* [PATCH v11 1/6] Bluetooth: Add initial support for HDT PHY
2026-11-09 17:18 [PATCH v11 0/6] Bluetooth: Add support for HDT and EKS Luiz Augusto von Dentz
@ 2026-11-09 17:18 ` Luiz Augusto von Dentz
2026-11-09 17:18 ` [PATCH v11 2/6] Bluetooth: ISO: Add extended QoS with the HDT rates Luiz Augusto von Dentz
` (5 subsequent siblings)
6 siblings, 0 replies; 9+ messages in thread
From: Luiz Augusto von Dentz @ 2026-11-09 17:18 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Add support for the LE HDT PHY introduced by High Data Throughput (HDT)
in Bluetooth 7.0:
- The HDT feature bits (Link Layer feature bits 76-83) and the
le_feature() helper to access the FeatureSet pages above page 0,
along with hdt_capable() and the per-rate capability checks.
- BT_PHY_HDT_* bits for the HDT2, HDT3, HDT4, HDT6 and HDT7.5 rates in
each direction, so userspace can select them with BT_PHY, which map
to the LE HDT PHY and the rate bits of PHY_Options in LE Set PHY.
- LE Read Maximum Data Length v2 and LE Read/Write Suggested Default
Data Length v2, used instead of their v1 counterparts on HDT capable
controllers so the default data length is set for each PHY. The
values given to LE Write Suggested Default Data Length are clamped to
the maximum the specification allows.
- LE Set CIG Parameters v2, LE CIS Established v3, LE Create BIG v2 and
LE Create BIG Complete v2, which carry the HDT rates, MIC length and
packet format of a CIS or BIS. The CIS and BIS default to all the HDT
rates the controller supports when the HDT PHY is selected.
- MGMT_SETTING_HDT to report HDT support to userspace.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
include/net/bluetooth/bluetooth.h | 18 ++
include/net/bluetooth/hci.h | 178 +++++++++++++-
include/net/bluetooth/hci_core.h | 29 +++
include/net/bluetooth/hci_sync.h | 5 +-
include/net/bluetooth/mgmt.h | 1 +
net/bluetooth/hci_conn.c | 229 +++++++++++-------
net/bluetooth/hci_event.c | 363 +++++++++++++++++++++++++++--
net/bluetooth/hci_sync.c | 374 +++++++++++++++++++++++++++++-
net/bluetooth/iso.c | 2 +-
net/bluetooth/mgmt.c | 6 +
10 files changed, 1093 insertions(+), 112 deletions(-)
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index cd9189244566..fbedd1ebd051 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -142,6 +142,16 @@ struct bt_voice {
#define BT_PHY_LE_2M_RX BIT(12)
#define BT_PHY_LE_CODED_TX BIT(13)
#define BT_PHY_LE_CODED_RX BIT(14)
+#define BT_PHY_HDT_2M_TX BIT(15)
+#define BT_PHY_HDT_2M_RX BIT(16)
+#define BT_PHY_HDT_3M_TX BIT(17)
+#define BT_PHY_HDT_3M_RX BIT(18)
+#define BT_PHY_HDT_4M_TX BIT(19)
+#define BT_PHY_HDT_4M_RX BIT(20)
+#define BT_PHY_HDT_6M_TX BIT(21)
+#define BT_PHY_HDT_6M_RX BIT(22)
+#define BT_PHY_HDT_7_5M_TX BIT(23)
+#define BT_PHY_HDT_7_5M_RX BIT(24)
#define BT_PHY_BREDR_MASK (BT_PHY_BR_1M_1SLOT | BT_PHY_BR_1M_3SLOT | \
BT_PHY_BR_1M_5SLOT | BT_PHY_EDR_2M_1SLOT | \
@@ -151,6 +161,13 @@ struct bt_voice {
#define BT_PHY_LE_MASK (BT_PHY_LE_1M_TX | BT_PHY_LE_1M_RX | \
BT_PHY_LE_2M_TX | BT_PHY_LE_2M_RX | \
BT_PHY_LE_CODED_TX | BT_PHY_LE_CODED_RX)
+#define BT_PHY_HDT_TX_MASK (BT_PHY_HDT_2M_TX | BT_PHY_HDT_3M_TX | \
+ BT_PHY_HDT_4M_TX | BT_PHY_HDT_6M_TX | \
+ BT_PHY_HDT_7_5M_TX)
+#define BT_PHY_HDT_RX_MASK (BT_PHY_HDT_2M_RX | BT_PHY_HDT_3M_RX | \
+ BT_PHY_HDT_4M_RX | BT_PHY_HDT_6M_RX | \
+ BT_PHY_HDT_7_5M_RX)
+#define BT_PHY_HDT_MASK (BT_PHY_HDT_TX_MASK | BT_PHY_HDT_RX_MASK)
#define BT_MODE 15
@@ -221,6 +238,7 @@ struct bt_iso_qos {
#define BT_ISO_PHY_1M BIT(0)
#define BT_ISO_PHY_2M BIT(1)
#define BT_ISO_PHY_CODED BIT(2)
+#define BT_ISO_PHY_HDT BIT(4)
#define BT_ISO_PHY_ANY (BT_ISO_PHY_1M | BT_ISO_PHY_2M | \
BT_ISO_PHY_CODED)
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 1c992e87534d..e60686cf978d 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -659,6 +659,16 @@ enum {
#define HCI_LE_SCI 0x01 /* byte 9 - Shorter Connection Intervals */
#define HCI_LE_SCI_HOST 0x02 /* byte 9 - Shorter Connection Intervals (Host) */
+/* HDT features - Page 1 */
+#define HCI_LE_EKS_FEATURE BIT(4) /* Byte 1 */
+#define HCI_LE_HDT_FEATURE BIT(5)
+#define HCI_LE_HDT_6_RX_FEATURE BIT(6)
+#define HCI_LE_HDT_6_TX_FEATURE BIT(7)
+#define HCI_LE_HDT_7_5_RX_FEATURE BIT(0) /* Byte 2 */
+#define HCI_LE_HDT_7_5_TX_FEATURE BIT(1)
+#define HCI_LE_HDT_PF_1 BIT(2)
+#define HCI_LE_HDT_LQF_FEATURE BIT(3)
+
/* Connection modes */
#define HCI_CM_ACTIVE 0x0000
#define HCI_CM_HOLD 0x0001
@@ -1891,9 +1901,10 @@ struct hci_cp_le_set_default_phy {
__u8 rx_phys;
} __packed;
-#define HCI_LE_SET_PHY_1M 0x01
-#define HCI_LE_SET_PHY_2M 0x02
-#define HCI_LE_SET_PHY_CODED 0x04
+#define HCI_LE_SET_PHY_1M BIT(0)
+#define HCI_LE_SET_PHY_2M BIT(1)
+#define HCI_LE_SET_PHY_CODED BIT(2)
+#define HCI_LE_SET_PHY_HDT BIT(4)
#define HCI_OP_LE_SET_PHY 0x2032
struct hci_cp_le_set_phy {
@@ -2216,7 +2227,7 @@ struct hci_bis {
__le16 sdu;
__le16 latency;
__u8 rtn;
- __u8 phy;
+ __u8 phys;
__u8 packing;
__u8 framing;
__u8 encryption;
@@ -2535,6 +2546,113 @@ struct hci_rp_le_read_conn_interval {
struct hci_le_conn_interval_group grps[];
} __packed;
+#define HCI_OP_LE_WRITE_DEF_DATA_LEN_V2 0x20b2
+struct hci_cp_le_write_def_data_len_v2 {
+ __le16 tx_len;
+ __le16 tx_time;
+ __u8 phys;
+} __packed;
+
+#define HCI_OP_LE_READ_DEF_DATA_LEN_V2 0x20b1
+struct hci_cp_le_read_def_data_len_v2 {
+ __u8 phys;
+} __packed;
+
+struct hci_rp_le_read_def_data_len_v2 {
+ __u8 status;
+ __le16 tx_len;
+ __le16 tx_time;
+} __packed;
+
+#define HCI_OP_LE_READ_MAX_DATA_LEN_V2 0x20b0
+struct hci_cp_le_read_max_data_len_v2 {
+ __u8 phy;
+} __packed;
+
+struct hci_rp_le_read_max_data_len_v2 {
+ __u8 status;
+ __le16 tx_len;
+ __le16 tx_time;
+ __le16 rx_len;
+ __le16 rx_time;
+ __u8 tx_win;
+ __u8 rx_win;
+ __le16 rx_packet;
+} __packed;
+
+/* HDT_Rates bits of the CIS and BIS parameters */
+#define HCI_HDT_RATE_2M BIT(0)
+#define HCI_HDT_RATE_3M BIT(1)
+#define HCI_HDT_RATE_4M BIT(2)
+#define HCI_HDT_RATE_6M BIT(3)
+#define HCI_HDT_RATE_7_5M BIT(4)
+
+#define HCI_OP_LE_SET_CIG_PARAMS_V2 0x20b3
+struct hci_cis_params_v2 {
+ __u8 cis_id;
+ __le16 c_sdu;
+ __le16 p_sdu;
+ __u8 c_phys;
+ __u8 p_phys;
+ __u8 c_rtn;
+ __u8 p_rtn;
+ __u8 c_coded_rates;
+ __u8 p_coded_rates;
+ __le16 c_hdt_rates;
+ __le16 p_hdt_rates;
+ __u8 mic_len;
+ __u8 format;
+} __packed;
+
+struct hci_cp_le_set_cig_params_v2 {
+ __u8 cig_id;
+ __u8 c_interval[3];
+ __u8 p_interval[3];
+ __u8 sca;
+ __u8 packing;
+ __u8 framing;
+ __le16 c_latency;
+ __le16 p_latency;
+ __u8 num_cis;
+ struct hci_cis_params_v2 cis[] __counted_by(num_cis);
+} __packed;
+
+/* The CIS that fit in the 255 octets of command parameters */
+#define HCI_LE_CIG_PARAMS_V2_MAX_CIS \
+ ((U8_MAX - sizeof(struct hci_cp_le_set_cig_params_v2)) / \
+ sizeof(struct hci_cis_params_v2))
+
+struct hci_rp_le_set_cig_params_v2 {
+ __u8 status;
+ __u8 cig_id;
+ __u8 num_handles;
+ __le16 handle[];
+} __packed;
+
+#define HCI_OP_LE_CREATE_BIG_V2 0x20b6
+struct hci_bis_v2 {
+ __u8 sdu_interval[3];
+ __le16 sdu;
+ __le16 latency;
+ __u8 rtn;
+ __u8 phys;
+ __u8 packing;
+ __u8 framing;
+ __u8 encryption;
+ __u8 bcode[16];
+ __u8 coded_rates;
+ __le16 hdt_rates;
+ __u8 mic_len;
+ __u8 format;
+} __packed;
+
+struct hci_cp_le_create_big_v2 {
+ __u8 handle;
+ __u8 adv_handle;
+ __u8 num_bis;
+ struct hci_bis_v2 bis;
+} __packed;
+
/* ---- HCI Events ---- */
struct hci_ev_status {
__u8 status;
@@ -3360,6 +3478,58 @@ struct hci_evt_le_conn_rate_change {
__le16 supv_timeout;
} __packed;
+#define HCI_EVT_LE_CIS_ESTABLISHED_V3 0x3a
+struct hci_evt_le_cis_established_v3 {
+ __u8 status;
+ __le16 handle;
+ __u8 cig_sync_delay[3];
+ __u8 cis_sync_delay[3];
+ __u8 c_latency[3];
+ __u8 p_latency[3];
+ __u8 c_phy;
+ __u8 p_phy;
+ __u8 nse;
+ __u8 c_bn;
+ __u8 p_bn;
+ __u8 c_ft;
+ __u8 p_ft;
+ __le16 c_mtu;
+ __le16 p_mtu;
+ __le16 interval;
+ __u8 sub_interval[3];
+ __le16 c_sdu;
+ __le16 p_sdu;
+ __u8 c_sdu_interval[3];
+ __u8 p_sdu_interval[3];
+ __u8 framing;
+ __le16 c_rates;
+ __le16 p_rates;
+ __u8 config_id;
+ __u8 group_id;
+ __u8 encryption;
+ __u8 mic_len;
+} __packed;
+
+#define HCI_EVT_LE_CREATE_BIG_COMPLETE_V2 0x3b
+struct hci_evt_le_create_big_complete_v2 {
+ __u8 status;
+ __u8 handle;
+ __u8 sync_delay[3];
+ __u8 latency[3];
+ __u8 phy;
+ __u8 nse;
+ __u8 bn;
+ __u8 pto;
+ __u8 irc;
+ __le16 max_pdu;
+ __le16 interval;
+ __le16 rates;
+ __u8 encryption;
+ __u8 mic_len;
+ __u8 num_bis;
+ __le16 bis_handle[];
+} __packed;
+
#define HCI_EV_VENDOR 0xff
/* Internal events generated by Bluetooth stack */
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index e33b158086fd..689e2a1266b4 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -424,6 +424,15 @@ struct hci_dev {
__u16 le_max_tx_time;
__u16 le_max_rx_len;
__u16 le_max_rx_time;
+ __u16 hdt_def_tx_len;
+ __u16 hdt_def_tx_time;
+ __u16 hdt_max_tx_len;
+ __u16 hdt_max_tx_time;
+ __u16 hdt_max_rx_len;
+ __u16 hdt_max_rx_time;
+ __u8 hdt_max_tx_win;
+ __u8 hdt_max_rx_win;
+ __u16 hdt_max_rx_packet;
__u8 le_max_key_size;
__u8 le_min_key_size;
__u16 discov_interleaved_timeout;
@@ -784,6 +793,7 @@ struct hci_conn {
__u8 le_rx_def_phys;
__u8 le_tx_phy;
__u8 le_rx_phy;
+ __u16 le_phy_opts;
__s8 rssi;
__s8 tx_power;
__s8 max_tx_power;
@@ -2148,6 +2158,25 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
(past_sender_enabled(dev) || past_receiver_enabled(dev))
#define ll_ext_feature_capable(dev) \
((dev)->le_features[7] & HCI_LE_LL_EXT_FEATURE)
+#define le_feature(dev, page, byte) \
+ (page ? ((dev)->le_features[(page - 1) * 24 + 8 + byte]) : \
+ ((dev)->le_features[byte]))
+#define hdt_capable(dev) \
+ (le_feature(dev, 1, 1) & HCI_LE_HDT_FEATURE)
+#define le_set_cig_params_v2_capable(dev) \
+ (hdt_capable(dev) && ((dev)->commands[51] & BIT(0)))
+#define hdt_enabled(dev) \
+ (le_enabled(dev) && hdt_capable(dev))
+#define hdt_6_rx_capable(dev) \
+ (le_feature(dev, 1, 1) & HCI_LE_HDT_6_RX_FEATURE)
+#define hdt_6_tx_capable(dev) \
+ (le_feature(dev, 1, 1) & HCI_LE_HDT_6_TX_FEATURE)
+#define hdt_7_5_rx_capable(dev) \
+ (le_feature(dev, 1, 2) & HCI_LE_HDT_7_5_RX_FEATURE)
+#define hdt_7_5_tx_capable(dev) \
+ (le_feature(dev, 1, 2) & HCI_LE_HDT_7_5_TX_FEATURE)
+#define hdt_pf1_capable(dev) \
+ (le_feature(dev, 1, 2) & HCI_LE_HDT_PF_1)
/* Channel sounding support */
#define le_cs_capable(dev) \
diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h
index 59cb918d1405..a24f6a84a447 100644
--- a/include/net/bluetooth/hci_sync.h
+++ b/include/net/bluetooth/hci_sync.h
@@ -193,4 +193,7 @@ int hci_past_sync(struct hci_conn *conn, struct hci_conn *le);
int hci_le_read_remote_features(struct hci_conn *conn);
int hci_acl_change_pkt_type(struct hci_conn *conn, u16 pkt_type);
-int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys);
+int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys, u16 phy_opts);
+int hci_le_set_cig_params_sync(struct hci_dev *hdev, u8 cig_id);
+int hci_le_create_big_sync(struct hci_conn *conn, struct bt_iso_qos *qos,
+ u8 num_bis);
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index b02e915bb44c..17bdd6345d19 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -119,6 +119,7 @@ struct mgmt_rp_read_index_list {
#define MGMT_SETTING_PAST_SENDER BIT(23)
#define MGMT_SETTING_PAST_RECEIVER BIT(24)
#define MGMT_SETTING_SCI BIT(25)
+#define MGMT_SETTING_HDT BIT(26)
#define MGMT_OP_READ_INFO 0x0004
#define MGMT_READ_INFO_SIZE 0
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index b007f623b2ec..83aed078032d 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1941,11 +1941,8 @@ struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos)
{
struct hci_dev *hdev = conn->hdev;
- struct hci_cp_le_create_big cp;
struct iso_list_data data;
- memset(&cp, 0, sizeof(cp));
-
data.big = qos->bcast.big;
data.bis = qos->bcast.bis;
data.count = 0;
@@ -1954,84 +1951,14 @@ static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos)
hci_conn_hash_list_state(hdev, bis_list, BIS_LINK,
BT_BOUND, &data);
- cp.handle = qos->bcast.big;
- cp.adv_handle = qos->bcast.bis;
- cp.num_bis = data.count;
- hci_cpu_to_le24(qos->bcast.out.interval, cp.bis.sdu_interval);
- cp.bis.sdu = cpu_to_le16(qos->bcast.out.sdu);
- cp.bis.latency = cpu_to_le16(qos->bcast.out.latency);
- cp.bis.rtn = qos->bcast.out.rtn;
- cp.bis.phy = qos->bcast.out.phys;
- cp.bis.packing = qos->bcast.packing;
- cp.bis.framing = qos->bcast.framing;
- cp.bis.encryption = qos->bcast.encryption;
- memcpy(cp.bis.bcode, qos->bcast.bcode, sizeof(cp.bis.bcode));
-
- return hci_send_cmd(hdev, HCI_OP_LE_CREATE_BIG, sizeof(cp), &cp);
+ return hci_le_create_big_sync(conn, qos, data.count);
}
static int set_cig_params_sync(struct hci_dev *hdev, void *data)
{
- DEFINE_FLEX(struct hci_cp_le_set_cig_params, pdu, cis, num_cis, 0x1f);
u8 cig_id = PTR_UINT(data);
- struct hci_conn *conn;
- struct bt_iso_qos *qos;
- u8 aux_num_cis = 0;
- u8 cis_id;
- hci_dev_lock(hdev);
-
- conn = hci_conn_hash_lookup_cig(hdev, cig_id);
- if (!conn) {
- hci_dev_unlock(hdev);
- return 0;
- }
-
- qos = &conn->iso_qos;
- pdu->cig_id = cig_id;
- hci_cpu_to_le24(qos->ucast.out.interval, pdu->c_interval);
- hci_cpu_to_le24(qos->ucast.in.interval, pdu->p_interval);
- pdu->sca = qos->ucast.sca;
- pdu->packing = qos->ucast.packing;
- pdu->framing = qos->ucast.framing;
- pdu->c_latency = cpu_to_le16(qos->ucast.out.latency);
- pdu->p_latency = cpu_to_le16(qos->ucast.in.latency);
-
- /* Reprogram all CIS(s) with the same CIG, valid range are:
- * num_cis: 0x00 to 0x1F
- * cis_id: 0x00 to 0xEF
- */
- for (cis_id = 0x00; cis_id < 0xf0 &&
- aux_num_cis < pdu->num_cis; cis_id++) {
- struct hci_cis_params *cis;
-
- conn = hci_conn_hash_lookup_cis(hdev, NULL, 0, cig_id, cis_id);
- if (!conn)
- continue;
-
- qos = &conn->iso_qos;
-
- cis = &pdu->cis[aux_num_cis++];
- cis->cis_id = cis_id;
- cis->c_sdu = cpu_to_le16(conn->iso_qos.ucast.out.sdu);
- cis->p_sdu = cpu_to_le16(conn->iso_qos.ucast.in.sdu);
- cis->c_phys = qos->ucast.out.phys ? qos->ucast.out.phys :
- qos->ucast.in.phys;
- cis->p_phys = qos->ucast.in.phys ? qos->ucast.in.phys :
- qos->ucast.out.phys;
- cis->c_rtn = qos->ucast.out.rtn;
- cis->p_rtn = qos->ucast.in.rtn;
- }
- pdu->num_cis = aux_num_cis;
-
- hci_dev_unlock(hdev);
-
- if (!pdu->num_cis)
- return 0;
-
- return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_CIG_PARAMS,
- struct_size(pdu, cis, pdu->num_cis),
- pdu, HCI_CMD_TIMEOUT);
+ return hci_le_set_cig_params_sync(hdev, cig_id);
}
static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
@@ -2064,6 +1991,20 @@ static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
qos->ucast.cig = data.cig;
}
+ /* LE Set CIG Parameters v2 only fits so many CIS in a CIG */
+ if (le_set_cig_params_v2_capable(hdev)) {
+ data.cig = qos->ucast.cig;
+ data.count = 0;
+ hci_conn_hash_list_state(hdev, find_cis, CIS_LINK, BT_BOUND,
+ &data);
+ hci_conn_hash_list_state(hdev, find_cis, CIS_LINK, BT_CONNECT,
+ &data);
+ hci_conn_hash_list_state(hdev, find_cis, CIS_LINK,
+ BT_CONNECTED, &data);
+ if (data.count >= HCI_LE_CIG_PARAMS_V2_MAX_CIS)
+ return false;
+ }
+
if (qos->ucast.cis != BT_ISO_QOS_CIS_UNSET) {
if (hci_conn_hash_lookup_cis(hdev, NULL, 0, qos->ucast.cig,
qos->ucast.cis))
@@ -2245,9 +2186,11 @@ static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn,
if (!qos->sdu && qos->phys)
qos->sdu = conn->mtu;
- /* Use the same PHY as ACL if set to any */
+ /* Use the same PHY as ACL if set to any, which doesn't include HDT,
+ * so the QoS stays the same as when it was bound.
+ */
if (qos->phys == BT_ISO_PHY_ANY)
- qos->phys = phys;
+ qos->phys = (phys & BT_ISO_PHY_ANY) ? : BT_ISO_PHY_ANY;
/* Use LE ACL connection interval if not set */
if (!qos->interval)
@@ -3122,6 +3065,78 @@ u32 hci_conn_get_phy(struct hci_conn *conn)
if (conn->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
phys |= BT_PHY_LE_CODED_RX;
+ if (conn->le_tx_def_phys & HCI_LE_SET_PHY_HDT) {
+ /* If le_phy_opts is set, it means user has
+ * specified specific PHYs to use rather than the
+ * default ones. PHY_Options is common to both
+ * directions, so only the rates this direction
+ * supports are reported.
+ */
+ if (conn->le_phy_opts) {
+ if (conn->le_phy_opts & BIT(2))
+ phys |= BT_PHY_HDT_2M_TX;
+
+ if (conn->le_phy_opts & BIT(3))
+ phys |= BT_PHY_HDT_3M_TX;
+
+ if (conn->le_phy_opts & BIT(4))
+ phys |= BT_PHY_HDT_4M_TX;
+
+ if (conn->le_phy_opts & BIT(5) &&
+ hdt_6_tx_capable(conn->hdev))
+ phys |= BT_PHY_HDT_6M_TX;
+
+ if (conn->le_phy_opts & BIT(6) &&
+ hdt_7_5_tx_capable(conn->hdev))
+ phys |= BT_PHY_HDT_7_5M_TX;
+ } else {
+ phys |= BT_PHY_HDT_2M_TX;
+ phys |= BT_PHY_HDT_3M_TX;
+ phys |= BT_PHY_HDT_4M_TX;
+
+ if (hdt_6_tx_capable(conn->hdev))
+ phys |= BT_PHY_HDT_6M_TX;
+
+ if (hdt_7_5_tx_capable(conn->hdev))
+ phys |= BT_PHY_HDT_7_5M_TX;
+ }
+ }
+
+ if (conn->le_rx_def_phys & HCI_LE_SET_PHY_HDT) {
+ /* If le_phy_opts is set, it means user has
+ * specified specific PHYs to use rather than the
+ * default ones.
+ */
+ if (conn->le_phy_opts) {
+ if (conn->le_phy_opts & BIT(2))
+ phys |= BT_PHY_HDT_2M_RX;
+
+ if (conn->le_phy_opts & BIT(3))
+ phys |= BT_PHY_HDT_3M_RX;
+
+ if (conn->le_phy_opts & BIT(4))
+ phys |= BT_PHY_HDT_4M_RX;
+
+ if (conn->le_phy_opts & BIT(5) &&
+ hdt_6_rx_capable(conn->hdev))
+ phys |= BT_PHY_HDT_6M_RX;
+
+ if (conn->le_phy_opts & BIT(6) &&
+ hdt_7_5_rx_capable(conn->hdev))
+ phys |= BT_PHY_HDT_7_5M_RX;
+ } else {
+ phys |= BT_PHY_HDT_2M_RX;
+ phys |= BT_PHY_HDT_3M_RX;
+ phys |= BT_PHY_HDT_4M_RX;
+
+ if (hdt_6_rx_capable(conn->hdev))
+ phys |= BT_PHY_HDT_6M_RX;
+
+ if (hdt_7_5_rx_capable(conn->hdev))
+ phys |= BT_PHY_HDT_7_5M_RX;
+ }
+ }
+
break;
}
@@ -3175,7 +3190,7 @@ static u16 bt_phy_pkt_type(struct hci_conn *conn, u32 phys)
return pkt_type;
}
-static int bt_phy_le_phy(u32 phys, u8 *tx_phys, u8 *rx_phys)
+static int bt_phy_le_phy(u32 phys, u8 *tx_phys, u8 *rx_phys, u16 *phy_opts)
{
if (!tx_phys || !rx_phys)
return -EINVAL;
@@ -3201,12 +3216,47 @@ static int bt_phy_le_phy(u32 phys, u8 *tx_phys, u8 *rx_phys)
if (phys & BT_PHY_LE_CODED_RX)
*rx_phys |= HCI_LE_SET_PHY_CODED;
+ if (phys & BT_PHY_HDT_2M_TX || phys & BT_PHY_HDT_3M_TX ||
+ phys & BT_PHY_HDT_4M_TX || phys & BT_PHY_HDT_6M_TX ||
+ phys & BT_PHY_HDT_7_5M_TX) {
+ *tx_phys |= HCI_LE_SET_PHY_HDT;
+
+ if (phys & BT_PHY_HDT_2M_TX)
+ *phy_opts |= BIT(2);
+ if (phys & BT_PHY_HDT_3M_TX)
+ *phy_opts |= BIT(3);
+ if (phys & BT_PHY_HDT_4M_TX)
+ *phy_opts |= BIT(4);
+ if (phys & BT_PHY_HDT_6M_TX)
+ *phy_opts |= BIT(5);
+ if (phys & BT_PHY_HDT_7_5M_TX)
+ *phy_opts |= BIT(6);
+ }
+
+ if (phys & BT_PHY_HDT_2M_RX || phys & BT_PHY_HDT_3M_RX ||
+ phys & BT_PHY_HDT_4M_RX || phys & BT_PHY_HDT_6M_RX ||
+ phys & BT_PHY_HDT_7_5M_RX) {
+ *rx_phys |= HCI_LE_SET_PHY_HDT;
+
+ if (phys & BT_PHY_HDT_2M_RX)
+ *phy_opts |= BIT(2);
+ if (phys & BT_PHY_HDT_3M_RX)
+ *phy_opts |= BIT(3);
+ if (phys & BT_PHY_HDT_4M_RX)
+ *phy_opts |= BIT(4);
+ if (phys & BT_PHY_HDT_6M_RX)
+ *phy_opts |= BIT(5);
+ if (phys & BT_PHY_HDT_7_5M_RX)
+ *phy_opts |= BIT(6);
+ }
+
return 0;
}
int hci_conn_set_phy(struct hci_conn *conn, u32 phys)
{
u8 tx_phys, rx_phys;
+ u16 phy_opts = 0;
switch (conn->type) {
case SCO_LINK:
@@ -3221,13 +3271,30 @@ int hci_conn_set_phy(struct hci_conn *conn, u32 phys)
bt_phy_pkt_type(conn, phys));
case LE_LINK:
/* Only allow setting LE PHYs if link type is LE */
- if (phys & ~BT_PHY_LE_MASK)
+ if (phys & ~(BT_PHY_LE_MASK | BT_PHY_HDT_MASK))
return -EINVAL;
- if (bt_phy_le_phy(phys, &tx_phys, &rx_phys))
+ /* HDT PHYs can only be selected if the controller supports
+ * them.
+ */
+ if (phys & BT_PHY_HDT_MASK && !hdt_capable(conn->hdev))
return -EINVAL;
- return hci_le_set_phy(conn, tx_phys, rx_phys);
+ /* HDT6 and HDT7.5 are optional in each direction, see
+ * hci_hdt_tx_rates().
+ */
+ if ((phys & BT_PHY_HDT_6M_TX && !hdt_6_tx_capable(conn->hdev)) ||
+ (phys & BT_PHY_HDT_6M_RX && !hdt_6_rx_capable(conn->hdev)) ||
+ (phys & BT_PHY_HDT_7_5M_TX &&
+ !hdt_7_5_tx_capable(conn->hdev)) ||
+ (phys & BT_PHY_HDT_7_5M_RX &&
+ !hdt_7_5_rx_capable(conn->hdev)))
+ return -EINVAL;
+
+ if (bt_phy_le_phy(phys, &tx_phys, &rx_phys, &phy_opts))
+ return -EINVAL;
+
+ return hci_le_set_phy(conn, tx_phys, rx_phys, phy_opts);
default:
return -EINVAL;
}
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index f0ce124bb12b..cdf010a2c37f 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2995,6 +2995,7 @@ static void hci_cs_le_set_phy(struct hci_dev *hdev, u8 status)
if (conn) {
conn->le_tx_def_phys = cp->tx_phys;
conn->le_rx_def_phys = cp->rx_phys;
+ conn->le_phy_opts = __le16_to_cpu(cp->phy_opts);
}
hci_dev_unlock(hdev);
@@ -3942,6 +3943,35 @@ static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd)
rcu_read_unlock();
}
+static u8 hci_cc_le_read_def_data_len_v2(struct hci_dev *hdev, void *data,
+ struct sk_buff *skb)
+{
+ struct hci_rp_le_read_def_data_len_v2 *rp = data;
+ struct hci_cp_le_read_def_data_len_v2 *cp;
+
+ bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
+
+ if (rp->status)
+ return rp->status;
+
+ cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_DEF_DATA_LEN_V2);
+ if (!cp)
+ return rp->status;
+
+ switch (cp->phys) {
+ case 0x00: /* All GFSK PHYs */
+ hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
+ hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
+ break;
+ case 0x01: /* HDT PHY */
+ hdev->hdt_def_tx_len = le16_to_cpu(rp->tx_len);
+ hdev->hdt_def_tx_time = le16_to_cpu(rp->tx_time);
+ break;
+ }
+
+ return rp->status;
+}
+
static u8 hci_cc_le_read_buffer_size_v2(struct hci_dev *hdev, void *data,
struct sk_buff *skb)
{
@@ -3969,6 +3999,78 @@ static u8 hci_cc_le_read_buffer_size_v2(struct hci_dev *hdev, void *data,
return rp->status;
}
+static u8 hci_cc_le_read_max_data_len_v2(struct hci_dev *hdev, void *data,
+ struct sk_buff *skb)
+{
+ struct hci_rp_le_read_max_data_len_v2 *rp = data;
+ struct hci_cp_le_read_max_data_len_v2 *cp;
+
+ bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
+
+ if (rp->status)
+ return rp->status;
+
+ cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_MAX_DATA_LEN_V2);
+ if (!cp)
+ return rp->status;
+
+ switch (cp->phy) {
+ case 0x00:
+ case 0x01:
+ case 0x02:
+ case 0x03:
+ hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
+ hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
+ hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
+ hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
+ break;
+ case 0x05:
+ hdev->hdt_max_tx_len = le16_to_cpu(rp->tx_len);
+ hdev->hdt_max_tx_time = le16_to_cpu(rp->tx_time);
+ hdev->hdt_max_rx_len = le16_to_cpu(rp->rx_len);
+ hdev->hdt_max_rx_time = le16_to_cpu(rp->rx_time);
+ hdev->hdt_max_tx_win = rp->tx_win;
+ hdev->hdt_max_rx_win = rp->rx_win;
+ hdev->hdt_max_rx_packet = le16_to_cpu(rp->rx_packet);
+ break;
+ }
+
+ return rp->status;
+}
+
+static u8 hci_cc_le_write_def_data_len_v2(struct hci_dev *hdev, void *data,
+ struct sk_buff *skb)
+{
+ struct hci_cp_le_write_def_data_len_v2 *sent;
+ struct hci_ev_status *rp = data;
+
+ bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
+
+ if (rp->status)
+ return rp->status;
+
+ sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN_V2);
+ if (!sent)
+ return rp->status;
+
+ hci_dev_lock(hdev);
+
+ switch (sent->phys) {
+ case 0x00:
+ hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
+ hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
+ break;
+ case 0x01:
+ hdev->hdt_def_tx_len = le16_to_cpu(sent->tx_len);
+ hdev->hdt_def_tx_time = le16_to_cpu(sent->tx_time);
+ break;
+ }
+
+ hci_dev_unlock(hdev);
+
+ return rp->status;
+}
+
static void hci_unbound_cis_failed(struct hci_dev *hdev, u8 cig, u8 status)
{
struct hci_conn *conn, *tmp;
@@ -4121,6 +4223,81 @@ static u8 hci_cc_le_read_all_local_features(struct hci_dev *hdev, void *data,
return rp->status;
}
+static u8 hci_cc_le_set_cig_params_v2(struct hci_dev *hdev, void *data,
+ struct sk_buff *skb)
+{
+ struct hci_rp_le_set_cig_params_v2 *rp = data;
+ struct hci_cp_le_set_cig_params_v2 *cp;
+ struct hci_conn *conn;
+ u8 status = rp->status;
+ bool pending = false;
+ size_t len;
+ int i;
+
+ bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
+
+ cp = hci_sent_cmd_data_len(hdev, HCI_OP_LE_SET_CIG_PARAMS_V2, &len);
+ if (!rp->status &&
+ (!cp || len < sizeof(*cp) ||
+ len < struct_size(cp, cis, cp->num_cis) ||
+ rp->num_handles != cp->num_cis ||
+ rp->cig_id != cp->cig_id ||
+ skb->len < array_size(rp->num_handles, sizeof(*rp->handle)))) {
+ bt_dev_err(hdev,
+ "unexpected Set CIG Parameters v2 response data");
+ status = HCI_ERROR_UNSPECIFIED;
+ }
+
+ hci_dev_lock(hdev);
+
+ /* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E page 2554
+ *
+ * If the Status return parameter is non-zero, then the state of the CIG
+ * and its CIS configurations shall not be changed by the command. If
+ * the CIG did not already exist, it shall not be created.
+ */
+ if (status) {
+ /* Keep current configuration, fail only the unbound CIS of the
+ * CIG the command was sent for.
+ */
+ hci_unbound_cis_failed(hdev, cp && len >= sizeof(*cp) ?
+ cp->cig_id : rp->cig_id, status);
+ goto unlock;
+ }
+
+ /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2553
+ *
+ * If the Status return parameter is zero, then the Controller shall
+ * set the Connection_Handle arrayed return parameter to the connection
+ * handle(s) corresponding to the CIS configurations specified in
+ * the CIS_IDs command parameter, in the same order.
+ */
+ for (i = 0; i < rp->num_handles; ++i) {
+ conn = hci_conn_hash_lookup_cis(hdev, NULL, 0, rp->cig_id,
+ cp->cis[i].cis_id);
+ if (!conn || !bacmp(&conn->dst, BDADDR_ANY))
+ continue;
+
+ if (conn->state != BT_BOUND && conn->state != BT_CONNECT)
+ continue;
+
+ if (hci_conn_set_handle(conn, __le16_to_cpu(rp->handle[i])))
+ continue;
+
+ if (conn->state == BT_CONNECT)
+ pending = true;
+ }
+
+unlock:
+ if (pending)
+ hci_le_create_cis_pending(hdev);
+
+ hci_dev_unlock(hdev);
+
+ /* A response that doesn't match the command fails it */
+ return status;
+}
+
static void hci_cs_le_create_big(struct hci_dev *hdev, u8 status)
{
bt_dev_dbg(hdev, "status 0x%2.2x", status);
@@ -4409,8 +4586,14 @@ static const struct hci_cc {
HCI_CC(HCI_OP_LE_READ_TRANSMIT_POWER, hci_cc_le_read_transmit_power,
sizeof(struct hci_rp_le_read_transmit_power)),
HCI_CC_STATUS(HCI_OP_LE_SET_PRIVACY_MODE, hci_cc_le_set_privacy_mode),
+ HCI_CC(HCI_OP_LE_READ_DEF_DATA_LEN_V2, hci_cc_le_read_def_data_len_v2,
+ sizeof(struct hci_rp_le_read_def_data_len_v2)),
HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE_V2, hci_cc_le_read_buffer_size_v2,
sizeof(struct hci_rp_le_read_buffer_size_v2)),
+ HCI_CC(HCI_OP_LE_READ_MAX_DATA_LEN_V2, hci_cc_le_read_max_data_len_v2,
+ sizeof(struct hci_rp_le_read_max_data_len_v2)),
+ HCI_CC_STATUS(HCI_OP_LE_WRITE_DEF_DATA_LEN_V2,
+ hci_cc_le_write_def_data_len_v2),
HCI_CC_VL(HCI_OP_LE_SET_CIG_PARAMS, hci_cc_le_set_cig_params,
sizeof(struct hci_rp_le_set_cig_params), HCI_MAX_CC_PLEN),
HCI_CC(HCI_OP_LE_SETUP_ISO_PATH, hci_cc_le_setup_iso_path,
@@ -4418,6 +4601,9 @@ static const struct hci_cc {
HCI_CC(HCI_OP_LE_READ_ALL_LOCAL_FEATURES,
hci_cc_le_read_all_local_features,
sizeof(struct hci_rp_le_read_all_local_features)),
+ HCI_CC_VL(HCI_OP_LE_SET_CIG_PARAMS_V2, hci_cc_le_set_cig_params_v2,
+ sizeof(struct hci_rp_le_set_cig_params_v2),
+ HCI_MAX_CC_PLEN),
};
static u8 hci_cc_func(struct hci_dev *hdev, const struct hci_cc *cc,
@@ -6945,6 +7131,12 @@ static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev, void *data,
conn->le_tx_def_phys &= ~HCI_LE_SET_PHY_CODED;
conn->le_rx_def_phys &= ~HCI_LE_SET_PHY_CODED;
}
+
+ /* HDT is a feature of page 1, which this event doesn't
+ * report, so it can't be assumed.
+ */
+ conn->le_tx_def_phys &= ~HCI_LE_SET_PHY_HDT;
+ conn->le_rx_def_phys &= ~HCI_LE_SET_PHY_HDT;
}
if (conn->state == BT_CONFIG) {
@@ -7185,6 +7377,8 @@ static u8 le_phy_qos(u8 phy)
return HCI_LE_SET_PHY_2M;
case 0x03:
return HCI_LE_SET_PHY_CODED;
+ case 0x05:
+ return HCI_LE_SET_PHY_HDT;
}
return 0;
@@ -7368,51 +7562,45 @@ static int hci_iso_term_big_sync(struct hci_dev *hdev, void *data)
HCI_ERROR_LOCAL_HOST_TERM);
}
-static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
- struct sk_buff *skb)
+static void hci_le_create_big_complete(struct hci_dev *hdev, u8 status,
+ u8 handle, u8 num_bis,
+ const __le16 *bis_handle)
{
- struct hci_evt_le_create_big_complete *ev = data;
struct hci_conn *conn;
__u8 i = 0;
- BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
-
- if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_CREATE_BIG_COMPLETE,
- flex_array_size(ev, bis_handle, ev->num_bis)))
- return;
-
hci_dev_lock(hdev);
/* Connect all BISes that are bound to the BIG */
- while ((conn = hci_conn_hash_lookup_big_state(hdev, ev->handle,
+ while ((conn = hci_conn_hash_lookup_big_state(hdev, handle,
BT_BOUND,
HCI_ROLE_MASTER))) {
- if (ev->status) {
- hci_connect_cfm(conn, ev->status);
+ if (status) {
+ hci_connect_cfm(conn, status);
hci_conn_del(conn);
continue;
}
- if (ev->num_bis <= i) {
+ if (num_bis <= i) {
bt_dev_err(hdev,
"Not enough BIS handles for BIG 0x%2.2x",
- ev->handle);
- ev->status = HCI_ERROR_UNSPECIFIED;
- hci_connect_cfm(conn, ev->status);
+ handle);
+ status = HCI_ERROR_UNSPECIFIED;
+ hci_connect_cfm(conn, status);
hci_conn_del(conn);
continue;
}
if (hci_conn_set_handle(conn,
- __le16_to_cpu(ev->bis_handle[i++]))) {
+ __le16_to_cpu(bis_handle[i++]))) {
bt_dev_err(hdev,
"Failed to set BIS handle for BIG 0x%2.2x",
- ev->handle);
+ handle);
/* Force error so BIG gets terminated as not all BIS
* could be connected.
*/
- ev->status = HCI_ERROR_UNSPECIFIED;
- hci_connect_cfm(conn, ev->status);
+ status = HCI_ERROR_UNSPECIFIED;
+ hci_connect_cfm(conn, status);
hci_conn_del(conn);
continue;
}
@@ -7427,18 +7615,33 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
/* If there is an unexpected error or if no BISes have been connected
* for the BIG, terminate it.
*/
- if (ev->status == HCI_ERROR_UNSPECIFIED || (!ev->status && !i))
+ if (status == HCI_ERROR_UNSPECIFIED || (!status && !i))
/* If no BISes have been connected for the BIG,
* terminate. This is in case all bound connections
* have been closed before the BIG creation
* has completed.
*/
hci_cmd_sync_queue(hdev, hci_iso_term_big_sync,
- UINT_PTR(ev->handle), NULL);
+ UINT_PTR(handle), NULL);
hci_dev_unlock(hdev);
}
+static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
+ struct sk_buff *skb)
+{
+ struct hci_evt_le_create_big_complete *ev = data;
+
+ BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
+
+ if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_CREATE_BIG_COMPLETE,
+ flex_array_size(ev, bis_handle, ev->num_bis)))
+ return;
+
+ hci_le_create_big_complete(hdev, ev->status, ev->handle, ev->num_bis,
+ ev->bis_handle);
+}
+
static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data,
struct sk_buff *skb)
{
@@ -7623,6 +7826,11 @@ static void hci_le_read_all_remote_features_evt(struct hci_dev *hdev,
conn->le_tx_def_phys &= ~HCI_LE_SET_PHY_CODED;
conn->le_rx_def_phys &= ~HCI_LE_SET_PHY_CODED;
}
+
+ if (!hdt_capable(conn)) {
+ conn->le_tx_def_phys &= ~HCI_LE_SET_PHY_HDT;
+ conn->le_rx_def_phys &= ~HCI_LE_SET_PHY_HDT;
+ }
}
if (conn->state == BT_CONFIG) {
@@ -7682,6 +7890,109 @@ static void hci_le_conn_rate_change_evt(struct hci_dev *hdev, void *data,
hci_dev_unlock(hdev);
}
+static void hci_le_cis_established_evt_v3(struct hci_dev *hdev, void *data,
+ struct sk_buff *skb)
+{
+ struct hci_evt_le_cis_established_v3 *ev = data;
+ struct hci_conn *conn;
+ struct bt_iso_qos *qos;
+ bool pending = false;
+ u16 handle = __le16_to_cpu(ev->handle);
+ u32 c_sdu_interval, p_sdu_interval;
+
+ bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
+
+ hci_dev_lock(hdev);
+
+ conn = hci_conn_hash_lookup_handle(hdev, handle);
+ if (!conn) {
+ bt_dev_err(hdev,
+ "Unable to find connection with handle 0x%4.4x",
+ handle);
+ goto unlock;
+ }
+
+ if (conn->type != CIS_LINK) {
+ bt_dev_err(hdev,
+ "Invalid connection link type handle 0x%4.4x",
+ handle);
+ goto unlock;
+ }
+
+ qos = &conn->iso_qos;
+
+ pending = test_and_clear_bit(HCI_CONN_CREATE_CIS, conn->flags);
+
+ c_sdu_interval = get_unaligned_le24(ev->c_sdu_interval);
+ p_sdu_interval = get_unaligned_le24(ev->p_sdu_interval);
+
+ switch (conn->role) {
+ case HCI_ROLE_SLAVE:
+ qos->ucast.in.interval = c_sdu_interval;
+ qos->ucast.out.interval = p_sdu_interval;
+ /* Convert Transport Latency (us) to Latency (msec) */
+ qos->ucast.in.latency =
+ DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
+ 1000);
+ qos->ucast.out.latency =
+ DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),
+ 1000);
+ qos->ucast.in.sdu = ev->c_bn ? le16_to_cpu(ev->c_sdu) : 0;
+ qos->ucast.out.sdu = ev->p_bn ? le16_to_cpu(ev->p_sdu) : 0;
+ qos->ucast.in.phys = le_phy_qos(ev->c_phy);
+ qos->ucast.out.phys = le_phy_qos(ev->p_phy);
+ break;
+ case HCI_ROLE_MASTER:
+ qos->ucast.in.interval = p_sdu_interval;
+ qos->ucast.out.interval = c_sdu_interval;
+ /* Convert Transport Latency (us) to Latency (msec) */
+ qos->ucast.out.latency =
+ DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
+ 1000);
+ qos->ucast.in.latency =
+ DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),
+ 1000);
+ qos->ucast.out.sdu = ev->c_bn ? le16_to_cpu(ev->c_sdu) : 0;
+ qos->ucast.in.sdu = ev->p_bn ? le16_to_cpu(ev->p_sdu) : 0;
+ qos->ucast.out.phys = le_phy_qos(ev->c_phy);
+ qos->ucast.in.phys = le_phy_qos(ev->p_phy);
+ break;
+ }
+
+ if (!ev->status) {
+ conn->state = BT_CONNECTED;
+ hci_debugfs_create_conn(conn);
+ hci_conn_add_sysfs(conn);
+ hci_iso_setup_path(conn);
+ goto unlock;
+ }
+
+ conn->state = BT_CLOSED;
+ hci_connect_cfm(conn, ev->status);
+ hci_conn_del(conn);
+
+unlock:
+ if (pending)
+ hci_le_create_cis_pending(hdev);
+
+ hci_dev_unlock(hdev);
+}
+
+static void hci_le_create_big_complete_v2_evt(struct hci_dev *hdev, void *data,
+ struct sk_buff *skb)
+{
+ struct hci_evt_le_create_big_complete_v2 *ev = data;
+
+ BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
+
+ if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_CREATE_BIG_COMPLETE_V2,
+ flex_array_size(ev, bis_handle, ev->num_bis)))
+ return;
+
+ hci_le_create_big_complete(hdev, ev->status, ev->handle, ev->num_bis,
+ ev->bis_handle);
+}
+
#define HCI_LE_EV_VL(_op, _func, _min_len, _max_len) \
[_op] = { \
.func = _func, \
@@ -7799,6 +8110,14 @@ static const struct hci_le_ev {
/* [0x37 = HCI_EVT_LE_CONN_RATE_CHANGE] */
HCI_LE_EV(HCI_EVT_LE_CONN_RATE_CHANGE, hci_le_conn_rate_change_evt,
sizeof(struct hci_evt_le_conn_rate_change)),
+ /* [0x3a = HCI_EVT_LE_CIS_ESTABLISHED_V3] */
+ HCI_LE_EV(HCI_EVT_LE_CIS_ESTABLISHED_V3, hci_le_cis_established_evt_v3,
+ sizeof(struct hci_evt_le_cis_established_v3)),
+ /* [0x3b = HCI_EVT_LE_CREATE_BIG_COMPLETE_V2] */
+ HCI_LE_EV_VL(HCI_EVT_LE_CREATE_BIG_COMPLETE_V2,
+ hci_le_create_big_complete_v2_evt,
+ sizeof(struct hci_evt_le_create_big_complete_v2),
+ HCI_MAX_LE_SUBEVT_PLEN),
};
static void hci_le_meta_evt(struct hci_dev *hdev, void *data,
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 9213e3ef9f26..9a5b198fa0c5 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -4717,6 +4717,23 @@ static int hci_le_set_event_mask_sync(struct hci_dev *hdev)
if (le_sci_capable(hdev))
events[6] |= 0x40; /* LE Connection Rate Change event */
+ /* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 4, Part E,
+ * Section 4.8.2:
+ *
+ * If an event has more than one version and the event is
+ * generated, then the Controller shall use the latest version that
+ * is both supported and enabled ("unmasked") in the relevant event
+ * mask.
+ *
+ * So with these unmasked the older versions aren't reported.
+ */
+ if (hdt_capable(hdev)) {
+ if (cis_capable(hdev))
+ events[7] |= BIT(1); /* LE CIS Established v3 */
+ if (bis_capable(hdev))
+ events[7] |= BIT(2); /* LE Create BIG Complete v2 */
+ }
+
return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EVENT_MASK,
sizeof(events), events, HCI_CMD_TIMEOUT);
}
@@ -4794,22 +4811,71 @@ static int hci_le_set_rpa_timeout_sync(struct hci_dev *hdev)
HCI_CMD_TIMEOUT);
}
+/* Read LE Maximum Data Length V2 */
+static int hci_le_read_max_data_len_v2_sync(struct hci_dev *hdev, u8 phy)
+{
+ struct hci_cp_le_read_max_data_len_v2 cp;
+
+ memset(&cp, 0, sizeof(cp));
+ cp.phy = phy;
+
+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_MAX_DATA_LEN_V2,
+ sizeof(cp), &cp, HCI_CMD_TIMEOUT);
+}
+
/* Read LE Maximum Data Length */
static int hci_le_read_max_data_len_sync(struct hci_dev *hdev)
{
if (!(hdev->le_features[0] & HCI_LE_DATA_LEN_EXT))
return 0;
+ /* Check if HDT PHY and HCI_OP_LE_READ_MAX_DATA_LEN_V2 are supported */
+ if (hdt_capable(hdev) && hdev->commands[50] & BIT(5)) {
+ int err;
+
+ /* Read max data length for non-hdt PHYs (use 0x01 for LE 1M) */
+ err = hci_le_read_max_data_len_v2_sync(hdev, 0x01);
+ if (err)
+ return err;
+
+ /* Read max data length for HDT (0x05) */
+ return hci_le_read_max_data_len_v2_sync(hdev, 0x05);
+ }
+
return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL,
HCI_CMD_TIMEOUT);
}
+/* Read LE Suggested Default Data Length V2 */
+static int hci_le_read_def_data_len_v2_sync(struct hci_dev *hdev, u8 phys)
+{
+ struct hci_cp_le_read_def_data_len_v2 cp;
+
+ memset(&cp, 0, sizeof(cp));
+ cp.phys = phys;
+
+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_DEF_DATA_LEN_V2,
+ sizeof(cp), &cp, HCI_CMD_TIMEOUT);
+}
+
/* Read LE Suggested Default Data Length */
static int hci_le_read_def_data_len_sync(struct hci_dev *hdev)
{
if (!(hdev->le_features[0] & HCI_LE_DATA_LEN_EXT))
return 0;
+ if (hdt_capable(hdev) && hdev->commands[50] & BIT(6)) {
+ int err;
+
+ /* All GFSK PHYs */
+ err = hci_le_read_def_data_len_v2_sync(hdev, 0x00);
+ if (err)
+ return err;
+
+ /* HDT PHY */
+ return hci_le_read_def_data_len_v2_sync(hdev, 0x01);
+ }
+
return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL,
HCI_CMD_TIMEOUT);
}
@@ -5233,6 +5299,41 @@ static const struct hci_init_stage hci_init4[] = {
{}
};
+/* Write Suggested Default Data Length V2 */
+static int hci_le_write_def_data_len_v2_sync(struct hci_dev *hdev, u8 phys)
+{
+ struct hci_cp_le_write_def_data_len_v2 cp;
+
+ switch (phys) {
+ case 0x00:
+ /* If already set to max skip */
+ if (hdev->le_def_tx_len == hdev->le_max_tx_len &&
+ hdev->le_def_tx_time == hdev->le_max_tx_time)
+ return 0;
+
+ memset(&cp, 0, sizeof(cp));
+ /* All GFSK PHYs */
+ cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
+ cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);
+ break;
+ case 0x01:
+ /* If already set to max skip */
+ if (hdev->hdt_def_tx_len == hdev->hdt_max_tx_len &&
+ hdev->hdt_def_tx_time == hdev->hdt_max_tx_time)
+ return 0;
+
+ memset(&cp, 0, sizeof(cp));
+ /* HDT PHY */
+ cp.phys = 0x01;
+ cp.tx_len = cpu_to_le16(hdev->hdt_max_tx_len);
+ cp.tx_time = cpu_to_le16(hdev->hdt_max_tx_time);
+ break;
+ }
+
+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN_V2,
+ sizeof(cp), &cp, HCI_CMD_TIMEOUT);
+}
+
/* Set Suggested Default Data Length to maximum if supported */
static int hci_le_set_write_def_data_len_sync(struct hci_dev *hdev)
{
@@ -5241,7 +5342,36 @@ static int hci_le_set_write_def_data_len_sync(struct hci_dev *hdev)
if (!(hdev->le_features[0] & HCI_LE_DATA_LEN_EXT))
return 0;
+ /* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 6, Part B,
+ * Section 4.5.10, Table 4.11: Valid ranges for data PDU length
+ * management parameters on the GFSK PHYs, at most 251 octets and
+ * 17040 microseconds, so clamp what the controller reports to them.
+ */
+ if (hdev->le_max_tx_len > 0x00fb)
+ hdev->le_max_tx_len = 0x00fb;
+
+ if (hdev->le_max_tx_time > 0x4290)
+ hdev->le_max_tx_time = 0x4290;
+
+ /* If controller is HDT check if it support V2 then use it */
+ if (hdt_capable(hdev) && hdev->commands[50] & BIT(7)) {
+ int err;
+
+ /* All GFSK PHYs */
+ err = hci_le_write_def_data_len_v2_sync(hdev, 0x00);
+ if (err)
+ return err;
+
+ return hci_le_write_def_data_len_v2_sync(hdev, 0x01);
+ }
+
+ /* If already set to max skip */
+ if (hdev->le_def_tx_len == hdev->le_max_tx_len &&
+ hdev->le_def_tx_time == hdev->le_max_tx_time)
+ return 0;
+
memset(&cp, 0, sizeof(cp));
+
cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);
@@ -5249,6 +5379,39 @@ static int hci_le_set_write_def_data_len_sync(struct hci_dev *hdev)
sizeof(cp), &cp, HCI_CMD_TIMEOUT);
}
+/* HDT rates the controller supports in each direction.
+ *
+ * BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 6, Part A, Section 1:
+ *
+ * If the LE HDT PHY is supported, then HDT2, HDT3, and HDT4 shall be
+ * supported. HDT6 and HDT7.5 are optional
+ */
+static u16 hci_hdt_tx_rates(struct hci_dev *hdev)
+{
+ u16 rates = HCI_HDT_RATE_2M | HCI_HDT_RATE_3M | HCI_HDT_RATE_4M;
+
+ if (hdt_6_tx_capable(hdev))
+ rates |= HCI_HDT_RATE_6M;
+
+ if (hdt_7_5_tx_capable(hdev))
+ rates |= HCI_HDT_RATE_7_5M;
+
+ return rates;
+}
+
+static u16 hci_hdt_rx_rates(struct hci_dev *hdev)
+{
+ u16 rates = HCI_HDT_RATE_2M | HCI_HDT_RATE_3M | HCI_HDT_RATE_4M;
+
+ if (hdt_6_rx_capable(hdev))
+ rates |= HCI_HDT_RATE_6M;
+
+ if (hdt_7_5_rx_capable(hdev))
+ rates |= HCI_HDT_RATE_7_5M;
+
+ return rates;
+}
+
/* Set Default PHY parameters if command is supported, enables all supported
* PHYs according to the LE Features bits.
*/
@@ -5282,6 +5445,12 @@ static int hci_le_set_default_phy_sync(struct hci_dev *hdev)
cp.rx_phys |= HCI_LE_SET_PHY_CODED;
}
+ /* Enables HDT PHY if supported */
+ if (hdt_capable(hdev)) {
+ cp.tx_phys |= HCI_LE_SET_PHY_HDT;
+ cp.rx_phys |= HCI_LE_SET_PHY_HDT;
+ }
+
return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
sizeof(cp), &cp, HCI_CMD_TIMEOUT);
}
@@ -7253,10 +7422,15 @@ int hci_le_create_cis_sync(struct hci_dev *hdev)
if (!aux_num_cis)
return 0;
- /* Wait for HCI_LE_CIS_Established */
+ /* Wait for HCI_LE_CIS_Established, which HDT capable controllers
+ * report with the v3 event since it is the one unmasked, see
+ * hci_le_set_event_mask_sync().
+ */
return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_CREATE_CIS,
struct_size(cmd, cis, cmd->num_cis),
- cmd, HCI_EVT_LE_CIS_ESTABLISHED,
+ cmd, hdt_capable(hdev) ?
+ HCI_EVT_LE_CIS_ESTABLISHED_V3 :
+ HCI_EVT_LE_CIS_ESTABLISHED,
timeout, NULL);
}
@@ -8225,7 +8399,7 @@ static int hci_le_set_phy_sync(struct hci_dev *hdev, void *data)
HCI_CMD_TIMEOUT, NULL);
}
-int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys)
+int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys, u16 phy_opts)
{
struct hci_dev *hdev = conn->hdev;
struct hci_cp_le_set_phy *cp;
@@ -8239,6 +8413,7 @@ int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys)
cp->handle = cpu_to_le16(conn->handle);
cp->tx_phys = tx_phys;
cp->rx_phys = rx_phys;
+ cp->phy_opts = cpu_to_le16(phy_opts);
err = hci_cmd_sync_queue_once(hdev, hci_le_set_phy_sync, cp,
le_phy_update_complete);
@@ -8247,3 +8422,196 @@ int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys)
return (err == -EEXIST) ? 0 : err;
}
+
+/* LE Set CIG Params v2 */
+static int hci_le_set_cig_params_v2_sync(struct hci_dev *hdev, u8 cig_id)
+{
+ DEFINE_FLEX(struct hci_cp_le_set_cig_params_v2, pdu, cis, num_cis,
+ HCI_LE_CIG_PARAMS_V2_MAX_CIS);
+ struct hci_conn *conn;
+ struct bt_iso_qos *qos;
+ u8 aux_num_cis = 0;
+ u8 cis_id;
+
+ hci_dev_lock(hdev);
+
+ conn = hci_conn_hash_lookup_cig(hdev, cig_id);
+ if (!conn) {
+ hci_dev_unlock(hdev);
+ return 0;
+ }
+
+ qos = &conn->iso_qos;
+ pdu->cig_id = cig_id;
+ hci_cpu_to_le24(qos->ucast.out.interval, pdu->c_interval);
+ hci_cpu_to_le24(qos->ucast.in.interval, pdu->p_interval);
+ pdu->sca = qos->ucast.sca;
+ pdu->packing = qos->ucast.packing;
+ pdu->framing = qos->ucast.framing;
+ pdu->c_latency = cpu_to_le16(qos->ucast.out.latency);
+ pdu->p_latency = cpu_to_le16(qos->ucast.in.latency);
+
+ /* Reprogram all CIS(s) with the same CIG, valid range are:
+ * num_cis: 0x00 to 0x1F
+ * cis_id: 0x00 to 0xEF
+ */
+ for (cis_id = 0x00; cis_id < 0xf0 &&
+ aux_num_cis < pdu->num_cis; cis_id++) {
+ struct hci_cis_params_v2 *cis;
+
+ conn = hci_conn_hash_lookup_cis(hdev, NULL, 0, cig_id, cis_id);
+ if (!conn)
+ continue;
+
+ qos = &conn->iso_qos;
+
+ cis = &pdu->cis[aux_num_cis++];
+ cis->cis_id = cis_id;
+ cis->c_sdu = cpu_to_le16(conn->iso_qos.ucast.out.sdu);
+ cis->p_sdu = cpu_to_le16(conn->iso_qos.ucast.in.sdu);
+ cis->c_phys = qos->ucast.out.phys ? qos->ucast.out.phys :
+ qos->ucast.in.phys;
+ cis->p_phys = qos->ucast.in.phys ? qos->ucast.in.phys :
+ qos->ucast.out.phys;
+ cis->c_rtn = qos->ucast.out.rtn;
+ cis->p_rtn = qos->ucast.in.rtn;
+
+ if (cis->c_phys & HCI_LE_SET_PHY_HDT)
+ cis->c_hdt_rates = cpu_to_le16(hci_hdt_tx_rates(hdev));
+
+ if (cis->p_phys & HCI_LE_SET_PHY_HDT)
+ cis->p_hdt_rates = cpu_to_le16(hci_hdt_rx_rates(hdev));
+ }
+ pdu->num_cis = aux_num_cis;
+
+ hci_dev_unlock(hdev);
+
+ if (!pdu->num_cis)
+ return 0;
+
+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_CIG_PARAMS_V2,
+ struct_size(pdu, cis, pdu->num_cis),
+ pdu, HCI_CMD_TIMEOUT);
+}
+
+/* LE Set CIG Params */
+int hci_le_set_cig_params_sync(struct hci_dev *hdev, u8 cig_id)
+{
+ DEFINE_FLEX(struct hci_cp_le_set_cig_params, pdu, cis, num_cis, 0x1f);
+ struct hci_conn *conn;
+ struct bt_iso_qos *qos;
+ u8 aux_num_cis = 0;
+ u8 cis_id;
+
+ if (le_set_cig_params_v2_capable(hdev))
+ return hci_le_set_cig_params_v2_sync(hdev, cig_id);
+
+ hci_dev_lock(hdev);
+
+ conn = hci_conn_hash_lookup_cig(hdev, cig_id);
+ if (!conn) {
+ hci_dev_unlock(hdev);
+ return 0;
+ }
+
+ qos = &conn->iso_qos;
+ pdu->cig_id = cig_id;
+ hci_cpu_to_le24(qos->ucast.out.interval, pdu->c_interval);
+ hci_cpu_to_le24(qos->ucast.in.interval, pdu->p_interval);
+ pdu->sca = qos->ucast.sca;
+ pdu->packing = qos->ucast.packing;
+ pdu->framing = qos->ucast.framing;
+ pdu->c_latency = cpu_to_le16(qos->ucast.out.latency);
+ pdu->p_latency = cpu_to_le16(qos->ucast.in.latency);
+
+ /* Reprogram all CIS(s) with the same CIG, valid range are:
+ * num_cis: 0x00 to 0x1F
+ * cis_id: 0x00 to 0xEF
+ */
+ for (cis_id = 0x00; cis_id < 0xf0 &&
+ aux_num_cis < pdu->num_cis; cis_id++) {
+ struct hci_cis_params *cis;
+
+ conn = hci_conn_hash_lookup_cis(hdev, NULL, 0, cig_id, cis_id);
+ if (!conn)
+ continue;
+
+ qos = &conn->iso_qos;
+
+ cis = &pdu->cis[aux_num_cis++];
+ cis->cis_id = cis_id;
+ cis->c_sdu = cpu_to_le16(conn->iso_qos.ucast.out.sdu);
+ cis->p_sdu = cpu_to_le16(conn->iso_qos.ucast.in.sdu);
+ cis->c_phys = qos->ucast.out.phys ? qos->ucast.out.phys :
+ qos->ucast.in.phys;
+ cis->p_phys = qos->ucast.in.phys ? qos->ucast.in.phys :
+ qos->ucast.out.phys;
+ cis->c_rtn = qos->ucast.out.rtn;
+ cis->p_rtn = qos->ucast.in.rtn;
+ }
+ pdu->num_cis = aux_num_cis;
+
+ hci_dev_unlock(hdev);
+
+ if (!pdu->num_cis)
+ return 0;
+
+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_CIG_PARAMS,
+ struct_size(pdu, cis, pdu->num_cis),
+ pdu, HCI_CMD_TIMEOUT);
+}
+
+static int hci_le_create_big_v2_sync(struct hci_conn *conn,
+ struct bt_iso_qos *qos, u8 num_bis)
+{
+ struct hci_dev *hdev = conn->hdev;
+ struct hci_cp_le_create_big_v2 cp;
+
+ memset(&cp, 0, sizeof(cp));
+ cp.handle = qos->bcast.big;
+ cp.adv_handle = qos->bcast.bis;
+ cp.num_bis = num_bis;
+ hci_cpu_to_le24(qos->bcast.out.interval, cp.bis.sdu_interval);
+ cp.bis.sdu = cpu_to_le16(qos->bcast.out.sdu);
+ cp.bis.latency = cpu_to_le16(qos->bcast.out.latency);
+ cp.bis.rtn = qos->bcast.out.rtn;
+ cp.bis.phys = qos->bcast.out.phys;
+ cp.bis.packing = qos->bcast.packing;
+ cp.bis.framing = qos->bcast.framing;
+ cp.bis.encryption = qos->bcast.encryption;
+ memcpy(cp.bis.bcode, qos->bcast.bcode, sizeof(cp.bis.bcode));
+
+ /* Check if HDT PHY is set then enable HDT supported rates */
+ if (cp.bis.phys & HCI_LE_SET_PHY_HDT)
+ cp.bis.hdt_rates = cpu_to_le16(hci_hdt_tx_rates(hdev));
+
+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_CREATE_BIG_V2,
+ sizeof(cp), &cp, HCI_CMD_TIMEOUT);
+}
+
+int hci_le_create_big_sync(struct hci_conn *conn, struct bt_iso_qos *qos,
+ u8 num_bis)
+{
+ struct hci_dev *hdev = conn->hdev;
+ struct hci_cp_le_create_big cp;
+
+ if (hdt_capable(hdev) && hdev->commands[51] & BIT(3))
+ return hci_le_create_big_v2_sync(conn, qos, num_bis);
+
+ memset(&cp, 0, sizeof(cp));
+ cp.handle = qos->bcast.big;
+ cp.adv_handle = qos->bcast.bis;
+ cp.num_bis = num_bis;
+ hci_cpu_to_le24(qos->bcast.out.interval, cp.bis.sdu_interval);
+ cp.bis.sdu = cpu_to_le16(qos->bcast.out.sdu);
+ cp.bis.latency = cpu_to_le16(qos->bcast.out.latency);
+ cp.bis.rtn = qos->bcast.out.rtn;
+ cp.bis.phys = qos->bcast.out.phys;
+ cp.bis.packing = qos->bcast.packing;
+ cp.bis.framing = qos->bcast.framing;
+ cp.bis.encryption = qos->bcast.encryption;
+ memcpy(cp.bis.bcode, qos->bcast.bcode, sizeof(cp.bis.bcode));
+
+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_CREATE_BIG,
+ sizeof(cp), &cp, HCI_CMD_TIMEOUT);
+}
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 06f1e7ba2cb1..cc6c8b7ba027 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -1875,7 +1875,7 @@ static bool check_io_qos(struct bt_iso_io_qos *qos)
if (qos->latency && (qos->latency < 0x05 || qos->latency > 0xfa0))
return false;
- if (qos->phys > BT_ISO_PHY_ANY)
+ if (qos->phys & ~(BT_ISO_PHY_ANY | BT_ISO_PHY_HDT))
return false;
return true;
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 260ef2a45719..6ed3bf6f1738 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -865,6 +865,9 @@ static u32 get_supported_settings(struct hci_dev *hdev)
if (le_sci_capable(hdev))
settings |= MGMT_SETTING_SCI;
+ if (hdt_capable(hdev))
+ settings |= MGMT_SETTING_HDT;
+
settings |= MGMT_SETTING_PHY_CONFIGURATION;
return settings;
@@ -959,6 +962,9 @@ static u32 get_current_settings(struct hci_dev *hdev)
if (le_sci_enabled(hdev))
settings |= MGMT_SETTING_SCI;
+ if (hdt_enabled(hdev))
+ settings |= MGMT_SETTING_HDT;
+
return settings;
}
--
2.56.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v11 2/6] Bluetooth: ISO: Add extended QoS with the HDT rates
2026-11-09 17:18 [PATCH v11 0/6] Bluetooth: Add support for HDT and EKS Luiz Augusto von Dentz
2026-11-09 17:18 ` [PATCH v11 1/6] Bluetooth: Add initial support for HDT PHY Luiz Augusto von Dentz
@ 2026-11-09 17:18 ` Luiz Augusto von Dentz
2026-11-09 17:18 ` [PATCH v11 3/6] Bluetooth: Add initial support for EKS Luiz Augusto von Dentz
` (4 subsequent siblings)
6 siblings, 0 replies; 9+ messages in thread
From: Luiz Augusto von Dentz @ 2026-11-09 17:18 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Add struct bt_iso_qos_ext, an extensible version of struct bt_iso_qos,
so new QoS fields can be added without defining a new socket option or
struct each time. It starts with two fields:
- version tells which fields are valid, so later versions can add
fields while applications built for an earlier version keep working.
- type tells which member of the union is in use, unicast or
broadcast. The QoS is usually set before bind() or connect(), when
the socket can't tell which one it was given, so without type the
two could only grow together. With it, each can be extended on its
own by adding fields at its end, which is also why the union is the
last member.
BT_ISO_QOS_ANY leaves the type to connect() or listen(), which set it.
That works for version 1 since its unicast fields are a prefix of the
broadcast ones, and is what struct bt_iso_qos uses. A type that doesn't
match how the socket is used makes connect() or listen() fail with
-EINVAL, or setsockopt() on a socket that already has a connection,
such as with deferred setup or a PA sync.
Version 1 adds the rates of each direction, BT_ISO_HDT_RATE_*, so
userspace can select the HDT rates of a CIS or BIS along with
BT_ISO_PHY_HDT; 0 selects every rate the controller supports.
BT_ISO_QOS accepts either struct: the length of struct bt_iso_qos
selects it, as before, and any other length must carry struct
bt_iso_qos_ext of a known version and type. The struct is copied field
by field, so its padding is zeroed. Reading BT_ISO_QOS with a buffer
shorter than struct bt_iso_qos_ext returns struct bt_iso_qos, so
existing userspace is not affected; otherwise the version and type in
use are reported, including for connections set up by the controller.
The ISO sockets keep the extended form internally, so the rates are
passed to LE Set CIG Parameters v2 and LE Create BIG v2, and reported
back from LE CIS Established v3 and LE Create BIG Complete v2.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
include/net/bluetooth/bluetooth.h | 83 ++++++++++
include/net/bluetooth/hci_core.h | 15 +-
include/net/bluetooth/hci_sync.h | 2 +-
net/bluetooth/hci_conn.c | 34 ++--
net/bluetooth/hci_event.c | 20 ++-
net/bluetooth/hci_sync.c | 32 ++--
net/bluetooth/iso.c | 262 ++++++++++++++++++++++++++++--
7 files changed, 393 insertions(+), 55 deletions(-)
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index fbedd1ebd051..d59407349b3e 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -235,6 +235,89 @@ struct bt_iso_qos {
};
};
+/* Extended ISO QoS, set and read with BT_ISO_QOS.
+ *
+ * The option length tells it apart from struct bt_iso_qos, which is kept for
+ * existing applications. New fields are added by extending this struct rather
+ * than by adding new socket options or structs:
+ *
+ * - version tells which fields are valid, so later versions can add fields
+ * while older applications keep working with the fields they know.
+ * - type tells which member of the union is in use. The QoS is usually set
+ * before bind() or connect(), so the socket can't tell unicast from
+ * broadcast at that point. With type, struct bt_iso_ucast_qos_ext and
+ * struct bt_iso_bcast_qos_ext can each grow on their own, by adding fields
+ * at their end, without the kernel having to guess which one it was given.
+ * For that the union shall remain the last member.
+ *
+ * BT_ISO_QOS_ANY leaves the type to be set by connect() or listen(), which is
+ * possible with version 1 since its unicast fields are a prefix of the
+ * broadcast ones. A type that doesn't match how the socket is used makes
+ * connect() or listen() fail with -EINVAL, or setsockopt() on a socket that
+ * already has a connection, such as with deferred setup. getsockopt() reports
+ * the type in use once it is known.
+ *
+ * Version 1 adds the HDT rates of each direction, see BT_ISO_HDT_RATE_*, used
+ * when the PHY is BT_ISO_PHY_HDT; 0 means every rate the controller supports.
+ */
+#define BT_ISO_QOS_VERSION_1 0x0001
+
+#define BT_ISO_QOS_ANY 0x0000
+#define BT_ISO_QOS_UCAST 0x0001
+#define BT_ISO_QOS_BCAST 0x0002
+
+#define BT_ISO_HDT_RATE_2M BIT(0)
+#define BT_ISO_HDT_RATE_3M BIT(1)
+#define BT_ISO_HDT_RATE_4M BIT(2)
+#define BT_ISO_HDT_RATE_6M BIT(3)
+#define BT_ISO_HDT_RATE_7_5M BIT(4)
+
+struct bt_iso_io_qos_ext {
+ __u32 interval;
+ __u16 latency;
+ __u16 sdu;
+ __u8 phys;
+ __u8 rtn;
+ __u16 rates;
+};
+
+struct bt_iso_ucast_qos_ext {
+ __u8 cig;
+ __u8 cis;
+ __u8 sca;
+ __u8 packing;
+ __u8 framing;
+ struct bt_iso_io_qos_ext in;
+ struct bt_iso_io_qos_ext out;
+};
+
+struct bt_iso_bcast_qos_ext {
+ __u8 big;
+ __u8 bis;
+ __u8 sync_factor;
+ __u8 packing;
+ __u8 framing;
+ struct bt_iso_io_qos_ext in;
+ struct bt_iso_io_qos_ext out;
+ __u8 encryption;
+ __u8 bcode[16];
+ __u8 options;
+ __u16 skip;
+ __u16 sync_timeout;
+ __u8 sync_cte_type;
+ __u8 mse;
+ __u16 timeout;
+};
+
+struct bt_iso_qos_ext {
+ __u16 version;
+ __u16 type;
+ union { /* Shall be the last member */
+ struct bt_iso_ucast_qos_ext ucast;
+ struct bt_iso_bcast_qos_ext bcast;
+ };
+};
+
#define BT_ISO_PHY_1M BIT(0)
#define BT_ISO_PHY_2M BIT(1)
#define BT_ISO_PHY_CODED BIT(2)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 689e2a1266b4..1158ec218e1a 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -797,7 +797,7 @@ struct hci_conn {
__s8 rssi;
__s8 tx_power;
__s8 max_tx_power;
- struct bt_iso_qos iso_qos;
+ struct bt_iso_qos_ext iso_qos;
__u8 num_bis;
__u8 bis[HCI_MAX_ISO_BIS];
@@ -1678,23 +1678,24 @@ struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
__u16 setting, struct bt_codec *codec,
u16 timeout);
struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
- __u8 dst_type, struct bt_iso_qos *qos,
+ __u8 dst_type, struct bt_iso_qos_ext *qos,
u16 timeout);
struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, __u8 sid,
- struct bt_iso_qos *qos,
+ struct bt_iso_qos_ext *qos,
__u8 base_len, __u8 *base, u16 timeout);
int hci_past_bis(struct hci_conn *conn, bdaddr_t *dst, __u8 dst_type);
struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
- __u8 dst_type, struct bt_iso_qos *qos,
+ __u8 dst_type, struct bt_iso_qos_ext *qos,
u16 timeout);
struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
__u8 dst_type, __u8 sid,
- struct bt_iso_qos *qos,
+ struct bt_iso_qos_ext *qos,
__u8 data_len, __u8 *data, u16 timeout);
struct hci_conn *hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst,
- __u8 dst_type, __u8 sid, struct bt_iso_qos *qos);
+ __u8 dst_type, __u8 sid,
+ struct bt_iso_qos_ext *qos);
int hci_conn_big_create_sync(struct hci_dev *hdev, struct hci_conn *hcon,
- struct bt_iso_qos *qos, __u16 sync_handle,
+ struct bt_iso_qos_ext *qos, __u16 sync_handle,
__u8 num_bis, __u8 bis[]);
int hci_conn_check_link_mode(struct hci_conn *conn);
int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level);
diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h
index a24f6a84a447..aa12250eca52 100644
--- a/include/net/bluetooth/hci_sync.h
+++ b/include/net/bluetooth/hci_sync.h
@@ -195,5 +195,5 @@ int hci_le_read_remote_features(struct hci_conn *conn);
int hci_acl_change_pkt_type(struct hci_conn *conn, u16 pkt_type);
int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys, u16 phy_opts);
int hci_le_set_cig_params_sync(struct hci_dev *hdev, u8 cig_id);
-int hci_le_create_big_sync(struct hci_conn *conn, struct bt_iso_qos *qos,
+int hci_le_create_big_sync(struct hci_conn *conn, struct bt_iso_qos_ext *qos,
u8 num_bis);
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 83aed078032d..64d4cb940aaa 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1120,6 +1120,12 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type,
conn->cleanup = cis_cleanup;
conn->mtu = hdev->iso_mtu;
+
+ /* Set for connections the controller sets up, such as an
+ * incoming CIS, sockets replace it with their own QoS.
+ */
+ conn->iso_qos.version = BT_ISO_QOS_VERSION_1;
+ conn->iso_qos.type = BT_ISO_QOS_UCAST;
break;
case PA_LINK:
case BIS_LINK:
@@ -1127,6 +1133,8 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type,
hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
conn->cleanup = bis_cleanup;
conn->mtu = hdev->iso_mtu;
+ conn->iso_qos.version = BT_ISO_QOS_VERSION_1;
+ conn->iso_qos.type = BT_ISO_QOS_BCAST;
break;
case SCO_LINK:
if (lmp_esco_capable(hdev))
@@ -1637,7 +1645,7 @@ static int hci_explicit_conn_params_set(struct hci_dev *hdev,
return 0;
}
-static int qos_set_big(struct hci_dev *hdev, struct bt_iso_qos *qos)
+static int qos_set_big(struct hci_dev *hdev, struct bt_iso_qos_ext *qos)
{
struct hci_conn *conn;
u8 big;
@@ -1661,7 +1669,7 @@ static int qos_set_big(struct hci_dev *hdev, struct bt_iso_qos *qos)
return 0;
}
-static int qos_set_bis(struct hci_dev *hdev, struct bt_iso_qos *qos)
+static int qos_set_bis(struct hci_dev *hdev, struct bt_iso_qos_ext *qos)
{
struct hci_conn *conn;
u8 bis;
@@ -1703,7 +1711,7 @@ static int qos_set_bis(struct hci_dev *hdev, struct bt_iso_qos *qos)
/* This function requires the caller holds hdev->lock */
static struct hci_conn *hci_add_bis(struct hci_dev *hdev, bdaddr_t *dst,
- __u8 sid, struct bt_iso_qos *qos,
+ __u8 sid, struct bt_iso_qos_ext *qos,
__u8 base_len, __u8 *base, u16 timeout)
{
struct hci_conn *conn;
@@ -1938,7 +1946,7 @@ struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
return sco;
}
-static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos)
+static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos_ext *qos)
{
struct hci_dev *hdev = conn->hdev;
struct iso_list_data data;
@@ -1961,7 +1969,7 @@ static int set_cig_params_sync(struct hci_dev *hdev, void *data)
return hci_le_set_cig_params_sync(hdev, cig_id);
}
-static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
+static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos_ext *qos)
{
struct hci_dev *hdev = conn->hdev;
struct iso_list_data data;
@@ -2037,7 +2045,7 @@ static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
}
struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
- __u8 dst_type, struct bt_iso_qos *qos,
+ __u8 dst_type, struct bt_iso_qos_ext *qos,
u16 timeout)
{
struct hci_conn *cis;
@@ -2180,7 +2188,7 @@ int hci_le_create_cis_pending(struct hci_dev *hdev)
}
static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn,
- struct bt_iso_io_qos *qos, __u8 phys)
+ struct bt_iso_io_qos_ext *qos, __u8 phys)
{
/* Only set MTU if PHY is enabled */
if (!qos->sdu && qos->phys)
@@ -2205,7 +2213,7 @@ static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn,
static int create_big_sync(struct hci_dev *hdev, void *data)
{
struct hci_conn *conn = data;
- struct bt_iso_qos *qos = &conn->iso_qos;
+ struct bt_iso_qos_ext *qos = &conn->iso_qos;
u16 interval, sync_interval = 0;
u32 flags = 0;
int err;
@@ -2234,7 +2242,7 @@ static int create_big_sync(struct hci_dev *hdev, void *data)
struct hci_conn *hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst,
__u8 dst_type, __u8 sid,
- struct bt_iso_qos *qos)
+ struct bt_iso_qos_ext *qos)
{
struct hci_conn *conn;
@@ -2257,7 +2265,7 @@ struct hci_conn *hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst,
}
int hci_conn_big_create_sync(struct hci_dev *hdev, struct hci_conn *hcon,
- struct bt_iso_qos *qos, __u16 sync_handle,
+ struct bt_iso_qos_ext *qos, __u16 sync_handle,
__u8 num_bis, __u8 bis[])
{
int err;
@@ -2308,7 +2316,7 @@ static void create_big_complete(struct hci_dev *hdev, void *data, int err)
}
struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, __u8 sid,
- struct bt_iso_qos *qos,
+ struct bt_iso_qos_ext *qos,
__u8 base_len, __u8 *base, u16 timeout)
{
struct hci_conn *conn;
@@ -2396,7 +2404,7 @@ static void bis_mark_per_adv(struct hci_conn *conn, void *data)
struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
__u8 dst_type, __u8 sid,
- struct bt_iso_qos *qos,
+ struct bt_iso_qos_ext *qos,
__u8 base_len, __u8 *base, u16 timeout)
{
struct hci_conn *conn;
@@ -2447,7 +2455,7 @@ struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
}
struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
- __u8 dst_type, struct bt_iso_qos *qos,
+ __u8 dst_type, struct bt_iso_qos_ext *qos,
u16 timeout)
{
struct hci_conn *le;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index cdf010a2c37f..f7297179e69c 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -7389,7 +7389,7 @@ static void hci_le_cis_established_evt(struct hci_dev *hdev, void *data,
{
struct hci_evt_le_cis_established *ev = data;
struct hci_conn *conn;
- struct bt_iso_qos *qos;
+ struct bt_iso_qos_ext *qos;
bool pending = false;
u16 handle = __le16_to_cpu(ev->handle);
u32 c_sdu_interval, p_sdu_interval;
@@ -7415,6 +7415,10 @@ static void hci_le_cis_established_evt(struct hci_dev *hdev, void *data,
qos = &conn->iso_qos;
+ /* This version of the event doesn't report the HDT rates */
+ qos->ucast.in.rates = 0x0000;
+ qos->ucast.out.rates = 0x0000;
+
pending = test_and_clear_bit(HCI_CONN_CREATE_CIS, conn->flags);
/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 6, Part G
@@ -7564,7 +7568,7 @@ static int hci_iso_term_big_sync(struct hci_dev *hdev, void *data)
static void hci_le_create_big_complete(struct hci_dev *hdev, u8 status,
u8 handle, u8 num_bis,
- const __le16 *bis_handle)
+ const __le16 *bis_handle, u16 rates)
{
struct hci_conn *conn;
__u8 i = 0;
@@ -7606,6 +7610,7 @@ static void hci_le_create_big_complete(struct hci_dev *hdev, u8 status,
}
conn->state = BT_CONNECTED;
+ conn->iso_qos.bcast.out.rates = rates;
set_bit(HCI_CONN_BIG_CREATED, conn->flags);
hci_debugfs_create_conn(conn);
hci_conn_add_sysfs(conn);
@@ -7639,7 +7644,7 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
return;
hci_le_create_big_complete(hdev, ev->status, ev->handle, ev->num_bis,
- ev->bis_handle);
+ ev->bis_handle, 0x0000);
}
static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data,
@@ -7895,7 +7900,7 @@ static void hci_le_cis_established_evt_v3(struct hci_dev *hdev, void *data,
{
struct hci_evt_le_cis_established_v3 *ev = data;
struct hci_conn *conn;
- struct bt_iso_qos *qos;
+ struct bt_iso_qos_ext *qos;
bool pending = false;
u16 handle = __le16_to_cpu(ev->handle);
u32 c_sdu_interval, p_sdu_interval;
@@ -7941,6 +7946,8 @@ static void hci_le_cis_established_evt_v3(struct hci_dev *hdev, void *data,
qos->ucast.out.sdu = ev->p_bn ? le16_to_cpu(ev->p_sdu) : 0;
qos->ucast.in.phys = le_phy_qos(ev->c_phy);
qos->ucast.out.phys = le_phy_qos(ev->p_phy);
+ qos->ucast.in.rates = le16_to_cpu(ev->c_rates);
+ qos->ucast.out.rates = le16_to_cpu(ev->p_rates);
break;
case HCI_ROLE_MASTER:
qos->ucast.in.interval = p_sdu_interval;
@@ -7956,6 +7963,8 @@ static void hci_le_cis_established_evt_v3(struct hci_dev *hdev, void *data,
qos->ucast.in.sdu = ev->p_bn ? le16_to_cpu(ev->p_sdu) : 0;
qos->ucast.out.phys = le_phy_qos(ev->c_phy);
qos->ucast.in.phys = le_phy_qos(ev->p_phy);
+ qos->ucast.out.rates = le16_to_cpu(ev->c_rates);
+ qos->ucast.in.rates = le16_to_cpu(ev->p_rates);
break;
}
@@ -7990,7 +7999,8 @@ static void hci_le_create_big_complete_v2_evt(struct hci_dev *hdev, void *data,
return;
hci_le_create_big_complete(hdev, ev->status, ev->handle, ev->num_bis,
- ev->bis_handle);
+ ev->bis_handle,
+ le16_to_cpu(ev->rates));
}
#define HCI_LE_EV_VL(_op, _func, _min_len, _max_len) \
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 9a5b198fa0c5..a01eea7c2032 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -3187,7 +3187,7 @@ static int hci_le_set_ext_scan_param_sync(struct hci_dev *hdev, u8 type,
conn = hci_conn_hash_lookup_ba(hdev, PA_LINK,
&bdaddr);
if (conn) {
- struct bt_iso_qos *qos = &conn->iso_qos;
+ struct bt_iso_qos_ext *qos = &conn->iso_qos;
if (qos->bcast.in.phys & BT_ISO_PHY_1M ||
qos->bcast.in.phys & BT_ISO_PHY_2M) {
@@ -7926,7 +7926,7 @@ static void create_pa_complete(struct hci_dev *hdev, void *data, int err)
}
static int hci_le_past_params_sync(struct hci_dev *hdev, struct hci_conn *conn,
- u16 acl_handle, struct bt_iso_qos *qos)
+ u16 acl_handle, struct bt_iso_qos_ext *qos)
{
struct hci_cp_le_past_params cp;
int err;
@@ -7960,7 +7960,7 @@ static int hci_le_pa_create_sync(struct hci_dev *hdev, void *data)
{
struct hci_cp_le_pa_create_sync cp;
struct hci_conn *conn = data, *le;
- struct bt_iso_qos *qos = &conn->iso_qos;
+ struct bt_iso_qos_ext *qos = &conn->iso_qos;
int err;
if (!hci_conn_valid(hdev, conn))
@@ -8101,7 +8101,7 @@ static int hci_le_big_create_sync(struct hci_dev *hdev, void *data)
DEFINE_FLEX(struct hci_cp_le_big_create_sync, cp, bis, num_bis,
HCI_MAX_ISO_BIS);
struct hci_conn *conn = data;
- struct bt_iso_qos *qos = &conn->iso_qos;
+ struct bt_iso_qos_ext *qos = &conn->iso_qos;
int err;
if (!hci_conn_valid(hdev, conn))
@@ -8429,7 +8429,7 @@ static int hci_le_set_cig_params_v2_sync(struct hci_dev *hdev, u8 cig_id)
DEFINE_FLEX(struct hci_cp_le_set_cig_params_v2, pdu, cis, num_cis,
HCI_LE_CIG_PARAMS_V2_MAX_CIS);
struct hci_conn *conn;
- struct bt_iso_qos *qos;
+ struct bt_iso_qos_ext *qos;
u8 aux_num_cis = 0;
u8 cis_id;
@@ -8476,11 +8476,16 @@ static int hci_le_set_cig_params_v2_sync(struct hci_dev *hdev, u8 cig_id)
cis->c_rtn = qos->ucast.out.rtn;
cis->p_rtn = qos->ucast.in.rtn;
+ /* Use the rates of each direction, or all the HDT rates the
+ * controller supports if none were set.
+ */
if (cis->c_phys & HCI_LE_SET_PHY_HDT)
- cis->c_hdt_rates = cpu_to_le16(hci_hdt_tx_rates(hdev));
+ cis->c_hdt_rates = cpu_to_le16(qos->ucast.out.rates ? :
+ hci_hdt_tx_rates(hdev));
if (cis->p_phys & HCI_LE_SET_PHY_HDT)
- cis->p_hdt_rates = cpu_to_le16(hci_hdt_rx_rates(hdev));
+ cis->p_hdt_rates = cpu_to_le16(qos->ucast.in.rates ? :
+ hci_hdt_rx_rates(hdev));
}
pdu->num_cis = aux_num_cis;
@@ -8499,7 +8504,7 @@ int hci_le_set_cig_params_sync(struct hci_dev *hdev, u8 cig_id)
{
DEFINE_FLEX(struct hci_cp_le_set_cig_params, pdu, cis, num_cis, 0x1f);
struct hci_conn *conn;
- struct bt_iso_qos *qos;
+ struct bt_iso_qos_ext *qos;
u8 aux_num_cis = 0;
u8 cis_id;
@@ -8562,7 +8567,7 @@ int hci_le_set_cig_params_sync(struct hci_dev *hdev, u8 cig_id)
}
static int hci_le_create_big_v2_sync(struct hci_conn *conn,
- struct bt_iso_qos *qos, u8 num_bis)
+ struct bt_iso_qos_ext *qos, u8 num_bis)
{
struct hci_dev *hdev = conn->hdev;
struct hci_cp_le_create_big_v2 cp;
@@ -8581,15 +8586,18 @@ static int hci_le_create_big_v2_sync(struct hci_conn *conn,
cp.bis.encryption = qos->bcast.encryption;
memcpy(cp.bis.bcode, qos->bcast.bcode, sizeof(cp.bis.bcode));
- /* Check if HDT PHY is set then enable HDT supported rates */
+ /* Use the rates set, or all the HDT rates the controller supports if
+ * none were set.
+ */
if (cp.bis.phys & HCI_LE_SET_PHY_HDT)
- cp.bis.hdt_rates = cpu_to_le16(hci_hdt_tx_rates(hdev));
+ cp.bis.hdt_rates = cpu_to_le16(qos->bcast.out.rates ? :
+ hci_hdt_tx_rates(hdev));
return __hci_cmd_sync_status(hdev, HCI_OP_LE_CREATE_BIG_V2,
sizeof(cp), &cp, HCI_CMD_TIMEOUT);
}
-int hci_le_create_big_sync(struct hci_conn *conn, struct bt_iso_qos *qos,
+int hci_le_create_big_sync(struct hci_conn *conn, struct bt_iso_qos_ext *qos,
u8 num_bis)
{
struct hci_dev *hdev = conn->hdev;
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index cc6c8b7ba027..e945bd2b33e5 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -75,7 +75,7 @@ struct iso_pinfo {
__u8 bc_bis[ISO_MAX_NUM_BIS];
__u16 sync_handle;
unsigned long flags;
- struct bt_iso_qos qos;
+ struct bt_iso_qos_ext qos;
bool qos_user_set;
__u8 base_len;
__u8 base[BASE_MAX_LENGTH];
@@ -83,10 +83,23 @@ struct iso_pinfo {
struct delayed_work timeout_work;
};
-static struct bt_iso_qos default_qos;
+static struct bt_iso_qos_ext default_qos;
+
+static bool check_ucast_qos(struct bt_iso_qos_ext *qos);
+static bool check_bcast_qos(struct bt_iso_qos_ext *qos);
+
+/* The type is set by the first connect() or listen() if left as
+ * BT_ISO_QOS_ANY, otherwise it has to match how the socket is used, see
+ * struct bt_iso_qos_ext.
+ */
+static bool iso_qos_check_type(struct bt_iso_qos_ext *qos, u16 type)
+{
+ if (qos->type == BT_ISO_QOS_ANY)
+ qos->type = type;
+
+ return qos->type == type;
+}
-static bool check_ucast_qos(struct bt_iso_qos *qos);
-static bool check_bcast_qos(struct bt_iso_qos *qos);
static bool iso_match_sid(struct sock *sk, void *data);
static bool iso_match_sid_past(struct sock *sk, void *data);
static bool iso_match_sync_handle(struct sock *sk, void *data);
@@ -427,6 +440,12 @@ static int iso_connect_bis(struct sock *sk)
goto unlock;
}
+ /* Fail if the QoS was set for the other type */
+ if (!iso_qos_check_type(&iso_pi(sk)->qos, BT_ISO_QOS_BCAST)) {
+ err = -EINVAL;
+ goto unlock;
+ }
+
/* Fail if user set invalid QoS */
if (iso_pi(sk)->qos_user_set && !check_bcast_qos(&iso_pi(sk)->qos)) {
iso_pi(sk)->qos = default_qos;
@@ -531,6 +550,12 @@ static int iso_connect_cis(struct sock *sk)
goto unlock;
}
+ /* Fail if the QoS was set for the other type */
+ if (!iso_qos_check_type(&iso_pi(sk)->qos, BT_ISO_QOS_UCAST)) {
+ err = -EINVAL;
+ goto unlock;
+ }
+
/* Fail if user set invalid QoS */
if (iso_pi(sk)->qos_user_set && !check_ucast_qos(&iso_pi(sk)->qos)) {
iso_pi(sk)->qos = default_qos;
@@ -620,7 +645,7 @@ static int iso_connect_cis(struct sock *sk)
return err;
}
-static struct bt_iso_qos *iso_sock_get_qos(struct sock *sk)
+static struct bt_iso_qos_ext *iso_sock_get_qos(struct sock *sk)
{
if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONNECT2)
return &iso_pi(sk)->conn->hcon->iso_qos;
@@ -628,11 +653,134 @@ static struct bt_iso_qos *iso_sock_get_qos(struct sock *sk)
return &iso_pi(sk)->qos;
}
+/* The unicast QoS is a prefix of the broadcast one, with the same fields at
+ * the same offsets, in both struct bt_iso_qos and struct bt_iso_qos_ext, so
+ * converting the broadcast view converts either.
+ */
+static void iso_io_qos_to_ext(const struct bt_iso_io_qos *io,
+ struct bt_iso_io_qos_ext *ext)
+{
+ ext->interval = io->interval;
+ ext->latency = io->latency;
+ ext->sdu = io->sdu;
+ ext->phys = io->phys;
+ ext->rtn = io->rtn;
+ ext->rates = 0x0000;
+}
+
+static void iso_io_qos_from_ext(const struct bt_iso_io_qos_ext *ext,
+ struct bt_iso_io_qos *io)
+{
+ io->interval = ext->interval;
+ io->latency = ext->latency;
+ io->sdu = ext->sdu;
+ io->phys = ext->phys;
+ io->rtn = ext->rtn;
+}
+
+static void iso_io_qos_ext_copy(const struct bt_iso_io_qos_ext *src,
+ struct bt_iso_io_qos_ext *dst)
+{
+ dst->interval = src->interval;
+ dst->latency = src->latency;
+ dst->sdu = src->sdu;
+ dst->phys = src->phys;
+ dst->rtn = src->rtn;
+ dst->rates = src->rates;
+}
+
+/* Copy field by field so the padding, which the likes of hci_add_bis()
+ * compare with memcmp(), is zeroed rather than copied from or to userspace.
+ *
+ * In version 1 the unicast fields are a prefix of the broadcast ones, so
+ * copying the broadcast view copies either type. Fields added later to only
+ * one of them will need copying according to type.
+ */
+static void iso_qos_ext_copy(const struct bt_iso_qos_ext *src,
+ struct bt_iso_qos_ext *dst)
+{
+ const struct bt_iso_bcast_qos_ext *s = &src->bcast;
+ struct bt_iso_bcast_qos_ext *d = &dst->bcast;
+
+ memset(dst, 0, sizeof(*dst));
+ dst->version = BT_ISO_QOS_VERSION_1;
+ dst->type = src->type;
+
+ d->big = s->big;
+ d->bis = s->bis;
+ d->sync_factor = s->sync_factor;
+ d->packing = s->packing;
+ d->framing = s->framing;
+ iso_io_qos_ext_copy(&s->in, &d->in);
+ iso_io_qos_ext_copy(&s->out, &d->out);
+ d->encryption = s->encryption;
+ memcpy(d->bcode, s->bcode, sizeof(d->bcode));
+ d->options = s->options;
+ d->skip = s->skip;
+ d->sync_timeout = s->sync_timeout;
+ d->sync_cte_type = s->sync_cte_type;
+ d->mse = s->mse;
+ d->timeout = s->timeout;
+}
+
+static void iso_qos_to_ext(const struct bt_iso_qos *qos,
+ struct bt_iso_qos_ext *ext)
+{
+ const struct bt_iso_bcast_qos *b = &qos->bcast;
+ struct bt_iso_bcast_qos_ext *e = &ext->bcast;
+
+ memset(ext, 0, sizeof(*ext));
+ ext->version = BT_ISO_QOS_VERSION_1;
+ /* struct bt_iso_qos has no type, connect() or listen() sets it */
+ ext->type = BT_ISO_QOS_ANY;
+
+ e->big = b->big;
+ e->bis = b->bis;
+ e->sync_factor = b->sync_factor;
+ e->packing = b->packing;
+ e->framing = b->framing;
+ iso_io_qos_to_ext(&b->in, &e->in);
+ iso_io_qos_to_ext(&b->out, &e->out);
+ e->encryption = b->encryption;
+ memcpy(e->bcode, b->bcode, sizeof(e->bcode));
+ e->options = b->options;
+ e->skip = b->skip;
+ e->sync_timeout = b->sync_timeout;
+ e->sync_cte_type = b->sync_cte_type;
+ e->mse = b->mse;
+ e->timeout = b->timeout;
+}
+
+static void iso_qos_from_ext(const struct bt_iso_qos_ext *ext,
+ struct bt_iso_qos *qos)
+{
+ const struct bt_iso_bcast_qos_ext *e = &ext->bcast;
+ struct bt_iso_bcast_qos *b = &qos->bcast;
+
+ memset(qos, 0, sizeof(*qos));
+
+ b->big = e->big;
+ b->bis = e->bis;
+ b->sync_factor = e->sync_factor;
+ b->packing = e->packing;
+ b->framing = e->framing;
+ iso_io_qos_from_ext(&e->in, &b->in);
+ iso_io_qos_from_ext(&e->out, &b->out);
+ b->encryption = e->encryption;
+ memcpy(b->bcode, e->bcode, sizeof(b->bcode));
+ b->options = e->options;
+ b->skip = e->skip;
+ b->sync_timeout = e->sync_timeout;
+ b->sync_cte_type = e->sync_cte_type;
+ b->mse = e->mse;
+ b->timeout = e->timeout;
+}
+
static int iso_send_frame(struct sock *sk, struct sk_buff *skb,
const struct sockcm_cookie *sockc)
{
struct iso_conn *conn = iso_pi(sk)->conn;
- struct bt_iso_qos *qos = iso_sock_get_qos(sk);
+ struct bt_iso_qos_ext *qos = iso_sock_get_qos(sk);
struct hci_iso_data_hdr *hdr;
int len = 0;
@@ -1009,7 +1157,8 @@ static struct proto iso_proto = {
.rtn = 2u, \
}
-static struct bt_iso_qos default_qos = {
+static struct bt_iso_qos_ext default_qos = {
+ .version = BT_ISO_QOS_VERSION_1,
.bcast = {
.big = BT_ISO_QOS_BIG_UNSET,
.bis = BT_ISO_QOS_BIS_UNSET,
@@ -1375,6 +1524,12 @@ static int iso_listen_bis(struct sock *sk)
goto unlock;
}
+ /* Fail if the QoS was set for the other type */
+ if (!iso_qos_check_type(&iso_pi(sk)->qos, BT_ISO_QOS_BCAST)) {
+ err = -EINVAL;
+ goto unlock;
+ }
+
/* Fail if user set invalid QoS */
if (iso_pi(sk)->qos_user_set && !check_bcast_qos(&iso_pi(sk)->qos)) {
iso_pi(sk)->qos = default_qos;
@@ -1417,6 +1572,10 @@ static int iso_listen_cis(struct sock *sk)
BT_DBG("%pMR", &iso_pi(sk)->src);
+ /* Fail if the QoS was set for the other type */
+ if (!iso_qos_check_type(&iso_pi(sk)->qos, BT_ISO_QOS_UCAST))
+ return -EINVAL;
+
write_lock(&iso_sk_list.lock);
if (__iso_get_sock_listen_by_addr(&iso_pi(sk)->src, &iso_pi(sk)->dst))
@@ -1863,7 +2022,7 @@ static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,
return bt_sock_recvmsg(sock, msg, len, flags);
}
-static bool check_io_qos(struct bt_iso_io_qos *qos)
+static bool check_io_qos(struct bt_iso_io_qos_ext *qos)
{
/* If no PHY is enable SDU must be 0 */
if (!qos->phys && qos->sdu)
@@ -1878,10 +2037,19 @@ static bool check_io_qos(struct bt_iso_io_qos *qos)
if (qos->phys & ~(BT_ISO_PHY_ANY | BT_ISO_PHY_HDT))
return false;
+ /* Rates only apply to the LE HDT PHY */
+ if (qos->rates & ~(BT_ISO_HDT_RATE_2M | BT_ISO_HDT_RATE_3M |
+ BT_ISO_HDT_RATE_4M | BT_ISO_HDT_RATE_6M |
+ BT_ISO_HDT_RATE_7_5M))
+ return false;
+
+ if (qos->rates && !(qos->phys & BT_ISO_PHY_HDT))
+ return false;
+
return true;
}
-static bool check_ucast_qos(struct bt_iso_qos *qos)
+static bool check_ucast_qos(struct bt_iso_qos_ext *qos)
{
if (qos->ucast.cig > 0xef && qos->ucast.cig != BT_ISO_QOS_CIG_UNSET)
return false;
@@ -1907,7 +2075,7 @@ static bool check_ucast_qos(struct bt_iso_qos *qos)
return true;
}
-static bool check_bcast_qos(struct bt_iso_qos *qos)
+static bool check_bcast_qos(struct bt_iso_qos_ext *qos)
{
if (!qos->bcast.sync_factor)
qos->bcast.sync_factor = 0x01;
@@ -1959,7 +2127,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
{
struct sock *sk = sock->sk;
int err = 0;
- struct bt_iso_qos qos = default_qos;
+ struct bt_iso_qos_ext qos = default_qos;
+ struct bt_iso_qos_ext qos_user;
+ struct bt_iso_qos qos_old;
u32 opt;
BT_DBG("sk %p", sk);
@@ -2005,9 +2175,49 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
break;
}
- err = copy_safe_from_sockptr(&qos, sizeof(qos), optval, optlen);
- if (err)
+ /* The length of struct bt_iso_qos selects it, any other
+ * length is struct bt_iso_qos_ext of a known version.
+ */
+ if (optlen == sizeof(qos_old)) {
+ err = copy_safe_from_sockptr(&qos_old, sizeof(qos_old),
+ optval, optlen);
+ if (err)
+ break;
+
+ iso_qos_to_ext(&qos_old, &qos);
+ } else {
+ if (optlen < sizeof(qos)) {
+ err = -EINVAL;
+ break;
+ }
+
+ err = copy_struct_from_sockptr(&qos_user,
+ sizeof(qos_user),
+ optval, optlen);
+ if (err)
+ break;
+
+ if (qos_user.version != BT_ISO_QOS_VERSION_1 ||
+ qos_user.type > BT_ISO_QOS_BCAST) {
+ err = -EINVAL;
+ break;
+ }
+
+ iso_qos_ext_copy(&qos_user, &qos);
+ }
+
+ /* A socket that already has a connection, such as one with
+ * deferred setup or a PA sync, knows its type, so check it
+ * now as connect() or listen() won't.
+ */
+ if (iso_pi(sk)->conn && iso_pi(sk)->conn->hcon &&
+ !iso_qos_check_type(&qos,
+ iso_pi(sk)->conn->hcon->type ==
+ CIS_LINK ? BT_ISO_QOS_UCAST :
+ BT_ISO_QOS_BCAST)) {
+ err = -EINVAL;
break;
+ }
iso_pi(sk)->qos = qos;
iso_pi(sk)->qos_user_set = true;
@@ -2048,7 +2258,9 @@ static int iso_sock_getsockopt(struct socket *sock, int level, int optname,
sockopt_t *opt)
{
struct sock *sk = sock->sk;
- struct bt_iso_qos *qos;
+ struct bt_iso_qos_ext *qos;
+ struct bt_iso_qos_ext qos_ext;
+ struct bt_iso_qos qos_old;
int len, val, err = 0;
u8 base_len;
u8 *base;
@@ -2083,9 +2295,25 @@ static int iso_sock_getsockopt(struct socket *sock, int level, int optname,
case BT_ISO_QOS:
qos = iso_sock_get_qos(sk);
- len = min_t(unsigned int, len, sizeof(*qos));
- if (copy_to_iter(qos, len, &opt->iter_out) != len)
- err = -EFAULT;
+ /* A buffer too short for struct bt_iso_qos_ext gets
+ * struct bt_iso_qos, as it did before the extension.
+ */
+ if (len < sizeof(*qos)) {
+ iso_qos_from_ext(qos, &qos_old);
+
+ len = min_t(unsigned int, len, sizeof(qos_old));
+ if (copy_to_iter(&qos_old, len, &opt->iter_out) != len)
+ err = -EFAULT;
+ } else {
+ /* Report the version of this struct, with its padding
+ * zeroed.
+ */
+ iso_qos_ext_copy(qos, &qos_ext);
+
+ len = sizeof(qos_ext);
+ if (copy_to_iter(&qos_ext, len, &opt->iter_out) != len)
+ err = -EFAULT;
+ }
break;
--
2.56.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v11 3/6] Bluetooth: Add initial support for EKS
2026-11-09 17:18 [PATCH v11 0/6] Bluetooth: Add support for HDT and EKS Luiz Augusto von Dentz
2026-11-09 17:18 ` [PATCH v11 1/6] Bluetooth: Add initial support for HDT PHY Luiz Augusto von Dentz
2026-11-09 17:18 ` [PATCH v11 2/6] Bluetooth: ISO: Add extended QoS with the HDT rates Luiz Augusto von Dentz
@ 2026-11-09 17:18 ` Luiz Augusto von Dentz
2026-11-09 17:18 ` [PATCH v11 4/6] Bluetooth: L2CAP: Add MIC length validation for HDT PHY Luiz Augusto von Dentz
` (3 subsequent siblings)
6 siblings, 0 replies; 9+ messages in thread
From: Luiz Augusto von Dentz @ 2026-11-09 17:18 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Add support for Encryption Key Schedule (EKS) introduced in Bluetooth
7.0:
- LE Enable Encryption v2, which replaces LE Start Encryption on EKS
capable controllers and carries the MIC length to use on the LE HDT
PHY. SMP now starts encryption through hci_le_enable_encrypt(),
which picks the version the controller supports, outside of the RCU
read-side section since queueing the command may sleep. If it can't
be queued SMP fails the pairing or doesn't consider the encryption
started. A Command Status error disconnects the link as it does for
LE Start Encryption, and so does a command that fails without one,
such as one that couldn't be sent. The Command Status error of LE
Start Encryption now also clears the pending encryption, so the two
don't both act on it. The command, which carries the key, is freed
with kfree_sensitive().
- Encryption Change v3 and Encryption Key Refresh Complete v2, enabled
through Event Mask Page 2, which report the MIC length and whether
the key schedule is in use. The encryption change and key refresh
handling is moved to helpers shared by every version of the events.
- The encryption key size Encryption Change v3 reports for BR/EDR is
used instead of reading it with HCI_Read_Encryption_Key_Size, saving
a round trip; it is validated the same way, in a helper shared with
the read's completion. The spec says to ignore it for LE, where it
comes from SMP, and a value outside its 0x07 to 0x10 range is read.
- eks_capable() for the Encryption Key Schedule feature bit.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
include/net/bluetooth/hci.h | 30 +++
include/net/bluetooth/hci_core.h | 4 +-
include/net/bluetooth/hci_sync.h | 3 +
net/bluetooth/hci_conn.c | 18 --
net/bluetooth/hci_event.c | 308 ++++++++++++++++++++++---------
net/bluetooth/hci_sync.c | 135 ++++++++++++++
net/bluetooth/smp.c | 67 +++++--
7 files changed, 445 insertions(+), 120 deletions(-)
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index e60686cf978d..778c234385ce 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -2564,6 +2564,16 @@ struct hci_rp_le_read_def_data_len_v2 {
__le16 tx_time;
} __packed;
+#define HCI_OP_LE_ENABLE_ENCRYPT_V2 0x20af
+struct hci_cp_le_enable_encrypt_v2 {
+ __le16 handle;
+ __le64 rand;
+ __le16 ediv;
+ __u8 ltk[16];
+ __u8 mic_len;
+ __u8 encryption;
+} __packed;
+
#define HCI_OP_LE_READ_MAX_DATA_LEN_V2 0x20b0
struct hci_cp_le_read_max_data_len_v2 {
__u8 phy;
@@ -3039,6 +3049,26 @@ struct hci_ev_sync_train_complete {
#define HCI_EV_PERIPHERAL_PAGE_RESP_TIMEOUT 0x54
+#define HCI_EVT_KEY_REFRESH_COMPLETE_V2 0x5b
+struct hci_evt_key_refresh_complete_v2 {
+ __u8 status;
+ __le16 handle;
+ __u8 mic_len;
+ __u8 eks_mode;
+ __u8 eks_debug;
+} __packed;
+
+#define HCI_EVT_ENCRYPT_CHANGE_V3 0x5a
+struct hci_evt_encrypt_change_v3 {
+ __u8 status;
+ __le16 handle;
+ __u8 mode;
+ __u8 key_size;
+ __u8 mic_len;
+ __u8 eks_mode;
+ __u8 eks_debug;
+} __packed;
+
#define HCI_EV_LE_CONN_COMPLETE 0x01
struct hci_ev_le_conn_complete {
__u8 status;
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 1158ec218e1a..7a4f87236854 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -2178,6 +2178,8 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
(le_feature(dev, 1, 2) & HCI_LE_HDT_7_5_TX_FEATURE)
#define hdt_pf1_capable(dev) \
(le_feature(dev, 1, 2) & HCI_LE_HDT_PF_1)
+#define eks_capable(dev) \
+ (le_feature(dev, 1, 1) & HCI_LE_EKS_FEATURE)
/* Channel sounding support */
#define le_cs_capable(dev) \
@@ -2625,8 +2627,6 @@ void mgmt_conn_subrate_notify(struct hci_dev *hdev, struct hci_conn *conn,
int hci_abort_conn(struct hci_conn *conn, u8 reason);
void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
u16 to_multiplier);
-void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
- __u8 ltk[16], __u8 key_size);
void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
u8 *bdaddr_type);
diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h
index aa12250eca52..ab880384614a 100644
--- a/include/net/bluetooth/hci_sync.h
+++ b/include/net/bluetooth/hci_sync.h
@@ -197,3 +197,6 @@ int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys, u16 phy_opts);
int hci_le_set_cig_params_sync(struct hci_dev *hdev, u8 cig_id);
int hci_le_create_big_sync(struct hci_conn *conn, struct bt_iso_qos_ext *qos,
u8 num_bis);
+
+int hci_le_enable_encrypt(struct hci_conn *conn, __le16 ediv, __le64 rand,
+ __u8 ltk[16], __u8 key_size);
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 64d4cb940aaa..15b665229c0e 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -598,24 +598,6 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max, u16 latency,
}
}
-void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __le64 rand,
- __u8 ltk[16], __u8 key_size)
-{
- struct hci_dev *hdev = conn->hdev;
- struct hci_cp_le_start_enc cp;
-
- BT_DBG("hcon %p", conn);
-
- memset(&cp, 0, sizeof(cp));
-
- cp.handle = cpu_to_le16(conn->handle);
- cp.rand = rand;
- cp.ediv = ediv;
- memcpy(cp.ltk, ltk, key_size);
-
- hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
-}
-
/* Device _must_ be locked */
void hci_sco_setup(struct hci_conn *conn, __u8 status)
{
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index f7297179e69c..9dc0e13ce7c1 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -704,25 +704,14 @@ static u8 hci_cc_read_local_version(struct hci_dev *hdev, void *data,
return rp->status;
}
-static u8 hci_cc_read_enc_key_size(struct hci_dev *hdev, void *data,
- struct sk_buff *skb)
+/* Complete the encryption change of an ACL link once its encryption key size
+ * is known, either read with HCI_Read_Encryption_Key_Size or reported by
+ * HCI_Encryption_Change [v3].
+ */
+static u8 hci_conn_enc_key_size_set(struct hci_dev *hdev, struct hci_conn *conn,
+ u8 status, u8 key_size)
{
- struct hci_rp_read_enc_key_size *rp = data;
- struct hci_conn *conn;
- u16 handle;
- u8 status = rp->status;
-
- bt_dev_dbg(hdev, "status 0x%2.2x", status);
-
- handle = le16_to_cpu(rp->handle);
-
- hci_dev_lock(hdev);
-
- conn = hci_conn_hash_lookup_handle(hdev, handle);
- if (!conn) {
- status = 0xFF;
- goto done;
- }
+ u16 handle = conn->handle;
clear_bit(HCI_CONN_ENC_KEY_SIZE_PEND, conn->flags);
@@ -745,7 +734,7 @@ static u8 hci_cc_read_enc_key_size(struct hci_dev *hdev, void *data,
} else {
u8 *key_enc_size = hci_conn_key_enc_size(conn);
- conn->enc_key_size = rp->key_size;
+ conn->enc_key_size = key_size;
status = 0;
/* Attempt to check if the key size is too small or if it has
@@ -800,6 +789,31 @@ static u8 hci_cc_read_enc_key_size(struct hci_dev *hdev, void *data,
*/
mgmt_security_level_changed(conn);
+ return status;
+}
+
+static u8 hci_cc_read_enc_key_size(struct hci_dev *hdev, void *data,
+ struct sk_buff *skb)
+{
+ struct hci_rp_read_enc_key_size *rp = data;
+ struct hci_conn *conn;
+ u16 handle;
+ u8 status = rp->status;
+
+ bt_dev_dbg(hdev, "status 0x%2.2x", status);
+
+ handle = le16_to_cpu(rp->handle);
+
+ hci_dev_lock(hdev);
+
+ conn = hci_conn_hash_lookup_handle(hdev, handle);
+ if (!conn) {
+ status = 0xFF;
+ goto done;
+ }
+
+ status = hci_conn_enc_key_size_set(hdev, conn, status, rp->key_size);
+
done:
hci_dev_unlock(hdev);
@@ -3061,6 +3075,8 @@ static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
if (!conn)
goto unlock;
+ clear_bit(HCI_CONN_ENCRYPT_PEND, conn->flags);
+
if (conn->state != BT_CONNECTED)
goto unlock;
@@ -3071,6 +3087,41 @@ static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
hci_dev_unlock(hdev);
}
+static void hci_cs_le_enable_encrypt_v2(struct hci_dev *hdev, u8 status)
+{
+ struct hci_cp_le_enable_encrypt_v2 *cp;
+ struct hci_conn *conn;
+
+ bt_dev_dbg(hdev, "status 0x%2.2x", status);
+
+ if (!status)
+ return;
+
+ hci_dev_lock(hdev);
+
+ cp = hci_sent_cmd_data(hdev, HCI_OP_LE_ENABLE_ENCRYPT_V2);
+ if (!cp)
+ goto unlock;
+
+ conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
+ if (!conn)
+ goto unlock;
+
+ clear_bit(HCI_CONN_ENCRYPT_PEND, conn->flags);
+
+ /* An opportunistic encryption that cannot be started just leaves
+ * the link unencrypted, as it was.
+ */
+ if (cp->encryption == 0x01 || conn->state != BT_CONNECTED)
+ goto unlock;
+
+ hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
+ hci_conn_drop(conn);
+
+unlock:
+ hci_dev_unlock(hdev);
+}
+
static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
{
struct hci_cp_switch_role *cp;
@@ -3725,22 +3776,16 @@ static void hci_remote_name_evt(struct hci_dev *hdev, void *data,
hci_dev_unlock(hdev);
}
-static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
- struct sk_buff *skb)
+/* key_size is the encryption key size of an ACL link reported by the event,
+ * or 0 if it doesn't report it, in which case it is read.
+ */
+static void hci_change_encrypt(struct hci_conn *conn, u8 status, u8 encrypt,
+ u8 key_size)
{
- struct hci_ev_encrypt_change *ev = data;
- struct hci_conn *conn;
+ struct hci_dev *hdev = conn->hdev;
- bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
-
- hci_dev_lock(hdev);
-
- conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
- if (!conn)
- goto unlock;
-
- if (!ev->status) {
- if (ev->encrypt) {
+ if (!status) {
+ if (encrypt) {
/* Encryption implies authentication */
set_bit(HCI_CONN_AUTH, conn->flags);
set_bit(HCI_CONN_ENCRYPT, conn->flags);
@@ -3750,16 +3795,16 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
set_bit(HCI_CONN_FIPS, conn->flags);
- if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
+ if ((conn->type == ACL_LINK && encrypt == 0x02) ||
conn->type == LE_LINK)
set_bit(HCI_CONN_AES_CCM, conn->flags);
/* For ACL links the encryption key size is still
- * validated below via hci_read_enc_key_size(). Its
- * completion handler, hci_cc_read_enc_key_size(),
- * reports the final security level so userspace does
- * not see a transient "encrypted" state that a
- * key-size downgrade would immediately invalidate.
+ * validated below by hci_conn_enc_key_size_set(),
+ * once known. It reports the final security level so
+ * userspace does not see a transient "encrypted"
+ * state that a key-size downgrade would immediately
+ * invalidate.
*/
if (conn->type != ACL_LINK)
mgmt_security_level_changed(conn);
@@ -3781,7 +3826,7 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
/* We should disregard the current RPA and generate a new one
* whenever the encryption procedure fails.
*/
- if (ev->status && conn->type == LE_LINK) {
+ if (status && conn->type == LE_LINK) {
hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
hci_adv_instances_set_rpa_expired(hdev, true);
}
@@ -3790,23 +3835,30 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
/* Check link security requirements are met */
if (!hci_conn_check_link_mode(conn))
- ev->status = HCI_ERROR_AUTH_FAILURE;
+ status = HCI_ERROR_AUTH_FAILURE;
- if (ev->status && conn->state == BT_CONNECTED) {
- if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
+ if (status && conn->state == BT_CONNECTED) {
+ if (status == HCI_ERROR_PIN_OR_KEY_MISSING)
set_bit(HCI_CONN_AUTH_FAILURE, conn->flags);
/* Notify upper layers so they can cleanup before
* disconnecting.
*/
- hci_encrypt_cfm(conn, ev->status);
+ hci_encrypt_cfm(conn, status);
hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
hci_conn_drop(conn);
- goto unlock;
+ return;
}
- /* Try reading the encryption key size for encrypted ACL links */
- if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
+ /* Validate the encryption key size of encrypted ACL links, reading
+ * it unless the event reported it.
+ */
+ if (!status && encrypt && conn->type == ACL_LINK) {
+ if (key_size) {
+ hci_conn_enc_key_size_set(hdev, conn, 0x00, key_size);
+ return;
+ }
+
if (hci_read_enc_key_size(hdev, conn)) {
/* Could not even issue the key-size read: report the
* security level now since hci_cc_read_enc_key_size()
@@ -3816,7 +3868,7 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
goto notify;
}
- goto unlock;
+ return;
}
/* We skip the WRITE_AUTH_PAYLOAD_TIMEOUT for ATS2851 based controllers
@@ -3846,7 +3898,64 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
}
notify:
- hci_encrypt_cfm(conn, ev->status);
+ hci_encrypt_cfm(conn, status);
+}
+
+static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
+ struct sk_buff *skb)
+{
+ struct hci_ev_encrypt_change *ev = data;
+ struct hci_conn *conn;
+
+ bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
+
+ hci_dev_lock(hdev);
+
+ conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
+ if (!conn)
+ goto unlock;
+
+ /* This version doesn't report the key size, so it is read */
+ hci_change_encrypt(conn, ev->status, ev->encrypt, 0x00);
+
+unlock:
+ hci_dev_unlock(hdev);
+}
+
+static void hci_encrypt_change_v3_evt(struct hci_dev *hdev, void *data,
+ struct sk_buff *skb)
+{
+ struct hci_evt_encrypt_change_v3 *ev = data;
+ struct hci_conn *conn;
+ u8 key_size;
+
+ bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
+
+ hci_dev_lock(hdev);
+
+ conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
+ if (!conn)
+ goto unlock;
+
+ /* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 4, Part E,
+ * Section 7.7.8:
+ *
+ * Encryption_Key_Size: Encryption key size in octets.
+ * This parameter shall be ignored for LE connections and shall be
+ * ignored when Link Level Encryption is OFF.
+ * Range: 0x07 to 0x10
+ *
+ * So only a BR/EDR link with encryption on has it, which saves
+ * reading it. It is still validated against the minimum and the
+ * size stored with the link key, and a value out of range is read
+ * instead.
+ */
+ key_size = 0x00;
+ if (conn->type == ACL_LINK && !ev->status && ev->mode &&
+ ev->key_size >= 0x07 && ev->key_size <= 0x10)
+ key_size = ev->key_size;
+
+ hci_change_encrypt(conn, ev->status, ev->mode, key_size);
unlock:
hci_dev_unlock(hdev);
@@ -4760,6 +4869,7 @@ static const struct hci_cs {
HCI_CS(HCI_OP_LE_CREATE_CONN, hci_cs_le_create_conn),
HCI_CS(HCI_OP_LE_READ_REMOTE_FEATURES, hci_cs_le_read_remote_features),
HCI_CS(HCI_OP_LE_START_ENC, hci_cs_le_start_enc),
+ HCI_CS(HCI_OP_LE_ENABLE_ENCRYPT_V2, hci_cs_le_enable_encrypt_v2),
HCI_CS(HCI_OP_LE_SET_PHY, hci_cs_le_set_phy),
HCI_CS(HCI_OP_LE_EXT_CREATE_CONN, hci_cs_le_ext_create_conn),
HCI_CS(HCI_OP_LE_CREATE_CIS, hci_cs_le_create_cis),
@@ -5555,6 +5665,46 @@ static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, void *edata,
hci_dev_unlock(hdev);
}
+static void hci_conn_refresh_key(struct hci_conn *conn, u8 status)
+{
+ /* For BR/EDR the necessary steps are taken through the
+ * auth_complete event.
+ */
+ if (conn->type != LE_LINK)
+ return;
+
+ if (!status) {
+ bool sec_level_changed =
+ conn->sec_level != conn->pending_sec_level;
+
+ conn->sec_level = conn->pending_sec_level;
+ if (sec_level_changed)
+ mgmt_security_level_changed(conn);
+ }
+
+ clear_bit(HCI_CONN_ENCRYPT_PEND, conn->flags);
+
+ if (status && conn->state == BT_CONNECTED) {
+ hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
+ hci_conn_drop(conn);
+ return;
+ }
+
+ if (conn->state == BT_CONFIG) {
+ if (!status)
+ conn->state = BT_CONNECTED;
+
+ hci_connect_cfm(conn, status);
+ hci_conn_drop(conn);
+ } else {
+ hci_auth_cfm(conn, status);
+
+ hci_conn_hold(conn);
+ conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+ hci_conn_drop(conn);
+ }
+}
+
static void hci_key_refresh_complete_evt(struct hci_dev *hdev, void *data,
struct sk_buff *skb)
{
@@ -5570,42 +5720,28 @@ static void hci_key_refresh_complete_evt(struct hci_dev *hdev, void *data,
if (!conn)
goto unlock;
- /* For BR/EDR the necessary steps are taken through the
- * auth_complete event.
- */
- if (conn->type != LE_LINK)
+ hci_conn_refresh_key(conn, ev->status);
+
+unlock:
+ hci_dev_unlock(hdev);
+}
+
+static void hci_key_refresh_complete_v2_evt(struct hci_dev *hdev, void *data,
+ struct sk_buff *skb)
+{
+ struct hci_evt_key_refresh_complete_v2 *ev = data;
+ struct hci_conn *conn;
+
+ bt_dev_dbg(hdev, "status 0x%2.2x handle 0x%4.4x", ev->status,
+ __le16_to_cpu(ev->handle));
+
+ hci_dev_lock(hdev);
+
+ conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
+ if (!conn)
goto unlock;
- if (!ev->status) {
- bool sec_level_changed =
- conn->sec_level != conn->pending_sec_level;
-
- conn->sec_level = conn->pending_sec_level;
- if (sec_level_changed)
- mgmt_security_level_changed(conn);
- }
-
- clear_bit(HCI_CONN_ENCRYPT_PEND, conn->flags);
-
- if (ev->status && conn->state == BT_CONNECTED) {
- hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
- hci_conn_drop(conn);
- goto unlock;
- }
-
- if (conn->state == BT_CONFIG) {
- if (!ev->status)
- conn->state = BT_CONNECTED;
-
- hci_connect_cfm(conn, ev->status);
- hci_conn_drop(conn);
- } else {
- hci_auth_cfm(conn, ev->status);
-
- hci_conn_hold(conn);
- conn->disc_timeout = HCI_DISCONN_TIMEOUT;
- hci_conn_drop(conn);
- }
+ hci_conn_refresh_key(conn, ev->status);
unlock:
hci_dev_unlock(hdev);
@@ -8408,6 +8544,12 @@ static const struct hci_ev {
/* [0x3e = HCI_EV_LE_META] */
HCI_EV_REQ_VL(HCI_EV_LE_META, hci_le_meta_evt,
sizeof(struct hci_ev_le_meta), HCI_MAX_EVENT_PLEN),
+ /* [0x5a = HCI_EVT_ENCRYPT_CHANGE_V3] */
+ HCI_EV(HCI_EVT_ENCRYPT_CHANGE_V3, hci_encrypt_change_v3_evt,
+ sizeof(struct hci_evt_encrypt_change_v3)),
+ /* [0x5b = HCI_EVT_KEY_REFRESH_COMPLETE_V2] */
+ HCI_EV(HCI_EVT_KEY_REFRESH_COMPLETE_V2, hci_key_refresh_complete_v2_evt,
+ sizeof(struct hci_evt_key_refresh_complete_v2)),
/* [0xff = HCI_EV_VENDOR] */
HCI_EV_VL(HCI_EV_VENDOR, hci_vendor_evt, 0, HCI_MAX_EVENT_PLEN),
};
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index a01eea7c2032..93cd95ecf309 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -5187,6 +5187,13 @@ static int hci_set_event_mask_page_2_sync(struct hci_dev *hdev)
changed = true;
}
+ if (eks_capable(hdev)) {
+ /* EKS events */
+ events[3] |= BIT(2); /* Encrytion Change v3 */
+ events[3] |= BIT(3); /* Encrytion Key Refresh Complete v2 */
+ changed = true;
+ }
+
/* Some Broadcom based controllers indicate support for Set Event
* Mask Page 2 command, but then actually do not support it. Since
* the default value is all bits set to zero, the command is only
@@ -8475,6 +8482,7 @@ static int hci_le_set_cig_params_v2_sync(struct hci_dev *hdev, u8 cig_id)
qos->ucast.out.phys;
cis->c_rtn = qos->ucast.out.rtn;
cis->p_rtn = qos->ucast.in.rtn;
+ cis->mic_len = 0x02; /* Always prefer 128 bits? */
/* Use the rates of each direction, or all the HDT rates the
* controller supports if none were set.
@@ -8623,3 +8631,130 @@ int hci_le_create_big_sync(struct hci_conn *conn, struct bt_iso_qos_ext *qos,
return __hci_cmd_sync_status(hdev, HCI_OP_LE_CREATE_BIG,
sizeof(cp), &cp, HCI_CMD_TIMEOUT);
}
+
+static void le_enable_encrypt_complete(struct hci_dev *hdev, void *data, int err)
+{
+ bt_dev_dbg(hdev, "err %d", err);
+
+ /* The command carries the key */
+ kfree_sensitive(data);
+}
+
+/* A command that failed without a Command Status, such as one that couldn't
+ * be sent, leaves the encryption pending, so disconnect as a Command Status
+ * error does. If one was received it has already cleared the pending
+ * encryption and disconnected.
+ */
+static void le_enable_encrypt_failed(struct hci_dev *hdev, __le16 handle)
+{
+ struct hci_conn *conn;
+
+ hci_dev_lock(hdev);
+
+ conn = hci_conn_hash_lookup_handle(hdev, le16_to_cpu(handle));
+ if (conn && test_and_clear_bit(HCI_CONN_ENCRYPT_PEND, conn->flags) &&
+ conn->state == BT_CONNECTED)
+ conn = hci_conn_get(conn);
+ else
+ conn = NULL;
+
+ hci_dev_unlock(hdev);
+
+ if (!conn)
+ return;
+
+ hci_abort_conn_sync(hdev, conn, HCI_ERROR_AUTH_FAILURE);
+ hci_conn_put(conn);
+}
+
+static int hci_le_enable_encrypt_v2_sync(struct hci_dev *hdev, void *data)
+{
+ struct hci_cp_le_enable_encrypt_v2 *cp = data;
+ int err;
+
+ err = __hci_cmd_sync_status(hdev, HCI_OP_LE_ENABLE_ENCRYPT_V2,
+ sizeof(*cp), cp, HCI_CMD_TIMEOUT);
+ if (err)
+ le_enable_encrypt_failed(hdev, cp->handle);
+
+ return err;
+}
+
+static int hci_le_enable_encrypt_v2(struct hci_conn *conn, __le16 ediv,
+ __le64 rand, __u8 ltk[16], __u8 key_size)
+{
+ struct hci_dev *hdev = conn->hdev;
+ struct hci_cp_le_enable_encrypt_v2 *cp;
+ int err;
+
+ bt_dev_dbg(hdev, "hcon %p", conn);
+
+ cp = kzalloc_obj(*cp);
+ if (!cp)
+ return -ENOMEM;
+
+ cp->handle = cpu_to_le16(conn->handle);
+ cp->rand = rand;
+ cp->ediv = ediv;
+ cp->mic_len = 0x02; /* Always prefer 128 bits? */
+
+ /* The key is zero padded when shorter than 16 octets */
+ if (ltk) {
+ memcpy(cp->ltk, ltk, key_size);
+ cp->encryption = 0x00; /* Use LTK provided in LTK field */
+ } else {
+ cp->encryption = 0x01; /* Use opportunistic with EKS */
+ }
+
+ err = hci_cmd_sync_queue_once(hdev, hci_le_enable_encrypt_v2_sync, cp,
+ le_enable_encrypt_complete);
+ if (err)
+ kfree_sensitive(cp);
+
+ return err;
+}
+
+static int hci_le_enable_encrypt_sync(struct hci_dev *hdev, void *data)
+{
+ struct hci_cp_le_start_enc *cp = data;
+ int err;
+
+ err = __hci_cmd_sync_status(hdev, HCI_OP_LE_START_ENC, sizeof(*cp), cp,
+ HCI_CMD_TIMEOUT);
+ if (err)
+ le_enable_encrypt_failed(hdev, cp->handle);
+
+ return err;
+}
+
+int hci_le_enable_encrypt(struct hci_conn *conn, __le16 ediv, __le64 rand,
+ __u8 ltk[16], __u8 key_size)
+{
+ struct hci_dev *hdev = conn->hdev;
+ struct hci_cp_le_start_enc *cp;
+ int err;
+
+ /* Check if EKS and HCI_OP_LE_ENABLE_ENCRYPT_V2 are supported */
+ if (eks_capable(hdev) && (hdev->commands[50] & BIT(4)))
+ return hci_le_enable_encrypt_v2(conn, ediv, rand, ltk,
+ key_size);
+
+ bt_dev_dbg(hdev, "hcon %p", conn);
+
+ /* The key is zero padded when shorter than 16 octets */
+ cp = kzalloc_obj(*cp);
+ if (!cp)
+ return -ENOMEM;
+
+ cp->handle = cpu_to_le16(conn->handle);
+ cp->rand = rand;
+ cp->ediv = ediv;
+ memcpy(cp->ltk, ltk, key_size);
+
+ err = hci_cmd_sync_queue_once(hdev, hci_le_enable_encrypt_sync, cp,
+ le_enable_encrypt_complete);
+ if (err)
+ kfree_sensitive(cp);
+
+ return err;
+}
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index b7015e37e1f1..140b9813998b 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -987,7 +987,12 @@ static u8 smp_random(struct smp_chan *smp)
if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, hcon->flags))
return SMP_UNSPECIFIED;
- hci_le_start_enc(hcon, ediv, rand, stk, smp->enc_key_size);
+ if (hci_le_enable_encrypt(hcon, ediv, rand, stk,
+ smp->enc_key_size)) {
+ clear_bit(HCI_CONN_ENCRYPT_PEND, hcon->flags);
+ return SMP_UNSPECIFIED;
+ }
+
hcon->enc_key_size = smp->enc_key_size;
set_bit(HCI_CONN_STK_ENCRYPT, hcon->flags);
} else {
@@ -2209,30 +2214,46 @@ static bool smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
{
struct smp_ltk *key;
struct hci_conn *hcon = conn->hcon;
- bool ret = false;
+ u8 val[16], enc_size;
+ __le64 rand;
+ __le16 ediv;
rcu_read_lock();
key = hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role);
- if (!key)
- goto unlock;
+ if (!key || smp_ltk_sec_level(key) < sec_level) {
+ rcu_read_unlock();
+ return false;
+ }
- if (smp_ltk_sec_level(key) < sec_level)
- goto unlock;
+ if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, hcon->flags)) {
+ rcu_read_unlock();
+ return true;
+ }
- ret = true;
- if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, hcon->flags))
- goto unlock;
+ /* Starting the encryption may sleep, so take a copy of the key and
+ * leave the RCU read-side section first.
+ */
+ memcpy(val, key->val, sizeof(val));
+ enc_size = key->enc_size;
+ rand = key->rand;
+ ediv = key->ediv;
- hci_le_start_enc(hcon, key->ediv, key->rand, key->val, key->enc_size);
- hcon->enc_key_size = key->enc_size;
+ rcu_read_unlock();
+
+ if (hci_le_enable_encrypt(hcon, ediv, rand, val, enc_size)) {
+ memzero_explicit(val, sizeof(val));
+ clear_bit(HCI_CONN_ENCRYPT_PEND, hcon->flags);
+ return false;
+ }
+
+ hcon->enc_key_size = enc_size;
+ memzero_explicit(val, sizeof(val));
/* We never store STKs for initiator role, so clear this flag */
clear_bit(HCI_CONN_STK_ENCRYPT, hcon->flags);
-unlock:
- rcu_read_unlock();
- return ret;
+ return true;
}
bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level,
@@ -2924,13 +2945,25 @@ static int smp_cmd_dhkey_check(struct l2cap_conn *conn, struct sk_buff *skb)
sc_dhkey_check(smp);
}
- sc_add_ltk(smp);
-
if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
- hci_le_start_enc(hcon, 0, 0, smp->tk, smp->enc_key_size);
+ /* Mark the encryption pending, as smp_random() does, before
+ * adding the LTK so it doesn't get started a second time with
+ * it, and so a failure doesn't remove a previously stored key.
+ */
+ if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, hcon->flags))
+ return SMP_UNSPECIFIED;
+
+ if (hci_le_enable_encrypt(hcon, 0, 0, smp->tk,
+ smp->enc_key_size)) {
+ clear_bit(HCI_CONN_ENCRYPT_PEND, hcon->flags);
+ return SMP_UNSPECIFIED;
+ }
+
hcon->enc_key_size = smp->enc_key_size;
}
+ sc_add_ltk(smp);
+
return 0;
}
--
2.56.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v11 4/6] Bluetooth: L2CAP: Add MIC length validation for HDT PHY
2026-11-09 17:18 [PATCH v11 0/6] Bluetooth: Add support for HDT and EKS Luiz Augusto von Dentz
` (2 preceding siblings ...)
2026-11-09 17:18 ` [PATCH v11 3/6] Bluetooth: Add initial support for EKS Luiz Augusto von Dentz
@ 2026-11-09 17:18 ` Luiz Augusto von Dentz
2026-11-09 17:18 ` [PATCH v11 5/6] Bluetooth: Add HCI_OP_LE_SET_HDT_DEFAULT_PARAMS support Luiz Augusto von Dentz
` (2 subsequent siblings)
6 siblings, 0 replies; 9+ messages in thread
From: Luiz Augusto von Dentz @ 2026-11-09 17:18 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Add a mic_len field to struct bt_security so userspace can require a
minimum MIC length on an L2CAP channel with BT_SECURITY, and read the
MIC length in use on the link back. The field is added at the end of
the struct, so the shorter struct is still accepted by L2CAP and RFCOMM,
leaving mic_len unset, and values other than 32, 64 and 128 bits are
rejected.
The MIC length a channel requires is requested on the connection on
every path starting LE security, so LE Enable Encryption v2 asks for
it, while the MIC length the controller reports with Encryption Change
v3 and Encryption Key Refresh Complete v2 is kept separately, so a
request never stands for what is in use. When a connection is
encrypted on the LE HDT PHY with a MIC shorter than the channel
requires, the LE Credit Based and Enhanced Credit Based connection
requests are rejected with MIC Length Too Short.
The reported MIC length only applies on the LE HDT PHY, the MIC is
always 32 bits on the GFSK PHYs, so hci_conn_mic_len() reports it as
such both for the check and for BT_SECURITY.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
include/net/bluetooth/bluetooth.h | 1 +
include/net/bluetooth/hci_core.h | 14 +++++++
include/net/bluetooth/l2cap.h | 9 +++++
net/bluetooth/hci_event.c | 20 ++++++---
net/bluetooth/hci_sync.c | 15 ++++++-
net/bluetooth/l2cap_core.c | 67 ++++++++++++++++++++++++++++++-
net/bluetooth/l2cap_sock.c | 27 +++++++++++--
net/bluetooth/rfcomm/sock.c | 13 ++++--
8 files changed, 152 insertions(+), 14 deletions(-)
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index d59407349b3e..777bc1a0336b 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -66,6 +66,7 @@
struct bt_security {
__u8 level;
__u8 key_size;
+ __u8 mic_len;
};
#define BT_SECURITY_SDP 0
#define BT_SECURITY_LOW 1
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 7a4f87236854..d2435bf49c5e 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -765,6 +765,8 @@ struct hci_conn {
__u8 pending_sec_level;
__u8 pin_length;
__u8 enc_key_size;
+ __u8 mic_len;
+ __u8 req_mic_len;
__u8 io_capability;
__u32 passkey_notify;
__u8 passkey_entered;
@@ -2178,6 +2180,18 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
(le_feature(dev, 1, 2) & HCI_LE_HDT_7_5_TX_FEATURE)
#define hdt_pf1_capable(dev) \
(le_feature(dev, 1, 2) & HCI_LE_HDT_PF_1)
+/* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 4, Part E, Section 7.8.24:
+ *
+ * The HDT_MIC_Length parameter indicates the MIC length to be used when the
+ * ACL connection is on LE HDT PHY.
+ *
+ * So the MIC length reported by the controller only applies on the LE HDT
+ * PHY, the MIC is 32 bits (0x00) on the GFSK PHYs.
+ */
+static inline __u8 hci_conn_mic_len(struct hci_conn *conn)
+{
+ return conn->le_rx_phy == 0x05 ? conn->mic_len : 0x00;
+}
#define eks_capable(dev) \
(le_feature(dev, 1, 1) & HCI_LE_EKS_FEATURE)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 54eddcdd341f..ff80238f3a51 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -285,6 +285,13 @@ struct l2cap_conn_rsp {
#define L2CAP_CR_LE_SCID_IN_USE 0x000A
#define L2CAP_CR_LE_UNACCEPT_PARAMS 0x000B
#define L2CAP_CR_LE_INVALID_PARAMS 0x000C
+/* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 3, Part A, Sections 4.23
+ * and 4.26: "Connection refused - MIC length too short" is 0x000C and "All
+ * connections refused - MIC length too short" is 0x0010. The LE Credit Based
+ * value is Invalid Parameters in the Enhanced Credit Based one.
+ */
+#define L2CAP_CR_LE_MIC_LEN_TOO_SHORT 0x000C
+#define L2CAP_CR_ECRED_MIC_LEN_TOO_SHORT 0x0010
/* connect/create channel status */
#define L2CAP_CS_NO_INFO 0x0000
@@ -533,6 +540,7 @@ struct l2cap_chan {
__u8 chan_policy;
__u8 sec_level;
+ __u8 mic_len;
__u8 ident;
@@ -981,6 +989,7 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
const struct sockcm_cookie *sockc);
void l2cap_chan_busy(struct l2cap_chan *chan, int busy);
void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail);
+void l2cap_chan_req_mic_len(struct l2cap_chan *chan, struct hci_conn *hcon);
int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator);
void l2cap_chan_set_defaults(struct l2cap_chan *chan, struct l2cap_chan *pchan);
int l2cap_ertm_init(struct l2cap_chan *chan);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 9dc0e13ce7c1..dfd889e376aa 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3777,10 +3777,11 @@ static void hci_remote_name_evt(struct hci_dev *hdev, void *data,
}
/* key_size is the encryption key size of an ACL link reported by the event,
- * or 0 if it doesn't report it, in which case it is read.
+ * or 0 if it doesn't report it, in which case it is read. mic_len is the MIC
+ * length reported by the event, 0x00 (32 bits) if it doesn't report it.
*/
static void hci_change_encrypt(struct hci_conn *conn, u8 status, u8 encrypt,
- u8 key_size)
+ u8 key_size, u8 mic_len)
{
struct hci_dev *hdev = conn->hdev;
@@ -3799,6 +3800,9 @@ static void hci_change_encrypt(struct hci_conn *conn, u8 status, u8 encrypt,
conn->type == LE_LINK)
set_bit(HCI_CONN_AES_CCM, conn->flags);
+ /* A 32-bit MIC is reported as 0x00 */
+ conn->mic_len = mic_len;
+
/* For ACL links the encryption key size is still
* validated below by hci_conn_enc_key_size_set(),
* once known. It reports the final security level so
@@ -3915,8 +3919,10 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
if (!conn)
goto unlock;
- /* This version doesn't report the key size, so it is read */
- hci_change_encrypt(conn, ev->status, ev->encrypt, 0x00);
+ /* This version doesn't report the key size, so it is read, nor the
+ * MIC length.
+ */
+ hci_change_encrypt(conn, ev->status, ev->encrypt, 0x00, 0x00);
unlock:
hci_dev_unlock(hdev);
@@ -3955,7 +3961,7 @@ static void hci_encrypt_change_v3_evt(struct hci_dev *hdev, void *data,
ev->key_size >= 0x07 && ev->key_size <= 0x10)
key_size = ev->key_size;
- hci_change_encrypt(conn, ev->status, ev->mode, key_size);
+ hci_change_encrypt(conn, ev->status, ev->mode, key_size, ev->mic_len);
unlock:
hci_dev_unlock(hdev);
@@ -5741,6 +5747,10 @@ static void hci_key_refresh_complete_v2_evt(struct hci_dev *hdev, void *data,
if (!conn)
goto unlock;
+ /* The key refresh may change the MIC length */
+ if (!ev->status)
+ conn->mic_len = ev->mic_len;
+
hci_conn_refresh_key(conn, ev->status);
unlock:
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 93cd95ecf309..0926dc844b44 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -8670,8 +8670,21 @@ static void le_enable_encrypt_failed(struct hci_dev *hdev, __le16 handle)
static int hci_le_enable_encrypt_v2_sync(struct hci_dev *hdev, void *data)
{
struct hci_cp_le_enable_encrypt_v2 *cp = data;
+ struct hci_conn *conn;
int err;
+ /* Use the MIC length requested by the time the command is sent, as
+ * channels may still raise it after it was queued, defaulting to 128
+ * bits if unset.
+ */
+ hci_dev_lock(hdev);
+
+ conn = hci_conn_hash_lookup_handle(hdev, le16_to_cpu(cp->handle));
+ if (conn)
+ cp->mic_len = conn->req_mic_len ? conn->req_mic_len : 0x02;
+
+ hci_dev_unlock(hdev);
+
err = __hci_cmd_sync_status(hdev, HCI_OP_LE_ENABLE_ENCRYPT_V2,
sizeof(*cp), cp, HCI_CMD_TIMEOUT);
if (err)
@@ -8696,8 +8709,6 @@ static int hci_le_enable_encrypt_v2(struct hci_conn *conn, __le16 ediv,
cp->handle = cpu_to_le16(conn->handle);
cp->rand = rand;
cp->ediv = ediv;
- cp->mic_len = 0x02; /* Always prefer 128 bits? */
-
/* The key is zero padded when shorter than 16 octets */
if (ltk) {
memcpy(cp->ltk, ltk, key_size);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 70ad30b091e4..d3b4153ee58e 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -579,6 +579,7 @@ void l2cap_chan_set_defaults(struct l2cap_chan *chan, struct l2cap_chan *pchan)
chan->tx_win = pchan->tx_win;
chan->tx_win_max = pchan->tx_win_max;
chan->sec_level = pchan->sec_level;
+ chan->mic_len = pchan->mic_len;
chan->conf_state = pchan->conf_state;
chan->flags = pchan->flags;
chan->tx_credits = pchan->tx_credits;
@@ -1025,14 +1026,26 @@ static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
}
}
+/* Raise the MIC length requested for the connection to the one the channel
+ * requires, so the next time encryption is started it asks for it.
+ */
+void l2cap_chan_req_mic_len(struct l2cap_chan *chan, struct hci_conn *hcon)
+{
+ if (chan->mic_len > hcon->req_mic_len)
+ hcon->req_mic_len = chan->mic_len;
+}
+
/* Service level security */
int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
{
struct l2cap_conn *conn = chan->conn;
__u8 auth_type;
- if (conn->hcon->type == LE_LINK)
+ if (conn->hcon->type == LE_LINK) {
+ l2cap_chan_req_mic_len(chan, conn->hcon);
+
return smp_conn_security(conn->hcon, chan->sec_level);
+ }
auth_type = l2cap_get_auth_type(chan);
@@ -1512,6 +1525,8 @@ static void l2cap_le_start(struct l2cap_chan *chan)
{
struct l2cap_conn *conn = chan->conn;
+ l2cap_chan_req_mic_len(chan, conn->hcon);
+
if (!smp_conn_security(conn->hcon, chan->sec_level))
return;
@@ -1579,6 +1594,18 @@ static bool l2cap_check_enc_key_size(struct hci_conn *hcon,
hcon->enc_key_size >= min_key_size);
}
+static bool l2cap_check_mic_len(struct hci_conn *hcon, struct l2cap_chan *chan)
+{
+ /* If the channel has no MIC length requirement, skip check */
+ if (!chan->mic_len)
+ return true;
+
+ if (!test_bit(HCI_CONN_ENCRYPT, hcon->flags))
+ return true;
+
+ return hci_conn_mic_len(hcon) >= chan->mic_len;
+}
+
static void l2cap_do_start(struct l2cap_chan *chan)
__must_hold(&chan->lock)
__must_hold(&chan->conn->lock)
@@ -5119,6 +5146,7 @@ static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
/* We'll need to send a new Connect Request */
clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);
+ l2cap_chan_req_mic_len(chan, hcon);
smp_conn_security(hcon, chan->sec_level);
break;
@@ -5268,6 +5296,11 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn,
l2cap_chan_lock(pchan);
+ /* Record the MIC length the channel requires before checking the
+ * security, so encryption started for it requests that.
+ */
+ l2cap_chan_req_mic_len(pchan, conn->hcon);
+
if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
SMP_ALLOW_STK)) {
result = pchan->sec_level == BT_SECURITY_MEDIUM ?
@@ -5283,6 +5316,20 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn,
goto response_unlock;
}
+ /* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 3, Part A,
+ * Section 10.1:
+ *
+ * If an L2CAP_LE_CREDIT_BASED_CONNECTION_REQ packet is received
+ * and the encryption key size is long enough but the MIC length is
+ * too short, then the connection shall be rejected with a result
+ * value of "Connection refused - MIC length too short".
+ */
+ if (!l2cap_check_mic_len(conn->hcon, pchan)) {
+ result = L2CAP_CR_LE_MIC_LEN_TOO_SHORT;
+ chan = NULL;
+ goto response_unlock;
+ }
+
/* Check for valid dynamic CID range */
if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
result = L2CAP_CR_LE_INVALID_SCID;
@@ -5494,6 +5541,11 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
l2cap_chan_lock(pchan);
+ /* Record the MIC length the channel requires before checking the
+ * security, so encryption started for it requests that.
+ */
+ l2cap_chan_req_mic_len(pchan, conn->hcon);
+
if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
SMP_ALLOW_STK)) {
result = pchan->sec_level == BT_SECURITY_MEDIUM ?
@@ -5501,6 +5553,18 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
goto unlock;
}
+ /* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 3, Part A,
+ * Section 10.2:
+ *
+ * If the encryption key size is long enough but the MIC length is
+ * too short, then the connection shall be rejected with a result
+ * value of "All connections refused - MIC length too short".
+ */
+ if (!l2cap_check_mic_len(conn->hcon, pchan)) {
+ result = L2CAP_CR_ECRED_MIC_LEN_TOO_SHORT;
+ goto unlock;
+ }
+
/* Check if the listening channel has set an output MTU then the
* requested MTU shall be less than or equal to that value.
*/
@@ -5697,6 +5761,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
/* We'll need to send a new Connect Request */
clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags);
+ l2cap_chan_req_mic_len(chan, hcon);
smp_conn_security(hcon, chan->sec_level);
break;
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 7a2551ef7f50..8609cde925b4 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -623,8 +623,10 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
if (conn) {
sec.level = conn->hcon->sec_level;
- if (sk->sk_state == BT_CONNECTED)
+ if (sk->sk_state == BT_CONNECTED) {
sec.key_size = conn->hcon->enc_key_size;
+ sec.mic_len = hci_conn_mic_len(conn->hcon);
+ }
} else {
sec.level = chan->sec_level;
}
@@ -960,9 +962,16 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break;
}
- sec.level = BT_SECURITY_LOW;
+ /* mic_len was added at the end of struct bt_security, so
+ * accept the shorter struct as well, leaving mic_len unset.
+ */
+ if (optlen < offsetofend(struct bt_security, key_size)) {
+ err = -EINVAL;
+ break;
+ }
- err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen);
+ err = copy_struct_from_sockptr(&sec, sizeof(sec), optval,
+ optlen);
if (err)
break;
@@ -972,7 +981,18 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break;
}
+ /* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 4,
+ * Part E, Section 7.7.8: MIC_Length 0x00 is 32 bits,
+ * 0x01 is 64 bits and 0x02 is 128 bits; all other
+ * values are reserved for future use.
+ */
+ if (sec.mic_len > 0x02) {
+ err = -EINVAL;
+ break;
+ }
+
chan->sec_level = sec.level;
+ chan->mic_len = sec.mic_len;
conn = l2cap_chan_conn(chan);
if (!conn)
@@ -980,6 +1000,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
/* change security for LE channels */
if (chan->scid == L2CAP_CID_ATT) {
+ l2cap_chan_req_mic_len(chan, conn->hcon);
if (smp_conn_security(conn->hcon, sec.level)) {
err = -EINVAL;
break;
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 3fb8b5474948..3ec2fb4ce580 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -700,9 +700,16 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname,
break;
}
- sec.level = BT_SECURITY_LOW;
+ /* mic_len was added at the end of struct bt_security, so
+ * accept the shorter struct as well. RFCOMM ignores it.
+ */
+ if (optlen < offsetofend(struct bt_security, key_size)) {
+ err = -EINVAL;
+ break;
+ }
- err = copy_safe_from_sockptr(&sec, sizeof(sec), optval, optlen);
+ err = copy_struct_from_sockptr(&sec, sizeof(sec), optval,
+ optlen);
if (err)
break;
@@ -844,8 +851,8 @@ static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname,
break;
}
+ memset(&sec, 0, sizeof(sec));
sec.level = rfcomm_pi(sk)->sec_level;
- sec.key_size = 0;
len = min(len, sizeof(sec));
if (copy_to_iter(&sec, len, &sopt->iter_out) != len)
--
2.56.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v11 5/6] Bluetooth: Add HCI_OP_LE_SET_HDT_DEFAULT_PARAMS support
2026-11-09 17:18 [PATCH v11 0/6] Bluetooth: Add support for HDT and EKS Luiz Augusto von Dentz
` (3 preceding siblings ...)
2026-11-09 17:18 ` [PATCH v11 4/6] Bluetooth: L2CAP: Add MIC length validation for HDT PHY Luiz Augusto von Dentz
@ 2026-11-09 17:18 ` Luiz Augusto von Dentz
2026-11-09 17:18 ` [PATCH v11 6/6] Bluetooth: Add EKS Opportunistic Encryption support Luiz Augusto von Dentz
2026-11-11 20:40 ` [PATCH v11 0/6] Bluetooth: Add support for HDT and EKS patchwork-bot+bluetooth
6 siblings, 0 replies; 9+ messages in thread
From: Luiz Augusto von Dentz @ 2026-11-09 17:18 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Add support for LE Set HDT Default Parameters, which sets the MIC
length, packet format and ACL rates the controller prefers on the LE
HDT PHY. The command is sent during controller initialization when the
controller supports HDT and the command, with the rates limited to the
ones the controller supports, preferring all of them if that leaves
none, and a packet format the controller doesn't support, Packet
Format 1 being optional, replaced by any supported one, since the
controller would reject either and fail the initialization.
The defaults are stored in hci_dev, 128-bit MIC, no packet format
preference and all HDT rates, and exposed through the MGMT system
configuration TLVs 0x0021-0x0023 so userspace can change them; changing
them while the controller is up sends the command again.
The spec reserves the values other than 64 or 128 bits for the MIC
length (the 32-bit MIC being the one of the GFSK PHYs), the packet
formats above 1 and the rate bits above HDT7.5. A TLV with a reserved
value is rejected with Invalid Parameters, rather than sent to a
controller that rejects it, which would fail the initialization.
The default MIC length applies when the connection did not request
one: to LE Enable Encryption v2, LE Set CIG Parameters v2 and LE Create
BIG v2, so ACL, CIS and BIS are set up with the MIC length the host was
told to use.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
include/net/bluetooth/hci.h | 7 +++
include/net/bluetooth/hci_core.h | 3 ++
include/net/bluetooth/hci_sync.h | 2 +
net/bluetooth/hci_core.c | 3 ++
net/bluetooth/hci_sync.c | 63 +++++++++++++++++++++++--
net/bluetooth/mgmt_config.c | 79 ++++++++++++++++++++++++++++++++
6 files changed, 153 insertions(+), 4 deletions(-)
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 778c234385ce..5edde8a6cc2d 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -2663,6 +2663,13 @@ struct hci_cp_le_create_big_v2 {
struct hci_bis_v2 bis;
} __packed;
+#define HCI_OP_LE_SET_HDT_DEFAULT_PARAMS 0x20bc
+struct hci_cp_le_set_hdt_default_params {
+ __u8 mic_len;
+ __u8 format;
+ __le16 rates;
+} __packed;
+
/* ---- HCI Events ---- */
struct hci_ev_status {
__u8 status;
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index d2435bf49c5e..e2a79ea5b6bc 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -433,6 +433,9 @@ struct hci_dev {
__u8 hdt_max_tx_win;
__u8 hdt_max_rx_win;
__u16 hdt_max_rx_packet;
+ __u8 hdt_def_mic_len;
+ __u8 hdt_def_format;
+ __u16 hdt_def_rates;
__u8 le_max_key_size;
__u8 le_min_key_size;
__u16 discov_interleaved_timeout;
diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h
index ab880384614a..e4e220ed098b 100644
--- a/include/net/bluetooth/hci_sync.h
+++ b/include/net/bluetooth/hci_sync.h
@@ -198,5 +198,7 @@ int hci_le_set_cig_params_sync(struct hci_dev *hdev, u8 cig_id);
int hci_le_create_big_sync(struct hci_conn *conn, struct bt_iso_qos_ext *qos,
u8 num_bis);
+int hci_le_set_hdt_params_sync(struct hci_dev *hdev);
+
int hci_le_enable_encrypt(struct hci_conn *conn, __le16 ediv, __le64 rand,
__u8 ltk[16], __u8 key_size);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index bfc5bdebc71a..a4014bbcdfc2 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2575,6 +2575,9 @@ struct hci_dev *hci_alloc_dev_priv(int sizeof_priv)
hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
+ hdev->hdt_def_mic_len = 0x02; /* 128-bit */
+ hdev->hdt_def_format = 0x00; /* No preference */
+ hdev->hdt_def_rates = 0x001f; /* All defined HDT rates */
hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES;
hdev->def_multi_adv_rotation_duration = HCI_DEFAULT_ADV_DURATION;
hdev->def_le_autoconnect_timeout = HCI_LE_CONN_TIMEOUT;
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 0926dc844b44..6674f8db7f52 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -5462,11 +5462,62 @@ static int hci_le_set_default_phy_sync(struct hci_dev *hdev)
sizeof(cp), &cp, HCI_CMD_TIMEOUT);
}
+int hci_le_set_hdt_params_sync(struct hci_dev *hdev)
+{
+ struct hci_cp_le_set_hdt_default_params cp;
+ u16 rates;
+ u8 format;
+
+ /* Only send if controller supports HDT and the command */
+ if (!hdt_capable(hdev) || !(hdev->commands[52] & BIT(1)))
+ return 0;
+
+ /* Mask out rates not supported by the controller */
+ rates = hdev->hdt_def_rates & hci_hdt_tx_rates(hdev);
+
+ /* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 6, Part A,
+ * Section 1:
+ *
+ * If the LE HDT PHY is supported, then HDT2, HDT3, and HDT4 shall be
+ * supported.
+ *
+ * So if none of the preferred rates is supported, such as when none
+ * is preferred, prefer all the ones that are rather than sending
+ * none, which the controller would reject.
+ */
+ if (!rates)
+ rates = hci_hdt_tx_rates(hdev);
+
+ /* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 4, Part E,
+ * Section 7.8.160:
+ *
+ * LE Set HDT Parameters Test fails with Command Disallowed when
+ * "Packet_Format equals 0x2 and HDT Packet Format 1 is not
+ * supported."
+ *
+ * So don't prefer a packet format the controller doesn't support,
+ * 0x00 being any supported one, as it would reject it the same way.
+ */
+ format = hdev->hdt_def_format;
+ if (format == 0x02 && !hdt_pf1_capable(hdev))
+ format = 0x00;
+
+ memset(&cp, 0, sizeof(cp));
+ cp.mic_len = hdev->hdt_def_mic_len;
+ cp.format = format;
+ cp.rates = cpu_to_le16(rates);
+
+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_HDT_DEFAULT_PARAMS,
+ sizeof(cp), &cp, HCI_CMD_TIMEOUT);
+}
+
static const struct hci_init_stage le_init4[] = {
/* HCI_OP_LE_WRITE_DEF_DATA_LEN */
HCI_INIT(hci_le_set_write_def_data_len_sync),
/* HCI_OP_LE_SET_DEFAULT_PHY */
HCI_INIT(hci_le_set_default_phy_sync),
+ /* HCI_OP_LE_SET_HDT_DEFAULT_PARAMS */
+ HCI_INIT(hci_le_set_hdt_params_sync),
{}
};
@@ -8482,7 +8533,8 @@ static int hci_le_set_cig_params_v2_sync(struct hci_dev *hdev, u8 cig_id)
qos->ucast.out.phys;
cis->c_rtn = qos->ucast.out.rtn;
cis->p_rtn = qos->ucast.in.rtn;
- cis->mic_len = 0x02; /* Always prefer 128 bits? */
+ cis->mic_len = conn->req_mic_len ? conn->req_mic_len :
+ hdev->hdt_def_mic_len;
/* Use the rates of each direction, or all the HDT rates the
* controller supports if none were set.
@@ -8593,6 +8645,8 @@ static int hci_le_create_big_v2_sync(struct hci_conn *conn,
cp.bis.framing = qos->bcast.framing;
cp.bis.encryption = qos->bcast.encryption;
memcpy(cp.bis.bcode, qos->bcast.bcode, sizeof(cp.bis.bcode));
+ cp.bis.mic_len = conn->req_mic_len ? conn->req_mic_len :
+ hdev->hdt_def_mic_len;
/* Use the rates set, or all the HDT rates the controller supports if
* none were set.
@@ -8674,14 +8728,15 @@ static int hci_le_enable_encrypt_v2_sync(struct hci_dev *hdev, void *data)
int err;
/* Use the MIC length requested by the time the command is sent, as
- * channels may still raise it after it was queued, defaulting to 128
- * bits if unset.
+ * channels may still raise it after it was queued, or the default one
+ * if unset.
*/
hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_handle(hdev, le16_to_cpu(cp->handle));
if (conn)
- cp->mic_len = conn->req_mic_len ? conn->req_mic_len : 0x02;
+ cp->mic_len = conn->req_mic_len ? conn->req_mic_len :
+ hdev->hdt_def_mic_len;
hci_dev_unlock(hdev);
diff --git a/net/bluetooth/mgmt_config.c b/net/bluetooth/mgmt_config.c
index fdcc752c6f13..054ba64e975b 100644
--- a/net/bluetooth/mgmt_config.c
+++ b/net/bluetooth/mgmt_config.c
@@ -91,6 +91,9 @@ int read_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
HDEV_PARAM_U16(advmon_no_filter_duration);
HDEV_PARAM_U8(enable_advmon_interleave_scan);
HDEV_PARAM_U32(idle_timeout);
+ HDEV_PARAM_U8(hdt_def_mic_len);
+ HDEV_PARAM_U8(hdt_def_format);
+ HDEV_PARAM_U16(hdt_def_rates);
} __packed rp = {
TLV_SET_U16(0x0000, def_page_scan_type),
TLV_SET_U16(0x0001, def_page_scan_int),
@@ -125,6 +128,9 @@ int read_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
TLV_SET_U16(0x001e, advmon_no_filter_duration),
TLV_SET_U8(0x001f, enable_advmon_interleave_scan),
TLV_SET_U32(0x0020, idle_timeout),
+ TLV_SET_U8(0x0021, hdt_def_mic_len),
+ TLV_SET_U8(0x0022, hdt_def_format),
+ TLV_SET_U16(0x0023, hdt_def_rates),
};
bt_dev_dbg(hdev, "sock %p", sk);
@@ -140,11 +146,19 @@ int read_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
#define TLV_GET_LE16(tlv) le16_to_cpu(*((__le16 *)(TO_TLV(tlv)->value)))
#define TLV_GET_U8(tlv) (*((__u8 *)(TO_TLV(tlv)->value)))
+static int set_hdt_params_sync(struct hci_dev *hdev, void *data)
+{
+ return hci_le_set_hdt_params_sync(hdev);
+}
+
int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
u16 data_len)
{
u16 buffer_left = data_len;
u8 *buffer = data;
+ u8 old_mic_len = hdev->hdt_def_mic_len;
+ u8 old_format = hdev->hdt_def_format;
+ u16 old_rates = hdev->hdt_def_rates;
if (buffer_left < sizeof(struct mgmt_tlv)) {
return mgmt_cmd_status(sk, hdev->id,
@@ -159,6 +173,7 @@ int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
const u16 exp_len = sizeof(struct mgmt_tlv) +
len;
const u16 type = le16_to_cpu(TO_TLV(buffer)->type);
+ bool invalid;
if (buffer_left < exp_len) {
bt_dev_warn(hdev, "invalid len left %u, exp >= %u",
@@ -201,9 +216,12 @@ int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
case 0x001b:
case 0x001d:
case 0x001e:
+ case 0x0023:
exp_type_len = sizeof(u16);
break;
case 0x001f:
+ case 0x0021:
+ case 0x0022:
exp_type_len = sizeof(u8);
break;
case 0x0020:
@@ -224,6 +242,51 @@ int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
MGMT_STATUS_INVALID_PARAMS);
}
+ /* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 4, Part E,
+ * Section 7.8.159:
+ *
+ * Preferred_MIC_Length: 0x01 Preferred MIC length is 64 bits.
+ * 0x02 MIC length is 128 bits (default). All other values
+ * Reserved for future use.
+ * Preferred_Packet_Format: 0x00 any supported, 0x01 packet
+ * format 0, 0x02 packet format 1. All other values Reserved
+ * for future use.
+ * Preferred_ACL_Rates: bits 0 to 4 are the HDT2, HDT3, HDT4,
+ * HDT6 and HDT7.5 rates. All other bits Reserved for future
+ * use.
+ *
+ * So a reserved value is not valid, the controller would
+ * reject it, failing the initialization when the default
+ * parameters are sent. For the MIC length, that includes 0x00
+ * (32 bits), the one of the GFSK PHYs.
+ */
+ switch (type) {
+ case 0x0021:
+ invalid = TLV_GET_U8(buffer) != 0x01 &&
+ TLV_GET_U8(buffer) != 0x02;
+ break;
+ case 0x0022:
+ invalid = TLV_GET_U8(buffer) > 0x02;
+ break;
+ case 0x0023:
+ invalid = TLV_GET_LE16(buffer) &
+ ~(HCI_HDT_RATE_2M | HCI_HDT_RATE_3M |
+ HCI_HDT_RATE_4M | HCI_HDT_RATE_6M |
+ HCI_HDT_RATE_7_5M);
+ break;
+ default:
+ invalid = false;
+ break;
+ }
+
+ if (invalid) {
+ bt_dev_warn(hdev, "invalid value for type %u", type);
+
+ return mgmt_cmd_status(sk, hdev->id,
+ MGMT_OP_SET_DEF_SYSTEM_CONFIG,
+ MGMT_STATUS_INVALID_PARAMS);
+ }
+
buffer_left -= exp_len;
buffer += exp_len;
}
@@ -335,6 +398,15 @@ int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
case 0x00020:
hdev->idle_timeout = TLV_GET_LE32(buffer);
break;
+ case 0x0021:
+ hdev->hdt_def_mic_len = TLV_GET_U8(buffer);
+ break;
+ case 0x0022:
+ hdev->hdt_def_format = TLV_GET_U8(buffer);
+ break;
+ case 0x0023:
+ hdev->hdt_def_rates = TLV_GET_LE16(buffer);
+ break;
default:
bt_dev_warn(hdev, "unsupported parameter %u", type);
break;
@@ -344,6 +416,13 @@ int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
buffer += exp_len;
}
+ /* The controller may be up without being powered through MGMT */
+ if (test_bit(HCI_UP, &hdev->flags) &&
+ (hdev->hdt_def_mic_len != old_mic_len ||
+ hdev->hdt_def_format != old_format ||
+ hdev->hdt_def_rates != old_rates))
+ hci_cmd_sync_queue(hdev, set_hdt_params_sync, NULL, NULL);
+
return mgmt_cmd_complete(sk, hdev->id,
MGMT_OP_SET_DEF_SYSTEM_CONFIG, 0, NULL, 0);
}
--
2.56.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v11 6/6] Bluetooth: Add EKS Opportunistic Encryption support
2026-11-09 17:18 [PATCH v11 0/6] Bluetooth: Add support for HDT and EKS Luiz Augusto von Dentz
` (4 preceding siblings ...)
2026-11-09 17:18 ` [PATCH v11 5/6] Bluetooth: Add HCI_OP_LE_SET_HDT_DEFAULT_PARAMS support Luiz Augusto von Dentz
@ 2026-11-09 17:18 ` Luiz Augusto von Dentz
2026-11-11 20:40 ` [PATCH v11 0/6] Bluetooth: Add support for HDT and EKS patchwork-bot+bluetooth
6 siblings, 0 replies; 9+ messages in thread
From: Luiz Augusto von Dentz @ 2026-11-09 17:18 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Add support for opportunistic encryption with Encryption Key Schedule,
which encrypts a link without pairing when both devices support it:
- The Opportunistic Encryption (Host Support) feature bit (Link Layer
feature bit 90) is set with LE Set Host Feature during
initialization, and eks_oppt_capable() checks the remote supports it.
- When the remote features are read as Central and there is no LTK for
the peer, LE Enable Encryption v2 is sent with Encryption set to
opportunistic. The checks are repeated right before the command is
sent, so it is skipped if the link is gone, already encrypted, has
SMP encryption pending or SMP pairing has started in the meantime,
and the MIC length is taken at that point so the one requested by
L2CAP is used.
- The new HCI_CONN_OPP_ENCRYPT flag marks the request in flight and,
once Encryption Change v3 reports it, an opportunistically encrypted
link, which is also marked as encrypted with AES-CCM. It doesn't
raise the security level, as it is not authenticated, and since it
has no key from pairing the L2CAP key size check is skipped for it.
A failure, or a command that cannot be sent, just leaves the link
unencrypted, as it was. Since opportunistic encryption can only be
started on an unencrypted link, reporting it for a link with a key
from pairing is a downgrade, which disconnects the link. A failure on
an opportunistically encrypted link is handled as for any encrypted
link, without the encryption flags it had.
- SMP only distributes keys once a key from pairing encrypts the link,
not on opportunistic encryption.
- HCI_CONN_ENCRYPT_PEND is not used for opportunistic encryption, so
it doesn't block SMP. Pairing over such a link completes: the Key
Refresh Complete of its key clears HCI_CONN_OPP_ENCRYPT and is
handled as Encryption Change is for an unencrypted link.
- A Key Refresh Complete reporting opportunistic encryption, such as
one changing the MIC length, keeps the link opportunistically
encrypted. Opportunistic encryption can only be started on an
unencrypted link, so on a link with a key from pairing it would be a
downgrade, which disconnects the link.
- The feature can be turned off with the MGMT system configuration TLV
0x0024; it is on by default. Changing it while the controller is up
updates the feature bit, which the controller only allows when there
are no connections.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
include/net/bluetooth/hci.h | 1 +
include/net/bluetooth/hci_core.h | 6 ++
include/net/bluetooth/hci_sync.h | 2 +
net/bluetooth/hci_core.c | 1 +
net/bluetooth/hci_event.c | 127 ++++++++++++++++++++++++++-
net/bluetooth/hci_sync.c | 145 ++++++++++++++++++++++++++++++-
net/bluetooth/l2cap_core.c | 7 ++
net/bluetooth/mgmt_config.c | 26 ++++++
net/bluetooth/smp.c | 29 ++++++-
net/bluetooth/smp.h | 2 +
10 files changed, 338 insertions(+), 8 deletions(-)
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 5edde8a6cc2d..efb85c781e4e 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -668,6 +668,7 @@ enum {
#define HCI_LE_HDT_7_5_TX_FEATURE BIT(1)
#define HCI_LE_HDT_PF_1 BIT(2)
#define HCI_LE_HDT_LQF_FEATURE BIT(3)
+#define HCI_LE_OPPORTUNISTIC_ENC BIT(2) /* Byte 3 */
/* Connection modes */
#define HCI_CM_ACTIVE 0x0000
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index e2a79ea5b6bc..967b89c31774 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -436,6 +436,7 @@ struct hci_dev {
__u8 hdt_def_mic_len;
__u8 hdt_def_format;
__u16 hdt_def_rates;
+ bool eks_oppt;
__u8 le_max_key_size;
__u8 le_min_key_size;
__u16 discov_interleaved_timeout;
@@ -707,6 +708,7 @@ enum {
HCI_CONN_POWER_SAVE,
HCI_CONN_FLUSH_KEY,
HCI_CONN_ENCRYPT,
+ HCI_CONN_OPP_ENCRYPT,
HCI_CONN_AUTH,
HCI_CONN_SECURE,
HCI_CONN_FIPS,
@@ -2198,6 +2200,10 @@ static inline __u8 hci_conn_mic_len(struct hci_conn *conn)
#define eks_capable(dev) \
(le_feature(dev, 1, 1) & HCI_LE_EKS_FEATURE)
+#define eks_oppt_capable(dev) \
+ (eks_capable(dev) && \
+ (le_feature(dev, 1, 3) & HCI_LE_OPPORTUNISTIC_ENC))
+
/* Channel sounding support */
#define le_cs_capable(dev) \
((dev)->le_features[5] & HCI_LE_CS)
diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h
index e4e220ed098b..966106b4a0fe 100644
--- a/include/net/bluetooth/hci_sync.h
+++ b/include/net/bluetooth/hci_sync.h
@@ -202,3 +202,5 @@ int hci_le_set_hdt_params_sync(struct hci_dev *hdev);
int hci_le_enable_encrypt(struct hci_conn *conn, __le16 ediv, __le64 rand,
__u8 ltk[16], __u8 key_size);
+int hci_le_eks_oppt_encrypt(struct hci_conn *conn);
+int hci_le_set_eks_oppt_sync(struct hci_dev *hdev);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index a4014bbcdfc2..06e676eed468 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2578,6 +2578,7 @@ struct hci_dev *hci_alloc_dev_priv(int sizeof_priv)
hdev->hdt_def_mic_len = 0x02; /* 128-bit */
hdev->hdt_def_format = 0x00; /* No preference */
hdev->hdt_def_rates = 0x001f; /* All defined HDT rates */
+ hdev->eks_oppt = true; /* Opportunistic encryption enabled */
hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES;
hdev->def_multi_adv_rotation_duration = HCI_DEFAULT_ADV_DURATION;
hdev->def_le_autoconnect_timeout = HCI_LE_CONN_TIMEOUT;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index dfd889e376aa..03bd9badf282 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3107,12 +3107,18 @@ static void hci_cs_le_enable_encrypt_v2(struct hci_dev *hdev, u8 status)
if (!conn)
goto unlock;
- clear_bit(HCI_CONN_ENCRYPT_PEND, conn->flags);
-
/* An opportunistic encryption that cannot be started just leaves
* the link unencrypted, as it was.
*/
- if (cp->encryption == 0x01 || conn->state != BT_CONNECTED)
+ if (cp->encryption == 0x01) {
+ if (!test_bit(HCI_CONN_ENCRYPT, conn->flags))
+ clear_bit(HCI_CONN_OPP_ENCRYPT, conn->flags);
+ goto unlock;
+ }
+
+ clear_bit(HCI_CONN_ENCRYPT_PEND, conn->flags);
+
+ if (conn->state != BT_CONNECTED)
goto unlock;
hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
@@ -3943,6 +3949,74 @@ static void hci_encrypt_change_v3_evt(struct hci_dev *hdev, void *data,
if (!conn)
goto unlock;
+ /* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 4, Part E,
+ * Section 7.8.24:
+ *
+ * When the Encryption_Type parameter is set to 0x01 (use
+ * opportunistic encryption with Encryption Key Schedule), the
+ * command shall be only used for unencrypted connections
+ *
+ * So on a link with a key from pairing it would be a downgrade.
+ */
+ if (ev->eks_mode == 0x02 && test_bit(HCI_CONN_ENCRYPT, conn->flags) &&
+ !test_bit(HCI_CONN_OPP_ENCRYPT, conn->flags)) {
+ bt_dev_err(hdev, "opportunistic encryption of hcon %p", conn);
+ hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
+ goto unlock;
+ }
+
+ if (ev->status || !ev->mode) {
+ if (test_and_clear_bit(HCI_CONN_OPP_ENCRYPT, conn->flags)) {
+ /* BLUETOOTH CORE SPECIFICATION Version 7.0 |
+ * Vol 4, Part E, Section 7.7.8:
+ *
+ * When encryption is enabled for LE, the
+ * Key_Schedule_Enabled parameter indicates whether
+ * Encryption Key Schedule based encryption is used.
+ *
+ * So a failure doesn't report it, and one while
+ * opportunistic encryption is being started is its
+ * own: the link is just left unencrypted, as it was.
+ */
+ if (!test_bit(HCI_CONN_ENCRYPT, conn->flags))
+ goto unlock;
+
+ /* Otherwise the opportunistic encryption is lost */
+ clear_bit(HCI_CONN_ENCRYPT, conn->flags);
+ clear_bit(HCI_CONN_AES_CCM, conn->flags);
+ }
+
+ /* Nothing to validate, so no key size */
+ hci_change_encrypt(conn, ev->status, ev->mode, 0x00,
+ ev->mic_len);
+ goto unlock;
+ }
+
+ /* Opportunistic encryption (eks_mode 0x02), started by this side or
+ * by the remote, encrypts the link without a key from pairing: it is
+ * marked with HCI_CONN_OPP_ENCRYPT and has no key size.
+ *
+ * BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 3, Part C,
+ * Section 10.3.3:
+ *
+ * If opportunistic encryption is used to encrypt the link and
+ * encryption is required, then the service request shall be
+ * rejected with the error code "Insufficient Encryption".
+ *
+ * So it doesn't change the security level, which stays as if the
+ * link were unencrypted.
+ */
+ if (ev->eks_mode == 0x02) {
+ set_bit(HCI_CONN_OPP_ENCRYPT, conn->flags);
+ set_bit(HCI_CONN_ENCRYPT, conn->flags);
+ set_bit(HCI_CONN_AES_CCM, conn->flags);
+ conn->mic_len = ev->mic_len;
+ goto unlock;
+ }
+
+ /* Encryption with a key from pairing replaces the opportunistic one */
+ clear_bit(HCI_CONN_OPP_ENCRYPT, conn->flags);
+
/* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 4, Part E,
* Section 7.7.8:
*
@@ -5747,6 +5821,51 @@ static void hci_key_refresh_complete_v2_evt(struct hci_dev *hdev, void *data,
if (!conn)
goto unlock;
+ /* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 4, Part E,
+ * Section 7.8.24:
+ *
+ * When the Encryption_Type parameter is set to 0x01 (use
+ * opportunistic encryption with Encryption Key Schedule), the
+ * command shall be only used for unencrypted connections
+ * ...
+ * The MIC length to be used for LE HDT PHY may be overridden by a
+ * later HCI_Refresh_Encryption_Key command on the same connection.
+ *
+ * So a refresh reporting it, such as one changing the MIC length,
+ * keeps the link opportunistically encrypted, and on a link with a
+ * key from pairing it would be a downgrade.
+ */
+ if (ev->eks_mode == 0x02 &&
+ !test_bit(HCI_CONN_OPP_ENCRYPT, conn->flags)) {
+ bt_dev_err(hdev, "opportunistic key refresh of hcon %p", conn);
+ hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
+ goto unlock;
+ }
+
+ /* A failure is handled below like any other */
+ if (ev->eks_mode == 0x02 && !ev->status) {
+ conn->mic_len = ev->mic_len;
+ goto unlock;
+ }
+
+ /* The key from pairing replacing the opportunistic one encrypts the
+ * link as Encryption Change does for an unencrypted link.
+ */
+ if (test_and_clear_bit(HCI_CONN_OPP_ENCRYPT, conn->flags)) {
+ /* On failure the link is disconnected, so don't report it
+ * as still encrypted with the opportunistic key meanwhile.
+ */
+ if (ev->status) {
+ clear_bit(HCI_CONN_ENCRYPT, conn->flags);
+ clear_bit(HCI_CONN_AES_CCM, conn->flags);
+ }
+
+ /* LE, so no key size */
+ hci_change_encrypt(conn, ev->status, ev->status ? 0x00 : 0x01,
+ 0x00, ev->mic_len);
+ goto unlock;
+ }
+
/* The key refresh may change the MIC length */
if (!ev->status)
conn->mic_len = ev->mic_len;
@@ -7982,6 +8101,8 @@ static void hci_le_read_all_remote_features_evt(struct hci_dev *hdev,
conn->le_tx_def_phys &= ~HCI_LE_SET_PHY_HDT;
conn->le_rx_def_phys &= ~HCI_LE_SET_PHY_HDT;
}
+
+ hci_le_eks_oppt_encrypt(conn);
}
if (conn->state == BT_CONFIG) {
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 6674f8db7f52..8a6e7fd86ba7 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -5043,6 +5043,16 @@ static int hci_le_set_def_rate_sync(struct hci_dev *hdev)
/* Set Host Features, each feature needs to be sent separately since
* HCI_OP_LE_SET_HOST_FEATURE doesn't support setting all of them at once.
*/
+int hci_le_set_eks_oppt_sync(struct hci_dev *hdev)
+{
+ if (!eks_capable(hdev))
+ return 0;
+
+ /* Opportunistic Encryption (Host Support) */
+ return hci_le_set_host_feature_sync(hdev, 90,
+ hdev->eks_oppt ? 0x01 : 0x00);
+}
+
static int hci_le_set_host_features_sync(struct hci_dev *hdev)
{
int err = 0;
@@ -5063,11 +5073,14 @@ static int hci_le_set_host_features_sync(struct hci_dev *hdev)
return err;
}
- if (le_sci_capable(hdev))
+ if (le_sci_capable(hdev)) {
/* Shorter Connection Intervals (Host Support) */
err = hci_le_set_host_feature_sync(hdev, 73, 0x01);
+ if (err)
+ return err;
+ }
- return err;
+ return hci_le_set_eks_oppt_sync(hdev);
}
/* LE Controller init stage 3 command sequence */
@@ -8721,6 +8734,13 @@ static void le_enable_encrypt_failed(struct hci_dev *hdev, __le16 handle)
hci_conn_put(conn);
}
+static int hci_le_enable_encrypt_v2_send(struct hci_dev *hdev,
+ struct hci_cp_le_enable_encrypt_v2 *cp)
+{
+ return __hci_cmd_sync_status(hdev, HCI_OP_LE_ENABLE_ENCRYPT_V2,
+ sizeof(*cp), cp, HCI_CMD_TIMEOUT);
+}
+
static int hci_le_enable_encrypt_v2_sync(struct hci_dev *hdev, void *data)
{
struct hci_cp_le_enable_encrypt_v2 *cp = data;
@@ -8740,8 +8760,7 @@ static int hci_le_enable_encrypt_v2_sync(struct hci_dev *hdev, void *data)
hci_dev_unlock(hdev);
- err = __hci_cmd_sync_status(hdev, HCI_OP_LE_ENABLE_ENCRYPT_V2,
- sizeof(*cp), cp, HCI_CMD_TIMEOUT);
+ err = hci_le_enable_encrypt_v2_send(hdev, cp);
if (err)
le_enable_encrypt_failed(hdev, cp->handle);
@@ -8824,3 +8843,121 @@ int hci_le_enable_encrypt(struct hci_conn *conn, __le16 ediv, __le64 rand,
return err;
}
+
+/* The opportunistic encryption is queued when the connection is set up, so
+ * by the time it runs the connection may be gone, already encrypted, have
+ * SMP encryption pending or SMP pairing in progress, so check again right
+ * before sending the command and leave the link to SMP in those cases.
+ *
+ * HCI_CONN_OPP_ENCRYPT, without HCI_CONN_ENCRYPT, marks the request in
+ * flight. HCI_CONN_ENCRYPT_PEND is not used for it, so SMP is not blocked
+ * by it: SMP pairing over a link being encrypted works, and the encryption
+ * started by SMP afterwards replaces the opportunistic key.
+ */
+static int hci_le_eks_oppt_encrypt_sync(struct hci_dev *hdev, void *data)
+{
+ struct hci_cp_le_enable_encrypt_v2 *cp = data;
+ struct hci_conn *conn;
+ int err;
+
+ hci_dev_lock(hdev);
+
+ conn = hci_conn_hash_lookup_handle(hdev, le16_to_cpu(cp->handle));
+ if (!conn || conn->state != BT_CONNECTED ||
+ test_bit(HCI_CONN_ENCRYPT, conn->flags) ||
+ test_bit(HCI_CONN_ENCRYPT_PEND, conn->flags))
+ goto unlock;
+
+ /* conn->hdev is hdev, whose lock is held */
+ lockdep_assert_held(&conn->hdev->lock);
+
+ if (smp_pairing_in_progress(conn)) {
+ bt_dev_dbg(hdev, "SMP in progress, skipping hcon %p", conn);
+ goto unlock;
+ }
+
+ if (test_and_set_bit(HCI_CONN_OPP_ENCRYPT, conn->flags))
+ goto unlock;
+
+ /* Use the MIC length requested by now, or the default one if unset */
+ cp->mic_len = conn->req_mic_len ? conn->req_mic_len :
+ hdev->hdt_def_mic_len;
+
+ bt_dev_dbg(hdev, "starting EKS opportunistic encryption hcon %p", conn);
+
+ hci_dev_unlock(hdev);
+
+ /* Sent without the failure handling of encryption started by SMP,
+ * which isn't pending for it and must not be disconnected for it.
+ */
+ err = hci_le_enable_encrypt_v2_send(hdev, cp);
+ if (!err)
+ return 0;
+
+ /* No result will come for a command that was not sent or failed */
+ hci_dev_lock(hdev);
+
+ conn = hci_conn_hash_lookup_handle(hdev, le16_to_cpu(cp->handle));
+ if (conn && !test_bit(HCI_CONN_ENCRYPT, conn->flags))
+ clear_bit(HCI_CONN_OPP_ENCRYPT, conn->flags);
+
+ hci_dev_unlock(hdev);
+
+ return err;
+
+unlock:
+ hci_dev_unlock(hdev);
+ return 0;
+}
+
+int hci_le_eks_oppt_encrypt(struct hci_conn *conn)
+{
+ struct hci_dev *hdev = conn->hdev;
+ struct hci_cp_le_enable_encrypt_v2 *cp;
+ int err;
+
+ /* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 4, Part E,
+ * Section 7.8.24: "This command shall only be used when the local
+ * device's role is Central."
+ */
+ if (conn->role != HCI_ROLE_MASTER)
+ return -EINVAL;
+
+ /* Check hdev config */
+ if (!hdev->eks_oppt)
+ return -EOPNOTSUPP;
+
+ /* Remote must support opportunistic encryption */
+ if (!eks_oppt_capable(conn))
+ return -EOPNOTSUPP;
+
+ /* Must support EKS and the encrypt_v2 command */
+ if (!eks_capable(hdev) || !(hdev->commands[50] & BIT(4)))
+ return -EOPNOTSUPP;
+
+ /* Don't encrypt if already encrypted or pending */
+ if (test_bit(HCI_CONN_ENCRYPT, conn->flags) ||
+ test_bit(HCI_CONN_ENCRYPT_PEND, conn->flags) ||
+ test_bit(HCI_CONN_OPP_ENCRYPT, conn->flags))
+ return -EALREADY;
+
+ /* Skip if we have an LTK for this peer (use normal encryption) */
+ if (hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role))
+ return -EEXIST;
+
+ bt_dev_dbg(hdev, "queueing EKS opportunistic encryption hcon %p", conn);
+
+ cp = kzalloc_obj(*cp);
+ if (!cp)
+ return -ENOMEM;
+
+ cp->handle = cpu_to_le16(conn->handle);
+ cp->encryption = 0x01; /* Opportunistic with EKS */
+
+ err = hci_cmd_sync_queue_once(hdev, hci_le_eks_oppt_encrypt_sync, cp,
+ le_enable_encrypt_complete);
+ if (err)
+ kfree(cp);
+
+ return err;
+}
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index d3b4153ee58e..783aada1edc2 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1583,6 +1583,12 @@ static bool l2cap_check_enc_key_size(struct hci_conn *hcon,
* This check might also be called for unencrypted connections
* that have no key size requirements. Ensure that the link is
* actually encrypted before enforcing a key size.
+ *
+ * Opportunistic encryption has no key from pairing, so there is no
+ * key size to enforce. The security level stays as if the link were
+ * unencrypted, see hci_encrypt_change_v3_evt(), so a channel
+ * requiring more still needs pairing, which then replaces the
+ * opportunistic key.
*/
int min_key_size = hcon->hdev->min_enc_key_size;
@@ -1591,6 +1597,7 @@ static bool l2cap_check_enc_key_size(struct hci_conn *hcon,
min_key_size = 16;
return (!test_bit(HCI_CONN_ENCRYPT, hcon->flags) ||
+ test_bit(HCI_CONN_OPP_ENCRYPT, hcon->flags) ||
hcon->enc_key_size >= min_key_size);
}
diff --git a/net/bluetooth/mgmt_config.c b/net/bluetooth/mgmt_config.c
index 054ba64e975b..e4af6959058c 100644
--- a/net/bluetooth/mgmt_config.c
+++ b/net/bluetooth/mgmt_config.c
@@ -94,6 +94,7 @@ int read_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
HDEV_PARAM_U8(hdt_def_mic_len);
HDEV_PARAM_U8(hdt_def_format);
HDEV_PARAM_U16(hdt_def_rates);
+ HDEV_PARAM_U8(eks_oppt);
} __packed rp = {
TLV_SET_U16(0x0000, def_page_scan_type),
TLV_SET_U16(0x0001, def_page_scan_int),
@@ -131,6 +132,7 @@ int read_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
TLV_SET_U8(0x0021, hdt_def_mic_len),
TLV_SET_U8(0x0022, hdt_def_format),
TLV_SET_U16(0x0023, hdt_def_rates),
+ TLV_SET_U8(0x0024, eks_oppt),
};
bt_dev_dbg(hdev, "sock %p", sk);
@@ -151,6 +153,22 @@ static int set_hdt_params_sync(struct hci_dev *hdev, void *data)
return hci_le_set_hdt_params_sync(hdev);
}
+static int set_eks_oppt_sync(struct hci_dev *hdev, void *data)
+{
+ int err;
+
+ /* BLUETOOTH CORE SPECIFICATION Version 7.0 | Vol 4, Part E,
+ * Section 7.8.115: LE Set Host Feature fails with Command Disallowed
+ * (0x0C) when "The Controller has a connection to another device."
+ */
+ err = hci_le_set_eks_oppt_sync(hdev);
+ if (err)
+ bt_dev_warn(hdev, "unable to set opportunistic encryption: %d",
+ err);
+
+ return err;
+}
+
int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
u16 data_len)
{
@@ -159,6 +177,7 @@ int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
u8 old_mic_len = hdev->hdt_def_mic_len;
u8 old_format = hdev->hdt_def_format;
u16 old_rates = hdev->hdt_def_rates;
+ bool old_eks_oppt = hdev->eks_oppt;
if (buffer_left < sizeof(struct mgmt_tlv)) {
return mgmt_cmd_status(sk, hdev->id,
@@ -222,6 +241,7 @@ int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
case 0x001f:
case 0x0021:
case 0x0022:
+ case 0x0024:
exp_type_len = sizeof(u8);
break;
case 0x0020:
@@ -407,6 +427,9 @@ int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
case 0x0023:
hdev->hdt_def_rates = TLV_GET_LE16(buffer);
break;
+ case 0x0024:
+ hdev->eks_oppt = !!TLV_GET_U8(buffer);
+ break;
default:
bt_dev_warn(hdev, "unsupported parameter %u", type);
break;
@@ -423,6 +446,9 @@ int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,
hdev->hdt_def_rates != old_rates))
hci_cmd_sync_queue(hdev, set_hdt_params_sync, NULL, NULL);
+ if (test_bit(HCI_UP, &hdev->flags) && hdev->eks_oppt != old_eks_oppt)
+ hci_cmd_sync_queue(hdev, set_eks_oppt_sync, NULL, NULL);
+
return mgmt_cmd_complete(sk, hdev->id,
MGMT_OP_SET_DEF_SYSTEM_CONFIG, 0, NULL, 0);
}
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 140b9813998b..b35093dfa40b 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2464,6 +2464,29 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
return ret;
}
+bool smp_pairing_in_progress(struct hci_conn *hcon)
+{
+ struct l2cap_conn *conn;
+ struct l2cap_chan *chan;
+ bool pending;
+
+ lockdep_assert_held(&hcon->hdev->lock);
+
+ conn = hcon->l2cap_data;
+ if (!conn)
+ return false;
+
+ chan = conn->smp;
+ if (!chan)
+ return false;
+
+ l2cap_chan_lock(chan);
+ pending = !!chan->data;
+ l2cap_chan_unlock(chan);
+
+ return pending;
+}
+
int smp_cancel_and_remove_pairing(struct hci_dev *hdev, bdaddr_t *bdaddr,
u8 addr_type)
{
@@ -3195,7 +3218,11 @@ static void smp_resume_cb(struct l2cap_chan *chan)
if (!smp)
return;
- if (!test_bit(HCI_CONN_ENCRYPT, hcon->flags))
+ /* Opportunistic encryption doesn't use a key from pairing, so keys
+ * are only distributed once the pairing encrypts the link.
+ */
+ if (!test_bit(HCI_CONN_ENCRYPT, hcon->flags) ||
+ test_bit(HCI_CONN_OPP_ENCRYPT, hcon->flags))
return;
cancel_delayed_work(&smp->security_timer);
diff --git a/net/bluetooth/smp.h b/net/bluetooth/smp.h
index c86c46389007..0537762e2775 100644
--- a/net/bluetooth/smp.h
+++ b/net/bluetooth/smp.h
@@ -185,6 +185,8 @@ int smp_cancel_and_remove_pairing(struct hci_dev *hdev, bdaddr_t *bdaddr,
bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level,
enum smp_key_pref key_pref);
int smp_conn_security(struct hci_conn *hcon, __u8 sec_level);
+bool smp_pairing_in_progress(struct hci_conn *hcon)
+ __must_hold(&hcon->hdev->lock);
int smp_user_confirm_reply(struct hci_conn *conn, u16 mgmt_op, __le32 passkey)
__must_hold(&conn->hdev->lock);
--
2.56.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH v11 0/6] Bluetooth: Add support for HDT and EKS
2026-11-09 17:18 [PATCH v11 0/6] Bluetooth: Add support for HDT and EKS Luiz Augusto von Dentz
` (5 preceding siblings ...)
2026-11-09 17:18 ` [PATCH v11 6/6] Bluetooth: Add EKS Opportunistic Encryption support Luiz Augusto von Dentz
@ 2026-11-11 20:40 ` patchwork-bot+bluetooth
6 siblings, 0 replies; 9+ messages in thread
From: patchwork-bot+bluetooth @ 2026-11-11 20:40 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth
Hello:
This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Mon, 9 Nov 2026 12:18:32 -0500 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> This adds support for the LE High Data Throughput (HDT) PHY and the
> Encryption Key Schedule (EKS) introduced in Bluetooth Core 7.0:
>
> - HDT PHY selection for ACL, CIS and BIS, the v2/v3 HCI commands and
> events that carry the HDT rates, and the LE Set HDT Default
> Parameters command.
> - ISO sockets take an extended, versioned QoS (struct bt_iso_qos_ext)
> through the existing BT_ISO_QOS option, carrying the HDT rates per
> direction; the legacy struct bt_iso_qos keeps working.
> - LE Enable Encryption v2 with the MIC length, Encryption Change v3
> and Key Refresh Complete v2.
> - L2CAP and BT_SECURITY gain a MIC length requirement; connections
> whose MIC is too short are refused with the MIC Length Too Short
> result.
> - EKS opportunistic encryption, enabled with a new MGMT system
> configuration parameter.
>
> [...]
Here is the summary with links:
- [v11,1/6] Bluetooth: Add initial support for HDT PHY
https://git.kernel.org/bluetooth/bluetooth-next/c/6833c8b542de
- [v11,2/6] Bluetooth: ISO: Add extended QoS with the HDT rates
https://git.kernel.org/bluetooth/bluetooth-next/c/d9b633525975
- [v11,3/6] Bluetooth: Add initial support for EKS
https://git.kernel.org/bluetooth/bluetooth-next/c/0c16445e4e73
- [v11,4/6] Bluetooth: L2CAP: Add MIC length validation for HDT PHY
https://git.kernel.org/bluetooth/bluetooth-next/c/daee0133436f
- [v11,5/6] Bluetooth: Add HCI_OP_LE_SET_HDT_DEFAULT_PARAMS support
https://git.kernel.org/bluetooth/bluetooth-next/c/0a30ad831392
- [v11,6/6] Bluetooth: Add EKS Opportunistic Encryption support
https://git.kernel.org/bluetooth/bluetooth-next/c/c9644a9257d1
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 9+ messages in thread