

bdaddr_t dst;

__u8 dst_type;

__u8 bc_sid;

__u8 bc_num_bis;

__u8 bc_bis[ISO_MAX_NUM_BIS];

__u16 sync_handle;

unsigned long flags;

struct bt_iso_qos qos;

bool qos_user_set;

__u8 base_len;

__u8 base[BASE_MAX_LENGTH];

struct iso_conn *conn;

};

static struct bt_iso_qos default_qos;

static bool check_ucast_qos(struct bt_iso_qos *qos);

static bool check_bcast_qos(struct bt_iso_qos *qos);

static bool iso_match_sid(struct sock *sk, void *data);

static bool iso_match_sid_past(struct sock *sk, void *data);

static bool iso_match_sync_handle(struct sock *sk, void *data);

static bool iso_match_sync_handle_pa_report(struct sock *sk, void *data);

static void iso_sock_disconn(struct sock *sk);

typedef bool (*iso_sock_match_t)(struct sock *sk, void *data);

static struct sock *iso_get_sock(struct hci_dev *hdev, bdaddr_t *src,

bdaddr_t *dst, enum bt_sock_state state,

iso_sock_match_t match, void *data);

/* ---- ISO timers ---- */

#define ISO_CONN_TIMEOUT secs_to_jiffies(20)

#define ISO_DISCONN_TIMEOUT secs_to_jiffies(2)

static void iso_conn_free(struct kref *ref)

{

struct iso_conn *conn = container_of(ref, struct iso_conn, ref);

BT_DBG("conn %p", conn);

if (conn->sk)

iso_pi(conn->sk)->conn = NULL;

if (conn->hcon) {

conn->hcon->iso_data = NULL;

hci_conn_drop(conn->hcon);

}

/* Ensure no more work items will run since hci_conn has been dropped */

disable_delayed_work_sync(&conn->timeout_work);

kfree_skb(conn->rx_skb);

kfree(conn);

}

static void iso_conn_put(struct iso_conn *conn)

{

if (!conn)

return;

BT_DBG("conn %p refcnt %d", conn, kref_read(&conn->ref));

kref_put(&conn->ref, iso_conn_free);

}

static struct iso_conn *iso_conn_hold_unless_zero(struct iso_conn *conn)

{

if (!conn)

return NULL;

BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref));

if (!kref_get_unless_zero(&conn->ref))

return NULL;

return conn;

}

static struct sock *iso_sock_hold(struct iso_conn *conn)

{

if (!conn || !bt_sock_linked(&iso_sk_list, conn->sk))

return NULL;

sock_hold(conn->sk);

return conn->sk;

}

static void iso_sock_timeout(struct work_struct *work)

{

struct iso_conn *conn = container_of(work, struct iso_conn,

timeout_work.work);

struct sock *sk;

conn = iso_conn_hold_unless_zero(conn);

if (!conn)

return;

iso_conn_lock(conn);

sk = iso_sock_hold(conn);

iso_conn_unlock(conn);

iso_conn_put(conn);

if (!sk)

return;

BT_DBG("sock %p state %d", sk, sk->sk_state);

lock_sock(sk);

sk->sk_err = ETIMEDOUT;

sk->sk_state_change(sk);

release_sock(sk);

sock_put(sk);

}

static void iso_sock_set_timer(struct sock *sk, long timeout)

{

if (!iso_pi(sk)->conn)

return;

BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);

cancel_delayed_work(&iso_pi(sk)->conn->timeout_work);

schedule_delayed_work(&iso_pi(sk)->conn->timeout_work, timeout);

}

static void iso_sock_clear_timer(struct sock *sk)

{

if (!iso_pi(sk)->conn)

return;

BT_DBG("sock %p state %d", sk, sk->sk_state);

cancel_delayed_work(&iso_pi(sk)->conn->timeout_work);

}

/* ---- ISO connections ---- */

static struct iso_conn *iso_conn_add(struct hci_conn *hcon)

{

struct iso_conn *conn = hcon->iso_data;

conn = iso_conn_hold_unless_zero(conn);

if (conn) {

if (!conn->hcon) {

iso_conn_lock(conn);

conn->hcon = hcon;

iso_conn_unlock(conn);

}

iso_conn_put(conn);

return conn;

}

conn = kzalloc_obj(*conn);

if (!conn)

return NULL;

kref_init(&conn->ref);

spin_lock_init(&conn->lock);

INIT_DELAYED_WORK(&conn->timeout_work, iso_sock_timeout);

hcon->iso_data = conn;

conn->hcon = hcon;

conn->tx_sn = 0;

BT_DBG("hcon %p conn %p", hcon, conn);

return conn;

}

/* Delete channel. Must be called on the locked socket. */

static void iso_chan_del(struct sock *sk, int err)

{

struct iso_conn *conn;

struct sock *parent;

conn = iso_pi(sk)->conn;

iso_pi(sk)->conn = NULL;

BT_DBG("sk %p, conn %p, err %d", sk, conn, err);

if (conn) {

iso_conn_lock(conn);

conn->sk = NULL;

iso_conn_unlock(conn);

iso_conn_put(conn);

}

sk->sk_state = BT_CLOSED;

sk->sk_err = err;

parent = bt_sk(sk)->parent;

if (parent) {

bt_accept_unlink(sk);

parent->sk_data_ready(parent);

} else {

sk->sk_state_change(sk);

}

sock_set_flag(sk, SOCK_ZAPPED);

}

static void iso_conn_del(struct hci_conn *hcon, int err)

{

struct iso_conn *conn = hcon->iso_data;

struct sock *sk;

conn = iso_conn_hold_unless_zero(conn);

if (!conn)

return;

BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);

/* Kill socket */

iso_conn_lock(conn);

sk = iso_sock_hold(conn);

iso_conn_unlock(conn);

iso_conn_put(conn);

if (!sk) {

iso_conn_put(conn);

return;

}

lock_sock(sk);

iso_sock_clear_timer(sk);

iso_chan_del(sk, err);

release_sock(sk);

sock_put(sk);

}

static int __iso_chan_add(struct iso_conn *conn, struct sock *sk,

struct sock *parent)

{

BT_DBG("conn %p", conn);

if (iso_pi(sk)->conn == conn && conn->sk == sk)

return 0;

if (conn->sk) {

BT_ERR("conn->sk already set");

return -EBUSY;

}

iso_pi(sk)->conn = conn;

conn->sk = sk;

if (parent)

bt_accept_enqueue(parent, sk, true);

return 0;

}

static int iso_chan_add(struct iso_conn *conn, struct sock *sk,

struct sock *parent)

{

int err;

iso_conn_lock(conn);

err = __iso_chan_add(conn, sk, parent);

iso_conn_unlock(conn);

return err;

}

static inline u8 le_addr_type(u8 bdaddr_type)

{

if (bdaddr_type == BDADDR_LE_PUBLIC)

return ADDR_LE_DEV_PUBLIC;

else

return ADDR_LE_DEV_RANDOM;

}

static int iso_connect_bis(struct sock *sk)

{

struct iso_conn *conn;

struct hci_conn *hcon;

struct hci_dev *hdev;

int err;

BT_DBG("%pMR (SID 0x%2.2x)", &iso_pi(sk)->src, iso_pi(sk)->bc_sid);

hdev = hci_get_route(&iso_pi(sk)->dst, &iso_pi(sk)->src,

iso_pi(sk)->src_type);

if (!hdev)

return -EHOSTUNREACH;

hci_dev_lock(hdev);

if (!bis_capable(hdev)) {

err = -EOPNOTSUPP;

goto unlock;

}

/* Fail if user set invalid QoS */

if (iso_pi(sk)->qos_user_set && !check_bcast_qos(&iso_pi(sk)->qos)) {

iso_pi(sk)->qos = default_qos;

err = -EINVAL;

goto unlock;

}

/* Fail if out PHYs are marked as disabled */

if (!iso_pi(sk)->qos.bcast.out.phys) {

err = -EINVAL;

goto unlock;

}

/* Just bind if DEFER_SETUP has been set */

if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {

hcon = hci_bind_bis(hdev, &iso_pi(sk)->dst, iso_pi(sk)->bc_sid,

&iso_pi(sk)->qos, iso_pi(sk)->base_len,

iso_pi(sk)->base,

READ_ONCE(sk->sk_sndtimeo));

if (IS_ERR(hcon)) {

err = PTR_ERR(hcon);

goto unlock;

}

} else {

hcon = hci_connect_bis(hdev, &iso_pi(sk)->dst,

le_addr_type(iso_pi(sk)->dst_type),

iso_pi(sk)->bc_sid, &iso_pi(sk)->qos,

iso_pi(sk)->base_len, iso_pi(sk)->base,

READ_ONCE(sk->sk_sndtimeo));

if (IS_ERR(hcon)) {

err = PTR_ERR(hcon);

goto unlock;

}

/* Update SID if it was not set */

if (iso_pi(sk)->bc_sid == HCI_SID_INVALID)

iso_pi(sk)->bc_sid = hcon->sid;

}

conn = iso_conn_add(hcon);

if (!conn) {

hci_conn_drop(hcon);

err = -ENOMEM;

goto unlock;

}

lock_sock(sk);

err = iso_chan_add(conn, sk, NULL);

if (err) {

release_sock(sk);

goto unlock;

}

/* Update source addr of the socket */

bacpy(&iso_pi(sk)->src, &hcon->src);

if (hcon->state == BT_CONNECTED) {

iso_sock_clear_timer(sk);

sk->sk_state = BT_CONNECTED;

} else if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {

iso_sock_clear_timer(sk);

sk->sk_state = BT_CONNECT;

} else {

sk->sk_state = BT_CONNECT;

iso_sock_set_timer(sk, READ_ONCE(sk->sk_sndtimeo));

}

release_sock(sk);

unlock:

hci_dev_unlock(hdev);

hci_dev_put(hdev);

return err;

}

static int iso_connect_cis(struct sock *sk)

{

struct iso_conn *conn;

struct hci_conn *hcon;

struct hci_dev *hdev;

int err;

BT_DBG("%pMR -> %pMR", &iso_pi(sk)->src, &iso_pi(sk)->dst);

hdev = hci_get_route(&iso_pi(sk)->dst, &iso_pi(sk)->src,

iso_pi(sk)->src_type);

if (!hdev)

return -EHOSTUNREACH;

hci_dev_lock(hdev);

if (!cis_central_capable(hdev)) {

err = -EOPNOTSUPP;

goto unlock;

}

/* Fail if user set invalid QoS */

if (iso_pi(sk)->qos_user_set && !check_ucast_qos(&iso_pi(sk)->qos)) {

iso_pi(sk)->qos = default_qos;

err = -EINVAL;

goto unlock;

}

/* Fail if either PHYs are marked as disabled */

if (!iso_pi(sk)->qos.ucast.in.phys && !iso_pi(sk)->qos.ucast.out.phys) {

err = -EINVAL;

goto unlock;

}

/* Check if there are available buffers for output/TX. */

if (iso_pi(sk)->qos.ucast.out.sdu && !hci_iso_count(hdev) &&

(hdev->iso_pkts && !hdev->iso_cnt)) {

err = -ENOBUFS;

goto unlock;

}

/* Just bind if DEFER_SETUP has been set */

if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {

hcon = hci_bind_cis(hdev, &iso_pi(sk)->dst,

le_addr_type(iso_pi(sk)->dst_type),

&iso_pi(sk)->qos,

READ_ONCE(sk->sk_sndtimeo));

if (IS_ERR(hcon)) {

err = PTR_ERR(hcon);

goto unlock;

}

} else {

hcon = hci_connect_cis(hdev, &iso_pi(sk)->dst,

le_addr_type(iso_pi(sk)->dst_type),

&iso_pi(sk)->qos,

READ_ONCE(sk->sk_sndtimeo));

if (IS_ERR(hcon)) {

err = PTR_ERR(hcon);

goto unlock;

}

}

conn = iso_conn_add(hcon);

if (!conn) {

hci_conn_drop(hcon);

err = -ENOMEM;

goto unlock;

}

lock_sock(sk);

err = iso_chan_add(conn, sk, NULL);

if (err) {

release_sock(sk);

goto unlock;

}

/* Update source addr of the socket */

bacpy(&iso_pi(sk)->src, &hcon->src);

if (hcon->state == BT_CONNECTED) {

iso_sock_clear_timer(sk);

sk->sk_state = BT_CONNECTED;

} else if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {

iso_sock_clear_timer(sk);

sk->sk_state = BT_CONNECT;

} else {

sk->sk_state = BT_CONNECT;

iso_sock_set_timer(sk, READ_ONCE(sk->sk_sndtimeo));

}

release_sock(sk);

unlock:

hci_dev_unlock(hdev);

hci_dev_put(hdev);

return err;

}

static struct bt_iso_qos *iso_sock_get_qos(struct sock *sk)

{

if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONNECT2)

return &iso_pi(sk)->conn->hcon->iso_qos;

return &iso_pi(sk)->qos;

}

static int iso_send_frame(struct sock *sk, struct sk_buff *skb,

const struct sockcm_cookie *sockc)

{

struct iso_conn *conn = iso_pi(sk)->conn;

struct bt_iso_qos *qos = iso_sock_get_qos(sk);

struct hci_iso_data_hdr *hdr;

int len = 0;

BT_DBG("sk %p len %d", sk, skb->len);

if (skb->len > qos->ucast.out.sdu)

return -EMSGSIZE;

len = skb->len;

/* Push ISO data header */

hdr = skb_push(skb, HCI_ISO_DATA_HDR_SIZE);

hdr->sn = cpu_to_le16(conn->tx_sn++);

hdr->slen = cpu_to_le16(hci_iso_data_len_pack(len,

HCI_ISO_STATUS_VALID));

if (sk->sk_state == BT_CONNECTED) {

hci_setup_tx_timestamp(skb, 1, sockc);

hci_send_iso(conn->hcon, skb);

} else {

len = -ENOTCONN;

}

return len;

}

static void iso_recv_frame(struct iso_conn *conn, struct sk_buff *skb)

{

struct sock *sk;

iso_conn_lock(conn);

sk = conn->sk;

iso_conn_unlock(conn);

if (!sk)

goto drop;

BT_DBG("sk %p len %d", sk, skb->len);

if (sk->sk_state != BT_CONNECTED)

goto drop;

if (!sock_queue_rcv_skb(sk, skb))

return;

drop:

kfree_skb(skb);

}

/* -------- Socket interface ---------- */

static struct sock *__iso_get_sock_listen_by_addr(bdaddr_t *src, bdaddr_t *dst)

{

struct sock *sk;

sk_for_each(sk, &iso_sk_list.head) {

if (sk->sk_state != BT_LISTEN)

continue;

if (bacmp(&iso_pi(sk)->dst, dst))

continue;

if (!bacmp(&iso_pi(sk)->src, src))

return sk;

}

return NULL;

}

static struct sock *__iso_get_sock_listen_by_sid(bdaddr_t *ba, bdaddr_t *bc,

__u8 sid)

{

struct sock *sk;

sk_for_each(sk, &iso_sk_list.head) {

if (sk->sk_state != BT_LISTEN)

continue;

if (bacmp(&iso_pi(sk)->src, ba))

continue;

if (bacmp(&iso_pi(sk)->dst, bc))

continue;

if (iso_pi(sk)->bc_sid == sid)

return sk;

}

return NULL;

}

/* Find socket in given state:

* source bdaddr (Unicast)

* destination bdaddr (Broadcast only)

* match func - pass NULL to ignore

* match func data - pass -1 to ignore

* Returns closest match.

*/

static struct sock *iso_get_sock(struct hci_dev *hdev, bdaddr_t *src,

bdaddr_t *dst, enum bt_sock_state state,

iso_sock_match_t match, void *data)

{

struct sock *sk = NULL, *sk1 = NULL;

read_lock(&iso_sk_list.lock);

sk_for_each(sk, &iso_sk_list.head) {

if (sk->sk_state != state)

continue;

/* Match Broadcast destination */

if (bacmp(dst, BDADDR_ANY) && bacmp(&iso_pi(sk)->dst, dst)) {

struct smp_irk *irk1, *irk2;

/* Check if destination is an RPA that we can resolve */

irk1 = hci_find_irk_by_rpa(hdev, dst);

if (!irk1)

continue;

/* Match with identity address */

if (bacmp(&iso_pi(sk)->dst, &irk1->bdaddr)) {

/* Check if socket destination address is also

* an RPA and if the IRK matches.

*/

irk2 = hci_find_irk_by_rpa(hdev,

&iso_pi(sk)->dst);

if (!irk2 || irk1 != irk2)

continue;

}

}

/* Use Match function if provided */

if (match && !match(sk, data))

continue;

/* Exact match. */

if (!bacmp(&iso_pi(sk)->src, src)) {

sock_hold(sk);

break;

}

/* Closest match */

if (!bacmp(&iso_pi(sk)->src, BDADDR_ANY)) {

if (sk1)

sock_put(sk1);

sk1 = sk;

sock_hold(sk1);

}

}

if (sk && sk1)

sock_put(sk1);

read_unlock(&iso_sk_list.lock);

return sk ? sk : sk1;

}

static struct sock *iso_get_sock_big(struct sock *match_sk, bdaddr_t *src,

bdaddr_t *dst, uint8_t big)

{

struct sock *sk = NULL;

read_lock(&iso_sk_list.lock);

sk_for_each(sk, &iso_sk_list.head) {

if (match_sk == sk)

continue;

/* Look for sockets that have already been

* connected to the BIG

*/

if (sk->sk_state != BT_CONNECTED &&

sk->sk_state != BT_CONNECT)

continue;

/* Match Broadcast destination */

if (bacmp(&iso_pi(sk)->dst, dst))

continue;

/* Match BIG handle */

if (iso_pi(sk)->qos.bcast.big != big)

continue;

/* Match source address */

if (bacmp(&iso_pi(sk)->src, src))

continue;

sock_hold(sk);

break;

}

read_unlock(&iso_sk_list.lock);

return sk;

}

static void iso_sock_destruct(struct sock *sk)

{

BT_DBG("sk %p", sk);

iso_conn_put(iso_pi(sk)->conn);

skb_queue_purge(&sk->sk_receive_queue);

skb_queue_purge(&sk->sk_write_queue);

skb_queue_purge(&sk->sk_error_queue);

}

static void iso_sock_cleanup_listen(struct sock *parent)

{

struct sock *sk;

BT_DBG("parent %p", parent);

/* Close not yet accepted channels */

while ((sk = bt_accept_dequeue(parent, NULL))) {

iso_sock_close(sk);

iso_sock_kill(sk);

}

/* If listening socket has a hcon, properly disconnect it */

if (iso_pi(parent)->conn && iso_pi(parent)->conn->hcon) {

iso_sock_disconn(parent);

return;

}

parent->sk_state = BT_CLOSED;

sock_set_flag(parent, SOCK_ZAPPED);

}

/* Kill socket (only if zapped and orphan)

* Must be called on unlocked socket.

*/

static void iso_sock_kill(struct sock *sk)

{

if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket ||

sock_flag(sk, SOCK_DEAD))

return;

BT_DBG("sk %p state %d", sk, sk->sk_state);

/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */

if (iso_pi(sk)->conn) {

iso_conn_lock(iso_pi(sk)->conn);

iso_pi(sk)->conn->sk = NULL;

iso_conn_unlock(iso_pi(sk)->conn);

}

/* Kill poor orphan */

bt_sock_unlink(&iso_sk_list, sk);

sock_set_flag(sk, SOCK_DEAD);

sock_put(sk);

}

static void iso_sock_disconn(struct sock *sk)

{

struct sock *bis_sk;

struct hci_conn *hcon = iso_pi(sk)->conn->hcon;

if (test_bit(HCI_CONN_BIG_CREATED, &hcon->flags)) {

bis_sk = iso_get_sock_big(sk, &iso_pi(sk)->src,

&iso_pi(sk)->dst,

iso_pi(sk)->qos.bcast.big);

/* If there are any other connected sockets for the

* same BIG, just delete the sk and leave the bis

* hcon active, in case later rebinding is needed.

*/

if (bis_sk) {

hcon->state = BT_OPEN;

hcon->iso_data = NULL;

iso_pi(sk)->conn->hcon = NULL;

iso_sock_clear_timer(sk);

iso_chan_del(sk, bt_to_errno(hcon->abort_reason));

sock_put(bis_sk);

return;

}

}

sk->sk_state = BT_DISCONN;

iso_conn_lock(iso_pi(sk)->conn);

hci_conn_drop(iso_pi(sk)->conn->hcon);

iso_pi(sk)->conn->hcon = NULL;

iso_conn_unlock(iso_pi(sk)->conn);

}

static void __iso_sock_close(struct sock *sk)

{

BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);

switch (sk->sk_state) {

case BT_LISTEN:

iso_sock_cleanup_listen(sk);

break;

case BT_CONNECT:

case BT_CONNECTED:

case BT_CONFIG:

if (iso_pi(sk)->conn->hcon)

iso_sock_disconn(sk);

else

iso_chan_del(sk, ECONNRESET);

break;

case BT_CONNECT2:

if (iso_pi(sk)->conn->hcon &&

(test_bit(HCI_CONN_PA_SYNC, &iso_pi(sk)->conn->hcon->flags) ||

test_bit(HCI_CONN_PA_SYNC_FAILED, &iso_pi(sk)->conn->hcon->flags)))

iso_sock_disconn(sk);

else

iso_chan_del(sk, ECONNRESET);

break;

case BT_DISCONN:

iso_chan_del(sk, ECONNRESET);

break;

default:

sock_set_flag(sk, SOCK_ZAPPED);

break;

}

}

/* Must be called on unlocked socket. */

static void iso_sock_close(struct sock *sk)

{

iso_sock_clear_timer(sk);

lock_sock(sk);

__iso_sock_close(sk);

release_sock(sk);

iso_sock_kill(sk);

}

static void iso_sock_init(struct sock *sk, struct sock *parent)

{

BT_DBG("sk %p", sk);

if (parent) {

sk->sk_type = parent->sk_type;

bt_sk(sk)->flags = bt_sk(parent)->flags;

security_sk_clone(parent, sk);

}

}

static struct proto iso_proto = {

.name = "ISO",

.owner = THIS_MODULE,

.obj_size = sizeof(struct iso_pinfo)

};

#define DEFAULT_IO_QOS \

{ \

.interval = 10000u, \

.latency = 10u, \

.sdu = 40u, \

.phys = BT_ISO_PHY_2M, \

.rtn = 2u, \

}

static struct bt_iso_qos default_qos = {

.bcast = {

.big = BT_ISO_QOS_BIG_UNSET,

.bis = BT_ISO_QOS_BIS_UNSET,

.sync_factor = 0x01,

.packing = 0x00,

.framing = 0x00,

.in = DEFAULT_IO_QOS,

.out = DEFAULT_IO_QOS,

.encryption = 0x00,

.bcode = {0x00},

.options = 0x00,

.skip = 0x0000,

.sync_timeout = BT_ISO_SYNC_TIMEOUT,

.sync_cte_type = 0x00,

.mse = 0x00,

.timeout = BT_ISO_SYNC_TIMEOUT,

},

};

static struct sock *iso_sock_alloc(struct net *net, struct socket *sock,

int proto, gfp_t prio, int kern)

{

struct sock *sk;

sk = bt_sock_alloc(net, sock, &iso_proto, proto, prio, kern);

if (!sk)

return NULL;

sk->sk_destruct = iso_sock_destruct;

sk->sk_sndtimeo = ISO_CONN_TIMEOUT;

/* Set address type as public as default src address is BDADDR_ANY */

iso_pi(sk)->src_type = BDADDR_LE_PUBLIC;

iso_pi(sk)->qos = default_qos;

iso_pi(sk)->sync_handle = -1;

bt_sock_link(&iso_sk_list, sk);

return sk;

}

static int iso_sock_create(struct net *net, struct socket *sock, int protocol,

int kern)

{

struct sock *sk;

BT_DBG("sock %p", sock);

sock->state = SS_UNCONNECTED;

if (sock->type != SOCK_SEQPACKET)

return -ESOCKTNOSUPPORT;

sock->ops = &iso_sock_ops;

sk = iso_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);

if (!sk)

return -ENOMEM;

iso_sock_init(sk, NULL);

return 0;

}

static int iso_sock_bind_bc(struct socket *sock, struct sockaddr_unsized *addr,

int addr_len)

{

struct sockaddr_iso *sa = (struct sockaddr_iso *)addr;

struct sock *sk = sock->sk;

int i;

BT_DBG("sk %p bc_sid %u bc_num_bis %u", sk, sa->iso_bc->bc_sid,

sa->iso_bc->bc_num_bis);

if (addr_len != sizeof(*sa) + sizeof(*sa->iso_bc))

return -EINVAL;

bacpy(&iso_pi(sk)->dst, &sa->iso_bc->bc_bdaddr);

/* Check if the address type is of LE type */

if (!bdaddr_type_is_le(sa->iso_bc->bc_bdaddr_type))

return -EINVAL;

iso_pi(sk)->dst_type = sa->iso_bc->bc_bdaddr_type;

if (sa->iso_bc->bc_sid > 0x0f && sa->iso_bc->bc_sid != HCI_SID_INVALID)

return -EINVAL;

iso_pi(sk)->bc_sid = sa->iso_bc->bc_sid;

if (sa->iso_bc->bc_num_bis > ISO_MAX_NUM_BIS)

return -EINVAL;

iso_pi(sk)->bc_num_bis = sa->iso_bc->bc_num_bis;

for (i = 0; i < iso_pi(sk)->bc_num_bis; i++)

if (sa->iso_bc->bc_bis[i] < 0x01 ||

sa->iso_bc->bc_bis[i] > 0x1f)

return -EINVAL;