1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 Copyright (C) 2000-2001 Qualcomm Incorporated 5 6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 7 8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 19 SOFTWARE IS DISCLAIMED. 20 */ 21 22 /* Bluetooth SCO sockets. */ 23 24 #include <linux/module.h> 25 #include <linux/debugfs.h> 26 #include <linux/seq_file.h> 27 #include <linux/sched/signal.h> 28 #include <linux/uio.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/sco.h> 33 34 static bool disable_esco; 35 36 static const struct proto_ops sco_sock_ops; 37 38 static struct bt_sock_list sco_sk_list = { 39 .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock) 40 }; 41 42 /* ---- SCO connections ---- */ 43 struct sco_conn { 44 struct hci_conn *hcon; 45 46 spinlock_t lock; 47 struct sock *sk; 48 49 struct delayed_work timeout_work; 50 51 unsigned int mtu; 52 struct kref ref; 53 }; 54 55 #define sco_conn_lock(c) spin_lock(&c->lock) 56 #define sco_conn_unlock(c) spin_unlock(&c->lock) 57 58 static void sco_sock_close(struct sock *sk); 59 static void sco_sock_kill(struct sock *sk); 60 61 /* ----- SCO socket info ----- */ 62 #define sco_pi(sk) ((struct sco_pinfo *) sk) 63 64 struct sco_pinfo { 65 struct bt_sock bt; 66 bdaddr_t src; 67 bdaddr_t dst; 68 __u32 flags; 69 __u16 setting; 70 struct bt_codec codec; 71 struct sco_conn *conn; 72 }; 73 74 /* ---- SCO timers ---- */ 75 #define SCO_CONN_TIMEOUT (HZ * 40) 76 #define SCO_DISCONN_TIMEOUT (HZ * 2) 77 78 static void sco_conn_free(struct kref *ref) 79 { 80 struct sco_conn *conn = container_of(ref, struct sco_conn, ref); 81 82 BT_DBG("conn %p", conn); 83 84 if (conn->sk) 85 sco_pi(conn->sk)->conn = NULL; 86 87 /* hcon->sco_data is cleared and the association's reference on the 88 * sco_conn is dropped in sco_conn_del() under hdev->lock, and the 89 * hci_conn is now owned by the socket (held in __sco_chan_add() and 90 * dropped in sco_chan_del()/sco_sock_destruct()), so there is nothing 91 * left to release towards hcon here. 92 */ 93 94 /* Ensure no more work items will run before the connection is freed */ 95 disable_delayed_work_sync(&conn->timeout_work); 96 97 kfree(conn); 98 } 99 100 static void sco_conn_put(struct sco_conn *conn) 101 { 102 if (!conn) 103 return; 104 105 BT_DBG("conn %p refcnt %d", conn, kref_read(&conn->ref)); 106 107 kref_put(&conn->ref, sco_conn_free); 108 } 109 110 static struct sco_conn *sco_conn_hold(struct sco_conn *conn) 111 { 112 BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref)); 113 114 kref_get(&conn->ref); 115 return conn; 116 } 117 118 static struct sco_conn *sco_conn_hold_unless_zero(struct sco_conn *conn) 119 { 120 if (!conn) 121 return NULL; 122 123 BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref)); 124 125 if (!kref_get_unless_zero(&conn->ref)) 126 return NULL; 127 128 return conn; 129 } 130 131 static struct sock *sco_sock_hold(struct sco_conn *conn) 132 { 133 if (!conn || !bt_sock_linked(&sco_sk_list, conn->sk)) 134 return NULL; 135 136 sock_hold(conn->sk); 137 138 return conn->sk; 139 } 140 141 static void sco_sock_timeout(struct work_struct *work) 142 { 143 struct sco_conn *conn = container_of(work, struct sco_conn, 144 timeout_work.work); 145 struct sock *sk; 146 147 conn = sco_conn_hold_unless_zero(conn); 148 if (!conn) 149 return; 150 151 sco_conn_lock(conn); 152 if (!conn->hcon) { 153 sco_conn_unlock(conn); 154 sco_conn_put(conn); 155 return; 156 } 157 sk = sco_sock_hold(conn); 158 sco_conn_unlock(conn); 159 sco_conn_put(conn); 160 161 if (!sk) 162 return; 163 164 BT_DBG("sock %p state %d", sk, sk->sk_state); 165 166 lock_sock(sk); 167 sk->sk_err = ETIMEDOUT; 168 sk->sk_state_change(sk); 169 release_sock(sk); 170 sock_put(sk); 171 } 172 173 static void sco_sock_set_timer(struct sock *sk, long timeout) 174 { 175 if (!sco_pi(sk)->conn) 176 return; 177 178 BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout); 179 cancel_delayed_work(&sco_pi(sk)->conn->timeout_work); 180 schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout); 181 } 182 183 static void sco_sock_clear_timer(struct sock *sk) 184 { 185 if (!sco_pi(sk)->conn) 186 return; 187 188 BT_DBG("sock %p state %d", sk, sk->sk_state); 189 cancel_delayed_work(&sco_pi(sk)->conn->timeout_work); 190 } 191 192 /* ---- SCO connections ---- */ 193 /* Returns a new reference the caller must drop with sco_conn_put(). The 194 * hcon->sco_data association holds its own reference on the sco_conn for the 195 * connection's lifetime; it is dropped in sco_conn_del() under hdev->lock. 196 * @hcon is not consumed: the hci_conn reference is taken and owned by the 197 * socket in __sco_chan_add(). 198 */ 199 static struct sco_conn *sco_conn_add(struct hci_conn *hcon) 200 { 201 struct sco_conn *conn = hcon->sco_data; 202 203 conn = sco_conn_hold_unless_zero(conn); 204 if (conn) 205 return conn; 206 207 conn = kzalloc_obj(struct sco_conn); 208 if (!conn) 209 return NULL; 210 211 kref_init(&conn->ref); 212 spin_lock_init(&conn->lock); 213 INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout); 214 215 hcon->sco_data = conn; 216 conn->hcon = hcon; 217 conn->mtu = hcon->mtu; 218 219 if (hcon->mtu > 0) 220 conn->mtu = hcon->mtu; 221 else 222 conn->mtu = 60; 223 224 BT_DBG("hcon %p conn %p", hcon, conn); 225 226 /* kref_init() above set the association reference owned by 227 * hcon->sco_data; hand the caller its own reference. 228 */ 229 return sco_conn_hold(conn); 230 } 231 232 /* Delete channel. 233 * Must be called on the locked socket. */ 234 static void sco_chan_del(struct sock *sk, int err) 235 { 236 struct sco_conn *conn; 237 238 conn = sco_pi(sk)->conn; 239 sco_pi(sk)->conn = NULL; 240 241 BT_DBG("sk %p, conn %p, err %d", sk, conn, err); 242 243 if (conn) { 244 struct hci_conn *hcon; 245 246 sco_conn_lock(conn); 247 hcon = conn->hcon; 248 sco_conn_unlock(conn); 249 250 /* Drop the socket's hci_conn reference BEFORE clearing 251 * conn->sk, so sco_conn_del() on another CPU cannot free 252 * the hci_conn while we still hold a pointer to it. 253 */ 254 if (hcon) 255 hci_conn_drop(hcon); 256 257 sco_conn_lock(conn); 258 conn->sk = NULL; 259 sco_conn_unlock(conn); 260 sco_conn_put(conn); 261 } 262 263 sk->sk_state = BT_CLOSED; 264 sk->sk_err = err; 265 sk->sk_state_change(sk); 266 267 sock_set_flag(sk, SOCK_ZAPPED); 268 } 269 270 static void sco_conn_del(struct hci_conn *hcon, int err) 271 { 272 struct sco_conn *conn = hcon->sco_data; 273 struct sock *sk; 274 275 conn = sco_conn_hold_unless_zero(conn); 276 if (!conn) 277 return; 278 279 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); 280 281 /* Detach from the hci_conn and drop the association's reference. 282 * The caller holds hdev->lock, which serialises this against the 283 * read of hcon->sco_data in sco_recv_scodata(). 284 */ 285 hcon->sco_data = NULL; 286 sco_conn_put(conn); 287 288 sco_conn_lock(conn); 289 sk = sco_sock_hold(conn); 290 sco_conn_unlock(conn); 291 sco_conn_put(conn); 292 293 if (!sk) 294 return; 295 296 /* Kill socket */ 297 lock_sock(sk); 298 sco_sock_clear_timer(sk); 299 sco_chan_del(sk, err); 300 release_sock(sk); 301 sock_put(sk); 302 } 303 304 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, 305 struct sock *parent) 306 { 307 BT_DBG("conn %p", conn); 308 309 sco_pi(sk)->conn = sco_conn_hold(conn); 310 conn->sk = sk; 311 312 /* The socket owns an hci_conn reference for as long as it stays 313 * attached; it is dropped in sco_chan_del()/sco_sock_destruct(). 314 */ 315 hci_conn_hold(conn->hcon); 316 317 if (parent) 318 bt_accept_enqueue(parent, sk, true); 319 } 320 321 static int sco_chan_add(struct sco_conn *conn, struct sock *sk, 322 struct sock *parent) 323 { 324 int err = 0; 325 326 sco_conn_lock(conn); 327 if (conn->sk || sco_pi(sk)->conn) 328 err = -EBUSY; 329 else 330 __sco_chan_add(conn, sk, parent); 331 332 sco_conn_unlock(conn); 333 return err; 334 } 335 336 static int sco_connect(struct sock *sk) 337 { 338 struct sco_conn *conn; 339 struct hci_conn *hcon; 340 struct hci_dev *hdev; 341 bdaddr_t src, dst; 342 struct bt_codec codec; 343 __u16 setting; 344 int err, type; 345 346 lock_sock(sk); 347 bacpy(&src, &sco_pi(sk)->src); 348 bacpy(&dst, &sco_pi(sk)->dst); 349 setting = sco_pi(sk)->setting; 350 codec = sco_pi(sk)->codec; 351 release_sock(sk); 352 353 BT_DBG("%pMR -> %pMR", &src, &dst); 354 355 hdev = hci_get_route(&dst, &src, BDADDR_BREDR); 356 if (!hdev) 357 return -EHOSTUNREACH; 358 359 hci_dev_lock(hdev); 360 361 if (lmp_esco_capable(hdev) && !disable_esco) 362 type = ESCO_LINK; 363 else 364 type = SCO_LINK; 365 366 switch (setting & SCO_AIRMODE_MASK) { 367 case SCO_AIRMODE_TRANSP: 368 if (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev)) { 369 err = -EOPNOTSUPP; 370 goto unlock; 371 } 372 break; 373 } 374 375 hcon = hci_connect_sco(hdev, type, &dst, 376 setting, &codec, 377 READ_ONCE(sk->sk_sndtimeo)); 378 if (IS_ERR(hcon)) { 379 err = PTR_ERR(hcon); 380 goto unlock; 381 } 382 383 conn = sco_conn_add(hcon); 384 if (!conn) { 385 hci_conn_drop(hcon); 386 err = -ENOMEM; 387 goto unlock; 388 } 389 390 lock_sock(sk); 391 392 /* Recheck state after reacquiring the socket lock, as another 393 * thread may have changed it (e.g., closed the socket). 394 */ 395 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 396 release_sock(sk); 397 sco_conn_put(conn); 398 hci_conn_drop(hcon); 399 err = -EBADFD; 400 goto unlock; 401 } 402 403 err = sco_chan_add(conn, sk, NULL); 404 sco_conn_put(conn); 405 if (err) { 406 release_sock(sk); 407 hci_conn_drop(hcon); 408 goto unlock; 409 } 410 411 /* __sco_chan_add() took its own hci_conn reference; drop ours. */ 412 hci_conn_drop(hcon); 413 414 /* Update source addr of the socket */ 415 bacpy(&sco_pi(sk)->src, &hcon->src); 416 417 if (hcon->state == BT_CONNECTED) { 418 sco_sock_clear_timer(sk); 419 sk->sk_state = BT_CONNECTED; 420 } else { 421 sk->sk_state = BT_CONNECT; 422 sco_sock_set_timer(sk, READ_ONCE(sk->sk_sndtimeo)); 423 } 424 425 release_sock(sk); 426 427 unlock: 428 hci_dev_unlock(hdev); 429 hci_dev_put(hdev); 430 return err; 431 } 432 433 static int sco_send_frame(struct sock *sk, struct sk_buff *skb, 434 const struct sockcm_cookie *sockc) 435 { 436 struct sco_conn *conn = sco_pi(sk)->conn; 437 int len = skb->len; 438 439 /* Check outgoing MTU */ 440 if (len > conn->mtu) 441 return -EINVAL; 442 443 BT_DBG("sk %p len %d", sk, len); 444 445 hci_setup_tx_timestamp(skb, 1, sockc); 446 hci_send_sco(conn->hcon, skb); 447 448 return len; 449 } 450 451 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb) 452 { 453 struct sock *sk; 454 455 sco_conn_lock(conn); 456 sk = sco_sock_hold(conn); 457 sco_conn_unlock(conn); 458 459 if (!sk) 460 goto drop; 461 462 BT_DBG("sk %p len %u", sk, skb->len); 463 464 if (sk->sk_state != BT_CONNECTED) 465 goto drop_put; 466 467 if (!sock_queue_rcv_skb(sk, skb)) { 468 sock_put(sk); 469 return; 470 } 471 472 drop_put: 473 sock_put(sk); 474 drop: 475 kfree_skb(skb); 476 } 477 478 /* -------- Socket interface ---------- */ 479 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba) 480 { 481 struct sock *sk; 482 483 sk_for_each(sk, &sco_sk_list.head) { 484 if (sk->sk_state != BT_LISTEN) 485 continue; 486 487 if (!bacmp(&sco_pi(sk)->src, ba)) 488 return sk; 489 } 490 491 return NULL; 492 } 493 494 /* Find socket listening on source bdaddr. 495 * Returns closest match. 496 */ 497 static struct sock *sco_get_sock_listen(bdaddr_t *src) 498 { 499 struct sock *sk = NULL, *sk1 = NULL; 500 501 read_lock(&sco_sk_list.lock); 502 503 sk_for_each(sk, &sco_sk_list.head) { 504 if (sk->sk_state != BT_LISTEN) 505 continue; 506 507 /* Exact match. */ 508 if (!bacmp(&sco_pi(sk)->src, src)) 509 break; 510 511 /* Closest match */ 512 if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY)) 513 sk1 = sk; 514 } 515 516 sk = sk ? sk : sk1; 517 if (sk) 518 sock_hold(sk); 519 520 read_unlock(&sco_sk_list.lock); 521 522 return sk; 523 } 524 525 static void sco_sock_destruct(struct sock *sk) 526 { 527 struct sco_conn *conn = sco_pi(sk)->conn; 528 529 BT_DBG("sk %p", sk); 530 531 /* If the channel was not already torn down via sco_chan_del(), drop 532 * the socket's own references here. 533 */ 534 if (conn) { 535 struct hci_conn *hcon; 536 537 sco_conn_lock(conn); 538 hcon = conn->hcon; 539 sco_conn_unlock(conn); 540 541 if (hcon) 542 hci_conn_drop(hcon); 543 sco_pi(sk)->conn = NULL; 544 sco_conn_put(conn); 545 } 546 547 skb_queue_purge(&sk->sk_receive_queue); 548 skb_queue_purge(&sk->sk_write_queue); 549 skb_queue_purge(&sk->sk_error_queue); 550 } 551 552 static void sco_sock_cleanup_listen(struct sock *parent) 553 { 554 struct sock *sk; 555 556 BT_DBG("parent %p", parent); 557 558 /* Close not yet accepted channels */ 559 while ((sk = bt_accept_dequeue(parent, NULL))) { 560 sco_sock_close(sk); 561 sco_sock_kill(sk); 562 /* Drop the reference handed back by bt_accept_dequeue(). */ 563 sock_put(sk); 564 } 565 566 parent->sk_state = BT_CLOSED; 567 sock_set_flag(parent, SOCK_ZAPPED); 568 } 569 570 /* Kill socket (only if zapped and orphan) 571 * Must be called on unlocked socket. 572 */ 573 static void sco_sock_kill(struct sock *sk) 574 { 575 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 576 return; 577 578 BT_DBG("sk %p state %d", sk, sk->sk_state); 579 580 /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ 581 lock_sock(sk); 582 if (sco_pi(sk)->conn) { 583 sco_conn_lock(sco_pi(sk)->conn); 584 sco_pi(sk)->conn->sk = NULL; 585 sco_conn_unlock(sco_pi(sk)->conn); 586 } 587 release_sock(sk); 588 589 /* Kill poor orphan */ 590 bt_sock_unlink(&sco_sk_list, sk); 591 sock_set_flag(sk, SOCK_DEAD); 592 sock_put(sk); 593 } 594 595 static void __sco_sock_close(struct sock *sk) 596 { 597 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket); 598 599 switch (sk->sk_state) { 600 case BT_LISTEN: 601 sco_sock_cleanup_listen(sk); 602 break; 603 604 case BT_CONNECTED: 605 case BT_CONFIG: 606 case BT_CONNECT2: 607 case BT_CONNECT: 608 case BT_DISCONN: 609 sco_chan_del(sk, ECONNRESET); 610 break; 611 612 default: 613 sock_set_flag(sk, SOCK_ZAPPED); 614 break; 615 } 616 617 } 618 619 /* Must be called on unlocked socket. */ 620 static void sco_sock_close(struct sock *sk) 621 { 622 struct sco_conn *conn; 623 624 lock_sock(sk); 625 conn = sco_pi(sk)->conn; 626 if (conn) 627 sco_conn_hold(conn); 628 release_sock(sk); 629 630 if (conn) 631 disable_delayed_work_sync(&conn->timeout_work); 632 633 lock_sock(sk); 634 __sco_sock_close(sk); 635 release_sock(sk); 636 637 if (conn) 638 sco_conn_put(conn); 639 } 640 641 static void sco_sock_init(struct sock *sk, struct sock *parent) 642 { 643 BT_DBG("sk %p", sk); 644 645 if (parent) { 646 sk->sk_type = parent->sk_type; 647 bt_sk(sk)->flags = bt_sk(parent)->flags; 648 security_sk_clone(parent, sk); 649 } 650 } 651 652 static struct proto sco_proto = { 653 .name = "SCO", 654 .owner = THIS_MODULE, 655 .obj_size = sizeof(struct sco_pinfo) 656 }; 657 658 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, 659 int proto, gfp_t prio, int kern) 660 { 661 struct sock *sk; 662 663 sk = bt_sock_alloc(net, sock, &sco_proto, proto, prio, kern); 664 if (!sk) 665 return NULL; 666 667 sk->sk_destruct = sco_sock_destruct; 668 sk->sk_sndtimeo = SCO_CONN_TIMEOUT; 669 670 sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT; 671 sco_pi(sk)->codec.id = BT_CODEC_CVSD; 672 sco_pi(sk)->codec.cid = 0xffff; 673 sco_pi(sk)->codec.vid = 0xffff; 674 sco_pi(sk)->codec.data_path = 0x00; 675 676 bt_sock_link(&sco_sk_list, sk); 677 return sk; 678 } 679 680 static int sco_sock_create(struct net *net, struct socket *sock, int protocol, 681 int kern) 682 { 683 struct sock *sk; 684 685 BT_DBG("sock %p", sock); 686 687 sock->state = SS_UNCONNECTED; 688 689 if (sock->type != SOCK_SEQPACKET) 690 return -ESOCKTNOSUPPORT; 691 692 sock->ops = &sco_sock_ops; 693 694 sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern); 695 if (!sk) 696 return -ENOMEM; 697 698 sco_sock_init(sk, NULL); 699 return 0; 700 } 701 702 static int sco_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, 703 int addr_len) 704 { 705 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 706 struct sock *sk = sock->sk; 707 int err = 0; 708 709 if (!addr || addr_len < sizeof(struct sockaddr_sco) || 710 addr->sa_family != AF_BLUETOOTH) 711 return -EINVAL; 712 713 BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr); 714 715 lock_sock(sk); 716 717 if (sk->sk_state != BT_OPEN) { 718 err = -EBADFD; 719 goto done; 720 } 721 722 if (sk->sk_type != SOCK_SEQPACKET) { 723 err = -EINVAL; 724 goto done; 725 } 726 727 bacpy(&sco_pi(sk)->src, &sa->sco_bdaddr); 728 729 sk->sk_state = BT_BOUND; 730 731 done: 732 release_sock(sk); 733 return err; 734 } 735 736 static int sco_sock_connect(struct socket *sock, struct sockaddr_unsized *addr, int alen, int flags) 737 { 738 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 739 struct sock *sk = sock->sk; 740 int err; 741 742 BT_DBG("sk %p", sk); 743 744 if (alen < sizeof(struct sockaddr_sco) || 745 addr->sa_family != AF_BLUETOOTH) 746 return -EINVAL; 747 748 lock_sock(sk); 749 750 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 751 release_sock(sk); 752 return -EBADFD; 753 } 754 755 if (sk->sk_type != SOCK_SEQPACKET) { 756 release_sock(sk); 757 return -EINVAL; 758 } 759 760 /* Set destination address and psm */ 761 bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr); 762 release_sock(sk); 763 764 err = sco_connect(sk); 765 if (err) 766 return err; 767 768 lock_sock(sk); 769 770 err = bt_sock_wait_state(sk, BT_CONNECTED, 771 sock_sndtimeo(sk, flags & O_NONBLOCK)); 772 773 release_sock(sk); 774 return err; 775 } 776 777 static int sco_sock_listen(struct socket *sock, int backlog) 778 { 779 struct sock *sk = sock->sk; 780 bdaddr_t *src = &sco_pi(sk)->src; 781 int err = 0; 782 783 BT_DBG("sk %p backlog %d", sk, backlog); 784 785 lock_sock(sk); 786 787 if (sk->sk_state != BT_BOUND) { 788 err = -EBADFD; 789 goto done; 790 } 791 792 if (sk->sk_type != SOCK_SEQPACKET) { 793 err = -EINVAL; 794 goto done; 795 } 796 797 write_lock(&sco_sk_list.lock); 798 799 if (__sco_get_sock_listen_by_addr(src)) { 800 err = -EADDRINUSE; 801 goto unlock; 802 } 803 804 sk->sk_max_ack_backlog = backlog; 805 sk->sk_ack_backlog = 0; 806 807 sk->sk_state = BT_LISTEN; 808 809 unlock: 810 write_unlock(&sco_sk_list.lock); 811 812 done: 813 release_sock(sk); 814 return err; 815 } 816 817 static int sco_sock_accept(struct socket *sock, struct socket *newsock, 818 struct proto_accept_arg *arg) 819 { 820 DEFINE_WAIT_FUNC(wait, woken_wake_function); 821 struct sock *sk = sock->sk, *ch; 822 long timeo; 823 int err = 0; 824 825 lock_sock(sk); 826 827 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK); 828 829 BT_DBG("sk %p timeo %ld", sk, timeo); 830 831 /* Wait for an incoming connection. (wake-one). */ 832 add_wait_queue_exclusive(sk_sleep(sk), &wait); 833 while (1) { 834 if (sk->sk_state != BT_LISTEN) { 835 err = -EBADFD; 836 break; 837 } 838 839 ch = bt_accept_dequeue(sk, newsock); 840 if (ch) { 841 /* Drop the bridging ref from bt_accept_dequeue(); 842 * the grafted socket keeps ch alive from here. 843 */ 844 sock_put(ch); 845 break; 846 } 847 848 if (!timeo) { 849 err = -EAGAIN; 850 break; 851 } 852 853 if (signal_pending(current)) { 854 err = sock_intr_errno(timeo); 855 break; 856 } 857 858 release_sock(sk); 859 860 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 861 lock_sock(sk); 862 } 863 remove_wait_queue(sk_sleep(sk), &wait); 864 865 if (err) 866 goto done; 867 868 newsock->state = SS_CONNECTED; 869 870 BT_DBG("new socket %p", ch); 871 872 done: 873 release_sock(sk); 874 return err; 875 } 876 877 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, 878 int peer) 879 { 880 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 881 struct sock *sk = sock->sk; 882 883 BT_DBG("sock %p, sk %p", sock, sk); 884 885 addr->sa_family = AF_BLUETOOTH; 886 887 if (peer) 888 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->dst); 889 else 890 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->src); 891 892 return sizeof(struct sockaddr_sco); 893 } 894 895 static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg, 896 size_t len) 897 { 898 struct sock *sk = sock->sk; 899 struct sk_buff *skb; 900 struct sockcm_cookie sockc; 901 int err; 902 903 BT_DBG("sock %p, sk %p", sock, sk); 904 905 err = sock_error(sk); 906 if (err) 907 return err; 908 909 if (msg->msg_flags & MSG_OOB) 910 return -EOPNOTSUPP; 911 912 hci_sockcm_init(&sockc, sk); 913 914 if (msg->msg_controllen) { 915 err = sock_cmsg_send(sk, msg, &sockc); 916 if (err) 917 return err; 918 } 919 920 skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0); 921 if (IS_ERR(skb)) 922 return PTR_ERR(skb); 923 924 lock_sock(sk); 925 926 if (sk->sk_state == BT_CONNECTED) 927 err = sco_send_frame(sk, skb, &sockc); 928 else 929 err = -ENOTCONN; 930 931 release_sock(sk); 932 933 if (err < 0) 934 kfree_skb(skb); 935 return err; 936 } 937 938 static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting) 939 { 940 struct hci_dev *hdev = conn->hdev; 941 942 BT_DBG("conn %p", conn); 943 944 conn->state = BT_CONFIG; 945 946 if (!lmp_esco_capable(hdev)) { 947 struct hci_cp_accept_conn_req cp; 948 949 bacpy(&cp.bdaddr, &conn->dst); 950 cp.role = 0x00; /* Ignored */ 951 952 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp); 953 } else { 954 struct hci_cp_accept_sync_conn_req cp; 955 956 bacpy(&cp.bdaddr, &conn->dst); 957 cp.pkt_type = cpu_to_le16(conn->pkt_type); 958 959 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 960 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 961 cp.content_format = cpu_to_le16(setting); 962 963 switch (setting & SCO_AIRMODE_MASK) { 964 case SCO_AIRMODE_TRANSP: 965 if (conn->pkt_type & ESCO_2EV3) 966 cp.max_latency = cpu_to_le16(0x0008); 967 else 968 cp.max_latency = cpu_to_le16(0x000D); 969 cp.retrans_effort = 0x02; 970 break; 971 case SCO_AIRMODE_CVSD: 972 cp.max_latency = cpu_to_le16(0xffff); 973 cp.retrans_effort = 0xff; 974 break; 975 default: 976 /* use CVSD settings as fallback */ 977 cp.max_latency = cpu_to_le16(0xffff); 978 cp.retrans_effort = 0xff; 979 break; 980 } 981 982 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, 983 sizeof(cp), &cp); 984 } 985 } 986 987 static int sco_sock_recvmsg(struct socket *sock, struct msghdr *msg, 988 size_t len, int flags) 989 { 990 struct sock *sk = sock->sk; 991 struct sco_pinfo *pi = sco_pi(sk); 992 993 if (unlikely(flags & MSG_ERRQUEUE)) 994 return sock_recv_errqueue(sk, msg, len, SOL_BLUETOOTH, 995 BT_SCM_ERROR); 996 997 lock_sock(sk); 998 999 if (sk->sk_state == BT_CONNECT2 && 1000 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) { 1001 sco_conn_defer_accept(pi->conn->hcon, pi->setting); 1002 sk->sk_state = BT_CONFIG; 1003 1004 release_sock(sk); 1005 return 0; 1006 } 1007 1008 release_sock(sk); 1009 1010 return bt_sock_recvmsg(sock, msg, len, flags); 1011 } 1012 1013 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, 1014 sockptr_t optval, unsigned int optlen) 1015 { 1016 struct sock *sk = sock->sk; 1017 int err = 0; 1018 struct bt_voice voice; 1019 u32 opt; 1020 struct bt_codecs *codecs; 1021 struct hci_dev *hdev; 1022 __u8 buffer[255]; 1023 1024 BT_DBG("sk %p", sk); 1025 1026 lock_sock(sk); 1027 1028 switch (optname) { 1029 1030 case BT_DEFER_SETUP: 1031 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 1032 err = -EINVAL; 1033 break; 1034 } 1035 1036 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1037 if (err) 1038 break; 1039 1040 if (opt) 1041 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 1042 else 1043 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 1044 break; 1045 1046 case BT_VOICE: 1047 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND && 1048 sk->sk_state != BT_CONNECT2) { 1049 err = -EINVAL; 1050 break; 1051 } 1052 1053 voice.setting = sco_pi(sk)->setting; 1054 1055 err = copy_safe_from_sockptr(&voice, sizeof(voice), optval, 1056 optlen); 1057 if (err) 1058 break; 1059 1060 sco_pi(sk)->setting = voice.setting; 1061 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, 1062 BDADDR_BREDR); 1063 if (!hdev) { 1064 err = -EBADFD; 1065 break; 1066 } 1067 1068 switch (sco_pi(sk)->setting & SCO_AIRMODE_MASK) { 1069 case SCO_AIRMODE_TRANSP: 1070 if (enhanced_sync_conn_capable(hdev)) 1071 sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT; 1072 break; 1073 } 1074 1075 hci_dev_put(hdev); 1076 break; 1077 1078 case BT_PKT_STATUS: 1079 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1080 if (err) 1081 break; 1082 1083 if (opt) 1084 set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags); 1085 else 1086 clear_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags); 1087 break; 1088 1089 case BT_CODEC: 1090 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND && 1091 sk->sk_state != BT_CONNECT2) { 1092 err = -EINVAL; 1093 break; 1094 } 1095 1096 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, 1097 BDADDR_BREDR); 1098 if (!hdev) { 1099 err = -EBADFD; 1100 break; 1101 } 1102 1103 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) { 1104 hci_dev_put(hdev); 1105 err = -EOPNOTSUPP; 1106 break; 1107 } 1108 1109 if (!hdev->get_data_path_id) { 1110 hci_dev_put(hdev); 1111 err = -EOPNOTSUPP; 1112 break; 1113 } 1114 1115 if (optlen < sizeof(struct bt_codecs) || 1116 optlen > sizeof(buffer)) { 1117 hci_dev_put(hdev); 1118 err = -EINVAL; 1119 break; 1120 } 1121 1122 err = copy_struct_from_sockptr(buffer, sizeof(buffer), optval, 1123 optlen); 1124 if (err) { 1125 hci_dev_put(hdev); 1126 break; 1127 } 1128 1129 codecs = (void *)buffer; 1130 1131 if (codecs->num_codecs != 1 || 1132 optlen < struct_size(codecs, codecs, codecs->num_codecs)) { 1133 hci_dev_put(hdev); 1134 err = -EINVAL; 1135 break; 1136 } 1137 1138 sco_pi(sk)->codec = codecs->codecs[0]; 1139 hci_dev_put(hdev); 1140 break; 1141 1142 default: 1143 err = -ENOPROTOOPT; 1144 break; 1145 } 1146 1147 release_sock(sk); 1148 return err; 1149 } 1150 1151 static int sco_sock_getsockopt_old(struct socket *sock, int optname, 1152 sockopt_t *opt) 1153 { 1154 struct sock *sk = sock->sk; 1155 struct sco_options opts; 1156 struct sco_conninfo cinfo; 1157 int err = 0; 1158 size_t len; 1159 1160 BT_DBG("sk %p", sk); 1161 1162 len = opt->optlen; 1163 1164 lock_sock(sk); 1165 1166 switch (optname) { 1167 case SCO_OPTIONS: 1168 if (sk->sk_state != BT_CONNECTED && 1169 !(sk->sk_state == BT_CONNECT2 && 1170 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 1171 err = -ENOTCONN; 1172 break; 1173 } 1174 1175 opts.mtu = sco_pi(sk)->conn->mtu; 1176 1177 BT_DBG("mtu %u", opts.mtu); 1178 1179 len = min(len, sizeof(opts)); 1180 if (copy_to_iter(&opts, len, &opt->iter_out) != len) 1181 err = -EFAULT; 1182 1183 break; 1184 1185 case SCO_CONNINFO: 1186 if (sk->sk_state != BT_CONNECTED && 1187 !(sk->sk_state == BT_CONNECT2 && 1188 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 1189 err = -ENOTCONN; 1190 break; 1191 } 1192 1193 memset(&cinfo, 0, sizeof(cinfo)); 1194 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle; 1195 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3); 1196 1197 len = min(len, sizeof(cinfo)); 1198 if (copy_to_iter(&cinfo, len, &opt->iter_out) != len) 1199 err = -EFAULT; 1200 1201 break; 1202 1203 default: 1204 err = -ENOPROTOOPT; 1205 break; 1206 } 1207 1208 release_sock(sk); 1209 return err; 1210 } 1211 1212 static int sco_sock_getsockopt(struct socket *sock, int level, int optname, 1213 sockopt_t *opt) 1214 { 1215 struct sock *sk = sock->sk; 1216 int len, val, err = 0; 1217 struct bt_voice voice; 1218 u32 phys; 1219 int buf_len; 1220 struct codec_list *c; 1221 u8 num_codecs, i; 1222 struct hci_dev *hdev; 1223 struct hci_codec_caps *caps; 1224 struct bt_codec codec; 1225 1226 BT_DBG("sk %p", sk); 1227 1228 if (level == SOL_SCO) 1229 return sco_sock_getsockopt_old(sock, optname, opt); 1230 1231 len = opt->optlen; 1232 1233 lock_sock(sk); 1234 1235 switch (optname) { 1236 1237 case BT_DEFER_SETUP: 1238 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 1239 err = -EINVAL; 1240 break; 1241 } 1242 1243 val = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 1244 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) != 1245 sizeof(val)) 1246 err = -EFAULT; 1247 1248 break; 1249 1250 case BT_VOICE: 1251 voice.setting = sco_pi(sk)->setting; 1252 1253 len = min_t(unsigned int, len, sizeof(voice)); 1254 if (copy_to_iter(&voice, len, &opt->iter_out) != len) 1255 err = -EFAULT; 1256 1257 break; 1258 1259 case BT_PHY: 1260 if (sk->sk_state != BT_CONNECTED) { 1261 err = -ENOTCONN; 1262 break; 1263 } 1264 1265 phys = hci_conn_get_phy(sco_pi(sk)->conn->hcon); 1266 1267 if (copy_to_iter(&phys, sizeof(phys), &opt->iter_out) != 1268 sizeof(phys)) 1269 err = -EFAULT; 1270 break; 1271 1272 case BT_PKT_STATUS: 1273 val = test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags); 1274 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) != 1275 sizeof(val)) 1276 err = -EFAULT; 1277 break; 1278 1279 case BT_SNDMTU: 1280 case BT_RCVMTU: 1281 if (sk->sk_state != BT_CONNECTED) { 1282 err = -ENOTCONN; 1283 break; 1284 } 1285 1286 val = sco_pi(sk)->conn->mtu; 1287 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) != 1288 sizeof(val)) 1289 err = -EFAULT; 1290 break; 1291 1292 case BT_CODEC: 1293 num_codecs = 0; 1294 buf_len = 0; 1295 1296 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR); 1297 if (!hdev) { 1298 err = -EBADFD; 1299 break; 1300 } 1301 1302 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) { 1303 hci_dev_put(hdev); 1304 err = -EOPNOTSUPP; 1305 break; 1306 } 1307 1308 if (!hdev->get_data_path_id) { 1309 hci_dev_put(hdev); 1310 err = -EOPNOTSUPP; 1311 break; 1312 } 1313 1314 release_sock(sk); 1315 1316 /* find total buffer size required to copy codec + caps */ 1317 hci_dev_lock(hdev); 1318 list_for_each_entry(c, &hdev->local_codecs, list) { 1319 if (c->transport != HCI_TRANSPORT_SCO_ESCO) 1320 continue; 1321 num_codecs++; 1322 for (i = 0, caps = c->caps; i < c->num_caps; i++) { 1323 buf_len += 1 + caps->len; 1324 caps = (void *)&caps->data[caps->len]; 1325 } 1326 buf_len += sizeof(struct bt_codec); 1327 } 1328 hci_dev_unlock(hdev); 1329 1330 buf_len += sizeof(struct bt_codecs); 1331 if (buf_len > len) { 1332 hci_dev_put(hdev); 1333 return -ENOBUFS; 1334 } 1335 1336 if (copy_to_iter(&num_codecs, sizeof(num_codecs), 1337 &opt->iter_out) != sizeof(num_codecs)) { 1338 hci_dev_put(hdev); 1339 return -EFAULT; 1340 } 1341 1342 /* Iterate all the codecs supported over SCO and populate 1343 * codec data 1344 */ 1345 hci_dev_lock(hdev); 1346 list_for_each_entry(c, &hdev->local_codecs, list) { 1347 if (c->transport != HCI_TRANSPORT_SCO_ESCO) 1348 continue; 1349 1350 codec.id = c->id; 1351 codec.cid = c->cid; 1352 codec.vid = c->vid; 1353 err = hdev->get_data_path_id(hdev, &codec.data_path); 1354 if (err < 0) 1355 break; 1356 codec.num_caps = c->num_caps; 1357 if (copy_to_iter(&codec, sizeof(codec), &opt->iter_out) 1358 != sizeof(codec)) { 1359 err = -EFAULT; 1360 break; 1361 } 1362 1363 /* find codec capabilities data length */ 1364 len = 0; 1365 for (i = 0, caps = c->caps; i < c->num_caps; i++) { 1366 len += 1 + caps->len; 1367 caps = (void *)&caps->data[caps->len]; 1368 } 1369 1370 /* copy codec capabilities data */ 1371 if (len && 1372 copy_to_iter(c->caps, len, &opt->iter_out) != len) { 1373 err = -EFAULT; 1374 break; 1375 } 1376 } 1377 1378 hci_dev_unlock(hdev); 1379 hci_dev_put(hdev); 1380 1381 lock_sock(sk); 1382 1383 if (!err) 1384 opt->optlen = buf_len; 1385 1386 break; 1387 1388 default: 1389 err = -ENOPROTOOPT; 1390 break; 1391 } 1392 1393 release_sock(sk); 1394 return err; 1395 } 1396 1397 static int sco_sock_shutdown(struct socket *sock, int how) 1398 { 1399 struct sock *sk = sock->sk; 1400 int err = 0; 1401 1402 BT_DBG("sock %p, sk %p", sock, sk); 1403 1404 if (!sk) 1405 return 0; 1406 1407 sock_hold(sk); 1408 lock_sock(sk); 1409 1410 if (!sk->sk_shutdown) { 1411 sk->sk_shutdown = SHUTDOWN_MASK; 1412 sco_sock_clear_timer(sk); 1413 __sco_sock_close(sk); 1414 1415 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 1416 !(current->flags & PF_EXITING)) 1417 err = bt_sock_wait_state(sk, BT_CLOSED, 1418 sk->sk_lingertime); 1419 } 1420 1421 release_sock(sk); 1422 sock_put(sk); 1423 1424 return err; 1425 } 1426 1427 static int sco_sock_release(struct socket *sock) 1428 { 1429 struct sock *sk = sock->sk; 1430 int err = 0; 1431 1432 BT_DBG("sock %p, sk %p", sock, sk); 1433 1434 if (!sk) 1435 return 0; 1436 1437 sco_sock_close(sk); 1438 1439 if (sock_flag(sk, SOCK_LINGER) && READ_ONCE(sk->sk_lingertime) && 1440 !(current->flags & PF_EXITING)) { 1441 lock_sock(sk); 1442 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); 1443 release_sock(sk); 1444 } 1445 1446 sock_orphan(sk); 1447 sco_sock_kill(sk); 1448 return err; 1449 } 1450 1451 static void sco_conn_ready(struct sco_conn *conn) 1452 { 1453 struct sock *parent, *sk; 1454 1455 sco_conn_lock(conn); 1456 sk = sco_sock_hold(conn); 1457 sco_conn_unlock(conn); 1458 1459 BT_DBG("conn %p", conn); 1460 1461 if (sk) { 1462 lock_sock(sk); 1463 1464 /* conn->sk may have become NULL if racing with sk close, but 1465 * due to held hdev->lock, it can't become different sk. 1466 */ 1467 if (conn->sk) { 1468 sco_sock_clear_timer(sk); 1469 sk->sk_state = BT_CONNECTED; 1470 sk->sk_state_change(sk); 1471 } 1472 1473 release_sock(sk); 1474 sock_put(sk); 1475 } else { 1476 if (!conn->hcon) 1477 return; 1478 1479 lockdep_assert_held(&conn->hcon->hdev->lock); 1480 1481 parent = sco_get_sock_listen(&conn->hcon->src); 1482 if (!parent) 1483 return; 1484 1485 lock_sock(parent); 1486 1487 sco_conn_lock(conn); 1488 1489 /* hdev->lock guarantees conn->sk == NULL still here */ 1490 1491 if (parent->sk_state != BT_LISTEN) 1492 goto release; 1493 1494 sk = sco_sock_alloc(sock_net(parent), NULL, 1495 BTPROTO_SCO, GFP_ATOMIC, 0); 1496 if (!sk) 1497 goto release; 1498 1499 sco_sock_init(sk, parent); 1500 1501 bacpy(&sco_pi(sk)->src, &conn->hcon->src); 1502 bacpy(&sco_pi(sk)->dst, &conn->hcon->dst); 1503 1504 __sco_chan_add(conn, sk, parent); 1505 1506 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) 1507 sk->sk_state = BT_CONNECT2; 1508 else 1509 sk->sk_state = BT_CONNECTED; 1510 1511 /* Wake up parent */ 1512 parent->sk_data_ready(parent); 1513 1514 release: 1515 sco_conn_unlock(conn); 1516 release_sock(parent); 1517 sock_put(parent); 1518 } 1519 } 1520 1521 /* ----- SCO interface with lower layer (HCI) ----- */ 1522 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) 1523 { 1524 struct sock *sk; 1525 int lm = 0; 1526 1527 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr); 1528 1529 /* Find listening sockets */ 1530 read_lock(&sco_sk_list.lock); 1531 sk_for_each(sk, &sco_sk_list.head) { 1532 if (sk->sk_state != BT_LISTEN) 1533 continue; 1534 1535 if (!bacmp(&sco_pi(sk)->src, &hdev->bdaddr) || 1536 !bacmp(&sco_pi(sk)->src, BDADDR_ANY)) { 1537 lm |= HCI_LM_ACCEPT; 1538 1539 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) 1540 *flags |= HCI_PROTO_DEFER; 1541 break; 1542 } 1543 } 1544 read_unlock(&sco_sk_list.lock); 1545 1546 return lm; 1547 } 1548 1549 static void sco_connect_cfm(struct hci_conn *hcon, __u8 status) 1550 { 1551 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) 1552 return; 1553 1554 BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status); 1555 1556 if (!status) { 1557 struct sco_conn *conn; 1558 1559 conn = sco_conn_add(hcon); 1560 if (conn) { 1561 sco_conn_ready(conn); 1562 sco_conn_put(conn); 1563 } 1564 } else 1565 sco_conn_del(hcon, bt_to_errno(status)); 1566 } 1567 1568 static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason) 1569 { 1570 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) 1571 return; 1572 1573 BT_DBG("hcon %p reason %d", hcon, reason); 1574 1575 sco_conn_del(hcon, bt_to_errno(reason)); 1576 } 1577 1578 int sco_recv_scodata(struct hci_dev *hdev, u16 handle, struct sk_buff *skb) 1579 { 1580 struct hci_conn *hcon; 1581 struct sco_conn *conn; 1582 1583 hci_dev_lock(hdev); 1584 1585 hcon = hci_conn_hash_lookup_handle(hdev, handle); 1586 if (!hcon) { 1587 hci_dev_unlock(hdev); 1588 kfree_skb(skb); 1589 return -ENOENT; 1590 } 1591 1592 conn = sco_conn_hold_unless_zero(hcon->sco_data); 1593 hcon = NULL; 1594 1595 hci_dev_unlock(hdev); 1596 1597 if (!conn) { 1598 kfree_skb(skb); 1599 return -EINVAL; 1600 } 1601 1602 BT_DBG("conn %p len %u", conn, skb->len); 1603 1604 if (skb->len) 1605 sco_recv_frame(conn, skb); 1606 else 1607 kfree_skb(skb); 1608 1609 sco_conn_put(conn); 1610 return 0; 1611 } 1612 1613 static struct hci_cb sco_cb = { 1614 .name = "SCO", 1615 .connect_cfm = sco_connect_cfm, 1616 .disconn_cfm = sco_disconn_cfm, 1617 }; 1618 1619 static int sco_debugfs_show(struct seq_file *f, void *p) 1620 { 1621 struct sock *sk; 1622 1623 read_lock(&sco_sk_list.lock); 1624 1625 sk_for_each(sk, &sco_sk_list.head) { 1626 seq_printf(f, "%pMR %pMR %d\n", &sco_pi(sk)->src, 1627 &sco_pi(sk)->dst, sk->sk_state); 1628 } 1629 1630 read_unlock(&sco_sk_list.lock); 1631 1632 return 0; 1633 } 1634 1635 DEFINE_SHOW_ATTRIBUTE(sco_debugfs); 1636 1637 static struct dentry *sco_debugfs; 1638 1639 static const struct proto_ops sco_sock_ops = { 1640 .family = PF_BLUETOOTH, 1641 .owner = THIS_MODULE, 1642 .release = sco_sock_release, 1643 .bind = sco_sock_bind, 1644 .connect = sco_sock_connect, 1645 .listen = sco_sock_listen, 1646 .accept = sco_sock_accept, 1647 .getname = sco_sock_getname, 1648 .sendmsg = sco_sock_sendmsg, 1649 .recvmsg = sco_sock_recvmsg, 1650 .poll = bt_sock_poll, 1651 .ioctl = bt_sock_ioctl, 1652 .gettstamp = sock_gettstamp, 1653 .mmap = sock_no_mmap, 1654 .socketpair = sock_no_socketpair, 1655 .shutdown = sco_sock_shutdown, 1656 .setsockopt = sco_sock_setsockopt, 1657 .getsockopt_iter = sco_sock_getsockopt 1658 }; 1659 1660 static const struct net_proto_family sco_sock_family_ops = { 1661 .family = PF_BLUETOOTH, 1662 .owner = THIS_MODULE, 1663 .create = sco_sock_create, 1664 }; 1665 1666 int __init sco_init(void) 1667 { 1668 int err; 1669 1670 BUILD_BUG_ON(sizeof(struct sockaddr_sco) > sizeof(struct sockaddr)); 1671 1672 err = proto_register(&sco_proto, 0); 1673 if (err < 0) 1674 return err; 1675 1676 err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops); 1677 if (err < 0) { 1678 BT_ERR("SCO socket registration failed"); 1679 goto error; 1680 } 1681 1682 err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL); 1683 if (err < 0) { 1684 BT_ERR("Failed to create SCO proc file"); 1685 bt_sock_unregister(BTPROTO_SCO); 1686 goto error; 1687 } 1688 1689 BT_INFO("SCO socket layer initialized"); 1690 1691 hci_register_cb(&sco_cb); 1692 1693 if (IS_ERR_OR_NULL(bt_debugfs)) 1694 return 0; 1695 1696 sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs, 1697 NULL, &sco_debugfs_fops); 1698 1699 return 0; 1700 1701 error: 1702 proto_unregister(&sco_proto); 1703 return err; 1704 } 1705 1706 void sco_exit(void) 1707 { 1708 bt_procfs_cleanup(&init_net, "sco"); 1709 1710 debugfs_remove(sco_debugfs); 1711 1712 hci_unregister_cb(&sco_cb); 1713 1714 bt_sock_unregister(BTPROTO_SCO); 1715 1716 proto_unregister(&sco_proto); 1717 } 1718 1719 module_param(disable_esco, bool, 0644); 1720 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation"); 1721