xref: /linux/net/bluetooth/sco.c (revision 150b567e0d572342ef08bace7ee7aff80fd75327)
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4 
5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6 
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License version 2 as
9    published by the Free Software Foundation;
10 
11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 
20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22    SOFTWARE IS DISCLAIMED.
23 */
24 
25 /* Bluetooth SCO sockets. */
26 
27 #include <linux/module.h>
28 #include <linux/debugfs.h>
29 #include <linux/seq_file.h>
30 #include <linux/sched/signal.h>
31 
32 #include <net/bluetooth/bluetooth.h>
33 #include <net/bluetooth/hci_core.h>
34 #include <net/bluetooth/sco.h>
35 
36 static bool disable_esco;
37 
38 static const struct proto_ops sco_sock_ops;
39 
40 static struct bt_sock_list sco_sk_list = {
41 	.lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
42 };
43 
44 /* ---- SCO connections ---- */
45 struct sco_conn {
46 	struct hci_conn	*hcon;
47 
48 	spinlock_t	lock;
49 	struct sock	*sk;
50 
51 	struct delayed_work	timeout_work;
52 
53 	unsigned int    mtu;
54 	struct kref	ref;
55 };
56 
57 #define sco_conn_lock(c)	spin_lock(&c->lock)
58 #define sco_conn_unlock(c)	spin_unlock(&c->lock)
59 
60 static void sco_sock_close(struct sock *sk);
61 static void sco_sock_kill(struct sock *sk);
62 
63 /* ----- SCO socket info ----- */
64 #define sco_pi(sk) ((struct sco_pinfo *) sk)
65 
66 struct sco_pinfo {
67 	struct bt_sock	bt;
68 	bdaddr_t	src;
69 	bdaddr_t	dst;
70 	__u32		flags;
71 	__u16		setting;
72 	struct bt_codec codec;
73 	struct sco_conn	*conn;
74 };
75 
76 /* ---- SCO timers ---- */
77 #define SCO_CONN_TIMEOUT	(HZ * 40)
78 #define SCO_DISCONN_TIMEOUT	(HZ * 2)
79 
sco_conn_free(struct kref * ref)80 static void sco_conn_free(struct kref *ref)
81 {
82 	struct sco_conn *conn = container_of(ref, struct sco_conn, ref);
83 
84 	BT_DBG("conn %p", conn);
85 
86 	if (conn->sk)
87 		sco_pi(conn->sk)->conn = NULL;
88 
89 	if (conn->hcon) {
90 		conn->hcon->sco_data = NULL;
91 		hci_conn_drop(conn->hcon);
92 	}
93 
94 	/* Ensure no more work items will run since hci_conn has been dropped */
95 	disable_delayed_work_sync(&conn->timeout_work);
96 
97 	kfree(conn);
98 }
99 
sco_conn_put(struct sco_conn * conn)100 static void sco_conn_put(struct sco_conn *conn)
101 {
102 	if (!conn)
103 		return;
104 
105 	BT_DBG("conn %p refcnt %d", conn, kref_read(&conn->ref));
106 
107 	kref_put(&conn->ref, sco_conn_free);
108 }
109 
sco_conn_hold_unless_zero(struct sco_conn * conn)110 static struct sco_conn *sco_conn_hold_unless_zero(struct sco_conn *conn)
111 {
112 	if (!conn)
113 		return NULL;
114 
115 	BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref));
116 
117 	if (!kref_get_unless_zero(&conn->ref))
118 		return NULL;
119 
120 	return conn;
121 }
122 
sco_sock_hold(struct sco_conn * conn)123 static struct sock *sco_sock_hold(struct sco_conn *conn)
124 {
125 	if (!conn || !bt_sock_linked(&sco_sk_list, conn->sk))
126 		return NULL;
127 
128 	sock_hold(conn->sk);
129 
130 	return conn->sk;
131 }
132 
sco_sock_timeout(struct work_struct * work)133 static void sco_sock_timeout(struct work_struct *work)
134 {
135 	struct sco_conn *conn = container_of(work, struct sco_conn,
136 					     timeout_work.work);
137 	struct sock *sk;
138 
139 	conn = sco_conn_hold_unless_zero(conn);
140 	if (!conn)
141 		return;
142 
143 	sco_conn_lock(conn);
144 	if (!conn->hcon) {
145 		sco_conn_unlock(conn);
146 		sco_conn_put(conn);
147 		return;
148 	}
149 	sk = sco_sock_hold(conn);
150 	sco_conn_unlock(conn);
151 	sco_conn_put(conn);
152 
153 	if (!sk)
154 		return;
155 
156 	BT_DBG("sock %p state %d", sk, sk->sk_state);
157 
158 	lock_sock(sk);
159 	sk->sk_err = ETIMEDOUT;
160 	sk->sk_state_change(sk);
161 	release_sock(sk);
162 	sock_put(sk);
163 }
164 
sco_sock_set_timer(struct sock * sk,long timeout)165 static void sco_sock_set_timer(struct sock *sk, long timeout)
166 {
167 	if (!sco_pi(sk)->conn)
168 		return;
169 
170 	BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
171 	cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
172 	schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout);
173 }
174 
sco_sock_clear_timer(struct sock * sk)175 static void sco_sock_clear_timer(struct sock *sk)
176 {
177 	if (!sco_pi(sk)->conn)
178 		return;
179 
180 	BT_DBG("sock %p state %d", sk, sk->sk_state);
181 	cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
182 }
183 
184 /* ---- SCO connections ---- */
sco_conn_add(struct hci_conn * hcon)185 static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
186 {
187 	struct sco_conn *conn = hcon->sco_data;
188 
189 	conn = sco_conn_hold_unless_zero(conn);
190 	if (conn) {
191 		if (!conn->hcon) {
192 			sco_conn_lock(conn);
193 			conn->hcon = hcon;
194 			sco_conn_unlock(conn);
195 		}
196 		return conn;
197 	}
198 
199 	conn = kzalloc(sizeof(struct sco_conn), GFP_KERNEL);
200 	if (!conn)
201 		return NULL;
202 
203 	kref_init(&conn->ref);
204 	spin_lock_init(&conn->lock);
205 	INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
206 
207 	hcon->sco_data = conn;
208 	conn->hcon = hcon;
209 	conn->mtu = hcon->mtu;
210 
211 	if (hcon->mtu > 0)
212 		conn->mtu = hcon->mtu;
213 	else
214 		conn->mtu = 60;
215 
216 	BT_DBG("hcon %p conn %p", hcon, conn);
217 
218 	return conn;
219 }
220 
221 /* Delete channel.
222  * Must be called on the locked socket. */
sco_chan_del(struct sock * sk,int err)223 static void sco_chan_del(struct sock *sk, int err)
224 {
225 	struct sco_conn *conn;
226 
227 	conn = sco_pi(sk)->conn;
228 	sco_pi(sk)->conn = NULL;
229 
230 	BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
231 
232 	if (conn) {
233 		sco_conn_lock(conn);
234 		conn->sk = NULL;
235 		sco_conn_unlock(conn);
236 		sco_conn_put(conn);
237 	}
238 
239 	sk->sk_state = BT_CLOSED;
240 	sk->sk_err   = err;
241 	sk->sk_state_change(sk);
242 
243 	sock_set_flag(sk, SOCK_ZAPPED);
244 }
245 
sco_conn_del(struct hci_conn * hcon,int err)246 static void sco_conn_del(struct hci_conn *hcon, int err)
247 {
248 	struct sco_conn *conn = hcon->sco_data;
249 	struct sock *sk;
250 
251 	conn = sco_conn_hold_unless_zero(conn);
252 	if (!conn)
253 		return;
254 
255 	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
256 
257 	sco_conn_lock(conn);
258 	sk = sco_sock_hold(conn);
259 	sco_conn_unlock(conn);
260 	sco_conn_put(conn);
261 
262 	if (!sk) {
263 		sco_conn_put(conn);
264 		return;
265 	}
266 
267 	/* Kill socket */
268 	lock_sock(sk);
269 	sco_sock_clear_timer(sk);
270 	sco_chan_del(sk, err);
271 	release_sock(sk);
272 	sock_put(sk);
273 }
274 
__sco_chan_add(struct sco_conn * conn,struct sock * sk,struct sock * parent)275 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
276 			   struct sock *parent)
277 {
278 	BT_DBG("conn %p", conn);
279 
280 	sco_pi(sk)->conn = conn;
281 	conn->sk = sk;
282 
283 	if (parent)
284 		bt_accept_enqueue(parent, sk, true);
285 }
286 
sco_chan_add(struct sco_conn * conn,struct sock * sk,struct sock * parent)287 static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
288 			struct sock *parent)
289 {
290 	int err = 0;
291 
292 	sco_conn_lock(conn);
293 	if (conn->sk)
294 		err = -EBUSY;
295 	else
296 		__sco_chan_add(conn, sk, parent);
297 
298 	sco_conn_unlock(conn);
299 	return err;
300 }
301 
sco_connect(struct sock * sk)302 static int sco_connect(struct sock *sk)
303 {
304 	struct sco_conn *conn;
305 	struct hci_conn *hcon;
306 	struct hci_dev  *hdev;
307 	int err, type;
308 
309 	BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst);
310 
311 	hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
312 	if (!hdev)
313 		return -EHOSTUNREACH;
314 
315 	hci_dev_lock(hdev);
316 
317 	if (lmp_esco_capable(hdev) && !disable_esco)
318 		type = ESCO_LINK;
319 	else
320 		type = SCO_LINK;
321 
322 	switch (sco_pi(sk)->setting & SCO_AIRMODE_MASK) {
323 	case SCO_AIRMODE_TRANSP:
324 		if (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev)) {
325 			err = -EOPNOTSUPP;
326 			goto unlock;
327 		}
328 		break;
329 	}
330 
331 	hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst,
332 			       sco_pi(sk)->setting, &sco_pi(sk)->codec,
333 			       sk->sk_sndtimeo);
334 	if (IS_ERR(hcon)) {
335 		err = PTR_ERR(hcon);
336 		goto unlock;
337 	}
338 
339 	conn = sco_conn_add(hcon);
340 	if (!conn) {
341 		hci_conn_drop(hcon);
342 		err = -ENOMEM;
343 		goto unlock;
344 	}
345 
346 	lock_sock(sk);
347 
348 	err = sco_chan_add(conn, sk, NULL);
349 	if (err) {
350 		release_sock(sk);
351 		goto unlock;
352 	}
353 
354 	/* Update source addr of the socket */
355 	bacpy(&sco_pi(sk)->src, &hcon->src);
356 
357 	if (hcon->state == BT_CONNECTED) {
358 		sco_sock_clear_timer(sk);
359 		sk->sk_state = BT_CONNECTED;
360 	} else {
361 		sk->sk_state = BT_CONNECT;
362 		sco_sock_set_timer(sk, sk->sk_sndtimeo);
363 	}
364 
365 	release_sock(sk);
366 
367 unlock:
368 	hci_dev_unlock(hdev);
369 	hci_dev_put(hdev);
370 	return err;
371 }
372 
sco_send_frame(struct sock * sk,struct sk_buff * skb)373 static int sco_send_frame(struct sock *sk, struct sk_buff *skb)
374 {
375 	struct sco_conn *conn = sco_pi(sk)->conn;
376 	int len = skb->len;
377 
378 	/* Check outgoing MTU */
379 	if (len > conn->mtu)
380 		return -EINVAL;
381 
382 	BT_DBG("sk %p len %d", sk, len);
383 
384 	hci_send_sco(conn->hcon, skb);
385 
386 	return len;
387 }
388 
sco_recv_frame(struct sco_conn * conn,struct sk_buff * skb)389 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
390 {
391 	struct sock *sk;
392 
393 	sco_conn_lock(conn);
394 	sk = conn->sk;
395 	sco_conn_unlock(conn);
396 
397 	if (!sk)
398 		goto drop;
399 
400 	BT_DBG("sk %p len %u", sk, skb->len);
401 
402 	if (sk->sk_state != BT_CONNECTED)
403 		goto drop;
404 
405 	if (!sock_queue_rcv_skb(sk, skb))
406 		return;
407 
408 drop:
409 	kfree_skb(skb);
410 }
411 
412 /* -------- Socket interface ---------- */
__sco_get_sock_listen_by_addr(bdaddr_t * ba)413 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
414 {
415 	struct sock *sk;
416 
417 	sk_for_each(sk, &sco_sk_list.head) {
418 		if (sk->sk_state != BT_LISTEN)
419 			continue;
420 
421 		if (!bacmp(&sco_pi(sk)->src, ba))
422 			return sk;
423 	}
424 
425 	return NULL;
426 }
427 
428 /* Find socket listening on source bdaddr.
429  * Returns closest match.
430  */
sco_get_sock_listen(bdaddr_t * src)431 static struct sock *sco_get_sock_listen(bdaddr_t *src)
432 {
433 	struct sock *sk = NULL, *sk1 = NULL;
434 
435 	read_lock(&sco_sk_list.lock);
436 
437 	sk_for_each(sk, &sco_sk_list.head) {
438 		if (sk->sk_state != BT_LISTEN)
439 			continue;
440 
441 		/* Exact match. */
442 		if (!bacmp(&sco_pi(sk)->src, src))
443 			break;
444 
445 		/* Closest match */
446 		if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY))
447 			sk1 = sk;
448 	}
449 
450 	read_unlock(&sco_sk_list.lock);
451 
452 	return sk ? sk : sk1;
453 }
454 
sco_sock_destruct(struct sock * sk)455 static void sco_sock_destruct(struct sock *sk)
456 {
457 	BT_DBG("sk %p", sk);
458 
459 	sco_conn_put(sco_pi(sk)->conn);
460 
461 	skb_queue_purge(&sk->sk_receive_queue);
462 	skb_queue_purge(&sk->sk_write_queue);
463 }
464 
sco_sock_cleanup_listen(struct sock * parent)465 static void sco_sock_cleanup_listen(struct sock *parent)
466 {
467 	struct sock *sk;
468 
469 	BT_DBG("parent %p", parent);
470 
471 	/* Close not yet accepted channels */
472 	while ((sk = bt_accept_dequeue(parent, NULL))) {
473 		sco_sock_close(sk);
474 		sco_sock_kill(sk);
475 	}
476 
477 	parent->sk_state  = BT_CLOSED;
478 	sock_set_flag(parent, SOCK_ZAPPED);
479 }
480 
481 /* Kill socket (only if zapped and orphan)
482  * Must be called on unlocked socket.
483  */
sco_sock_kill(struct sock * sk)484 static void sco_sock_kill(struct sock *sk)
485 {
486 	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
487 		return;
488 
489 	BT_DBG("sk %p state %d", sk, sk->sk_state);
490 
491 	/* Kill poor orphan */
492 	bt_sock_unlink(&sco_sk_list, sk);
493 	sock_set_flag(sk, SOCK_DEAD);
494 	sock_put(sk);
495 }
496 
__sco_sock_close(struct sock * sk)497 static void __sco_sock_close(struct sock *sk)
498 {
499 	BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
500 
501 	switch (sk->sk_state) {
502 	case BT_LISTEN:
503 		sco_sock_cleanup_listen(sk);
504 		break;
505 
506 	case BT_CONNECTED:
507 	case BT_CONFIG:
508 	case BT_CONNECT2:
509 	case BT_CONNECT:
510 	case BT_DISCONN:
511 		sco_chan_del(sk, ECONNRESET);
512 		break;
513 
514 	default:
515 		sock_set_flag(sk, SOCK_ZAPPED);
516 		break;
517 	}
518 
519 }
520 
521 /* Must be called on unlocked socket. */
sco_sock_close(struct sock * sk)522 static void sco_sock_close(struct sock *sk)
523 {
524 	lock_sock(sk);
525 	sco_sock_clear_timer(sk);
526 	__sco_sock_close(sk);
527 	release_sock(sk);
528 }
529 
sco_sock_init(struct sock * sk,struct sock * parent)530 static void sco_sock_init(struct sock *sk, struct sock *parent)
531 {
532 	BT_DBG("sk %p", sk);
533 
534 	if (parent) {
535 		sk->sk_type = parent->sk_type;
536 		bt_sk(sk)->flags = bt_sk(parent)->flags;
537 		security_sk_clone(parent, sk);
538 	}
539 }
540 
541 static struct proto sco_proto = {
542 	.name		= "SCO",
543 	.owner		= THIS_MODULE,
544 	.obj_size	= sizeof(struct sco_pinfo)
545 };
546 
sco_sock_alloc(struct net * net,struct socket * sock,int proto,gfp_t prio,int kern)547 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock,
548 				   int proto, gfp_t prio, int kern)
549 {
550 	struct sock *sk;
551 
552 	sk = bt_sock_alloc(net, sock, &sco_proto, proto, prio, kern);
553 	if (!sk)
554 		return NULL;
555 
556 	sk->sk_destruct = sco_sock_destruct;
557 	sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
558 
559 	sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
560 	sco_pi(sk)->codec.id = BT_CODEC_CVSD;
561 	sco_pi(sk)->codec.cid = 0xffff;
562 	sco_pi(sk)->codec.vid = 0xffff;
563 	sco_pi(sk)->codec.data_path = 0x00;
564 
565 	bt_sock_link(&sco_sk_list, sk);
566 	return sk;
567 }
568 
sco_sock_create(struct net * net,struct socket * sock,int protocol,int kern)569 static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
570 			   int kern)
571 {
572 	struct sock *sk;
573 
574 	BT_DBG("sock %p", sock);
575 
576 	sock->state = SS_UNCONNECTED;
577 
578 	if (sock->type != SOCK_SEQPACKET)
579 		return -ESOCKTNOSUPPORT;
580 
581 	sock->ops = &sco_sock_ops;
582 
583 	sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
584 	if (!sk)
585 		return -ENOMEM;
586 
587 	sco_sock_init(sk, NULL);
588 	return 0;
589 }
590 
sco_sock_bind(struct socket * sock,struct sockaddr * addr,int addr_len)591 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr,
592 			 int addr_len)
593 {
594 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
595 	struct sock *sk = sock->sk;
596 	int err = 0;
597 
598 	if (!addr || addr_len < sizeof(struct sockaddr_sco) ||
599 	    addr->sa_family != AF_BLUETOOTH)
600 		return -EINVAL;
601 
602 	BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
603 
604 	lock_sock(sk);
605 
606 	if (sk->sk_state != BT_OPEN) {
607 		err = -EBADFD;
608 		goto done;
609 	}
610 
611 	if (sk->sk_type != SOCK_SEQPACKET) {
612 		err = -EINVAL;
613 		goto done;
614 	}
615 
616 	bacpy(&sco_pi(sk)->src, &sa->sco_bdaddr);
617 
618 	sk->sk_state = BT_BOUND;
619 
620 done:
621 	release_sock(sk);
622 	return err;
623 }
624 
sco_sock_connect(struct socket * sock,struct sockaddr * addr,int alen,int flags)625 static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
626 {
627 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
628 	struct sock *sk = sock->sk;
629 	int err;
630 
631 	BT_DBG("sk %p", sk);
632 
633 	if (alen < sizeof(struct sockaddr_sco) ||
634 	    addr->sa_family != AF_BLUETOOTH)
635 		return -EINVAL;
636 
637 	if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
638 		return -EBADFD;
639 
640 	if (sk->sk_type != SOCK_SEQPACKET)
641 		err = -EINVAL;
642 
643 	lock_sock(sk);
644 	/* Set destination address and psm */
645 	bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr);
646 	release_sock(sk);
647 
648 	err = sco_connect(sk);
649 	if (err)
650 		return err;
651 
652 	lock_sock(sk);
653 
654 	err = bt_sock_wait_state(sk, BT_CONNECTED,
655 				 sock_sndtimeo(sk, flags & O_NONBLOCK));
656 
657 	release_sock(sk);
658 	return err;
659 }
660 
sco_sock_listen(struct socket * sock,int backlog)661 static int sco_sock_listen(struct socket *sock, int backlog)
662 {
663 	struct sock *sk = sock->sk;
664 	bdaddr_t *src = &sco_pi(sk)->src;
665 	int err = 0;
666 
667 	BT_DBG("sk %p backlog %d", sk, backlog);
668 
669 	lock_sock(sk);
670 
671 	if (sk->sk_state != BT_BOUND) {
672 		err = -EBADFD;
673 		goto done;
674 	}
675 
676 	if (sk->sk_type != SOCK_SEQPACKET) {
677 		err = -EINVAL;
678 		goto done;
679 	}
680 
681 	write_lock(&sco_sk_list.lock);
682 
683 	if (__sco_get_sock_listen_by_addr(src)) {
684 		err = -EADDRINUSE;
685 		goto unlock;
686 	}
687 
688 	sk->sk_max_ack_backlog = backlog;
689 	sk->sk_ack_backlog = 0;
690 
691 	sk->sk_state = BT_LISTEN;
692 
693 unlock:
694 	write_unlock(&sco_sk_list.lock);
695 
696 done:
697 	release_sock(sk);
698 	return err;
699 }
700 
sco_sock_accept(struct socket * sock,struct socket * newsock,struct proto_accept_arg * arg)701 static int sco_sock_accept(struct socket *sock, struct socket *newsock,
702 			   struct proto_accept_arg *arg)
703 {
704 	DEFINE_WAIT_FUNC(wait, woken_wake_function);
705 	struct sock *sk = sock->sk, *ch;
706 	long timeo;
707 	int err = 0;
708 
709 	lock_sock(sk);
710 
711 	timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK);
712 
713 	BT_DBG("sk %p timeo %ld", sk, timeo);
714 
715 	/* Wait for an incoming connection. (wake-one). */
716 	add_wait_queue_exclusive(sk_sleep(sk), &wait);
717 	while (1) {
718 		if (sk->sk_state != BT_LISTEN) {
719 			err = -EBADFD;
720 			break;
721 		}
722 
723 		ch = bt_accept_dequeue(sk, newsock);
724 		if (ch)
725 			break;
726 
727 		if (!timeo) {
728 			err = -EAGAIN;
729 			break;
730 		}
731 
732 		if (signal_pending(current)) {
733 			err = sock_intr_errno(timeo);
734 			break;
735 		}
736 
737 		release_sock(sk);
738 
739 		timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
740 		lock_sock(sk);
741 	}
742 	remove_wait_queue(sk_sleep(sk), &wait);
743 
744 	if (err)
745 		goto done;
746 
747 	newsock->state = SS_CONNECTED;
748 
749 	BT_DBG("new socket %p", ch);
750 
751 done:
752 	release_sock(sk);
753 	return err;
754 }
755 
sco_sock_getname(struct socket * sock,struct sockaddr * addr,int peer)756 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr,
757 			    int peer)
758 {
759 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
760 	struct sock *sk = sock->sk;
761 
762 	BT_DBG("sock %p, sk %p", sock, sk);
763 
764 	addr->sa_family = AF_BLUETOOTH;
765 
766 	if (peer)
767 		bacpy(&sa->sco_bdaddr, &sco_pi(sk)->dst);
768 	else
769 		bacpy(&sa->sco_bdaddr, &sco_pi(sk)->src);
770 
771 	return sizeof(struct sockaddr_sco);
772 }
773 
sco_sock_sendmsg(struct socket * sock,struct msghdr * msg,size_t len)774 static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
775 			    size_t len)
776 {
777 	struct sock *sk = sock->sk;
778 	struct sk_buff *skb;
779 	int err;
780 
781 	BT_DBG("sock %p, sk %p", sock, sk);
782 
783 	err = sock_error(sk);
784 	if (err)
785 		return err;
786 
787 	if (msg->msg_flags & MSG_OOB)
788 		return -EOPNOTSUPP;
789 
790 	skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0);
791 	if (IS_ERR(skb))
792 		return PTR_ERR(skb);
793 
794 	lock_sock(sk);
795 
796 	if (sk->sk_state == BT_CONNECTED)
797 		err = sco_send_frame(sk, skb);
798 	else
799 		err = -ENOTCONN;
800 
801 	release_sock(sk);
802 
803 	if (err < 0)
804 		kfree_skb(skb);
805 	return err;
806 }
807 
sco_conn_defer_accept(struct hci_conn * conn,u16 setting)808 static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
809 {
810 	struct hci_dev *hdev = conn->hdev;
811 
812 	BT_DBG("conn %p", conn);
813 
814 	conn->state = BT_CONFIG;
815 
816 	if (!lmp_esco_capable(hdev)) {
817 		struct hci_cp_accept_conn_req cp;
818 
819 		bacpy(&cp.bdaddr, &conn->dst);
820 		cp.role = 0x00; /* Ignored */
821 
822 		hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
823 	} else {
824 		struct hci_cp_accept_sync_conn_req cp;
825 
826 		bacpy(&cp.bdaddr, &conn->dst);
827 		cp.pkt_type = cpu_to_le16(conn->pkt_type);
828 
829 		cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
830 		cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
831 		cp.content_format = cpu_to_le16(setting);
832 
833 		switch (setting & SCO_AIRMODE_MASK) {
834 		case SCO_AIRMODE_TRANSP:
835 			if (conn->pkt_type & ESCO_2EV3)
836 				cp.max_latency = cpu_to_le16(0x0008);
837 			else
838 				cp.max_latency = cpu_to_le16(0x000D);
839 			cp.retrans_effort = 0x02;
840 			break;
841 		case SCO_AIRMODE_CVSD:
842 			cp.max_latency = cpu_to_le16(0xffff);
843 			cp.retrans_effort = 0xff;
844 			break;
845 		default:
846 			/* use CVSD settings as fallback */
847 			cp.max_latency = cpu_to_le16(0xffff);
848 			cp.retrans_effort = 0xff;
849 			break;
850 		}
851 
852 		hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
853 			     sizeof(cp), &cp);
854 	}
855 }
856 
sco_sock_recvmsg(struct socket * sock,struct msghdr * msg,size_t len,int flags)857 static int sco_sock_recvmsg(struct socket *sock, struct msghdr *msg,
858 			    size_t len, int flags)
859 {
860 	struct sock *sk = sock->sk;
861 	struct sco_pinfo *pi = sco_pi(sk);
862 
863 	lock_sock(sk);
864 
865 	if (sk->sk_state == BT_CONNECT2 &&
866 	    test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
867 		sco_conn_defer_accept(pi->conn->hcon, pi->setting);
868 		sk->sk_state = BT_CONFIG;
869 
870 		release_sock(sk);
871 		return 0;
872 	}
873 
874 	release_sock(sk);
875 
876 	return bt_sock_recvmsg(sock, msg, len, flags);
877 }
878 
sco_sock_setsockopt(struct socket * sock,int level,int optname,sockptr_t optval,unsigned int optlen)879 static int sco_sock_setsockopt(struct socket *sock, int level, int optname,
880 			       sockptr_t optval, unsigned int optlen)
881 {
882 	struct sock *sk = sock->sk;
883 	int err = 0;
884 	struct bt_voice voice;
885 	u32 opt;
886 	struct bt_codecs *codecs;
887 	struct hci_dev *hdev;
888 	__u8 buffer[255];
889 
890 	BT_DBG("sk %p", sk);
891 
892 	lock_sock(sk);
893 
894 	switch (optname) {
895 
896 	case BT_DEFER_SETUP:
897 		if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
898 			err = -EINVAL;
899 			break;
900 		}
901 
902 		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
903 		if (err)
904 			break;
905 
906 		if (opt)
907 			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
908 		else
909 			clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
910 		break;
911 
912 	case BT_VOICE:
913 		if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
914 		    sk->sk_state != BT_CONNECT2) {
915 			err = -EINVAL;
916 			break;
917 		}
918 
919 		voice.setting = sco_pi(sk)->setting;
920 
921 		err = copy_safe_from_sockptr(&voice, sizeof(voice), optval,
922 					     optlen);
923 		if (err)
924 			break;
925 
926 		sco_pi(sk)->setting = voice.setting;
927 		hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src,
928 				     BDADDR_BREDR);
929 		if (!hdev) {
930 			err = -EBADFD;
931 			break;
932 		}
933 
934 		switch (sco_pi(sk)->setting & SCO_AIRMODE_MASK) {
935 		case SCO_AIRMODE_TRANSP:
936 			if (enhanced_sync_conn_capable(hdev))
937 				sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT;
938 			break;
939 		}
940 
941 		hci_dev_put(hdev);
942 		break;
943 
944 	case BT_PKT_STATUS:
945 		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
946 		if (err)
947 			break;
948 
949 		if (opt)
950 			set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
951 		else
952 			clear_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
953 		break;
954 
955 	case BT_CODEC:
956 		if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
957 		    sk->sk_state != BT_CONNECT2) {
958 			err = -EINVAL;
959 			break;
960 		}
961 
962 		hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src,
963 				     BDADDR_BREDR);
964 		if (!hdev) {
965 			err = -EBADFD;
966 			break;
967 		}
968 
969 		if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) {
970 			hci_dev_put(hdev);
971 			err = -EOPNOTSUPP;
972 			break;
973 		}
974 
975 		if (!hdev->get_data_path_id) {
976 			hci_dev_put(hdev);
977 			err = -EOPNOTSUPP;
978 			break;
979 		}
980 
981 		if (optlen < sizeof(struct bt_codecs) ||
982 		    optlen > sizeof(buffer)) {
983 			hci_dev_put(hdev);
984 			err = -EINVAL;
985 			break;
986 		}
987 
988 		err = copy_struct_from_sockptr(buffer, sizeof(buffer), optval,
989 					       optlen);
990 		if (err) {
991 			hci_dev_put(hdev);
992 			break;
993 		}
994 
995 		codecs = (void *)buffer;
996 
997 		if (codecs->num_codecs > 1) {
998 			hci_dev_put(hdev);
999 			err = -EINVAL;
1000 			break;
1001 		}
1002 
1003 		sco_pi(sk)->codec = codecs->codecs[0];
1004 		hci_dev_put(hdev);
1005 		break;
1006 
1007 	default:
1008 		err = -ENOPROTOOPT;
1009 		break;
1010 	}
1011 
1012 	release_sock(sk);
1013 	return err;
1014 }
1015 
sco_sock_getsockopt_old(struct socket * sock,int optname,char __user * optval,int __user * optlen)1016 static int sco_sock_getsockopt_old(struct socket *sock, int optname,
1017 				   char __user *optval, int __user *optlen)
1018 {
1019 	struct sock *sk = sock->sk;
1020 	struct sco_options opts;
1021 	struct sco_conninfo cinfo;
1022 	int err = 0;
1023 	size_t len;
1024 
1025 	BT_DBG("sk %p", sk);
1026 
1027 	if (get_user(len, optlen))
1028 		return -EFAULT;
1029 
1030 	lock_sock(sk);
1031 
1032 	switch (optname) {
1033 	case SCO_OPTIONS:
1034 		if (sk->sk_state != BT_CONNECTED &&
1035 		    !(sk->sk_state == BT_CONNECT2 &&
1036 		      test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
1037 			err = -ENOTCONN;
1038 			break;
1039 		}
1040 
1041 		opts.mtu = sco_pi(sk)->conn->mtu;
1042 
1043 		BT_DBG("mtu %u", opts.mtu);
1044 
1045 		len = min(len, sizeof(opts));
1046 		if (copy_to_user(optval, (char *)&opts, len))
1047 			err = -EFAULT;
1048 
1049 		break;
1050 
1051 	case SCO_CONNINFO:
1052 		if (sk->sk_state != BT_CONNECTED &&
1053 		    !(sk->sk_state == BT_CONNECT2 &&
1054 		      test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
1055 			err = -ENOTCONN;
1056 			break;
1057 		}
1058 
1059 		memset(&cinfo, 0, sizeof(cinfo));
1060 		cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
1061 		memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
1062 
1063 		len = min(len, sizeof(cinfo));
1064 		if (copy_to_user(optval, (char *)&cinfo, len))
1065 			err = -EFAULT;
1066 
1067 		break;
1068 
1069 	default:
1070 		err = -ENOPROTOOPT;
1071 		break;
1072 	}
1073 
1074 	release_sock(sk);
1075 	return err;
1076 }
1077 
sco_sock_getsockopt(struct socket * sock,int level,int optname,char __user * optval,int __user * optlen)1078 static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
1079 			       char __user *optval, int __user *optlen)
1080 {
1081 	struct sock *sk = sock->sk;
1082 	int len, err = 0;
1083 	struct bt_voice voice;
1084 	u32 phys;
1085 	int buf_len;
1086 	struct codec_list *c;
1087 	u8 num_codecs, i, __user *ptr;
1088 	struct hci_dev *hdev;
1089 	struct hci_codec_caps *caps;
1090 	struct bt_codec codec;
1091 
1092 	BT_DBG("sk %p", sk);
1093 
1094 	if (level == SOL_SCO)
1095 		return sco_sock_getsockopt_old(sock, optname, optval, optlen);
1096 
1097 	if (get_user(len, optlen))
1098 		return -EFAULT;
1099 
1100 	lock_sock(sk);
1101 
1102 	switch (optname) {
1103 
1104 	case BT_DEFER_SETUP:
1105 		if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1106 			err = -EINVAL;
1107 			break;
1108 		}
1109 
1110 		if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
1111 			     (u32 __user *)optval))
1112 			err = -EFAULT;
1113 
1114 		break;
1115 
1116 	case BT_VOICE:
1117 		voice.setting = sco_pi(sk)->setting;
1118 
1119 		len = min_t(unsigned int, len, sizeof(voice));
1120 		if (copy_to_user(optval, (char *)&voice, len))
1121 			err = -EFAULT;
1122 
1123 		break;
1124 
1125 	case BT_PHY:
1126 		if (sk->sk_state != BT_CONNECTED) {
1127 			err = -ENOTCONN;
1128 			break;
1129 		}
1130 
1131 		phys = hci_conn_get_phy(sco_pi(sk)->conn->hcon);
1132 
1133 		if (put_user(phys, (u32 __user *) optval))
1134 			err = -EFAULT;
1135 		break;
1136 
1137 	case BT_PKT_STATUS:
1138 		if (put_user(test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags),
1139 			     (int __user *)optval))
1140 			err = -EFAULT;
1141 		break;
1142 
1143 	case BT_SNDMTU:
1144 	case BT_RCVMTU:
1145 		if (sk->sk_state != BT_CONNECTED) {
1146 			err = -ENOTCONN;
1147 			break;
1148 		}
1149 
1150 		if (put_user(sco_pi(sk)->conn->mtu, (u32 __user *)optval))
1151 			err = -EFAULT;
1152 		break;
1153 
1154 	case BT_CODEC:
1155 		num_codecs = 0;
1156 		buf_len = 0;
1157 
1158 		hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
1159 		if (!hdev) {
1160 			err = -EBADFD;
1161 			break;
1162 		}
1163 
1164 		if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) {
1165 			hci_dev_put(hdev);
1166 			err = -EOPNOTSUPP;
1167 			break;
1168 		}
1169 
1170 		if (!hdev->get_data_path_id) {
1171 			hci_dev_put(hdev);
1172 			err = -EOPNOTSUPP;
1173 			break;
1174 		}
1175 
1176 		release_sock(sk);
1177 
1178 		/* find total buffer size required to copy codec + caps */
1179 		hci_dev_lock(hdev);
1180 		list_for_each_entry(c, &hdev->local_codecs, list) {
1181 			if (c->transport != HCI_TRANSPORT_SCO_ESCO)
1182 				continue;
1183 			num_codecs++;
1184 			for (i = 0, caps = c->caps; i < c->num_caps; i++) {
1185 				buf_len += 1 + caps->len;
1186 				caps = (void *)&caps->data[caps->len];
1187 			}
1188 			buf_len += sizeof(struct bt_codec);
1189 		}
1190 		hci_dev_unlock(hdev);
1191 
1192 		buf_len += sizeof(struct bt_codecs);
1193 		if (buf_len > len) {
1194 			hci_dev_put(hdev);
1195 			return -ENOBUFS;
1196 		}
1197 		ptr = optval;
1198 
1199 		if (put_user(num_codecs, ptr)) {
1200 			hci_dev_put(hdev);
1201 			return -EFAULT;
1202 		}
1203 		ptr += sizeof(num_codecs);
1204 
1205 		/* Iterate all the codecs supported over SCO and populate
1206 		 * codec data
1207 		 */
1208 		hci_dev_lock(hdev);
1209 		list_for_each_entry(c, &hdev->local_codecs, list) {
1210 			if (c->transport != HCI_TRANSPORT_SCO_ESCO)
1211 				continue;
1212 
1213 			codec.id = c->id;
1214 			codec.cid = c->cid;
1215 			codec.vid = c->vid;
1216 			err = hdev->get_data_path_id(hdev, &codec.data_path);
1217 			if (err < 0)
1218 				break;
1219 			codec.num_caps = c->num_caps;
1220 			if (copy_to_user(ptr, &codec, sizeof(codec))) {
1221 				err = -EFAULT;
1222 				break;
1223 			}
1224 			ptr += sizeof(codec);
1225 
1226 			/* find codec capabilities data length */
1227 			len = 0;
1228 			for (i = 0, caps = c->caps; i < c->num_caps; i++) {
1229 				len += 1 + caps->len;
1230 				caps = (void *)&caps->data[caps->len];
1231 			}
1232 
1233 			/* copy codec capabilities data */
1234 			if (len && copy_to_user(ptr, c->caps, len)) {
1235 				err = -EFAULT;
1236 				break;
1237 			}
1238 			ptr += len;
1239 		}
1240 
1241 		hci_dev_unlock(hdev);
1242 		hci_dev_put(hdev);
1243 
1244 		lock_sock(sk);
1245 
1246 		if (!err && put_user(buf_len, optlen))
1247 			err = -EFAULT;
1248 
1249 		break;
1250 
1251 	default:
1252 		err = -ENOPROTOOPT;
1253 		break;
1254 	}
1255 
1256 	release_sock(sk);
1257 	return err;
1258 }
1259 
sco_sock_shutdown(struct socket * sock,int how)1260 static int sco_sock_shutdown(struct socket *sock, int how)
1261 {
1262 	struct sock *sk = sock->sk;
1263 	int err = 0;
1264 
1265 	BT_DBG("sock %p, sk %p", sock, sk);
1266 
1267 	if (!sk)
1268 		return 0;
1269 
1270 	sock_hold(sk);
1271 	lock_sock(sk);
1272 
1273 	if (!sk->sk_shutdown) {
1274 		sk->sk_shutdown = SHUTDOWN_MASK;
1275 		sco_sock_clear_timer(sk);
1276 		__sco_sock_close(sk);
1277 
1278 		if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1279 		    !(current->flags & PF_EXITING))
1280 			err = bt_sock_wait_state(sk, BT_CLOSED,
1281 						 sk->sk_lingertime);
1282 	}
1283 
1284 	release_sock(sk);
1285 	sock_put(sk);
1286 
1287 	return err;
1288 }
1289 
sco_sock_release(struct socket * sock)1290 static int sco_sock_release(struct socket *sock)
1291 {
1292 	struct sock *sk = sock->sk;
1293 	int err = 0;
1294 
1295 	BT_DBG("sock %p, sk %p", sock, sk);
1296 
1297 	if (!sk)
1298 		return 0;
1299 
1300 	sco_sock_close(sk);
1301 
1302 	if (sock_flag(sk, SOCK_LINGER) && READ_ONCE(sk->sk_lingertime) &&
1303 	    !(current->flags & PF_EXITING)) {
1304 		lock_sock(sk);
1305 		err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
1306 		release_sock(sk);
1307 	}
1308 
1309 	sock_orphan(sk);
1310 	sco_sock_kill(sk);
1311 	return err;
1312 }
1313 
sco_conn_ready(struct sco_conn * conn)1314 static void sco_conn_ready(struct sco_conn *conn)
1315 {
1316 	struct sock *parent;
1317 	struct sock *sk = conn->sk;
1318 
1319 	BT_DBG("conn %p", conn);
1320 
1321 	if (sk) {
1322 		lock_sock(sk);
1323 		sco_sock_clear_timer(sk);
1324 		sk->sk_state = BT_CONNECTED;
1325 		sk->sk_state_change(sk);
1326 		release_sock(sk);
1327 	} else {
1328 		sco_conn_lock(conn);
1329 
1330 		if (!conn->hcon) {
1331 			sco_conn_unlock(conn);
1332 			return;
1333 		}
1334 
1335 		parent = sco_get_sock_listen(&conn->hcon->src);
1336 		if (!parent) {
1337 			sco_conn_unlock(conn);
1338 			return;
1339 		}
1340 
1341 		lock_sock(parent);
1342 
1343 		sk = sco_sock_alloc(sock_net(parent), NULL,
1344 				    BTPROTO_SCO, GFP_ATOMIC, 0);
1345 		if (!sk) {
1346 			release_sock(parent);
1347 			sco_conn_unlock(conn);
1348 			return;
1349 		}
1350 
1351 		sco_sock_init(sk, parent);
1352 
1353 		bacpy(&sco_pi(sk)->src, &conn->hcon->src);
1354 		bacpy(&sco_pi(sk)->dst, &conn->hcon->dst);
1355 
1356 		hci_conn_hold(conn->hcon);
1357 		__sco_chan_add(conn, sk, parent);
1358 
1359 		if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
1360 			sk->sk_state = BT_CONNECT2;
1361 		else
1362 			sk->sk_state = BT_CONNECTED;
1363 
1364 		/* Wake up parent */
1365 		parent->sk_data_ready(parent);
1366 
1367 		release_sock(parent);
1368 
1369 		sco_conn_unlock(conn);
1370 	}
1371 }
1372 
1373 /* ----- SCO interface with lower layer (HCI) ----- */
sco_connect_ind(struct hci_dev * hdev,bdaddr_t * bdaddr,__u8 * flags)1374 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
1375 {
1376 	struct sock *sk;
1377 	int lm = 0;
1378 
1379 	BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1380 
1381 	/* Find listening sockets */
1382 	read_lock(&sco_sk_list.lock);
1383 	sk_for_each(sk, &sco_sk_list.head) {
1384 		if (sk->sk_state != BT_LISTEN)
1385 			continue;
1386 
1387 		if (!bacmp(&sco_pi(sk)->src, &hdev->bdaddr) ||
1388 		    !bacmp(&sco_pi(sk)->src, BDADDR_ANY)) {
1389 			lm |= HCI_LM_ACCEPT;
1390 
1391 			if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
1392 				*flags |= HCI_PROTO_DEFER;
1393 			break;
1394 		}
1395 	}
1396 	read_unlock(&sco_sk_list.lock);
1397 
1398 	return lm;
1399 }
1400 
sco_match(struct hci_conn * hcon)1401 static bool sco_match(struct hci_conn *hcon)
1402 {
1403 	return hcon->type == SCO_LINK || hcon->type == ESCO_LINK;
1404 }
1405 
sco_connect_cfm(struct hci_conn * hcon,__u8 status)1406 static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
1407 {
1408 	BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status);
1409 
1410 	if (!status) {
1411 		struct sco_conn *conn;
1412 
1413 		conn = sco_conn_add(hcon);
1414 		if (conn)
1415 			sco_conn_ready(conn);
1416 	} else
1417 		sco_conn_del(hcon, bt_to_errno(status));
1418 }
1419 
sco_disconn_cfm(struct hci_conn * hcon,__u8 reason)1420 static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
1421 {
1422 	BT_DBG("hcon %p reason %d", hcon, reason);
1423 
1424 	sco_conn_del(hcon, bt_to_errno(reason));
1425 }
1426 
sco_recv_scodata(struct hci_conn * hcon,struct sk_buff * skb)1427 void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
1428 {
1429 	struct sco_conn *conn = hcon->sco_data;
1430 
1431 	if (!conn)
1432 		goto drop;
1433 
1434 	BT_DBG("conn %p len %u", conn, skb->len);
1435 
1436 	if (skb->len) {
1437 		sco_recv_frame(conn, skb);
1438 		return;
1439 	}
1440 
1441 drop:
1442 	kfree_skb(skb);
1443 }
1444 
1445 static struct hci_cb sco_cb = {
1446 	.name		= "SCO",
1447 	.match		= sco_match,
1448 	.connect_cfm	= sco_connect_cfm,
1449 	.disconn_cfm	= sco_disconn_cfm,
1450 };
1451 
sco_debugfs_show(struct seq_file * f,void * p)1452 static int sco_debugfs_show(struct seq_file *f, void *p)
1453 {
1454 	struct sock *sk;
1455 
1456 	read_lock(&sco_sk_list.lock);
1457 
1458 	sk_for_each(sk, &sco_sk_list.head) {
1459 		seq_printf(f, "%pMR %pMR %d\n", &sco_pi(sk)->src,
1460 			   &sco_pi(sk)->dst, sk->sk_state);
1461 	}
1462 
1463 	read_unlock(&sco_sk_list.lock);
1464 
1465 	return 0;
1466 }
1467 
1468 DEFINE_SHOW_ATTRIBUTE(sco_debugfs);
1469 
1470 static struct dentry *sco_debugfs;
1471 
1472 static const struct proto_ops sco_sock_ops = {
1473 	.family		= PF_BLUETOOTH,
1474 	.owner		= THIS_MODULE,
1475 	.release	= sco_sock_release,
1476 	.bind		= sco_sock_bind,
1477 	.connect	= sco_sock_connect,
1478 	.listen		= sco_sock_listen,
1479 	.accept		= sco_sock_accept,
1480 	.getname	= sco_sock_getname,
1481 	.sendmsg	= sco_sock_sendmsg,
1482 	.recvmsg	= sco_sock_recvmsg,
1483 	.poll		= bt_sock_poll,
1484 	.ioctl		= bt_sock_ioctl,
1485 	.gettstamp	= sock_gettstamp,
1486 	.mmap		= sock_no_mmap,
1487 	.socketpair	= sock_no_socketpair,
1488 	.shutdown	= sco_sock_shutdown,
1489 	.setsockopt	= sco_sock_setsockopt,
1490 	.getsockopt	= sco_sock_getsockopt
1491 };
1492 
1493 static const struct net_proto_family sco_sock_family_ops = {
1494 	.family	= PF_BLUETOOTH,
1495 	.owner	= THIS_MODULE,
1496 	.create	= sco_sock_create,
1497 };
1498 
sco_init(void)1499 int __init sco_init(void)
1500 {
1501 	int err;
1502 
1503 	BUILD_BUG_ON(sizeof(struct sockaddr_sco) > sizeof(struct sockaddr));
1504 
1505 	err = proto_register(&sco_proto, 0);
1506 	if (err < 0)
1507 		return err;
1508 
1509 	err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
1510 	if (err < 0) {
1511 		BT_ERR("SCO socket registration failed");
1512 		goto error;
1513 	}
1514 
1515 	err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL);
1516 	if (err < 0) {
1517 		BT_ERR("Failed to create SCO proc file");
1518 		bt_sock_unregister(BTPROTO_SCO);
1519 		goto error;
1520 	}
1521 
1522 	BT_INFO("SCO socket layer initialized");
1523 
1524 	hci_register_cb(&sco_cb);
1525 
1526 	if (IS_ERR_OR_NULL(bt_debugfs))
1527 		return 0;
1528 
1529 	sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs,
1530 					  NULL, &sco_debugfs_fops);
1531 
1532 	return 0;
1533 
1534 error:
1535 	proto_unregister(&sco_proto);
1536 	return err;
1537 }
1538 
sco_exit(void)1539 void sco_exit(void)
1540 {
1541 	bt_procfs_cleanup(&init_net, "sco");
1542 
1543 	debugfs_remove(sco_debugfs);
1544 
1545 	hci_unregister_cb(&sco_cb);
1546 
1547 	bt_sock_unregister(BTPROTO_SCO);
1548 
1549 	proto_unregister(&sco_proto);
1550 }
1551 
1552 module_param(disable_esco, bool, 0644);
1553 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");
1554