iso.c

   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * BlueZ - Bluetooth protocol stack for Linux
   4 *
   5 * Copyright (C) 2022 Intel Corporation
   6 * Copyright 2023-2024 NXP
   7 */
   8
   9#include <linux/module.h>
  10#include <linux/debugfs.h>
  11#include <linux/seq_file.h>
  12#include <linux/sched/signal.h>
  13
  14#include <net/bluetooth/bluetooth.h>
  15#include <net/bluetooth/hci_core.h>
  16#include <net/bluetooth/iso.h>
  17#include "eir.h"
  18
  19static const struct proto_ops iso_sock_ops;
  20
  21static struct bt_sock_list iso_sk_list = {
  22	.lock = __RW_LOCK_UNLOCKED(iso_sk_list.lock)
  23};
  24
  25/* ---- ISO connections ---- */
  26struct iso_conn {
  27	struct hci_conn	*hcon;
  28
  29	/* @lock: spinlock protecting changes to iso_conn fields */
  30	spinlock_t	lock;
  31	struct sock	*sk;
  32
  33	struct delayed_work	timeout_work;
  34
  35	struct sk_buff	*rx_skb;
  36	__u32		rx_len;
  37	__u16		tx_sn;
  38	struct kref	ref;
  39};
  40
  41#define iso_conn_lock(c)	spin_lock(&(c)->lock)
  42#define iso_conn_unlock(c)	spin_unlock(&(c)->lock)
  43
  44static void iso_sock_close(struct sock *sk);
  45static void iso_sock_kill(struct sock *sk);
  46
  47/* ----- ISO socket info ----- */
  48#define iso_pi(sk) ((struct iso_pinfo *)sk)
  49
  50#define EIR_SERVICE_DATA_LENGTH 4
  51#define BASE_MAX_LENGTH (HCI_MAX_PER_AD_LENGTH - EIR_SERVICE_DATA_LENGTH)
  52#define EIR_BAA_SERVICE_UUID	0x1851
  53
  54/* iso_pinfo flags values */
  55enum {
  56	BT_SK_BIG_SYNC,
  57	BT_SK_PA_SYNC,
  58};
  59
  60struct iso_pinfo {
  61	struct bt_sock		bt;
  62	bdaddr_t		src;
  63	__u8			src_type;
  64	bdaddr_t		dst;
  65	__u8			dst_type;
  66	__u8			bc_sid;
  67	__u8			bc_num_bis;
  68	__u8			bc_bis[ISO_MAX_NUM_BIS];
  69	__u16			sync_handle;
  70	unsigned long		flags;
  71	struct bt_iso_qos	qos;
  72	bool			qos_user_set;
  73	__u8			base_len;
  74	__u8			base[BASE_MAX_LENGTH];
  75	struct iso_conn		*conn;
  76};
  77
  78static struct bt_iso_qos default_qos;
  79
  80static bool check_ucast_qos(struct bt_iso_qos *qos);
  81static bool check_bcast_qos(struct bt_iso_qos *qos);
  82static bool iso_match_sid(struct sock *sk, void *data);
  83static bool iso_match_sid_past(struct sock *sk, void *data);
  84static bool iso_match_sync_handle(struct sock *sk, void *data);
  85static bool iso_match_sync_handle_pa_report(struct sock *sk, void *data);
  86static void iso_sock_disconn(struct sock *sk);
  87
  88typedef bool (*iso_sock_match_t)(struct sock *sk, void *data);
  89
  90static struct sock *iso_get_sock(struct hci_dev *hdev, bdaddr_t *src,
  91				 bdaddr_t *dst, enum bt_sock_state state,
  92				 iso_sock_match_t match, void *data);
  93
  94/* ---- ISO timers ---- */
  95#define ISO_CONN_TIMEOUT	secs_to_jiffies(20)
  96#define ISO_DISCONN_TIMEOUT	secs_to_jiffies(2)
  97
  98static void iso_conn_free(struct kref *ref)
  99{
 100	struct iso_conn *conn = container_of(ref, struct iso_conn, ref);
 101
 102	BT_DBG("conn %p", conn);
 103
 104	if (conn->sk)
 105		iso_pi(conn->sk)->conn = NULL;
 106
 107	if (conn->hcon) {
 108		conn->hcon->iso_data = NULL;
 109		hci_conn_drop(conn->hcon);
 110	}
 111
 112	/* Ensure no more work items will run since hci_conn has been dropped */
 113	disable_delayed_work_sync(&conn->timeout_work);
 114
 115	kfree_skb(conn->rx_skb);
 116
 117	kfree(conn);
 118}
 119
 120static void iso_conn_put(struct iso_conn *conn)
 121{
 122	if (!conn)
 123		return;
 124
 125	BT_DBG("conn %p refcnt %d", conn, kref_read(&conn->ref));
 126
 127	kref_put(&conn->ref, iso_conn_free);
 128}
 129
 130static struct iso_conn *iso_conn_hold_unless_zero(struct iso_conn *conn)
 131{
 132	if (!conn)
 133		return NULL;
 134
 135	BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref));
 136
 137	if (!kref_get_unless_zero(&conn->ref))
 138		return NULL;
 139
 140	return conn;
 141}
 142
 143static struct sock *iso_sock_hold(struct iso_conn *conn)
 144{
 145	if (!conn || !bt_sock_linked(&iso_sk_list, conn->sk))
 146		return NULL;
 147
 148	sock_hold(conn->sk);
 149
 150	return conn->sk;
 151}
 152
 153static void iso_sock_timeout(struct work_struct *work)
 154{
 155	struct iso_conn *conn = container_of(work, struct iso_conn,
 156					     timeout_work.work);
 157	struct sock *sk;
 158
 159	conn = iso_conn_hold_unless_zero(conn);
 160	if (!conn)
 161		return;
 162
 163	iso_conn_lock(conn);
 164	sk = iso_sock_hold(conn);
 165	iso_conn_unlock(conn);
 166	iso_conn_put(conn);
 167
 168	if (!sk)
 169		return;
 170
 171	BT_DBG("sock %p state %d", sk, sk->sk_state);
 172
 173	lock_sock(sk);
 174	sk->sk_err = ETIMEDOUT;
 175	sk->sk_state_change(sk);
 176	release_sock(sk);
 177	sock_put(sk);
 178}
 179
 180static void iso_sock_set_timer(struct sock *sk, long timeout)
 181{
 182	if (!iso_pi(sk)->conn)
 183		return;
 184
 185	BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
 186	cancel_delayed_work(&iso_pi(sk)->conn->timeout_work);
 187	schedule_delayed_work(&iso_pi(sk)->conn->timeout_work, timeout);
 188}
 189
 190static void iso_sock_clear_timer(struct sock *sk)
 191{
 192	if (!iso_pi(sk)->conn)
 193		return;
 194
 195	BT_DBG("sock %p state %d", sk, sk->sk_state);
 196	cancel_delayed_work(&iso_pi(sk)->conn->timeout_work);
 197}
 198
 199/* ---- ISO connections ---- */
 200static struct iso_conn *iso_conn_add(struct hci_conn *hcon)
 201{
 202	struct iso_conn *conn = hcon->iso_data;
 203
 204	conn = iso_conn_hold_unless_zero(conn);
 205	if (conn) {
 206		if (!conn->hcon) {
 207			iso_conn_lock(conn);
 208			conn->hcon = hcon;
 209			iso_conn_unlock(conn);
 210		}
 211		iso_conn_put(conn);
 212		return conn;
 213	}
 214
 215	conn = kzalloc(sizeof(*conn), GFP_KERNEL);
 216	if (!conn)
 217		return NULL;
 218
 219	kref_init(&conn->ref);
 220	spin_lock_init(&conn->lock);
 221	INIT_DELAYED_WORK(&conn->timeout_work, iso_sock_timeout);
 222
 223	hcon->iso_data = conn;
 224	conn->hcon = hcon;
 225	conn->tx_sn = 0;
 226
 227	BT_DBG("hcon %p conn %p", hcon, conn);
 228
 229	return conn;
 230}
 231
 232/* Delete channel. Must be called on the locked socket. */
 233static void iso_chan_del(struct sock *sk, int err)
 234{
 235	struct iso_conn *conn;
 236	struct sock *parent;
 237
 238	conn = iso_pi(sk)->conn;
 239	iso_pi(sk)->conn = NULL;
 240
 241	BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
 242
 243	if (conn) {
 244		iso_conn_lock(conn);
 245		conn->sk = NULL;
 246		iso_conn_unlock(conn);
 247		iso_conn_put(conn);
 248	}
 249
 250	sk->sk_state = BT_CLOSED;
 251	sk->sk_err   = err;
 252
 253	parent = bt_sk(sk)->parent;
 254	if (parent) {
 255		bt_accept_unlink(sk);
 256		parent->sk_data_ready(parent);
 257	} else {
 258		sk->sk_state_change(sk);
 259	}
 260
 261	sock_set_flag(sk, SOCK_ZAPPED);
 262}
 263
 264static void iso_conn_del(struct hci_conn *hcon, int err)
 265{
 266	struct iso_conn *conn = hcon->iso_data;
 267	struct sock *sk;
 268
 269	conn = iso_conn_hold_unless_zero(conn);
 270	if (!conn)
 271		return;
 272
 273	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 274
 275	/* Kill socket */
 276	iso_conn_lock(conn);
 277	sk = iso_sock_hold(conn);
 278	iso_conn_unlock(conn);
 279	iso_conn_put(conn);
 280
 281	if (!sk) {
 282		iso_conn_put(conn);
 283		return;
 284	}
 285
 286	lock_sock(sk);
 287	iso_sock_clear_timer(sk);
 288	iso_chan_del(sk, err);
 289	release_sock(sk);
 290	sock_put(sk);
 291}
 292
 293static int __iso_chan_add(struct iso_conn *conn, struct sock *sk,
 294			  struct sock *parent)
 295{
 296	BT_DBG("conn %p", conn);
 297
 298	if (iso_pi(sk)->conn == conn && conn->sk == sk)
 299		return 0;
 300
 301	if (conn->sk) {
 302		BT_ERR("conn->sk already set");
 303		return -EBUSY;
 304	}
 305
 306	iso_pi(sk)->conn = conn;
 307	conn->sk = sk;
 308
 309	if (parent)
 310		bt_accept_enqueue(parent, sk, true);
 311
 312	return 0;
 313}
 314
 315static int iso_chan_add(struct iso_conn *conn, struct sock *sk,
 316			struct sock *parent)
 317{
 318	int err;
 319
 320	iso_conn_lock(conn);
 321	err = __iso_chan_add(conn, sk, parent);
 322	iso_conn_unlock(conn);
 323
 324	return err;
 325}
 326
 327static inline u8 le_addr_type(u8 bdaddr_type)
 328{
 329	if (bdaddr_type == BDADDR_LE_PUBLIC)
 330		return ADDR_LE_DEV_PUBLIC;
 331	else
 332		return ADDR_LE_DEV_RANDOM;
 333}
 334
 335static int iso_connect_bis(struct sock *sk)
 336{
 337	struct iso_conn *conn;
 338	struct hci_conn *hcon;
 339	struct hci_dev  *hdev;
 340	int err;
 341
 342	BT_DBG("%pMR (SID 0x%2.2x)", &iso_pi(sk)->src, iso_pi(sk)->bc_sid);
 343
 344	hdev = hci_get_route(&iso_pi(sk)->dst, &iso_pi(sk)->src,
 345			     iso_pi(sk)->src_type);
 346	if (!hdev)
 347		return -EHOSTUNREACH;
 348
 349	hci_dev_lock(hdev);
 350
 351	if (!bis_capable(hdev)) {
 352		err = -EOPNOTSUPP;
 353		goto unlock;
 354	}
 355
 356	/* Fail if user set invalid QoS */
 357	if (iso_pi(sk)->qos_user_set && !check_bcast_qos(&iso_pi(sk)->qos)) {
 358		iso_pi(sk)->qos = default_qos;
 359		err = -EINVAL;
 360		goto unlock;
 361	}
 362
 363	/* Fail if out PHYs are marked as disabled */
 364	if (!iso_pi(sk)->qos.bcast.out.phy) {
 365		err = -EINVAL;
 366		goto unlock;
 367	}
 368
 369	/* Just bind if DEFER_SETUP has been set */
 370	if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
 371		hcon = hci_bind_bis(hdev, &iso_pi(sk)->dst, iso_pi(sk)->bc_sid,
 372				    &iso_pi(sk)->qos, iso_pi(sk)->base_len,
 373				    iso_pi(sk)->base,
 374				    READ_ONCE(sk->sk_sndtimeo));
 375		if (IS_ERR(hcon)) {
 376			err = PTR_ERR(hcon);
 377			goto unlock;
 378		}
 379	} else {
 380		hcon = hci_connect_bis(hdev, &iso_pi(sk)->dst,
 381				       le_addr_type(iso_pi(sk)->dst_type),
 382				       iso_pi(sk)->bc_sid, &iso_pi(sk)->qos,
 383				       iso_pi(sk)->base_len, iso_pi(sk)->base,
 384				       READ_ONCE(sk->sk_sndtimeo));
 385		if (IS_ERR(hcon)) {
 386			err = PTR_ERR(hcon);
 387			goto unlock;
 388		}
 389
 390		/* Update SID if it was not set */
 391		if (iso_pi(sk)->bc_sid == HCI_SID_INVALID)
 392			iso_pi(sk)->bc_sid = hcon->sid;
 393	}
 394
 395	conn = iso_conn_add(hcon);
 396	if (!conn) {
 397		hci_conn_drop(hcon);
 398		err = -ENOMEM;
 399		goto unlock;
 400	}
 401
 402	lock_sock(sk);
 403
 404	err = iso_chan_add(conn, sk, NULL);
 405	if (err) {
 406		release_sock(sk);
 407		goto unlock;
 408	}
 409
 410	/* Update source addr of the socket */
 411	bacpy(&iso_pi(sk)->src, &hcon->src);
 412
 413	if (hcon->state == BT_CONNECTED) {
 414		iso_sock_clear_timer(sk);
 415		sk->sk_state = BT_CONNECTED;
 416	} else if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
 417		iso_sock_clear_timer(sk);
 418		sk->sk_state = BT_CONNECT;
 419	} else {
 420		sk->sk_state = BT_CONNECT;
 421		iso_sock_set_timer(sk, READ_ONCE(sk->sk_sndtimeo));
 422	}
 423
 424	release_sock(sk);
 425
 426unlock:
 427	hci_dev_unlock(hdev);
 428	hci_dev_put(hdev);
 429	return err;
 430}
 431
 432static int iso_connect_cis(struct sock *sk)
 433{
 434	struct iso_conn *conn;
 435	struct hci_conn *hcon;
 436	struct hci_dev  *hdev;
 437	int err;
 438
 439	BT_DBG("%pMR -> %pMR", &iso_pi(sk)->src, &iso_pi(sk)->dst);
 440
 441	hdev = hci_get_route(&iso_pi(sk)->dst, &iso_pi(sk)->src,
 442			     iso_pi(sk)->src_type);
 443	if (!hdev)
 444		return -EHOSTUNREACH;
 445
 446	hci_dev_lock(hdev);
 447
 448	if (!cis_central_capable(hdev)) {
 449		err = -EOPNOTSUPP;
 450		goto unlock;
 451	}
 452
 453	/* Fail if user set invalid QoS */
 454	if (iso_pi(sk)->qos_user_set && !check_ucast_qos(&iso_pi(sk)->qos)) {
 455		iso_pi(sk)->qos = default_qos;
 456		err = -EINVAL;
 457		goto unlock;
 458	}
 459
 460	/* Fail if either PHYs are marked as disabled */
 461	if (!iso_pi(sk)->qos.ucast.in.phy && !iso_pi(sk)->qos.ucast.out.phy) {
 462		err = -EINVAL;
 463		goto unlock;
 464	}
 465
 466	/* Check if there are available buffers for output/TX. */
 467	if (iso_pi(sk)->qos.ucast.out.sdu && !hci_iso_count(hdev) &&
 468	    (hdev->iso_pkts && !hdev->iso_cnt)) {
 469		err = -ENOBUFS;
 470		goto unlock;
 471	}
 472
 473	/* Just bind if DEFER_SETUP has been set */
 474	if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
 475		hcon = hci_bind_cis(hdev, &iso_pi(sk)->dst,
 476				    le_addr_type(iso_pi(sk)->dst_type),
 477				    &iso_pi(sk)->qos,
 478				    READ_ONCE(sk->sk_sndtimeo));
 479		if (IS_ERR(hcon)) {
 480			err = PTR_ERR(hcon);
 481			goto unlock;
 482		}
 483	} else {
 484		hcon = hci_connect_cis(hdev, &iso_pi(sk)->dst,
 485				       le_addr_type(iso_pi(sk)->dst_type),
 486				       &iso_pi(sk)->qos,
 487				       READ_ONCE(sk->sk_sndtimeo));
 488		if (IS_ERR(hcon)) {
 489			err = PTR_ERR(hcon);
 490			goto unlock;
 491		}
 492	}
 493
 494	conn = iso_conn_add(hcon);
 495	if (!conn) {
 496		hci_conn_drop(hcon);
 497		err = -ENOMEM;
 498		goto unlock;
 499	}
 500
 501	lock_sock(sk);
 502
 503	err = iso_chan_add(conn, sk, NULL);
 504	if (err) {
 505		release_sock(sk);
 506		goto unlock;
 507	}
 508
 509	/* Update source addr of the socket */
 510	bacpy(&iso_pi(sk)->src, &hcon->src);
 511
 512	if (hcon->state == BT_CONNECTED) {
 513		iso_sock_clear_timer(sk);
 514		sk->sk_state = BT_CONNECTED;
 515	} else if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
 516		iso_sock_clear_timer(sk);
 517		sk->sk_state = BT_CONNECT;
 518	} else {
 519		sk->sk_state = BT_CONNECT;
 520		iso_sock_set_timer(sk, READ_ONCE(sk->sk_sndtimeo));
 521	}
 522
 523	release_sock(sk);
 524
 525unlock:
 526	hci_dev_unlock(hdev);
 527	hci_dev_put(hdev);
 528	return err;
 529}
 530
 531static struct bt_iso_qos *iso_sock_get_qos(struct sock *sk)
 532{
 533	if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONNECT2)
 534		return &iso_pi(sk)->conn->hcon->iso_qos;
 535
 536	return &iso_pi(sk)->qos;
 537}
 538
 539static int iso_send_frame(struct sock *sk, struct sk_buff *skb,
 540			  const struct sockcm_cookie *sockc)
 541{
 542	struct iso_conn *conn = iso_pi(sk)->conn;
 543	struct bt_iso_qos *qos = iso_sock_get_qos(sk);
 544	struct hci_iso_data_hdr *hdr;
 545	int len = 0;
 546
 547	BT_DBG("sk %p len %d", sk, skb->len);
 548
 549	if (skb->len > qos->ucast.out.sdu)
 550		return -EMSGSIZE;
 551
 552	len = skb->len;
 553
 554	/* Push ISO data header */
 555	hdr = skb_push(skb, HCI_ISO_DATA_HDR_SIZE);
 556	hdr->sn = cpu_to_le16(conn->tx_sn++);
 557	hdr->slen = cpu_to_le16(hci_iso_data_len_pack(len,
 558						      HCI_ISO_STATUS_VALID));
 559
 560	if (sk->sk_state == BT_CONNECTED) {
 561		hci_setup_tx_timestamp(skb, 1, sockc);
 562		hci_send_iso(conn->hcon, skb);
 563	} else {
 564		len = -ENOTCONN;
 565	}
 566
 567	return len;
 568}
 569
 570static void iso_recv_frame(struct iso_conn *conn, struct sk_buff *skb)
 571{
 572	struct sock *sk;
 573
 574	iso_conn_lock(conn);
 575	sk = conn->sk;
 576	iso_conn_unlock(conn);
 577
 578	if (!sk)
 579		goto drop;
 580
 581	BT_DBG("sk %p len %d", sk, skb->len);
 582
 583	if (sk->sk_state != BT_CONNECTED)
 584		goto drop;
 585
 586	if (!sock_queue_rcv_skb(sk, skb))
 587		return;
 588
 589drop:
 590	kfree_skb(skb);
 591}
 592
 593/* -------- Socket interface ---------- */
 594static struct sock *__iso_get_sock_listen_by_addr(bdaddr_t *src, bdaddr_t *dst)
 595{
 596	struct sock *sk;
 597
 598	sk_for_each(sk, &iso_sk_list.head) {
 599		if (sk->sk_state != BT_LISTEN)
 600			continue;
 601
 602		if (bacmp(&iso_pi(sk)->dst, dst))
 603			continue;
 604
 605		if (!bacmp(&iso_pi(sk)->src, src))
 606			return sk;
 607	}
 608
 609	return NULL;
 610}
 611
 612static struct sock *__iso_get_sock_listen_by_sid(bdaddr_t *ba, bdaddr_t *bc,
 613						 __u8 sid)
 614{
 615	struct sock *sk;
 616
 617	sk_for_each(sk, &iso_sk_list.head) {
 618		if (sk->sk_state != BT_LISTEN)
 619			continue;
 620
 621		if (bacmp(&iso_pi(sk)->src, ba))
 622			continue;
 623
 624		if (bacmp(&iso_pi(sk)->dst, bc))
 625			continue;
 626
 627		if (iso_pi(sk)->bc_sid == sid)
 628			return sk;
 629	}
 630
 631	return NULL;
 632}
 633
 634/* Find socket in given state:
 635 * source bdaddr (Unicast)
 636 * destination bdaddr (Broadcast only)
 637 * match func - pass NULL to ignore
 638 * match func data - pass -1 to ignore
 639 * Returns closest match.
 640 */
 641static struct sock *iso_get_sock(struct hci_dev *hdev, bdaddr_t *src,
 642				 bdaddr_t *dst, enum bt_sock_state state,
 643				 iso_sock_match_t match, void *data)
 644{
 645	struct sock *sk = NULL, *sk1 = NULL;
 646
 647	read_lock(&iso_sk_list.lock);
 648
 649	sk_for_each(sk, &iso_sk_list.head) {
 650		if (sk->sk_state != state)
 651			continue;
 652
 653		/* Match Broadcast destination */
 654		if (bacmp(dst, BDADDR_ANY) && bacmp(&iso_pi(sk)->dst, dst)) {
 655			struct smp_irk *irk1, *irk2;
 656
 657			/* Check if destination is an RPA that we can resolve */
 658			irk1 = hci_find_irk_by_rpa(hdev, dst);
 659			if (!irk1)
 660				continue;
 661
 662			/* Match with identity address */
 663			if (bacmp(&iso_pi(sk)->dst, &irk1->bdaddr)) {
 664				/* Check if socket destination address is also
 665				 * an RPA and if the IRK matches.
 666				 */
 667				irk2 = hci_find_irk_by_rpa(hdev,
 668							   &iso_pi(sk)->dst);
 669				if (!irk2 || irk1 != irk2)
 670					continue;
 671			}
 672		}
 673
 674		/* Use Match function if provided */
 675		if (match && !match(sk, data))
 676			continue;
 677
 678		/* Exact match. */
 679		if (!bacmp(&iso_pi(sk)->src, src)) {
 680			sock_hold(sk);
 681			break;
 682		}
 683
 684		/* Closest match */
 685		if (!bacmp(&iso_pi(sk)->src, BDADDR_ANY)) {
 686			if (sk1)
 687				sock_put(sk1);
 688
 689			sk1 = sk;
 690			sock_hold(sk1);
 691		}
 692	}
 693
 694	if (sk && sk1)
 695		sock_put(sk1);
 696
 697	read_unlock(&iso_sk_list.lock);
 698
 699	return sk ? sk : sk1;
 700}
 701
 702static struct sock *iso_get_sock_big(struct sock *match_sk, bdaddr_t *src,
 703				     bdaddr_t *dst, uint8_t big)
 704{
 705	struct sock *sk = NULL;
 706
 707	read_lock(&iso_sk_list.lock);
 708
 709	sk_for_each(sk, &iso_sk_list.head) {
 710		if (match_sk == sk)
 711			continue;
 712
 713		/* Look for sockets that have already been
 714		 * connected to the BIG
 715		 */
 716		if (sk->sk_state != BT_CONNECTED &&
 717		    sk->sk_state != BT_CONNECT)
 718			continue;
 719
 720		/* Match Broadcast destination */
 721		if (bacmp(&iso_pi(sk)->dst, dst))
 722			continue;
 723
 724		/* Match BIG handle */
 725		if (iso_pi(sk)->qos.bcast.big != big)
 726			continue;
 727
 728		/* Match source address */
 729		if (bacmp(&iso_pi(sk)->src, src))
 730			continue;
 731
 732		sock_hold(sk);
 733		break;
 734	}
 735
 736	read_unlock(&iso_sk_list.lock);
 737
 738	return sk;
 739}
 740
 741static void iso_sock_destruct(struct sock *sk)
 742{
 743	BT_DBG("sk %p", sk);
 744
 745	iso_conn_put(iso_pi(sk)->conn);
 746
 747	skb_queue_purge(&sk->sk_receive_queue);
 748	skb_queue_purge(&sk->sk_write_queue);
 749	skb_queue_purge(&sk->sk_error_queue);
 750}
 751
 752static void iso_sock_cleanup_listen(struct sock *parent)
 753{
 754	struct sock *sk;
 755
 756	BT_DBG("parent %p", parent);
 757
 758	/* Close not yet accepted channels */
 759	while ((sk = bt_accept_dequeue(parent, NULL))) {
 760		iso_sock_close(sk);
 761		iso_sock_kill(sk);
 762	}
 763
 764	/* If listening socket has a hcon, properly disconnect it */
 765	if (iso_pi(parent)->conn && iso_pi(parent)->conn->hcon) {
 766		iso_sock_disconn(parent);
 767		return;
 768	}
 769
 770	parent->sk_state  = BT_CLOSED;
 771	sock_set_flag(parent, SOCK_ZAPPED);
 772}
 773
 774/* Kill socket (only if zapped and orphan)
 775 * Must be called on unlocked socket.
 776 */
 777static void iso_sock_kill(struct sock *sk)
 778{
 779	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket ||
 780	    sock_flag(sk, SOCK_DEAD))
 781		return;
 782
 783	BT_DBG("sk %p state %d", sk, sk->sk_state);
 784
 785	/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
 786	if (iso_pi(sk)->conn) {
 787		iso_conn_lock(iso_pi(sk)->conn);
 788		iso_pi(sk)->conn->sk = NULL;
 789		iso_conn_unlock(iso_pi(sk)->conn);
 790	}
 791
 792	/* Kill poor orphan */
 793	bt_sock_unlink(&iso_sk_list, sk);
 794	sock_set_flag(sk, SOCK_DEAD);
 795	sock_put(sk);
 796}
 797
 798static void iso_sock_disconn(struct sock *sk)
 799{
 800	struct sock *bis_sk;
 801	struct hci_conn *hcon = iso_pi(sk)->conn->hcon;
 802
 803	if (test_bit(HCI_CONN_BIG_CREATED, &hcon->flags)) {
 804		bis_sk = iso_get_sock_big(sk, &iso_pi(sk)->src,
 805					  &iso_pi(sk)->dst,
 806					  iso_pi(sk)->qos.bcast.big);
 807
 808		/* If there are any other connected sockets for the
 809		 * same BIG, just delete the sk and leave the bis
 810		 * hcon active, in case later rebinding is needed.
 811		 */
 812		if (bis_sk) {
 813			hcon->state = BT_OPEN;
 814			hcon->iso_data = NULL;
 815			iso_pi(sk)->conn->hcon = NULL;
 816			iso_sock_clear_timer(sk);
 817			iso_chan_del(sk, bt_to_errno(hcon->abort_reason));
 818			sock_put(bis_sk);
 819			return;
 820		}
 821	}
 822
 823	sk->sk_state = BT_DISCONN;
 824	iso_conn_lock(iso_pi(sk)->conn);
 825	hci_conn_drop(iso_pi(sk)->conn->hcon);
 826	iso_pi(sk)->conn->hcon = NULL;
 827	iso_conn_unlock(iso_pi(sk)->conn);
 828}
 829
 830static void __iso_sock_close(struct sock *sk)
 831{
 832	BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 833
 834	switch (sk->sk_state) {
 835	case BT_LISTEN:
 836		iso_sock_cleanup_listen(sk);
 837		break;
 838
 839	case BT_CONNECT:
 840	case BT_CONNECTED:
 841	case BT_CONFIG:
 842		if (iso_pi(sk)->conn->hcon)
 843			iso_sock_disconn(sk);
 844		else
 845			iso_chan_del(sk, ECONNRESET);
 846		break;
 847
 848	case BT_CONNECT2:
 849		if (iso_pi(sk)->conn->hcon &&
 850		    (test_bit(HCI_CONN_PA_SYNC, &iso_pi(sk)->conn->hcon->flags) ||
 851		    test_bit(HCI_CONN_PA_SYNC_FAILED, &iso_pi(sk)->conn->hcon->flags)))
 852			iso_sock_disconn(sk);
 853		else
 854			iso_chan_del(sk, ECONNRESET);
 855		break;
 856	case BT_DISCONN:
 857		iso_chan_del(sk, ECONNRESET);
 858		break;
 859
 860	default:
 861		sock_set_flag(sk, SOCK_ZAPPED);
 862		break;
 863	}
 864}
 865
 866/* Must be called on unlocked socket. */
 867static void iso_sock_close(struct sock *sk)
 868{
 869	iso_sock_clear_timer(sk);
 870	lock_sock(sk);
 871	__iso_sock_close(sk);
 872	release_sock(sk);
 873	iso_sock_kill(sk);
 874}
 875
 876static void iso_sock_init(struct sock *sk, struct sock *parent)
 877{
 878	BT_DBG("sk %p", sk);
 879
 880	if (parent) {
 881		sk->sk_type = parent->sk_type;
 882		bt_sk(sk)->flags = bt_sk(parent)->flags;
 883		security_sk_clone(parent, sk);
 884	}
 885}
 886
 887static struct proto iso_proto = {
 888	.name		= "ISO",
 889	.owner		= THIS_MODULE,
 890	.obj_size	= sizeof(struct iso_pinfo)
 891};
 892
 893#define DEFAULT_IO_QOS \
 894{ \
 895	.interval	= 10000u, \
 896	.latency	= 10u, \
 897	.sdu		= 40u, \
 898	.phy		= BT_ISO_PHY_2M, \
 899	.rtn		= 2u, \
 900}
 901
 902static struct bt_iso_qos default_qos = {
 903	.bcast = {
 904		.big			= BT_ISO_QOS_BIG_UNSET,
 905		.bis			= BT_ISO_QOS_BIS_UNSET,
 906		.sync_factor		= 0x01,
 907		.packing		= 0x00,
 908		.framing		= 0x00,
 909		.in			= DEFAULT_IO_QOS,
 910		.out			= DEFAULT_IO_QOS,
 911		.encryption		= 0x00,
 912		.bcode			= {0x00},
 913		.options		= 0x00,
 914		.skip			= 0x0000,
 915		.sync_timeout		= BT_ISO_SYNC_TIMEOUT,
 916		.sync_cte_type		= 0x00,
 917		.mse			= 0x00,
 918		.timeout		= BT_ISO_SYNC_TIMEOUT,
 919	},
 920};
 921
 922static struct sock *iso_sock_alloc(struct net *net, struct socket *sock,
 923				   int proto, gfp_t prio, int kern)
 924{
 925	struct sock *sk;
 926
 927	sk = bt_sock_alloc(net, sock, &iso_proto, proto, prio, kern);
 928	if (!sk)
 929		return NULL;
 930
 931	sk->sk_destruct = iso_sock_destruct;
 932	sk->sk_sndtimeo = ISO_CONN_TIMEOUT;
 933
 934	/* Set address type as public as default src address is BDADDR_ANY */
 935	iso_pi(sk)->src_type = BDADDR_LE_PUBLIC;
 936
 937	iso_pi(sk)->qos = default_qos;
 938	iso_pi(sk)->sync_handle = -1;
 939
 940	bt_sock_link(&iso_sk_list, sk);
 941	return sk;
 942}
 943
 944static int iso_sock_create(struct net *net, struct socket *sock, int protocol,
 945			   int kern)
 946{
 947	struct sock *sk;
 948
 949	BT_DBG("sock %p", sock);
 950
 951	sock->state = SS_UNCONNECTED;
 952
 953	if (sock->type != SOCK_SEQPACKET)
 954		return -ESOCKTNOSUPPORT;
 955
 956	sock->ops = &iso_sock_ops;
 957
 958	sk = iso_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
 959	if (!sk)
 960		return -ENOMEM;
 961
 962	iso_sock_init(sk, NULL);
 963	return 0;
 964}
 965
 966static int iso_sock_bind_bc(struct socket *sock, struct sockaddr_unsized *addr,
 967			    int addr_len)
 968{
 969	struct sockaddr_iso *sa = (struct sockaddr_iso *)addr;
 970	struct sock *sk = sock->sk;
 971	int i;
 972
 973	BT_DBG("sk %p bc_sid %u bc_num_bis %u", sk, sa->iso_bc->bc_sid,
 974	       sa->iso_bc->bc_num_bis);
 975
 976	if (addr_len != sizeof(*sa) + sizeof(*sa->iso_bc))
 977		return -EINVAL;
 978
 979	bacpy(&iso_pi(sk)->dst, &sa->iso_bc->bc_bdaddr);
 980
 981	/* Check if the address type is of LE type */
 982	if (!bdaddr_type_is_le(sa->iso_bc->bc_bdaddr_type))
 983		return -EINVAL;
 984
 985	iso_pi(sk)->dst_type = sa->iso_bc->bc_bdaddr_type;
 986
 987	if (sa->iso_bc->bc_sid > 0x0f && sa->iso_bc->bc_sid != HCI_SID_INVALID)
 988		return -EINVAL;
 989
 990	iso_pi(sk)->bc_sid = sa->iso_bc->bc_sid;
 991
 992	if (sa->iso_bc->bc_num_bis > ISO_MAX_NUM_BIS)
 993		return -EINVAL;
 994
 995	iso_pi(sk)->bc_num_bis = sa->iso_bc->bc_num_bis;
 996
 997	for (i = 0; i < iso_pi(sk)->bc_num_bis; i++)
 998		if (sa->iso_bc->bc_bis[i] < 0x01 ||
 999		    sa->iso_bc->bc_bis[i] > 0x1f)
1000			return -EINVAL;
1001
1002	memcpy(iso_pi(sk)->bc_bis, sa->iso_bc->bc_bis,
1003	       iso_pi(sk)->bc_num_bis);
1004
1005	return 0;
1006}
1007
1008/* Must be called on the locked socket. */
1009static int iso_sock_rebind_bis(struct sock *sk, struct sockaddr_iso *sa,
1010			       int addr_len)
1011{
1012	int err = 0;
1013
1014	if (!test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags))
1015		return -EBADFD;
1016
1017	if (sa->iso_bc->bc_num_bis > ISO_MAX_NUM_BIS) {
1018		err = -EINVAL;
1019		goto done;
1020	}
1021
1022	iso_pi(sk)->bc_num_bis = sa->iso_bc->bc_num_bis;
1023
1024	for (int i = 0; i < iso_pi(sk)->bc_num_bis; i++)
1025		if (sa->iso_bc->bc_bis[i] < 0x01 ||
1026		    sa->iso_bc->bc_bis[i] > 0x1f) {
1027			err = -EINVAL;
1028			goto done;
1029		}
1030
1031	memcpy(iso_pi(sk)->bc_bis, sa->iso_bc->bc_bis,
1032	       iso_pi(sk)->bc_num_bis);
1033
1034done:
1035	return err;
1036}
1037
1038static struct hci_dev *iso_conn_get_hdev(struct iso_conn *conn)
1039{
1040	struct hci_dev *hdev = NULL;
1041
1042	iso_conn_lock(conn);
1043	if (conn->hcon)
1044		hdev = hci_dev_hold(conn->hcon->hdev);
1045	iso_conn_unlock(conn);
1046
1047	return hdev;
1048}
1049
1050/* Must be called on the locked socket. */
1051static int iso_sock_rebind_bc(struct sock *sk, struct sockaddr_iso *sa,
1052			      int addr_len)
1053{
1054	struct hci_dev *hdev;
1055	struct hci_conn *bis;
1056	int err;
1057
1058	if (sk->sk_type != SOCK_SEQPACKET || !iso_pi(sk)->conn)
1059		return -EINVAL;
1060
1061	/* Check if it is really a Broadcast address being requested */
1062	if (addr_len != sizeof(*sa) + sizeof(*sa->iso_bc))
1063		return -EINVAL;
1064
1065	/* Check if the address hasn't changed then perhaps only the number of
1066	 * bis has changed.
1067	 */
1068	if (!bacmp(&iso_pi(sk)->dst, &sa->iso_bc->bc_bdaddr) ||
1069	    !bacmp(&sa->iso_bc->bc_bdaddr, BDADDR_ANY))
1070		return iso_sock_rebind_bis(sk, sa, addr_len);
1071
1072	/* Check if the address type is of LE type */
1073	if (!bdaddr_type_is_le(sa->iso_bc->bc_bdaddr_type))
1074		return -EINVAL;
1075
1076	hdev = iso_conn_get_hdev(iso_pi(sk)->conn);
1077	if (!hdev)
1078		return -EINVAL;
1079
1080	bis = iso_pi(sk)->conn->hcon;
1081
1082	/* Release the socket before lookups since that requires hci_dev_lock
1083	 * which shall not be acquired while holding sock_lock for proper
1084	 * ordering.
1085	 */
1086	release_sock(sk);
1087	hci_dev_lock(bis->hdev);
1088	lock_sock(sk);
1089
1090	if (!iso_pi(sk)->conn || iso_pi(sk)->conn->hcon != bis) {
1091		/* raced with iso_conn_del() or iso_disconn_sock() */
1092		err = -ENOTCONN;
1093		goto unlock;
1094	}
1095
1096	BT_DBG("sk %p %pMR type %u", sk, &sa->iso_bc->bc_bdaddr,
1097	       sa->iso_bc->bc_bdaddr_type);
1098
1099	err = hci_past_bis(bis, &sa->iso_bc->bc_bdaddr,
1100			   le_addr_type(sa->iso_bc->bc_bdaddr_type));
1101
1102unlock:
1103	hci_dev_unlock(hdev);
1104	hci_dev_put(hdev);
1105
1106	return err;
1107}
1108
1109static int iso_sock_bind(struct socket *sock, struct sockaddr_unsized *addr,
1110			 int addr_len)
1111{
1112	struct sockaddr_iso *sa = (struct sockaddr_iso *)addr;
1113	struct sock *sk = sock->sk;
1114	int err = 0;
1115
1116	BT_DBG("sk %p %pMR type %u", sk, &sa->iso_bdaddr, sa->iso_bdaddr_type);
1117
1118	if (!addr || addr_len < sizeof(struct sockaddr_iso) ||
1119	    addr->sa_family != AF_BLUETOOTH)
1120		return -EINVAL;
1121
1122	lock_sock(sk);
1123
1124	if ((sk->sk_state == BT_CONNECT2 || sk->sk_state == BT_CONNECTED) &&
1125	    addr_len > sizeof(*sa)) {
1126		/* Allow the user to rebind to a different address using
1127		 * PAST procedures.
1128		 */
1129		err = iso_sock_rebind_bc(sk, sa, addr_len);
1130		goto done;
1131	}
1132
1133	if (sk->sk_state != BT_OPEN) {
1134		err = -EBADFD;
1135		goto done;
1136	}
1137
1138	if (sk->sk_type != SOCK_SEQPACKET) {
1139		err = -EINVAL;
1140		goto done;
1141	}
1142
1143	/* Check if the address type is of LE type */
1144	if (!bdaddr_type_is_le(sa->iso_bdaddr_type)) {
1145		err = -EINVAL;
1146		goto done;
1147	}
1148
1149	bacpy(&iso_pi(sk)->src, &sa->iso_bdaddr);
1150	iso_pi(sk)->src_type = sa->iso_bdaddr_type;
1151
1152	/* Check for Broadcast address */
1153	if (addr_len > sizeof(*sa)) {
1154		err = iso_sock_bind_bc(sock, addr, addr_len);
1155		if (err)
1156			goto done;
1157	}
1158
1159	sk->sk_state = BT_BOUND;
1160
1161done:
1162	release_sock(sk);
1163	return err;
1164}
1165
1166static int iso_sock_connect(struct socket *sock, struct sockaddr_unsized *addr,
1167			    int alen, int flags)
1168{
1169	struct sockaddr_iso *sa = (struct sockaddr_iso *)addr;
1170	struct sock *sk = sock->sk;
1171	int err;
1172
1173	BT_DBG("sk %p", sk);
1174
1175	if (alen < sizeof(struct sockaddr_iso) ||
1176	    addr->sa_family != AF_BLUETOOTH)
1177		return -EINVAL;
1178
1179	if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
1180		return -EBADFD;
1181
1182	if (sk->sk_type != SOCK_SEQPACKET)
1183		return -EINVAL;
1184
1185	/* Check if the address type is of LE type */
1186	if (!bdaddr_type_is_le(sa->iso_bdaddr_type))
1187		return -EINVAL;
1188
1189	lock_sock(sk);
1190
1191	bacpy(&iso_pi(sk)->dst, &sa->iso_bdaddr);
1192	iso_pi(sk)->dst_type = sa->iso_bdaddr_type;
1193
1194	release_sock(sk);
1195
1196	if (bacmp(&iso_pi(sk)->dst, BDADDR_ANY))
1197		err = iso_connect_cis(sk);
1198	else
1199		err = iso_connect_bis(sk);
1200
1201	if (err)
1202		return err;
1203
1204	lock_sock(sk);
1205
1206	if (!test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
1207		err = bt_sock_wait_state(sk, BT_CONNECTED,
1208					 sock_sndtimeo(sk, flags & O_NONBLOCK));
1209	}
1210
1211	release_sock(sk);
1212	return err;
1213}
1214
1215static int iso_listen_bis(struct sock *sk)
1216{
1217	struct hci_dev *hdev;
1218	int err = 0;
1219	struct iso_conn *conn;
1220	struct hci_conn *hcon;
1221
1222	BT_DBG("%pMR -> %pMR (SID 0x%2.2x)", &iso_pi(sk)->src,
1223	       &iso_pi(sk)->dst, iso_pi(sk)->bc_sid);
1224
1225	write_lock(&iso_sk_list.lock);
1226
1227	if (__iso_get_sock_listen_by_sid(&iso_pi(sk)->src, &iso_pi(sk)->dst,
1228					 iso_pi(sk)->bc_sid))
1229		err = -EADDRINUSE;
1230
1231	write_unlock(&iso_sk_list.lock);
1232
1233	if (err)
1234		return err;
1235
1236	hdev = hci_get_route(&iso_pi(sk)->dst, &iso_pi(sk)->src,
1237			     iso_pi(sk)->src_type);
1238	if (!hdev)
1239		return -EHOSTUNREACH;
1240
1241	hci_dev_lock(hdev);
1242	lock_sock(sk);
1243
1244	/* Fail if user set invalid QoS */
1245	if (iso_pi(sk)->qos_user_set && !check_bcast_qos(&iso_pi(sk)->qos)) {
1246		iso_pi(sk)->qos = default_qos;
1247		err = -EINVAL;
1248		goto unlock;
1249	}
1250
1251	hcon = hci_pa_create_sync(hdev, &iso_pi(sk)->dst,
1252				  le_addr_type(iso_pi(sk)->dst_type),
1253				  iso_pi(sk)->bc_sid, &iso_pi(sk)->qos);
1254	if (IS_ERR(hcon)) {
1255		err = PTR_ERR(hcon);
1256		goto unlock;
1257	}
1258
1259	conn = iso_conn_add(hcon);
1260	if (!conn) {
1261		hci_conn_drop(hcon);
1262		err = -ENOMEM;
1263		goto unlock;
1264	}
1265
1266	err = iso_chan_add(conn, sk, NULL);
1267	if (err) {
1268		hci_conn_drop(hcon);
1269		goto unlock;
1270	}
1271
1272unlock:
1273	release_sock(sk);
1274	hci_dev_unlock(hdev);
1275	hci_dev_put(hdev);
1276	return err;
1277}
1278
1279static int iso_listen_cis(struct sock *sk)
1280{
1281	int err = 0;
1282
1283	BT_DBG("%pMR", &iso_pi(sk)->src);
1284
1285	write_lock(&iso_sk_list.lock);
1286
1287	if (__iso_get_sock_listen_by_addr(&iso_pi(sk)->src, &iso_pi(sk)->dst))
1288		err = -EADDRINUSE;
1289
1290	write_unlock(&iso_sk_list.lock);
1291
1292	return err;
1293}
1294
1295static int iso_sock_listen(struct socket *sock, int backlog)
1296{
1297	struct sock *sk = sock->sk;
1298	int err = 0;
1299
1300	BT_DBG("sk %p backlog %d", sk, backlog);
1301
1302	sock_hold(sk);
1303	lock_sock(sk);
1304
1305	if (sk->sk_state != BT_BOUND) {
1306		err = -EBADFD;
1307		goto done;
1308	}
1309
1310	if (sk->sk_type != SOCK_SEQPACKET) {
1311		err = -EINVAL;
1312		goto done;
1313	}
1314
1315	if (!bacmp(&iso_pi(sk)->dst, BDADDR_ANY)) {
1316		err = iso_listen_cis(sk);
1317	} else {
1318		/* Drop sock lock to avoid potential
1319		 * deadlock with the hdev lock.
1320		 */
1321		release_sock(sk);
1322		err = iso_listen_bis(sk);
1323		lock_sock(sk);
1324	}
1325
1326	if (err)
1327		goto done;
1328
1329	sk->sk_max_ack_backlog = backlog;
1330	sk->sk_ack_backlog = 0;
1331
1332	sk->sk_state = BT_LISTEN;
1333
1334done:
1335	release_sock(sk);
1336	sock_put(sk);
1337	return err;
1338}
1339
1340static int iso_sock_accept(struct socket *sock, struct socket *newsock,
1341			   struct proto_accept_arg *arg)
1342{
1343	DEFINE_WAIT_FUNC(wait, woken_wake_function);
1344	struct sock *sk = sock->sk, *ch;
1345	long timeo;
1346	int err = 0;
1347
1348	/* Use explicit nested locking to avoid lockdep warnings generated
1349	 * because the parent socket and the child socket are locked on the
1350	 * same thread.
1351	 */
1352	lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1353
1354	timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK);
1355
1356	BT_DBG("sk %p timeo %ld", sk, timeo);
1357
1358	/* Wait for an incoming connection. (wake-one). */
1359	add_wait_queue_exclusive(sk_sleep(sk), &wait);
1360	while (1) {
1361		if (sk->sk_state != BT_LISTEN) {
1362			err = -EBADFD;
1363			break;
1364		}
1365
1366		ch = bt_accept_dequeue(sk, newsock);
1367		if (ch)
1368			break;
1369
1370		if (!timeo) {
1371			err = -EAGAIN;
1372			break;
1373		}
1374
1375		if (signal_pending(current)) {
1376			err = sock_intr_errno(timeo);
1377			break;
1378		}
1379
1380		release_sock(sk);
1381
1382		timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
1383		lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1384	}
1385	remove_wait_queue(sk_sleep(sk), &wait);
1386
1387	if (err)
1388		goto done;
1389
1390	newsock->state = SS_CONNECTED;
1391
1392	BT_DBG("new socket %p", ch);
1393
1394	/* A Broadcast Sink might require BIG sync to be terminated
1395	 * and re-established multiple times, while keeping the same
1396	 * PA sync handle active. To allow this, once all BIS
1397	 * connections have been accepted on a PA sync parent socket,
1398	 * "reset" socket state, to allow future BIG re-sync procedures.
1399	 */
1400	if (test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) {
1401		/* Iterate through the list of bound BIS indices
1402		 * and clear each BIS as they are accepted by the
1403		 * user space, one by one.
1404		 */
1405		for (int i = 0; i < iso_pi(sk)->bc_num_bis; i++) {
1406			if (iso_pi(sk)->bc_bis[i] > 0) {
1407				iso_pi(sk)->bc_bis[i] = 0;
1408				iso_pi(sk)->bc_num_bis--;
1409				break;
1410			}
1411		}
1412
1413		if (iso_pi(sk)->bc_num_bis == 0) {
1414			/* Once the last BIS was accepted, reset parent
1415			 * socket parameters to mark that the listening
1416			 * process for BIS connections has been completed:
1417			 *
1418			 * 1. Reset the DEFER setup flag on the parent sk.
1419			 * 2. Clear the flag marking that the BIG create
1420			 *    sync command is pending.
1421			 * 3. Transition socket state from BT_LISTEN to
1422			 *    BT_CONNECTED.
1423			 */
1424			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
1425			clear_bit(BT_SK_BIG_SYNC, &iso_pi(sk)->flags);
1426			sk->sk_state = BT_CONNECTED;
1427		}
1428	}
1429
1430done:
1431	release_sock(sk);
1432	return err;
1433}
1434
1435static int iso_sock_getname(struct socket *sock, struct sockaddr *addr,
1436			    int peer)
1437{
1438	struct sockaddr_iso *sa = (struct sockaddr_iso *)addr;
1439	struct sock *sk = sock->sk;
1440	int len = sizeof(struct sockaddr_iso);
1441
1442	BT_DBG("sock %p, sk %p", sock, sk);
1443
1444	addr->sa_family = AF_BLUETOOTH;
1445
1446	if (peer) {
1447		struct hci_conn *hcon = iso_pi(sk)->conn ?
1448					iso_pi(sk)->conn->hcon : NULL;
1449
1450		bacpy(&sa->iso_bdaddr, &iso_pi(sk)->dst);
1451		sa->iso_bdaddr_type = iso_pi(sk)->dst_type;
1452
1453		if (hcon && (hcon->type == BIS_LINK || hcon->type == PA_LINK)) {
1454			sa->iso_bc->bc_sid = iso_pi(sk)->bc_sid;
1455			sa->iso_bc->bc_num_bis = iso_pi(sk)->bc_num_bis;
1456			memcpy(sa->iso_bc->bc_bis, iso_pi(sk)->bc_bis,
1457			       ISO_MAX_NUM_BIS);
1458			len += sizeof(struct sockaddr_iso_bc);
1459		}
1460	} else {
1461		bacpy(&sa->iso_bdaddr, &iso_pi(sk)->src);
1462		sa->iso_bdaddr_type = iso_pi(sk)->src_type;
1463	}
1464
1465	return len;
1466}
1467
1468static int iso_sock_sendmsg(struct socket *sock, struct msghdr *msg,
1469			    size_t len)
1470{
1471	struct sock *sk = sock->sk;
1472	struct sk_buff *skb, **frag;
1473	struct sockcm_cookie sockc;
1474	size_t mtu;
1475	int err;
1476
1477	BT_DBG("sock %p, sk %p", sock, sk);
1478
1479	err = sock_error(sk);
1480	if (err)
1481		return err;
1482
1483	if (msg->msg_flags & MSG_OOB)
1484		return -EOPNOTSUPP;
1485
1486	hci_sockcm_init(&sockc, sk);
1487
1488	if (msg->msg_controllen) {
1489		err = sock_cmsg_send(sk, msg, &sockc);
1490		if (err)
1491			return err;
1492	}
1493
1494	lock_sock(sk);
1495
1496	if (sk->sk_state != BT_CONNECTED) {
1497		release_sock(sk);
1498		return -ENOTCONN;
1499	}
1500
1501	mtu = iso_pi(sk)->conn->hcon->mtu;
1502
1503	release_sock(sk);
1504
1505	skb = bt_skb_sendmsg(sk, msg, len, mtu, HCI_ISO_DATA_HDR_SIZE, 0);
1506	if (IS_ERR(skb))
1507		return PTR_ERR(skb);
1508
1509	len -= skb->len;
1510
1511	BT_DBG("skb %p len %d", sk, skb->len);
1512
1513	/* Continuation fragments */
1514	frag = &skb_shinfo(skb)->frag_list;
1515	while (len) {
1516		struct sk_buff *tmp;
1517
1518		tmp = bt_skb_sendmsg(sk, msg, len, mtu, 0, 0);
1519		if (IS_ERR(tmp)) {
1520			kfree_skb(skb);
1521			return PTR_ERR(tmp);
1522		}
1523
1524		*frag = tmp;
1525
1526		len  -= tmp->len;
1527
1528		skb->len += tmp->len;
1529		skb->data_len += tmp->len;
1530
1531		BT_DBG("frag %p len %d", *frag, tmp->len);
1532
1533		frag = &(*frag)->next;
1534	}
1535
1536	lock_sock(sk);
1537
1538	if (sk->sk_state == BT_CONNECTED)
1539		err = iso_send_frame(sk, skb, &sockc);
1540	else
1541		err = -ENOTCONN;
1542
1543	release_sock(sk);
1544
1545	if (err < 0)
1546		kfree_skb(skb);
1547	return err;
1548}
1549
1550static void iso_conn_defer_accept(struct hci_conn *conn)
1551{
1552	struct hci_cp_le_accept_cis cp;
1553	struct hci_dev *hdev = conn->hdev;
1554
1555	BT_DBG("conn %p", conn);
1556
1557	conn->state = BT_CONFIG;
1558
1559	cp.handle = cpu_to_le16(conn->handle);
1560
1561	hci_send_cmd(hdev, HCI_OP_LE_ACCEPT_CIS, sizeof(cp), &cp);
1562}
1563
1564static void iso_conn_big_sync(struct sock *sk)
1565{
1566	int err;
1567	struct hci_dev *hdev;
1568
1569	hdev = hci_get_route(&iso_pi(sk)->dst, &iso_pi(sk)->src,
1570			     iso_pi(sk)->src_type);
1571
1572	if (!hdev)
1573		return;
1574
1575	/* hci_le_big_create_sync requires hdev lock to be held, since
1576	 * it enqueues the HCI LE BIG Create Sync command via
1577	 * hci_cmd_sync_queue_once, which checks hdev flags that might
1578	 * change.
1579	 */
1580	hci_dev_lock(hdev);
1581	lock_sock(sk);
1582
1583	if (!test_and_set_bit(BT_SK_BIG_SYNC, &iso_pi(sk)->flags)) {
1584		err = hci_conn_big_create_sync(hdev, iso_pi(sk)->conn->hcon,
1585					       &iso_pi(sk)->qos,
1586					       iso_pi(sk)->sync_handle,
1587					       iso_pi(sk)->bc_num_bis,
1588					       iso_pi(sk)->bc_bis);
1589		if (err)
1590			bt_dev_err(hdev, "hci_big_create_sync: %d", err);
1591	}
1592
1593	release_sock(sk);
1594	hci_dev_unlock(hdev);
1595}
1596
1597static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1598			    size_t len, int flags)
1599{
1600	struct sock *sk = sock->sk;
1601	struct iso_pinfo *pi = iso_pi(sk);
1602	bool early_ret = false;
1603	int err = 0;
1604
1605	BT_DBG("sk %p", sk);
1606
1607	if (unlikely(flags & MSG_ERRQUEUE))
1608		return sock_recv_errqueue(sk, msg, len, SOL_BLUETOOTH,
1609					  BT_SCM_ERROR);
1610
1611	if (test_and_clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
1612		sock_hold(sk);
1613		lock_sock(sk);
1614
1615		switch (sk->sk_state) {
1616		case BT_CONNECT2:
1617			if (test_bit(BT_SK_PA_SYNC, &pi->flags)) {
1618				release_sock(sk);
1619				iso_conn_big_sync(sk);
1620				lock_sock(sk);
1621
1622				sk->sk_state = BT_LISTEN;
1623			} else {
1624				iso_conn_defer_accept(pi->conn->hcon);
1625				sk->sk_state = BT_CONFIG;
1626			}
1627
1628			early_ret = true;
1629			break;
1630		case BT_CONNECTED:
1631			if (test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) {
1632				release_sock(sk);
1633				iso_conn_big_sync(sk);
1634				lock_sock(sk);
1635
1636				sk->sk_state = BT_LISTEN;
1637				early_ret = true;
1638			}
1639
1640			break;
1641		case BT_CONNECT:
1642			release_sock(sk);
1643			err = iso_connect_cis(sk);
1644			lock_sock(sk);
1645
1646			early_ret = true;
1647			break;
1648		default:
1649			break;
1650		}
1651
1652		release_sock(sk);
1653		sock_put(sk);
1654
1655		if (early_ret)
1656			return err;
1657	}
1658
1659	return bt_sock_recvmsg(sock, msg, len, flags);
1660}
1661
1662static bool check_io_qos(struct bt_iso_io_qos *qos)
1663{
1664	/* If no PHY is enable SDU must be 0 */
1665	if (!qos->phy && qos->sdu)
1666		return false;
1667
1668	if (qos->interval && (qos->interval < 0xff || qos->interval > 0xfffff))
1669		return false;
1670
1671	if (qos->latency && (qos->latency < 0x05 || qos->latency > 0xfa0))
1672		return false;
1673
1674	if (qos->phy > BT_ISO_PHY_ANY)
1675		return false;
1676
1677	return true;
1678}
1679
1680static bool check_ucast_qos(struct bt_iso_qos *qos)
1681{
1682	if (qos->ucast.cig > 0xef && qos->ucast.cig != BT_ISO_QOS_CIG_UNSET)
1683		return false;
1684
1685	if (qos->ucast.cis > 0xef && qos->ucast.cis != BT_ISO_QOS_CIS_UNSET)
1686		return false;
1687
1688	if (qos->ucast.sca > 0x07)
1689		return false;
1690
1691	if (qos->ucast.packing > 0x01)
1692		return false;
1693
1694	if (qos->ucast.framing > 0x01)
1695		return false;
1696
1697	if (!check_io_qos(&qos->ucast.in))
1698		return false;
1699
1700	if (!check_io_qos(&qos->ucast.out))
1701		return false;
1702
1703	return true;
1704}
1705
1706static bool check_bcast_qos(struct bt_iso_qos *qos)
1707{
1708	if (!qos->bcast.sync_factor)
1709		qos->bcast.sync_factor = 0x01;
1710
1711	if (qos->bcast.packing > 0x01)
1712		return false;
1713
1714	if (qos->bcast.framing > 0x01)
1715		return false;
1716
1717	if (!check_io_qos(&qos->bcast.in))
1718		return false;
1719
1720	if (!check_io_qos(&qos->bcast.out))
1721		return false;
1722
1723	if (qos->bcast.encryption > 0x01)
1724		return false;
1725
1726	if (qos->bcast.options > 0x07)
1727		return false;
1728
1729	if (qos->bcast.skip > 0x01f3)
1730		return false;
1731
1732	if (!qos->bcast.sync_timeout)
1733		qos->bcast.sync_timeout = BT_ISO_SYNC_TIMEOUT;
1734
1735	if (qos->bcast.sync_timeout < 0x000a || qos->bcast.sync_timeout > 0x4000)
1736		return false;
1737
1738	if (qos->bcast.sync_cte_type > 0x1f)
1739		return false;
1740
1741	if (qos->bcast.mse > 0x1f)
1742		return false;
1743
1744	if (!qos->bcast.timeout)
1745		qos->bcast.sync_timeout = BT_ISO_SYNC_TIMEOUT;
1746
1747	if (qos->bcast.timeout < 0x000a || qos->bcast.timeout > 0x4000)
1748		return false;
1749
1750	return true;
1751}
1752
1753static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
1754			       sockptr_t optval, unsigned int optlen)
1755{
1756	struct sock *sk = sock->sk;
1757	int err = 0;
1758	struct bt_iso_qos qos = default_qos;
1759	u32 opt;
1760
1761	BT_DBG("sk %p", sk);
1762
1763	lock_sock(sk);
1764
1765	switch (optname) {
1766	case BT_DEFER_SETUP:
1767		if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1768			err = -EINVAL;
1769			break;
1770		}
1771
1772		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
1773		if (err)
1774			break;
1775
1776		if (opt)
1777			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
1778		else
1779			clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
1780		break;
1781
1782	case BT_PKT_STATUS:
1783		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
1784		if (err)
1785			break;
1786
1787		if (opt)
1788			set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
1789		else
1790			clear_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
1791		break;
1792
1793	case BT_PKT_SEQNUM:
1794		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
1795		if (err)
1796			break;
1797
1798		if (opt)
1799			set_bit(BT_SK_PKT_SEQNUM, &bt_sk(sk)->flags);
1800		else
1801			clear_bit(BT_SK_PKT_SEQNUM, &bt_sk(sk)->flags);
1802		break;
1803
1804	case BT_ISO_QOS:
1805		if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
1806		    sk->sk_state != BT_CONNECT2 &&
1807		    (!test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags) ||
1808		    sk->sk_state != BT_CONNECTED)) {
1809			err = -EINVAL;
1810			break;
1811		}
1812
1813		err = copy_safe_from_sockptr(&qos, sizeof(qos), optval, optlen);
1814		if (err)
1815			break;
1816
1817		iso_pi(sk)->qos = qos;
1818		iso_pi(sk)->qos_user_set = true;
1819
1820		break;
1821
1822	case BT_ISO_BASE:
1823		if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
1824		    sk->sk_state != BT_CONNECT2) {
1825			err = -EINVAL;
1826			break;
1827		}
1828
1829		if (optlen > sizeof(iso_pi(sk)->base)) {
1830			err = -EINVAL;
1831			break;
1832		}
1833
1834		err = copy_safe_from_sockptr(iso_pi(sk)->base, optlen, optval,
1835					     optlen);
1836		if (err)
1837			break;
1838
1839		iso_pi(sk)->base_len = optlen;
1840
1841		break;
1842
1843	default:
1844		err = -ENOPROTOOPT;
1845		break;
1846	}
1847
1848	release_sock(sk);
1849	return err;
1850}
1851
1852static int iso_sock_getsockopt(struct socket *sock, int level, int optname,
1853			       char __user *optval, int __user *optlen)
1854{
1855	struct sock *sk = sock->sk;
1856	int len, err = 0;
1857	struct bt_iso_qos *qos;
1858	u8 base_len;
1859	u8 *base;
1860
1861	BT_DBG("sk %p", sk);
1862
1863	if (get_user(len, optlen))
1864		return -EFAULT;
1865
1866	lock_sock(sk);
1867
1868	switch (optname) {
1869	case BT_DEFER_SETUP:
1870		if (sk->sk_state == BT_CONNECTED) {
1871			err = -EINVAL;
1872			break;
1873		}
1874
1875		if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
1876			     (u32 __user *)optval))
1877			err = -EFAULT;
1878
1879		break;
1880
1881	case BT_PKT_STATUS:
1882		if (put_user(test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags),
1883			     (int __user *)optval))
1884			err = -EFAULT;
1885		break;
1886
1887	case BT_ISO_QOS:
1888		qos = iso_sock_get_qos(sk);
1889
1890		len = min_t(unsigned int, len, sizeof(*qos));
1891		if (copy_to_user(optval, qos, len))
1892			err = -EFAULT;
1893
1894		break;
1895
1896	case BT_ISO_BASE:
1897		if (sk->sk_state == BT_CONNECTED &&
1898		    !bacmp(&iso_pi(sk)->dst, BDADDR_ANY)) {
1899			base_len = iso_pi(sk)->conn->hcon->le_per_adv_data_len;
1900			base = iso_pi(sk)->conn->hcon->le_per_adv_data;
1901		} else {
1902			base_len = iso_pi(sk)->base_len;
1903			base = iso_pi(sk)->base;
1904		}
1905
1906		len = min_t(unsigned int, len, base_len);
1907		if (copy_to_user(optval, base, len))
1908			err = -EFAULT;
1909		if (put_user(len, optlen))
1910			err = -EFAULT;
1911
1912		break;
1913
1914	default:
1915		err = -ENOPROTOOPT;
1916		break;
1917	}
1918
1919	release_sock(sk);
1920	return err;
1921}
1922
1923static int iso_sock_shutdown(struct socket *sock, int how)
1924{
1925	struct sock *sk = sock->sk;
1926	int err = 0;
1927
1928	BT_DBG("sock %p, sk %p, how %d", sock, sk, how);
1929
1930	if (!sk)
1931		return 0;
1932
1933	sock_hold(sk);
1934	lock_sock(sk);
1935
1936	switch (how) {
1937	case SHUT_RD:
1938		if (sk->sk_shutdown & RCV_SHUTDOWN)
1939			goto unlock;
1940		sk->sk_shutdown |= RCV_SHUTDOWN;
1941		break;
1942	case SHUT_WR:
1943		if (sk->sk_shutdown & SEND_SHUTDOWN)
1944			goto unlock;
1945		sk->sk_shutdown |= SEND_SHUTDOWN;
1946		break;
1947	case SHUT_RDWR:
1948		if (sk->sk_shutdown & SHUTDOWN_MASK)
1949			goto unlock;
1950		sk->sk_shutdown |= SHUTDOWN_MASK;
1951		break;
1952	}
1953
1954	iso_sock_clear_timer(sk);
1955	__iso_sock_close(sk);
1956
1957	if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1958	    !(current->flags & PF_EXITING))
1959		err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
1960
1961unlock:
1962	release_sock(sk);
1963	sock_put(sk);
1964
1965	return err;
1966}
1967
1968static int iso_sock_release(struct socket *sock)
1969{
1970	struct sock *sk = sock->sk;
1971	int err = 0;
1972
1973	BT_DBG("sock %p, sk %p", sock, sk);
1974
1975	if (!sk)
1976		return 0;
1977
1978	iso_sock_close(sk);
1979
1980	if (sock_flag(sk, SOCK_LINGER) && READ_ONCE(sk->sk_lingertime) &&
1981	    !(current->flags & PF_EXITING)) {
1982		lock_sock(sk);
1983		err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
1984		release_sock(sk);
1985	}
1986
1987	sock_orphan(sk);
1988	iso_sock_kill(sk);
1989	return err;
1990}
1991
1992static void iso_sock_ready(struct sock *sk)
1993{
1994	BT_DBG("sk %p", sk);
1995
1996	if (!sk)
1997		return;
1998
1999	lock_sock(sk);
2000	iso_sock_clear_timer(sk);
2001	sk->sk_state = BT_CONNECTED;
2002	sk->sk_state_change(sk);
2003	release_sock(sk);
2004}
2005
2006static bool iso_match_big(struct sock *sk, void *data)
2007{
2008	struct hci_evt_le_big_sync_established *ev = data;
2009
2010	return ev->handle == iso_pi(sk)->qos.bcast.big;
2011}
2012
2013static bool iso_match_big_hcon(struct sock *sk, void *data)
2014{
2015	struct hci_conn *hcon = data;
2016
2017	return hcon->iso_qos.bcast.big == iso_pi(sk)->qos.bcast.big;
2018}
2019
2020static bool iso_match_pa_sync_flag(struct sock *sk, void *data)
2021{
2022	return test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags);
2023}
2024
2025static bool iso_match_dst(struct sock *sk, void *data)
2026{
2027	return !bacmp(&iso_pi(sk)->dst, (bdaddr_t *)data);
2028}
2029
2030static void iso_conn_ready(struct iso_conn *conn)
2031{
2032	struct sock *parent = NULL;
2033	struct sock *sk = conn->sk;
2034	struct hci_ev_le_big_sync_established *ev = NULL;
2035	struct hci_ev_le_pa_sync_established *ev2 = NULL;
2036	struct hci_ev_le_per_adv_report *ev3 = NULL;
2037	struct hci_conn *hcon;
2038	struct hci_dev *hdev;
2039
2040	BT_DBG("conn %p", conn);
2041
2042	if (sk) {
2043		/* Attempt to update source address in case of BIS Sender if
2044		 * the advertisement is using a random address.
2045		 */
2046		if (conn->hcon->type == BIS_LINK &&
2047		    conn->hcon->role == HCI_ROLE_MASTER &&
2048		    !bacmp(&conn->hcon->dst, BDADDR_ANY)) {
2049			struct hci_conn *bis = conn->hcon;
2050			struct adv_info *adv;
2051
2052			adv = hci_find_adv_instance(bis->hdev,
2053						    bis->iso_qos.bcast.bis);
2054			if (adv && bacmp(&adv->random_addr, BDADDR_ANY)) {
2055				lock_sock(sk);
2056				iso_pi(sk)->src_type = BDADDR_LE_RANDOM;
2057				bacpy(&iso_pi(sk)->src, &adv->random_addr);
2058				release_sock(sk);
2059			}
2060		}
2061
2062		iso_sock_ready(conn->sk);
2063	} else {
2064		hcon = conn->hcon;
2065		if (!hcon)
2066			return;
2067
2068		hdev = hcon->hdev;
2069
2070		if (test_bit(HCI_CONN_BIG_SYNC, &hcon->flags)) {
2071			/* A BIS slave hcon is notified to the ISO layer
2072			 * after the Command Complete for the LE Setup
2073			 * ISO Data Path command is received. Get the
2074			 * parent socket that matches the hcon BIG handle.
2075			 */
2076			parent = iso_get_sock(hdev, &hcon->src, &hcon->dst,
2077					      BT_LISTEN, iso_match_big_hcon,
2078					      hcon);
2079		} else if (test_bit(HCI_CONN_BIG_SYNC_FAILED, &hcon->flags)) {
2080			ev = hci_recv_event_data(hcon->hdev,
2081						 HCI_EVT_LE_BIG_SYNC_ESTABLISHED);
2082
2083			/* Get reference to PA sync parent socket, if it exists */
2084			parent = iso_get_sock(hdev, &hcon->src, &hcon->dst,
2085					      BT_LISTEN,
2086					      iso_match_pa_sync_flag,
2087					      NULL);
2088			if (!parent && ev)
2089				parent = iso_get_sock(hdev, &hcon->src,
2090						      &hcon->dst,
2091						      BT_LISTEN,
2092						      iso_match_big, ev);
2093		} else if (test_bit(HCI_CONN_PA_SYNC_FAILED, &hcon->flags)) {
2094			ev2 = hci_recv_event_data(hcon->hdev,
2095						  HCI_EV_LE_PA_SYNC_ESTABLISHED);
2096			if (ev2)
2097				parent = iso_get_sock(hdev, &hcon->src,
2098						      &hcon->dst,
2099						      BT_LISTEN,
2100						      iso_match_sid, ev2);
2101		} else if (test_bit(HCI_CONN_PA_SYNC, &hcon->flags)) {
2102			ev3 = hci_recv_event_data(hcon->hdev,
2103						  HCI_EV_LE_PER_ADV_REPORT);
2104			if (ev3)
2105				parent = iso_get_sock(hdev, &hcon->src,
2106						      &hcon->dst,
2107						      BT_LISTEN,
2108						      iso_match_sync_handle_pa_report,
2109						      ev3);
2110		}
2111
2112		if (!parent)
2113			parent = iso_get_sock(hdev, &hcon->src, BDADDR_ANY,
2114					      BT_LISTEN, iso_match_dst, BDADDR_ANY);
2115
2116		if (!parent)
2117			return;
2118
2119		lock_sock(parent);
2120
2121		sk = iso_sock_alloc(sock_net(parent), NULL,
2122				    BTPROTO_ISO, GFP_ATOMIC, 0);
2123		if (!sk) {
2124			release_sock(parent);
2125			return;
2126		}
2127
2128		iso_sock_init(sk, parent);
2129
2130		bacpy(&iso_pi(sk)->src, &hcon->src);
2131
2132		/* Convert from HCI to three-value type */
2133		if (hcon->src_type == ADDR_LE_DEV_PUBLIC)
2134			iso_pi(sk)->src_type = BDADDR_LE_PUBLIC;
2135		else
2136			iso_pi(sk)->src_type = BDADDR_LE_RANDOM;
2137
2138		/* If hcon has no destination address (BDADDR_ANY) it means it
2139		 * was created by HCI_EV_LE_BIG_SYNC_ESTABILISHED or
2140		 * HCI_EV_LE_PA_SYNC_ESTABLISHED so we need to initialize using
2141		 * the parent socket destination address.
2142		 */
2143		if (!bacmp(&hcon->dst, BDADDR_ANY)) {
2144			bacpy(&hcon->dst, &iso_pi(parent)->dst);
2145			hcon->dst_type = le_addr_type(iso_pi(parent)->dst_type);
2146		}
2147
2148		if (test_bit(HCI_CONN_PA_SYNC, &hcon->flags)) {
2149			iso_pi(sk)->qos = iso_pi(parent)->qos;
2150			hcon->iso_qos = iso_pi(sk)->qos;
2151			iso_pi(sk)->bc_sid = iso_pi(parent)->bc_sid;
2152			iso_pi(sk)->bc_num_bis = iso_pi(parent)->bc_num_bis;
2153			memcpy(iso_pi(sk)->bc_bis, iso_pi(parent)->bc_bis,
2154			       ISO_MAX_NUM_BIS);
2155			set_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags);
2156		}
2157
2158		bacpy(&iso_pi(sk)->dst, &hcon->dst);
2159
2160		/* Convert from HCI to three-value type */
2161		if (hcon->dst_type == ADDR_LE_DEV_PUBLIC)
2162			iso_pi(sk)->dst_type = BDADDR_LE_PUBLIC;
2163		else
2164			iso_pi(sk)->dst_type = BDADDR_LE_RANDOM;
2165
2166		iso_pi(sk)->sync_handle = iso_pi(parent)->sync_handle;
2167		memcpy(iso_pi(sk)->base, iso_pi(parent)->base, iso_pi(parent)->base_len);
2168		iso_pi(sk)->base_len = iso_pi(parent)->base_len;
2169
2170		hci_conn_hold(hcon);
2171		iso_chan_add(conn, sk, parent);
2172
2173		if ((ev && ((struct hci_evt_le_big_sync_established *)ev)->status) ||
2174		    (ev2 && ev2->status)) {
2175			/* Trigger error signal on child socket */
2176			sk->sk_err = ECONNREFUSED;
2177			sk->sk_error_report(sk);
2178		}
2179
2180		if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
2181			sk->sk_state = BT_CONNECT2;
2182		else
2183			sk->sk_state = BT_CONNECTED;
2184
2185		/* Wake up parent */
2186		parent->sk_data_ready(parent);
2187
2188		release_sock(parent);
2189		sock_put(parent);
2190	}
2191}
2192
2193static bool iso_match_sid(struct sock *sk, void *data)
2194{
2195	struct hci_ev_le_pa_sync_established *ev = data;
2196
2197	if (iso_pi(sk)->bc_sid == HCI_SID_INVALID)
2198		return true;
2199
2200	return ev->sid == iso_pi(sk)->bc_sid;
2201}
2202
2203static bool iso_match_sid_past(struct sock *sk, void *data)
2204{
2205	struct hci_ev_le_past_received *ev = data;
2206
2207	if (iso_pi(sk)->bc_sid == HCI_SID_INVALID)
2208		return true;
2209
2210	return ev->sid == iso_pi(sk)->bc_sid;
2211}
2212
2213static bool iso_match_sync_handle(struct sock *sk, void *data)
2214{
2215	struct hci_evt_le_big_info_adv_report *ev = data;
2216
2217	return le16_to_cpu(ev->sync_handle) == iso_pi(sk)->sync_handle;
2218}
2219
2220static bool iso_match_sync_handle_pa_report(struct sock *sk, void *data)
2221{
2222	struct hci_ev_le_per_adv_report *ev = data;
2223
2224	return le16_to_cpu(ev->sync_handle) == iso_pi(sk)->sync_handle;
2225}
2226
2227/* ----- ISO interface with lower layer (HCI) ----- */
2228
2229int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
2230{
2231	struct hci_ev_le_pa_sync_established *ev1;
2232	struct hci_ev_le_past_received *ev1a;
2233	struct hci_evt_le_big_info_adv_report *ev2;
2234	struct hci_ev_le_per_adv_report *ev3;
2235	struct sock *sk;
2236
2237	bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
2238
2239	/* Broadcast receiver requires handling of some events before it can
2240	 * proceed to establishing a BIG sync:
2241	 *
2242	 * 1. HCI_EV_LE_PA_SYNC_ESTABLISHED: The socket may specify a specific
2243	 * SID to listen to and once sync is established its handle needs to
2244	 * be stored in iso_pi(sk)->sync_handle so it can be matched once
2245	 * receiving the BIG Info.
2246	 * 1a. HCI_EV_LE_PAST_RECEIVED: alternative to 1.
2247	 * 2. HCI_EVT_LE_BIG_INFO_ADV_REPORT: When connect_ind is triggered by a
2248	 * a BIG Info it attempts to check if there any listening socket with
2249	 * the same sync_handle and if it does then attempt to create a sync.
2250	 * 3. HCI_EV_LE_PER_ADV_REPORT: When a PA report is received, it is stored
2251	 * in iso_pi(sk)->base so it can be passed up to user, in the case of a
2252	 * broadcast sink.
2253	 */
2254	ev1 = hci_recv_event_data(hdev, HCI_EV_LE_PA_SYNC_ESTABLISHED);
2255	if (ev1) {
2256		sk = iso_get_sock(hdev, &hdev->bdaddr, bdaddr, BT_LISTEN,
2257				  iso_match_sid, ev1);
2258		if (sk && !ev1->status) {
2259			iso_pi(sk)->sync_handle = le16_to_cpu(ev1->handle);
2260			iso_pi(sk)->bc_sid = ev1->sid;
2261		}
2262
2263		goto done;
2264	}
2265
2266	ev1a = hci_recv_event_data(hdev, HCI_EV_LE_PAST_RECEIVED);
2267	if (ev1a) {
2268		sk = iso_get_sock(hdev, &hdev->bdaddr, bdaddr, BT_LISTEN,
2269				  iso_match_sid_past, ev1a);
2270		if (sk && !ev1a->status) {
2271			iso_pi(sk)->sync_handle = le16_to_cpu(ev1a->sync_handle);
2272			iso_pi(sk)->bc_sid = ev1a->sid;
2273		}
2274
2275		goto done;
2276	}
2277
2278	ev2 = hci_recv_event_data(hdev, HCI_EVT_LE_BIG_INFO_ADV_REPORT);
2279	if (ev2) {
2280		/* Check if BIGInfo report has already been handled */
2281		sk = iso_get_sock(hdev, &hdev->bdaddr, bdaddr, BT_CONNECTED,
2282				  iso_match_sync_handle, ev2);
2283		if (sk) {
2284			sock_put(sk);
2285			sk = NULL;
2286			goto done;
2287		}
2288
2289		/* Try to get PA sync socket, if it exists */
2290		sk = iso_get_sock(hdev, &hdev->bdaddr, bdaddr, BT_CONNECT2,
2291				  iso_match_sync_handle, ev2);
2292		if (!sk)
2293			sk = iso_get_sock(hdev, &hdev->bdaddr, bdaddr,
2294					  BT_LISTEN,
2295					  iso_match_sync_handle,
2296					  ev2);
2297
2298		if (sk) {
2299			int err;
2300			struct hci_conn	*hcon = iso_pi(sk)->conn->hcon;
2301
2302			iso_pi(sk)->qos.bcast.encryption = ev2->encryption;
2303
2304			if (ev2->num_bis < iso_pi(sk)->bc_num_bis)
2305				iso_pi(sk)->bc_num_bis = ev2->num_bis;
2306
2307			if (!test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags) &&
2308			    !test_and_set_bit(BT_SK_BIG_SYNC, &iso_pi(sk)->flags)) {
2309				err = hci_conn_big_create_sync(hdev, hcon,
2310							       &iso_pi(sk)->qos,
2311							       iso_pi(sk)->sync_handle,
2312							       iso_pi(sk)->bc_num_bis,
2313							       iso_pi(sk)->bc_bis);
2314				if (err) {
2315					bt_dev_err(hdev, "hci_le_big_create_sync: %d",
2316						   err);
2317					sock_put(sk);
2318					sk = NULL;
2319				}
2320			}
2321		}
2322
2323		goto done;
2324	}
2325
2326	ev3 = hci_recv_event_data(hdev, HCI_EV_LE_PER_ADV_REPORT);
2327	if (ev3) {
2328		size_t base_len = 0;
2329		u8 *base;
2330		struct hci_conn *hcon;
2331
2332		sk = iso_get_sock(hdev, &hdev->bdaddr, bdaddr, BT_LISTEN,
2333				  iso_match_sync_handle_pa_report, ev3);
2334		if (!sk)
2335			goto done;
2336
2337		hcon = iso_pi(sk)->conn->hcon;
2338		if (!hcon)
2339			goto done;
2340
2341		if (ev3->data_status == LE_PA_DATA_TRUNCATED) {
2342			/* The controller was unable to retrieve PA data. */
2343			memset(hcon->le_per_adv_data, 0,
2344			       HCI_MAX_PER_AD_TOT_LEN);
2345			hcon->le_per_adv_data_len = 0;
2346			hcon->le_per_adv_data_offset = 0;
2347			goto done;
2348		}
2349
2350		if (hcon->le_per_adv_data_offset + ev3->length >
2351		    HCI_MAX_PER_AD_TOT_LEN)
2352			goto done;
2353
2354		memcpy(hcon->le_per_adv_data + hcon->le_per_adv_data_offset,
2355		       ev3->data, ev3->length);
2356		hcon->le_per_adv_data_offset += ev3->length;
2357
2358		if (ev3->data_status == LE_PA_DATA_COMPLETE) {
2359			/* All PA data has been received. */
2360			hcon->le_per_adv_data_len =
2361				hcon->le_per_adv_data_offset;
2362			hcon->le_per_adv_data_offset = 0;
2363
2364			/* Extract BASE */
2365			base = eir_get_service_data(hcon->le_per_adv_data,
2366						    hcon->le_per_adv_data_len,
2367						    EIR_BAA_SERVICE_UUID,
2368						    &base_len);
2369
2370			if (!base || base_len > BASE_MAX_LENGTH)
2371				goto done;
2372
2373			memcpy(iso_pi(sk)->base, base, base_len);
2374			iso_pi(sk)->base_len = base_len;
2375		} else {
2376			/* This is a PA data fragment. Keep pa_data_len set to 0
2377			 * until all data has been reassembled.
2378			 */
2379			hcon->le_per_adv_data_len = 0;
2380		}
2381	} else {
2382		sk = iso_get_sock(hdev, &hdev->bdaddr, BDADDR_ANY,
2383				  BT_LISTEN, iso_match_dst, BDADDR_ANY);
2384	}
2385
2386done:
2387	if (!sk)
2388		return 0;
2389
2390	if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
2391		*flags |= HCI_PROTO_DEFER;
2392
2393	sock_put(sk);
2394
2395	return HCI_LM_ACCEPT;
2396}
2397
2398static void iso_connect_cfm(struct hci_conn *hcon, __u8 status)
2399{
2400	if (hcon->type != CIS_LINK && hcon->type != BIS_LINK &&
2401	    hcon->type != PA_LINK) {
2402		if (hcon->type != LE_LINK)
2403			return;
2404
2405		/* Check if LE link has failed */
2406		if (status) {
2407			struct hci_link *link, *t;
2408
2409			list_for_each_entry_safe(link, t, &hcon->link_list,
2410						 list)
2411				iso_conn_del(link->conn, bt_to_errno(status));
2412
2413			return;
2414		}
2415
2416		/* Create CIS if pending */
2417		hci_le_create_cis_pending(hcon->hdev);
2418		return;
2419	}
2420
2421	BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
2422
2423	/* Similar to the success case, if HCI_CONN_BIG_SYNC_FAILED or
2424	 * HCI_CONN_PA_SYNC_FAILED is set, queue the failed connection
2425	 * into the accept queue of the listening socket and wake up
2426	 * userspace, to inform the user about the event.
2427	 */
2428	if (!status || test_bit(HCI_CONN_BIG_SYNC_FAILED, &hcon->flags) ||
2429	    test_bit(HCI_CONN_PA_SYNC_FAILED, &hcon->flags)) {
2430		struct iso_conn *conn;
2431
2432		conn = iso_conn_add(hcon);
2433		if (conn)
2434			iso_conn_ready(conn);
2435	} else {
2436		iso_conn_del(hcon, bt_to_errno(status));
2437	}
2438}
2439
2440static void iso_disconn_cfm(struct hci_conn *hcon, __u8 reason)
2441{
2442	if (hcon->type != CIS_LINK && hcon->type !=  BIS_LINK &&
2443	    hcon->type != PA_LINK)
2444		return;
2445
2446	BT_DBG("hcon %p reason %d", hcon, reason);
2447
2448	iso_conn_del(hcon, bt_to_errno(reason));
2449}
2450
2451int iso_recv(struct hci_dev *hdev, u16 handle, struct sk_buff *skb, u16 flags)
2452{
2453	struct hci_conn *hcon;
2454	struct iso_conn *conn;
2455	struct skb_shared_hwtstamps *hwts;
2456	__u16 pb, ts, len, sn;
2457
2458	hci_dev_lock(hdev);
2459
2460	hcon = hci_conn_hash_lookup_handle(hdev, handle);
2461	if (!hcon) {
2462		hci_dev_unlock(hdev);
2463		kfree_skb(skb);
2464		return -ENOENT;
2465	}
2466
2467	conn = iso_conn_hold_unless_zero(hcon->iso_data);
2468	hcon = NULL;
2469
2470	hci_dev_unlock(hdev);
2471
2472	if (!conn) {
2473		kfree_skb(skb);
2474		return -EINVAL;
2475	}
2476
2477	pb     = hci_iso_flags_pb(flags);
2478	ts     = hci_iso_flags_ts(flags);
2479
2480	BT_DBG("conn %p len %d pb 0x%x ts 0x%x", conn, skb->len, pb, ts);
2481
2482	switch (pb) {
2483	case ISO_START:
2484	case ISO_SINGLE:
2485		if (conn->rx_len) {
2486			BT_ERR("Unexpected start frame (len %d)", skb->len);
2487			kfree_skb(conn->rx_skb);
2488			conn->rx_skb = NULL;
2489			conn->rx_len = 0;
2490		}
2491
2492		if (ts) {
2493			struct hci_iso_ts_data_hdr *hdr;
2494
2495			hdr = skb_pull_data(skb, HCI_ISO_TS_DATA_HDR_SIZE);
2496			if (!hdr) {
2497				BT_ERR("Frame is too short (len %d)", skb->len);
2498				goto drop;
2499			}
2500
2501			/*  Record the timestamp to skb */
2502			hwts = skb_hwtstamps(skb);
2503			hwts->hwtstamp = us_to_ktime(le32_to_cpu(hdr->ts));
2504
2505			sn = __le16_to_cpu(hdr->sn);
2506			len = __le16_to_cpu(hdr->slen);
2507		} else {
2508			struct hci_iso_data_hdr *hdr;
2509
2510			hdr = skb_pull_data(skb, HCI_ISO_DATA_HDR_SIZE);
2511			if (!hdr) {
2512				BT_ERR("Frame is too short (len %d)", skb->len);
2513				goto drop;
2514			}
2515
2516			sn = __le16_to_cpu(hdr->sn);
2517			len = __le16_to_cpu(hdr->slen);
2518		}
2519
2520		flags  = hci_iso_data_flags(len);
2521		len    = hci_iso_data_len(len);
2522
2523		BT_DBG("Start: total len %d, frag len %d flags 0x%4.4x sn %d",
2524		       len, skb->len, flags, sn);
2525
2526		if (len == skb->len) {
2527			/* Complete frame received */
2528			hci_skb_pkt_status(skb) = flags & 0x03;
2529			hci_skb_pkt_seqnum(skb) = sn;
2530			iso_recv_frame(conn, skb);
2531			goto done;
2532		}
2533
2534		if (pb == ISO_SINGLE) {
2535			BT_ERR("Frame malformed (len %d, expected len %d)",
2536			       skb->len, len);
2537			goto drop;
2538		}
2539
2540		if (skb->len > len) {
2541			BT_ERR("Frame is too long (len %d, expected len %d)",
2542			       skb->len, len);
2543			goto drop;
2544		}
2545
2546		/* Allocate skb for the complete frame (with header) */
2547		conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
2548		if (!conn->rx_skb)
2549			goto drop;
2550
2551		hci_skb_pkt_status(conn->rx_skb) = flags & 0x03;
2552		hci_skb_pkt_seqnum(conn->rx_skb) = sn;
2553		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2554					  skb->len);
2555		conn->rx_len = len - skb->len;
2556
2557		/* Copy hw timestamp from skb to rx_skb if present */
2558		if (ts) {
2559			hwts = skb_hwtstamps(conn->rx_skb);
2560			hwts->hwtstamp = skb_hwtstamps(skb)->hwtstamp;
2561		}
2562
2563		break;
2564
2565	case ISO_CONT:
2566		BT_DBG("Cont: frag len %d (expecting %d)", skb->len,
2567		       conn->rx_len);
2568
2569		if (!conn->rx_len) {
2570			BT_ERR("Unexpected continuation frame (len %d)",
2571			       skb->len);
2572			goto drop;
2573		}
2574
2575		if (skb->len > conn->rx_len) {
2576			BT_ERR("Fragment is too long (len %d, expected %d)",
2577			       skb->len, conn->rx_len);
2578			kfree_skb(conn->rx_skb);
2579			conn->rx_skb = NULL;
2580			conn->rx_len = 0;
2581			goto drop;
2582		}
2583
2584		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2585					  skb->len);
2586		conn->rx_len -= skb->len;
2587		break;
2588
2589	case ISO_END:
2590		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2591					  skb->len);
2592		conn->rx_len -= skb->len;
2593
2594		if (!conn->rx_len) {
2595			struct sk_buff *rx_skb = conn->rx_skb;
2596
2597			/* Complete frame received. iso_recv_frame
2598			 * takes ownership of the skb so set the global
2599			 * rx_skb pointer to NULL first.
2600			 */
2601			conn->rx_skb = NULL;
2602			iso_recv_frame(conn, rx_skb);
2603		}
2604		break;
2605	}
2606
2607drop:
2608	kfree_skb(skb);
2609done:
2610	iso_conn_put(conn);
2611	return 0;
2612}
2613
2614static struct hci_cb iso_cb = {
2615	.name		= "ISO",
2616	.connect_cfm	= iso_connect_cfm,
2617	.disconn_cfm	= iso_disconn_cfm,
2618};
2619
2620static int iso_debugfs_show(struct seq_file *f, void *p)
2621{
2622	struct sock *sk;
2623
2624	read_lock(&iso_sk_list.lock);
2625
2626	sk_for_each(sk, &iso_sk_list.head) {
2627		seq_printf(f, "%pMR %pMR %d\n", &iso_pi(sk)->src,
2628			   &iso_pi(sk)->dst, sk->sk_state);
2629	}
2630
2631	read_unlock(&iso_sk_list.lock);
2632
2633	return 0;
2634}
2635
2636DEFINE_SHOW_ATTRIBUTE(iso_debugfs);
2637
2638static struct dentry *iso_debugfs;
2639
2640static const struct proto_ops iso_sock_ops = {
2641	.family		= PF_BLUETOOTH,
2642	.owner		= THIS_MODULE,
2643	.release	= iso_sock_release,
2644	.bind		= iso_sock_bind,
2645	.connect	= iso_sock_connect,
2646	.listen		= iso_sock_listen,
2647	.accept		= iso_sock_accept,
2648	.getname	= iso_sock_getname,
2649	.sendmsg	= iso_sock_sendmsg,
2650	.recvmsg	= iso_sock_recvmsg,
2651	.poll		= bt_sock_poll,
2652	.ioctl		= bt_sock_ioctl,
2653	.mmap		= sock_no_mmap,
2654	.socketpair	= sock_no_socketpair,
2655	.shutdown	= iso_sock_shutdown,
2656	.setsockopt	= iso_sock_setsockopt,
2657	.getsockopt	= iso_sock_getsockopt
2658};
2659
2660static const struct net_proto_family iso_sock_family_ops = {
2661	.family	= PF_BLUETOOTH,
2662	.owner	= THIS_MODULE,
2663	.create	= iso_sock_create,
2664};
2665
2666static bool inited;
2667
2668bool iso_inited(void)
2669{
2670	return inited;
2671}
2672
2673int iso_init(void)
2674{
2675	int err;
2676
2677	BUILD_BUG_ON(sizeof(struct sockaddr_iso) > sizeof(struct sockaddr));
2678
2679	if (inited)
2680		return -EALREADY;
2681
2682	err = proto_register(&iso_proto, 0);
2683	if (err < 0)
2684		return err;
2685
2686	err = bt_sock_register(BTPROTO_ISO, &iso_sock_family_ops);
2687	if (err < 0) {
2688		BT_ERR("ISO socket registration failed");
2689		goto error;
2690	}
2691
2692	err = bt_procfs_init(&init_net, "iso", &iso_sk_list, NULL);
2693	if (err < 0) {
2694		BT_ERR("Failed to create ISO proc file");
2695		bt_sock_unregister(BTPROTO_ISO);
2696		goto error;
2697	}
2698
2699	BT_INFO("ISO socket layer initialized");
2700
2701	hci_register_cb(&iso_cb);
2702
2703	if (!IS_ERR_OR_NULL(bt_debugfs))
2704		iso_debugfs = debugfs_create_file("iso", 0444, bt_debugfs,
2705						  NULL, &iso_debugfs_fops);
2706
2707	inited = true;
2708
2709	return 0;
2710
2711error:
2712	proto_unregister(&iso_proto);
2713	return err;
2714}
2715
2716int iso_exit(void)
2717{
2718	if (!inited)
2719		return -EALREADY;
2720
2721	bt_procfs_cleanup(&init_net, "iso");
2722
2723	debugfs_remove(iso_debugfs);
2724	iso_debugfs = NULL;
2725
2726	hci_unregister_cb(&iso_cb);
2727
2728	bt_sock_unregister(BTPROTO_ISO);
2729
2730	proto_unregister(&iso_proto);
2731
2732	inited = false;
2733
2734	return 0;
2735}