1 /*
2  * Copyright (c) 2018-2021 Nordic Semiconductor ASA
3  *
4  * SPDX-License-Identifier: Apache-2.0
5  */
6 
7 #include <zephyr/kernel.h>
8 #include <soc.h>
9 #include <zephyr/bluetooth/hci_types.h>
10 #include <zephyr/sys/byteorder.h>
11 
12 #include "util/util.h"
13 #include "util/memq.h"
14 #include "util/mem.h"
15 #include "util/mayfly.h"
16 #include "util/dbuf.h"
17 
18 #include "hal/cpu.h"
19 #include "hal/ccm.h"
20 #include "hal/radio.h"
21 #include "hal/ticker.h"
22 
23 #include "ticker/ticker.h"
24 
25 #include "pdu_df.h"
26 #include "lll/pdu_vendor.h"
27 #include "pdu.h"
28 
29 #include "lll.h"
30 #include "lll_clock.h"
31 #include "lll/lll_vendor.h"
32 #include "lll/lll_adv_types.h"
33 #include "lll_adv.h"
34 #include "lll/lll_adv_pdu.h"
35 #include "lll_chan.h"
36 #include "lll_scan.h"
37 #include "lll/lll_df_types.h"
38 #include "lll_conn.h"
39 #include "lll_central.h"
40 #include "lll_filter.h"
41 #include "lll_conn_iso.h"
42 
43 #include "ll_sw/ull_tx_queue.h"
44 
45 #include "ull_adv_types.h"
46 #include "ull_scan_types.h"
47 #include "ull_conn_types.h"
48 #include "ull_filter.h"
49 
50 #include "ull_internal.h"
51 #include "ull_chan_internal.h"
52 #include "ull_scan_internal.h"
53 #include "ull_conn_internal.h"
54 #include "ull_central_internal.h"
55 
56 #include "ll.h"
57 #include "ll_feat.h"
58 #include "ll_settings.h"
59 
60 #include "ll_sw/isoal.h"
61 #include "ll_sw/ull_iso_types.h"
62 #include "ll_sw/ull_conn_iso_types.h"
63 #include "ll_sw/ull_conn_iso_internal.h"
64 
65 #include "ll_sw/ull_llcp.h"
66 
67 #include "hal/debug.h"
68 
69 static void ticker_op_stop_scan_cb(uint32_t status, void *param);
70 #if defined(CONFIG_BT_CTLR_ADV_EXT) && defined(CONFIG_BT_CTLR_PHY_CODED)
71 static void ticker_op_stop_scan_other_cb(uint32_t status, void *param);
72 #endif /* CONFIG_BT_CTLR_ADV_EXT && CONFIG_BT_CTLR_PHY_CODED */
73 static void ticker_op_cb(uint32_t status, void *param);
74 static inline void conn_release(struct ll_scan_set *scan);
75 
76 #if defined(CONFIG_BT_CTLR_ADV_EXT)
ll_create_connection(uint16_t scan_interval,uint16_t scan_window,uint8_t filter_policy,uint8_t peer_addr_type,uint8_t const * const peer_addr,uint8_t own_addr_type,uint16_t interval,uint16_t latency,uint16_t timeout,uint8_t phy)77 uint8_t ll_create_connection(uint16_t scan_interval, uint16_t scan_window,
78 			  uint8_t filter_policy, uint8_t peer_addr_type,
79 			  uint8_t const *const peer_addr, uint8_t own_addr_type,
80 			  uint16_t interval, uint16_t latency, uint16_t timeout,
81 			  uint8_t phy)
82 #else /* !CONFIG_BT_CTLR_ADV_EXT */
83 uint8_t ll_create_connection(uint16_t scan_interval, uint16_t scan_window,
84 			  uint8_t filter_policy, uint8_t peer_addr_type,
85 			  uint8_t const *const peer_addr, uint8_t own_addr_type,
86 			  uint16_t interval, uint16_t latency, uint16_t timeout)
87 #endif /* !CONFIG_BT_CTLR_ADV_EXT */
88 {
89 	struct lll_conn *conn_lll;
90 	uint32_t conn_interval_us;
91 	uint8_t own_id_addr_type;
92 	struct ll_scan_set *scan;
93 	uint32_t ready_delay_us;
94 	uint8_t *own_id_addr;
95 	struct lll_scan *lll;
96 	struct ll_conn *conn;
97 	uint16_t max_tx_time;
98 	uint16_t max_rx_time;
99 	memq_link_t *link;
100 	uint32_t slot_us;
101 	uint8_t hop;
102 	int err;
103 
104 	scan = ull_scan_is_disabled_get(SCAN_HANDLE_1M);
105 	if (!scan) {
106 		return BT_HCI_ERR_CMD_DISALLOWED;
107 	}
108 
109 	/* Check if random address has been set */
110 	own_id_addr_type = (own_addr_type & 0x01);
111 	own_id_addr = ll_addr_get(own_id_addr_type);
112 	if (own_id_addr_type && !mem_nz((void *)own_id_addr, BDADDR_SIZE)) {
113 		return BT_HCI_ERR_INVALID_PARAM;
114 	}
115 
116 #if defined(CONFIG_BT_CTLR_CHECK_SAME_PEER_CONN)
117 	/* Do not connect twice to the same peer */
118 	if (ull_conn_peer_connected(own_id_addr_type, own_id_addr,
119 				    peer_addr_type, peer_addr)) {
120 		return BT_HCI_ERR_CONN_ALREADY_EXISTS;
121 	}
122 #endif /* CONFIG_BT_CTLR_CHECK_SAME_PEER_CONN */
123 
124 #if defined(CONFIG_BT_CTLR_ADV_EXT)
125 #if defined(CONFIG_BT_CTLR_PHY_CODED)
126 	struct ll_scan_set *scan_coded;
127 	struct lll_scan *lll_coded;
128 
129 	scan_coded = ull_scan_is_disabled_get(SCAN_HANDLE_PHY_CODED);
130 	if (!scan_coded) {
131 		return BT_HCI_ERR_CMD_DISALLOWED;
132 	}
133 
134 	lll = &scan->lll;
135 	lll_coded = &scan_coded->lll;
136 
137 	/* NOTE: When coded PHY is supported, and connection establishment
138 	 *       over coded PHY is selected by application then look for
139 	 *       a connection context already assigned to 1M PHY scanning
140 	 *       context. Use the same connection context in the coded PHY
141 	 *       scanning context.
142 	 */
143 	if (phy & BT_HCI_LE_EXT_SCAN_PHY_CODED) {
144 		if (!lll_coded->conn) {
145 			lll_coded->conn = lll->conn;
146 		}
147 		scan = scan_coded;
148 		lll = lll_coded;
149 	} else {
150 		if (!lll->conn) {
151 			lll->conn = lll_coded->conn;
152 		}
153 	}
154 
155 #else /* !CONFIG_BT_CTLR_PHY_CODED */
156 	if (phy & ~BT_HCI_LE_EXT_SCAN_PHY_1M) {
157 		return BT_HCI_ERR_CMD_DISALLOWED;
158 	}
159 
160 	lll = &scan->lll;
161 
162 #endif /* !CONFIG_BT_CTLR_PHY_CODED */
163 
164 	/* NOTE: non-zero PHY value enables initiating connection on that PHY */
165 	lll->phy = phy;
166 
167 #else /* !CONFIG_BT_CTLR_ADV_EXT */
168 	lll = &scan->lll;
169 #endif /* !CONFIG_BT_CTLR_ADV_EXT */
170 
171 	if (lll->conn) {
172 		conn_lll = lll->conn;
173 		conn = HDR_LLL2ULL(conn_lll);
174 
175 		goto conn_is_valid;
176 	}
177 
178 	link = ll_rx_link_alloc();
179 	if (!link) {
180 		return BT_HCI_ERR_MEM_CAPACITY_EXCEEDED;
181 	}
182 
183 	conn = ll_conn_acquire();
184 	if (!conn) {
185 		ll_rx_link_release(link);
186 
187 		return BT_HCI_ERR_MEM_CAPACITY_EXCEEDED;
188 	}
189 
190 	conn_lll = &conn->lll;
191 
192 	err = util_aa_le32(conn_lll->access_addr);
193 	LL_ASSERT(!err);
194 
195 	lll_csrand_get(conn_lll->crc_init, sizeof(conn_lll->crc_init));
196 
197 	conn_lll->handle = 0xFFFF;
198 	conn_lll->interval = interval;
199 	conn_lll->latency = latency;
200 
201 	if (!conn_lll->link_tx_free) {
202 		conn_lll->link_tx_free = &conn_lll->link_tx;
203 	}
204 
205 	memq_init(conn_lll->link_tx_free, &conn_lll->memq_tx.head,
206 		  &conn_lll->memq_tx.tail);
207 	conn_lll->link_tx_free = NULL;
208 
209 	conn_lll->packet_tx_head_len = 0;
210 	conn_lll->packet_tx_head_offset = 0;
211 
212 	conn_lll->sn = 0;
213 	conn_lll->nesn = 0;
214 	conn_lll->empty = 0;
215 
216 #if defined(CONFIG_BT_CTLR_PHY)
217 	/* Use the default 1M PHY, extended connection initiation in LLL will
218 	 * update this with the correct PHY and defaults using the coding on
219 	 * which the connection is established.
220 	 */
221 	conn_lll->phy_tx = PHY_1M;
222 	conn_lll->phy_tx_time = PHY_1M;
223 	conn_lll->phy_flags = PHY_FLAGS_S8;
224 	conn_lll->phy_rx = PHY_1M;
225 #endif /* CONFIG_BT_CTLR_PHY */
226 
227 #if defined(CONFIG_BT_CTLR_DATA_LENGTH)
228 	ull_dle_init(conn, PHY_1M);
229 #endif /* CONFIG_BT_CTLR_DATA_LENGTH */
230 
231 #if defined(CONFIG_BT_CTLR_CONN_RSSI)
232 	conn_lll->rssi_latest = BT_HCI_LE_RSSI_NOT_AVAILABLE;
233 #if defined(CONFIG_BT_CTLR_CONN_RSSI_EVENT)
234 	conn_lll->rssi_reported = BT_HCI_LE_RSSI_NOT_AVAILABLE;
235 	conn_lll->rssi_sample_count = 0;
236 #endif /* CONFIG_BT_CTLR_CONN_RSSI_EVENT */
237 #endif /* CONFIG_BT_CTLR_CONN_RSSI */
238 
239 #if defined(CONFIG_BT_CTLR_TX_PWR_DYNAMIC_CONTROL)
240 	conn_lll->tx_pwr_lvl = RADIO_TXP_DEFAULT;
241 #endif /* CONFIG_BT_CTLR_TX_PWR_DYNAMIC_CONTROL */
242 
243 	/* FIXME: BEGIN: Move to ULL? */
244 	conn_lll->latency_prepare = 0;
245 	conn_lll->latency_event = 0;
246 	conn_lll->event_counter = 0;
247 
248 	conn_lll->data_chan_count = ull_chan_map_get(conn_lll->data_chan_map);
249 	lll_csrand_get(&hop, sizeof(uint8_t));
250 	conn_lll->data_chan_hop = 5 + (hop % 12);
251 	conn_lll->data_chan_sel = 0;
252 	conn_lll->data_chan_use = 0;
253 	conn_lll->role = 0;
254 	conn_lll->central.initiated = 0;
255 	conn_lll->central.cancelled = 0;
256 	/* FIXME: END: Move to ULL? */
257 #if defined(CONFIG_BT_CTLR_CONN_META)
258 	memset(&conn_lll->conn_meta, 0, sizeof(conn_lll->conn_meta));
259 #endif /* CONFIG_BT_CTLR_CONN_META */
260 
261 #if defined(CONFIG_BT_CTLR_DF_CONN_CTE_RX)
262 	conn_lll->df_rx_cfg.is_initialized = 0U;
263 	conn_lll->df_rx_cfg.hdr.elem_size = sizeof(struct lll_df_conn_rx_params);
264 #endif /* CONFIG_BT_CTLR_DF_CONN_CTE_RX */
265 #if defined(CONFIG_BT_CTLR_DF_CONN_CTE_TX)
266 	conn_lll->df_tx_cfg.is_initialized = 0U;
267 	conn_lll->df_tx_cfg.cte_rsp_en = 0U;
268 #endif /* CONFIG_BT_CTLR_DF_CONN_CTE_TX */
269 
270 	conn->connect_expire = CONN_ESTAB_COUNTDOWN;
271 	conn->supervision_expire = 0U;
272 	conn_interval_us = (uint32_t)interval * CONN_INT_UNIT_US;
273 	conn->supervision_timeout = timeout;
274 
275 #if defined(CONFIG_BT_CTLR_LE_PING)
276 	conn->apto_expire = 0U;
277 	/* APTO in no. of connection events */
278 	conn->apto_reload = RADIO_CONN_EVENTS((30000000), conn_interval_us);
279 	conn->appto_expire = 0U;
280 	/* Dispatch LE Ping PDU 6 connection events (that peer would listen to)
281 	 * before 30s timeout
282 	 * TODO: "peer listens to" is greater than 30s due to latency
283 	 */
284 	conn->appto_reload = (conn->apto_reload > (conn_lll->latency + 6)) ?
285 			     (conn->apto_reload - (conn_lll->latency + 6)) :
286 			     conn->apto_reload;
287 #endif /* CONFIG_BT_CTLR_LE_PING */
288 
289 	/* Re-initialize the control procedure data structures */
290 	ull_llcp_init(conn);
291 
292 	/* Setup the PRT reload */
293 	ull_cp_prt_reload_set(conn, conn_interval_us);
294 
295 	conn->llcp_terminate.reason_final = 0U;
296 	/* NOTE: use allocated link for generating dedicated
297 	 * terminate ind rx node
298 	 */
299 	conn->llcp_terminate.node_rx.rx.hdr.link = link;
300 
301 #if defined(CONFIG_BT_CTLR_PHY)
302 	conn->phy_pref_tx = ull_conn_default_phy_tx_get();
303 	conn->phy_pref_rx = ull_conn_default_phy_rx_get();
304 #endif /* CONFIG_BT_CTLR_PHY */
305 
306 #if defined(CONFIG_BT_CTLR_LE_ENC)
307 	conn->pause_rx_data = 0U;
308 #endif /* CONFIG_BT_CTLR_LE_ENC */
309 
310 	/* Re-initialize the Tx Q */
311 	ull_tx_q_init(&conn->tx_q);
312 
313 	/* TODO: active_to_start feature port */
314 	conn->ull.ticks_active_to_start = 0U;
315 	conn->ull.ticks_prepare_to_start =
316 		HAL_TICKER_US_TO_TICKS(EVENT_OVERHEAD_XTAL_US);
317 	conn->ull.ticks_preempt_to_start =
318 		HAL_TICKER_US_TO_TICKS(EVENT_OVERHEAD_PREEMPT_MIN_US);
319 
320 #if defined(CONFIG_BT_CTLR_CHECK_SAME_PEER_CONN)
321 	/* Remember peer and own identity address */
322 	conn->peer_id_addr_type = peer_addr_type;
323 	(void)memcpy(conn->peer_id_addr, peer_addr, sizeof(conn->peer_id_addr));
324 	conn->own_id_addr_type = own_id_addr_type;
325 	(void)memcpy(conn->own_id_addr, own_id_addr, sizeof(conn->own_id_addr));
326 #endif /* CONFIG_BT_CTLR_CHECK_SAME_PEER_CONN */
327 
328 	lll->conn = conn_lll;
329 
330 	ull_hdr_init(&conn->ull);
331 	lll_hdr_init(&conn->lll, conn);
332 
333 conn_is_valid:
334 #if defined(CONFIG_BT_CTLR_PHY)
335 	ready_delay_us = lll_radio_tx_ready_delay_get(conn_lll->phy_tx,
336 						      conn_lll->phy_flags);
337 #else
338 	ready_delay_us = lll_radio_tx_ready_delay_get(0, 0);
339 #endif
340 
341 #if defined(CONFIG_BT_CTLR_DATA_LENGTH)
342 #if defined(CONFIG_BT_CTLR_ADV_EXT)
343 	conn_lll->dle.eff.max_tx_time = MAX(conn_lll->dle.eff.max_tx_time,
344 					    PDU_DC_MAX_US(PDU_DC_PAYLOAD_SIZE_MIN,
345 							  lll->phy));
346 	conn_lll->dle.eff.max_rx_time = MAX(conn_lll->dle.eff.max_rx_time,
347 					    PDU_DC_MAX_US(PDU_DC_PAYLOAD_SIZE_MIN,
348 							  lll->phy));
349 #endif /* CONFIG_BT_CTLR_ADV_EXT */
350 	max_tx_time = conn_lll->dle.eff.max_tx_time;
351 	max_rx_time = conn_lll->dle.eff.max_rx_time;
352 #else /* CONFIG_BT_CTLR_DATA_LENGTH */
353 	max_tx_time = PDU_DC_MAX_US(PDU_DC_PAYLOAD_SIZE_MIN, PHY_1M);
354 	max_rx_time = PDU_DC_MAX_US(PDU_DC_PAYLOAD_SIZE_MIN, PHY_1M);
355 #if defined(CONFIG_BT_CTLR_ADV_EXT)
356 	max_tx_time = MAX(max_tx_time,
357 			  PDU_DC_MAX_US(PDU_DC_PAYLOAD_SIZE_MIN, lll->phy));
358 	max_rx_time = MAX(max_rx_time,
359 			  PDU_DC_MAX_US(PDU_DC_PAYLOAD_SIZE_MIN, lll->phy));
360 #endif /* CONFIG_BT_CTLR_ADV_EXT */
361 #endif /* CONFIG_BT_CTLR_DATA_LENGTH */
362 
363 	/* Calculate event time reservation */
364 	slot_us = max_tx_time + max_rx_time;
365 	slot_us += EVENT_IFS_US + (EVENT_CLOCK_JITTER_US << 1);
366 	slot_us += ready_delay_us;
367 	slot_us += EVENT_OVERHEAD_START_US + EVENT_OVERHEAD_END_US;
368 
369 	conn->ull.ticks_slot = HAL_TICKER_US_TO_TICKS_CEIL(slot_us);
370 
371 #if defined(CONFIG_BT_CTLR_PRIVACY)
372 	ull_filter_scan_update(filter_policy);
373 
374 	lll->rl_idx = FILTER_IDX_NONE;
375 	lll->rpa_gen = 0;
376 	if (!filter_policy && ull_filter_lll_rl_enabled()) {
377 		/* Look up the resolving list */
378 		lll->rl_idx = ull_filter_rl_find(peer_addr_type, peer_addr,
379 						 NULL);
380 	}
381 
382 	if (own_addr_type == BT_ADDR_LE_PUBLIC_ID ||
383 	    own_addr_type == BT_ADDR_LE_RANDOM_ID) {
384 
385 		/* Generate RPAs if required */
386 		ull_filter_rpa_update(false);
387 		own_addr_type &= 0x1;
388 		lll->rpa_gen = 1;
389 	}
390 #endif
391 
392 	scan->own_addr_type = own_addr_type;
393 	lll->adv_addr_type = peer_addr_type;
394 	memcpy(lll->adv_addr, peer_addr, BDADDR_SIZE);
395 	lll->conn_timeout = timeout;
396 
397 	scan->ticks_window = ull_scan_params_set(lll, 0U, scan_interval,
398 						 scan_window, filter_policy);
399 
400 #if defined(CONFIG_BT_CTLR_ADV_EXT)
401 	return 0;
402 #else /* !CONFIG_BT_CTLR_ADV_EXT */
403 	/* wait for stable clocks */
404 	err = lll_clock_wait();
405 	if (err) {
406 		conn_release(scan);
407 
408 		return BT_HCI_ERR_HW_FAILURE;
409 	}
410 
411 	return ull_scan_enable(scan);
412 #endif /* !CONFIG_BT_CTLR_ADV_EXT */
413 }
414 
415 #if defined(CONFIG_BT_CTLR_ADV_EXT)
ll_connect_enable(uint8_t is_coded_included)416 uint8_t ll_connect_enable(uint8_t is_coded_included)
417 {
418 	uint8_t err = BT_HCI_ERR_CMD_DISALLOWED;
419 	struct ll_scan_set *scan;
420 
421 	scan = ull_scan_set_get(SCAN_HANDLE_1M);
422 
423 	/* wait for stable clocks */
424 	err = lll_clock_wait();
425 	if (err) {
426 		conn_release(scan);
427 
428 		return BT_HCI_ERR_HW_FAILURE;
429 	}
430 
431 	if (!is_coded_included ||
432 	    (scan->lll.phy & PHY_1M)) {
433 		err = ull_scan_enable(scan);
434 		if (err) {
435 			return err;
436 		}
437 	}
438 
439 	if (IS_ENABLED(CONFIG_BT_CTLR_PHY_CODED) && is_coded_included) {
440 		scan = ull_scan_set_get(SCAN_HANDLE_PHY_CODED);
441 		err = ull_scan_enable(scan);
442 		if (err) {
443 			return err;
444 		}
445 	}
446 
447 	return err;
448 }
449 #endif /* CONFIG_BT_CTLR_ADV_EXT */
450 
ll_connect_disable(void ** rx)451 uint8_t ll_connect_disable(void **rx)
452 {
453 	struct ll_scan_set *scan_coded;
454 	struct lll_scan *scan_lll;
455 	struct lll_conn *conn_lll;
456 	struct ll_scan_set *scan;
457 	uint8_t err;
458 
459 	scan = ull_scan_is_enabled_get(SCAN_HANDLE_1M);
460 
461 	if (IS_ENABLED(CONFIG_BT_CTLR_ADV_EXT) &&
462 	    IS_ENABLED(CONFIG_BT_CTLR_PHY_CODED)) {
463 		scan_coded = ull_scan_is_enabled_get(SCAN_HANDLE_PHY_CODED);
464 	} else {
465 		scan_coded = NULL;
466 	}
467 
468 	if (!scan) {
469 		if (!scan_coded) {
470 			return BT_HCI_ERR_CMD_DISALLOWED;
471 		}
472 
473 		scan_lll = &scan_coded->lll;
474 	} else {
475 		scan_lll = &scan->lll;
476 	}
477 
478 	/* Check if initiator active */
479 	conn_lll = scan_lll->conn;
480 	if (!conn_lll) {
481 		/* Scanning not associated with initiation of a connection or
482 		 * connection setup already complete (was set to NULL in
483 		 * ull_central_setup), but HCI event not processed by host.
484 		 */
485 		return BT_HCI_ERR_CMD_DISALLOWED;
486 	}
487 
488 	/* Indicate to LLL that a cancellation is requested */
489 	conn_lll->central.cancelled = 1U;
490 	cpu_dmb();
491 
492 	/* Check if connection was established under race condition, i.e.
493 	 * before the cancelled flag was set.
494 	 */
495 	conn_lll = scan_lll->conn;
496 	if (!conn_lll) {
497 		/* Connection setup completed on race condition with cancelled
498 		 * flag, before it was set.
499 		 */
500 		return BT_HCI_ERR_CMD_DISALLOWED;
501 	}
502 
503 	if (scan) {
504 		err = ull_scan_disable(SCAN_HANDLE_1M, scan);
505 	} else {
506 		err = 0U;
507 	}
508 
509 	if (!err && scan_coded) {
510 		err = ull_scan_disable(SCAN_HANDLE_PHY_CODED, scan_coded);
511 	}
512 
513 	if (!err) {
514 		struct node_rx_pdu *node_rx;
515 		struct node_rx_cc *cc;
516 		struct ll_conn *conn;
517 		memq_link_t *link;
518 
519 		conn = HDR_LLL2ULL(conn_lll);
520 		node_rx = (void *)&conn->llcp_terminate.node_rx.rx;
521 		link = node_rx->hdr.link;
522 		LL_ASSERT(link);
523 
524 		/* free the memq link early, as caller could overwrite it */
525 		ll_rx_link_release(link);
526 
527 		node_rx->hdr.type = NODE_RX_TYPE_CONNECTION;
528 		node_rx->hdr.handle = 0xffff;
529 
530 		/* NOTE: struct llcp_terminate.node_rx has uint8_t member
531 		 *       following the struct node_rx_hdr to store the reason.
532 		 */
533 		cc = (void *)node_rx->pdu;
534 		cc->status = BT_HCI_ERR_UNKNOWN_CONN_ID;
535 
536 		/* NOTE: Since NODE_RX_TYPE_CONNECTION is also generated from
537 		 *       LLL context for other cases, pass LLL context as
538 		 *       parameter.
539 		 */
540 		node_rx->rx_ftr.param = scan_lll;
541 
542 		*rx = node_rx;
543 	}
544 
545 	return err;
546 }
547 
548 #if defined(CONFIG_BT_CTLR_LE_ENC)
ll_enc_req_send(uint16_t handle,uint8_t const * const rand_num,uint8_t const * const ediv,uint8_t const * const ltk)549 uint8_t ll_enc_req_send(uint16_t handle, uint8_t const *const rand_num,
550 		     uint8_t const *const ediv, uint8_t const *const ltk)
551 {
552 	struct ll_conn *conn;
553 
554 	conn = ll_connected_get(handle);
555 	if (!conn) {
556 		return BT_HCI_ERR_UNKNOWN_CONN_ID;
557 	}
558 
559 #if defined(CONFIG_BT_CTLR_CENTRAL_ISO)
560 	struct ll_conn_iso_stream *cis = ll_conn_iso_stream_get_by_acl(conn, NULL);
561 
562 	if (cis || ull_lp_cc_is_enqueued(conn)) {
563 		return BT_HCI_ERR_CMD_DISALLOWED;
564 	}
565 #endif /* CONFIG_BT_CTLR_CENTRAL_ISO */
566 
567 	if (!conn->lll.enc_tx && !conn->lll.enc_rx) {
568 		/* Encryption is fully disabled */
569 		return ull_cp_encryption_start(conn, rand_num, ediv, ltk);
570 	} else if (conn->lll.enc_tx && conn->lll.enc_rx) {
571 		/* Encryption is fully enabled */
572 		return ull_cp_encryption_pause(conn, rand_num, ediv, ltk);
573 	}
574 
575 	return BT_HCI_ERR_CMD_DISALLOWED;
576 }
577 #endif /* CONFIG_BT_CTLR_LE_ENC */
578 
ull_central_reset(void)579 int ull_central_reset(void)
580 {
581 	int err;
582 	void *rx;
583 
584 	err = ll_connect_disable(&rx);
585 	if (!err) {
586 		struct ll_scan_set *scan;
587 
588 		scan = ull_scan_is_enabled_get(SCAN_HANDLE_1M);
589 
590 		if (IS_ENABLED(CONFIG_BT_CTLR_ADV_EXT) &&
591 		    IS_ENABLED(CONFIG_BT_CTLR_PHY_CODED)) {
592 			struct ll_scan_set *scan_other;
593 
594 			scan_other =
595 				ull_scan_is_enabled_get(SCAN_HANDLE_PHY_CODED);
596 			if (scan_other) {
597 				if (scan) {
598 					scan->is_enabled = 0U;
599 					scan->lll.conn = NULL;
600 				}
601 
602 				scan = scan_other;
603 			}
604 		}
605 
606 		LL_ASSERT(scan);
607 
608 		scan->is_enabled = 0U;
609 		scan->lll.conn = NULL;
610 	}
611 
612 	ARG_UNUSED(rx);
613 
614 	return err;
615 }
616 
ull_central_cleanup(struct node_rx_pdu * rx_free)617 void ull_central_cleanup(struct node_rx_pdu *rx_free)
618 {
619 	struct lll_conn *conn_lll;
620 	struct ll_scan_set *scan;
621 	struct ll_conn *conn;
622 	memq_link_t *link;
623 
624 	/* NOTE: `scan` variable can be 1M PHY or coded PHY scanning context.
625 	 *       Single connection context is allocated in both the 1M PHY and
626 	 *       coded PHY scanning context, hence releasing only this one
627 	 *       connection context.
628 	 */
629 	scan = HDR_LLL2ULL(rx_free->rx_ftr.param);
630 	conn_lll = scan->lll.conn;
631 	LL_ASSERT(conn_lll);
632 	scan->lll.conn = NULL;
633 
634 	LL_ASSERT(!conn_lll->link_tx_free);
635 	link = memq_deinit(&conn_lll->memq_tx.head,
636 			   &conn_lll->memq_tx.tail);
637 	LL_ASSERT(link);
638 	conn_lll->link_tx_free = link;
639 
640 	conn = HDR_LLL2ULL(conn_lll);
641 	ll_conn_release(conn);
642 
643 	/* 1M PHY is disabled here if both 1M and coded PHY was enabled for
644 	 * connection establishment.
645 	 */
646 	scan->is_enabled = 0U;
647 
648 #if defined(CONFIG_BT_CTLR_ADV_EXT) && defined(CONFIG_BT_CTLR_PHY_CODED)
649 	scan->lll.phy = 0U;
650 
651 	/* Determine if coded PHY was also enabled, if so, reset the assigned
652 	 * connection context, enabled flag and phy value.
653 	 */
654 	struct ll_scan_set *scan_coded =
655 				ull_scan_is_enabled_get(SCAN_HANDLE_PHY_CODED);
656 	if (scan_coded && scan_coded != scan) {
657 		conn_lll = scan_coded->lll.conn;
658 		LL_ASSERT(conn_lll);
659 		scan_coded->lll.conn = NULL;
660 
661 		scan_coded->is_enabled = 0U;
662 		scan_coded->lll.phy = 0U;
663 	}
664 #endif /* CONFIG_BT_CTLR_ADV_EXT && CONFIG_BT_CTLR_PHY_CODED */
665 }
666 
ull_central_setup(struct node_rx_pdu * rx,struct node_rx_ftr * ftr,struct lll_conn * lll)667 void ull_central_setup(struct node_rx_pdu *rx, struct node_rx_ftr *ftr,
668 		      struct lll_conn *lll)
669 {
670 	uint32_t conn_offset_us, conn_interval_us;
671 	uint8_t ticker_id_scan, ticker_id_conn;
672 	uint8_t peer_addr[BDADDR_SIZE];
673 	uint32_t ticks_slot_overhead;
674 	uint32_t ticks_slot_offset;
675 	struct ll_scan_set *scan;
676 	struct pdu_adv *pdu_tx;
677 	uint8_t peer_addr_type;
678 	uint32_t ticker_status;
679 	uint32_t ticks_at_stop;
680 	struct node_rx_cc *cc;
681 	struct ll_conn *conn;
682 	memq_link_t *link;
683 	uint8_t chan_sel;
684 	void *node;
685 
686 	/* Get reference to Tx-ed CONNECT_IND PDU */
687 	pdu_tx = (void *)rx->pdu;
688 
689 	/* Backup peer addr and type, as we reuse the Tx-ed PDU to generate
690 	 * event towards LL
691 	 */
692 	peer_addr_type = pdu_tx->rx_addr;
693 	memcpy(peer_addr, &pdu_tx->connect_ind.adv_addr[0], BDADDR_SIZE);
694 
695 	/* This is the chan sel bit from the received adv pdu */
696 	chan_sel = pdu_tx->chan_sel;
697 
698 	/* Check for pdu field being aligned before populating connection
699 	 * complete event.
700 	 */
701 	node = pdu_tx;
702 	LL_ASSERT(IS_PTR_ALIGNED(node, struct node_rx_cc));
703 
704 	/* Populate the fields required for connection complete event */
705 	cc = node;
706 	cc->status = 0U;
707 	cc->role = 0U;
708 
709 #if defined(CONFIG_BT_CTLR_PRIVACY)
710 	uint8_t rl_idx = ftr->rl_idx;
711 
712 	if (ftr->lrpa_used) {
713 		memcpy(&cc->local_rpa[0], &pdu_tx->connect_ind.init_addr[0],
714 		       BDADDR_SIZE);
715 	} else {
716 		memset(&cc->local_rpa[0], 0x0, BDADDR_SIZE);
717 	}
718 
719 	if (rl_idx != FILTER_IDX_NONE) {
720 		/* Store identity address */
721 		ll_rl_id_addr_get(rl_idx, &cc->peer_addr_type,
722 				  &cc->peer_addr[0]);
723 		/* Mark it as identity address from RPA (0x02, 0x03) */
724 		cc->peer_addr_type += 2;
725 
726 		/* Store peer RPA */
727 		memcpy(&cc->peer_rpa[0], &peer_addr[0], BDADDR_SIZE);
728 	} else {
729 		memset(&cc->peer_rpa[0], 0x0, BDADDR_SIZE);
730 #else
731 	if (1) {
732 #endif /* CONFIG_BT_CTLR_PRIVACY */
733 		cc->peer_addr_type = peer_addr_type;
734 		memcpy(cc->peer_addr, &peer_addr[0], BDADDR_SIZE);
735 	}
736 
737 	scan = HDR_LLL2ULL(ftr->param);
738 
739 	cc->interval = lll->interval;
740 	cc->latency = lll->latency;
741 	cc->timeout = scan->lll.conn_timeout;
742 	cc->sca = lll_clock_sca_local_get();
743 
744 	conn = lll->hdr.parent;
745 	lll->handle = ll_conn_handle_get(conn);
746 	rx->hdr.handle = lll->handle;
747 
748 	/* Set LLCP as connection-wise connected */
749 	ull_cp_state_set(conn, ULL_CP_CONNECTED);
750 
751 #if defined(CONFIG_BT_CTLR_TX_PWR_DYNAMIC_CONTROL)
752 	lll->tx_pwr_lvl = RADIO_TXP_DEFAULT;
753 #endif /* CONFIG_BT_CTLR_TX_PWR_DYNAMIC_CONTROL */
754 
755 	/* Use the link stored in the node rx to enqueue connection
756 	 * complete node rx towards LL context.
757 	 */
758 	link = rx->hdr.link;
759 
760 	/* Use Channel Selection Algorithm #2 if peer too supports it */
761 	if (IS_ENABLED(CONFIG_BT_CTLR_CHAN_SEL_2)) {
762 		struct node_rx_pdu *rx_csa;
763 		struct node_rx_cs *cs;
764 
765 		/* pick the rx node instance stored within the connection
766 		 * rx node.
767 		 */
768 		rx_csa = (void *)ftr->extra;
769 
770 		/* Enqueue the connection event */
771 		ll_rx_put(link, rx);
772 
773 		/* use the rx node for CSA event */
774 		rx = rx_csa;
775 		link = rx->hdr.link;
776 
777 		rx->hdr.handle = lll->handle;
778 		rx->hdr.type = NODE_RX_TYPE_CHAN_SEL_ALGO;
779 
780 		cs = (void *)rx_csa->pdu;
781 
782 		if (chan_sel) {
783 			lll->data_chan_sel = 1;
784 			lll->data_chan_id = lll_chan_id(lll->access_addr);
785 
786 			cs->csa = 0x01;
787 		} else {
788 			cs->csa = 0x00;
789 		}
790 	}
791 
792 	ll_rx_put_sched(link, rx);
793 
794 	ticks_slot_offset = MAX(conn->ull.ticks_active_to_start,
795 				conn->ull.ticks_prepare_to_start);
796 	if (IS_ENABLED(CONFIG_BT_CTLR_LOW_LAT)) {
797 		ticks_slot_overhead = ticks_slot_offset;
798 	} else {
799 		ticks_slot_overhead = 0U;
800 	}
801 	ticks_slot_offset += HAL_TICKER_US_TO_TICKS(EVENT_OVERHEAD_START_US);
802 
803 	conn_interval_us = lll->interval * CONN_INT_UNIT_US;
804 	conn_offset_us = ftr->radio_end_us;
805 
806 #if defined(CONFIG_BT_CTLR_PHY)
807 	conn_offset_us -= lll_radio_tx_ready_delay_get(lll->phy_tx,
808 						      lll->phy_flags);
809 #else
810 	conn_offset_us -= lll_radio_tx_ready_delay_get(0, 0);
811 #endif
812 
813 
814 #if (CONFIG_BT_CTLR_ULL_HIGH_PRIO == CONFIG_BT_CTLR_ULL_LOW_PRIO)
815 	/* disable ticker job, in order to chain stop and start to avoid RTC
816 	 * being stopped if no tickers active.
817 	 */
818 	mayfly_enable(TICKER_USER_ID_ULL_HIGH, TICKER_USER_ID_ULL_LOW, 0);
819 #endif
820 
821 	/* Stop Scanner */
822 	ticker_id_scan = TICKER_ID_SCAN_BASE + ull_scan_handle_get(scan);
823 	ticks_at_stop = ftr->ticks_anchor +
824 			HAL_TICKER_US_TO_TICKS(conn_offset_us) -
825 			ticks_slot_offset;
826 	ticker_status = ticker_stop_abs(TICKER_INSTANCE_ID_CTLR,
827 					TICKER_USER_ID_ULL_HIGH,
828 					ticker_id_scan, ticks_at_stop,
829 					ticker_op_stop_scan_cb, scan);
830 	LL_ASSERT((ticker_status == TICKER_STATUS_SUCCESS) ||
831 		  (ticker_status == TICKER_STATUS_BUSY));
832 
833 #if defined(CONFIG_BT_CTLR_ADV_EXT) && defined(CONFIG_BT_CTLR_PHY_CODED)
834 	/* Determine if coded PHY was also enabled, if so, reset the assigned
835 	 * connection context.
836 	 */
837 	struct ll_scan_set *scan_other =
838 				ull_scan_is_enabled_get(SCAN_HANDLE_PHY_CODED);
839 	if (scan_other) {
840 		if (scan_other == scan) {
841 			scan_other = ull_scan_is_enabled_get(SCAN_HANDLE_1M);
842 		}
843 
844 		if (scan_other) {
845 			ticker_id_scan = TICKER_ID_SCAN_BASE +
846 					 ull_scan_handle_get(scan_other);
847 			ticker_status = ticker_stop(TICKER_INSTANCE_ID_CTLR,
848 						    TICKER_USER_ID_ULL_HIGH,
849 						    ticker_id_scan,
850 						    ticker_op_stop_scan_other_cb,
851 						    scan_other);
852 			LL_ASSERT((ticker_status == TICKER_STATUS_SUCCESS) ||
853 				  (ticker_status == TICKER_STATUS_BUSY));
854 		}
855 	}
856 #endif /* CONFIG_BT_CTLR_ADV_EXT && CONFIG_BT_CTLR_PHY_CODED */
857 
858 	/* Scanner stop can expire while here in this ISR.
859 	 * Deferred attempt to stop can fail as it would have
860 	 * expired, hence ignore failure.
861 	 */
862 	(void)ticker_stop(TICKER_INSTANCE_ID_CTLR, TICKER_USER_ID_ULL_HIGH,
863 			  TICKER_ID_SCAN_STOP, NULL, NULL);
864 
865 	/* Start central */
866 	ticker_id_conn = TICKER_ID_CONN_BASE + ll_conn_handle_get(conn);
867 	ticker_status = ticker_start_us(TICKER_INSTANCE_ID_CTLR,
868 					TICKER_USER_ID_ULL_HIGH,
869 					ticker_id_conn,
870 					ftr->ticks_anchor - ticks_slot_offset,
871 					HAL_TICKER_US_TO_TICKS(conn_offset_us),
872 					HAL_TICKER_REMAINDER(conn_offset_us),
873 					HAL_TICKER_US_TO_TICKS(conn_interval_us),
874 					HAL_TICKER_REMAINDER(conn_interval_us),
875 					TICKER_NULL_LAZY,
876 					(conn->ull.ticks_slot + ticks_slot_overhead),
877 					ull_central_ticker_cb, conn,
878 					ticker_op_cb, (void *)__LINE__);
879 	LL_ASSERT((ticker_status == TICKER_STATUS_SUCCESS) ||
880 		  (ticker_status == TICKER_STATUS_BUSY));
881 
882 #if (CONFIG_BT_CTLR_ULL_HIGH_PRIO == CONFIG_BT_CTLR_ULL_LOW_PRIO)
883 	/* enable ticker job, irrespective of disabled in this function so
884 	 * first connection event can be scheduled as soon as possible.
885 	 */
886 	mayfly_enable(TICKER_USER_ID_ULL_HIGH, TICKER_USER_ID_ULL_LOW, 1);
887 #endif
888 }
889 
890 void ull_central_ticker_cb(uint32_t ticks_at_expire, uint32_t ticks_drift,
891 			  uint32_t remainder, uint16_t lazy, uint8_t force,
892 			  void *param)
893 {
894 	static memq_link_t link;
895 	static struct mayfly mfy = {0, 0, &link, NULL, lll_central_prepare};
896 	static struct lll_prepare_param p;
897 	struct ll_conn *conn;
898 	uint32_t err;
899 	uint8_t ref;
900 
901 	DEBUG_RADIO_PREPARE_M(1);
902 
903 	conn = param;
904 
905 	/* Check if stopping ticker (on disconnection, race with ticker expiry)
906 	 */
907 	if (unlikely(conn->lll.handle == 0xFFFF)) {
908 		DEBUG_RADIO_CLOSE_M(0);
909 		return;
910 	}
911 
912 #if defined(CONFIG_BT_CTLR_CONN_META)
913 	conn->common.is_must_expire = (lazy == TICKER_LAZY_MUST_EXPIRE);
914 #endif
915 	/* If this is a must-expire callback, LLCP state machine does not need
916 	 * to know. Will be called with lazy > 0 when scheduled in air.
917 	 */
918 	if (!IS_ENABLED(CONFIG_BT_CTLR_CONN_META) ||
919 	    (lazy != TICKER_LAZY_MUST_EXPIRE)) {
920 		int ret;
921 
922 		/* Handle any LL Control Procedures */
923 		ret = ull_conn_llcp(conn, ticks_at_expire, remainder, lazy);
924 		if (ret) {
925 			/* NOTE: Under BT_CTLR_LOW_LAT, ULL_LOW context is
926 			 *       disabled inside radio events, hence, abort any
927 			 *       active radio event which will re-enable
928 			 *       ULL_LOW context that permits ticker job to run.
929 			 */
930 			if (IS_ENABLED(CONFIG_BT_CTLR_LOW_LAT) &&
931 			    (CONFIG_BT_CTLR_LLL_PRIO ==
932 			     CONFIG_BT_CTLR_ULL_LOW_PRIO)) {
933 				ll_radio_state_abort();
934 			}
935 
936 			DEBUG_RADIO_CLOSE_M(0);
937 			return;
938 		}
939 	}
940 
941 	/* Increment prepare reference count */
942 	ref = ull_ref_inc(&conn->ull);
943 	LL_ASSERT(ref);
944 
945 	/* De-mux 2 tx node from FIFO, sufficient to be able to set MD bit */
946 	ull_conn_tx_demux(2);
947 
948 	/* Enqueue towards LLL */
949 	ull_conn_tx_lll_enqueue(conn, 2);
950 
951 	/* Append timing parameters */
952 	p.ticks_at_expire = ticks_at_expire;
953 	p.remainder = remainder;
954 	p.lazy = lazy;
955 	p.force = force;
956 	p.param = &conn->lll;
957 	mfy.param = &p;
958 
959 	/* Kick LLL prepare */
960 	err = mayfly_enqueue(TICKER_USER_ID_ULL_HIGH, TICKER_USER_ID_LLL,
961 			     0, &mfy);
962 	LL_ASSERT(!err);
963 
964 	/* De-mux remaining tx nodes from FIFO */
965 	ull_conn_tx_demux(UINT8_MAX);
966 
967 	/* Enqueue towards LLL */
968 	ull_conn_tx_lll_enqueue(conn, UINT8_MAX);
969 
970 	DEBUG_RADIO_PREPARE_M(1);
971 }
972 
973 uint8_t ull_central_chm_update(void)
974 {
975 	uint16_t handle;
976 
977 	handle = CONFIG_BT_MAX_CONN;
978 	while (handle--) {
979 		struct ll_conn *conn;
980 		uint8_t ret;
981 		uint8_t chm[5];
982 
983 		conn = ll_connected_get(handle);
984 		if (!conn || conn->lll.role) {
985 			continue;
986 		}
987 
988 		ull_chan_map_get(chm);
989 		ret = ull_cp_chan_map_update(conn, chm);
990 		if (ret) {
991 			return ret;
992 		}
993 	}
994 
995 	return 0;
996 }
997 
998 static void ticker_op_stop_scan_cb(uint32_t status, void *param)
999 {
1000 	/* NOTE: Nothing to do here, present here to add debug code if required
1001 	 */
1002 }
1003 
1004 #if defined(CONFIG_BT_CTLR_ADV_EXT) && defined(CONFIG_BT_CTLR_PHY_CODED)
1005 static void ticker_op_stop_scan_other_cb(uint32_t status, void *param)
1006 {
1007 	static memq_link_t link;
1008 	static struct mayfly mfy = {0, 0, &link, NULL, NULL};
1009 	struct ll_scan_set *scan;
1010 	struct ull_hdr *hdr;
1011 
1012 	/* Ignore if race between thread and ULL */
1013 	if (status != TICKER_STATUS_SUCCESS) {
1014 		/* TODO: detect race */
1015 
1016 		return;
1017 	}
1018 
1019 	/* NOTE: We are in ULL_LOW which can be pre-empted by ULL_HIGH.
1020 	 *       As we are in the callback after successful stop of the
1021 	 *       ticker, the ULL reference count will not be modified
1022 	 *       further hence it is safe to check and act on either the need
1023 	 *       to call lll_disable or not.
1024 	 */
1025 	scan = param;
1026 	hdr = &scan->ull;
1027 	mfy.param = &scan->lll;
1028 	if (ull_ref_get(hdr)) {
1029 		uint32_t ret;
1030 
1031 		mfy.fp = lll_disable;
1032 		ret = mayfly_enqueue(TICKER_USER_ID_ULL_LOW,
1033 				     TICKER_USER_ID_LLL, 0, &mfy);
1034 		LL_ASSERT(!ret);
1035 	}
1036 }
1037 #endif /* CONFIG_BT_CTLR_ADV_EXT && CONFIG_BT_CTLR_PHY_CODED */
1038 
1039 static void ticker_op_cb(uint32_t status, void *param)
1040 {
1041 	ARG_UNUSED(param);
1042 
1043 	LL_ASSERT(status == TICKER_STATUS_SUCCESS);
1044 }
1045 
1046 static inline void conn_release(struct ll_scan_set *scan)
1047 {
1048 	struct node_rx_pdu *cc;
1049 	struct lll_conn *lll;
1050 	struct ll_conn *conn;
1051 	memq_link_t *link;
1052 
1053 	lll = scan->lll.conn;
1054 	LL_ASSERT(!lll->link_tx_free);
1055 	link = memq_deinit(&lll->memq_tx.head, &lll->memq_tx.tail);
1056 	LL_ASSERT(link);
1057 	lll->link_tx_free = link;
1058 
1059 	conn = HDR_LLL2ULL(lll);
1060 
1061 	cc = (void *)&conn->llcp_terminate.node_rx.rx;
1062 	link = cc->hdr.link;
1063 	LL_ASSERT(link);
1064 
1065 	ll_rx_link_release(link);
1066 
1067 	ll_conn_release(conn);
1068 	scan->lll.conn = NULL;
1069 }
1070