1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 Copyright (C) 2000-2001 Qualcomm Incorporated 5 6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 7 8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 19 SOFTWARE IS DISCLAIMED. 20 */ 21 22 /* Bluetooth SCO sockets. */ 23 24 #include <linux/module.h> 25 #include <linux/debugfs.h> 26 #include <linux/seq_file.h> 27 #include <linux/sched/signal.h> 28 #include <linux/uio.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/sco.h> 33 34 static bool disable_esco; 35 36 static const struct proto_ops sco_sock_ops; 37 38 static struct bt_sock_list sco_sk_list = { 39 .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock) 40 }; 41 42 /* ---- SCO connections ---- */ 43 struct sco_conn { 44 struct hci_conn *hcon; 45 46 spinlock_t lock; 47 struct sock *sk; 48 49 struct delayed_work timeout_work; 50 51 unsigned int mtu; 52 struct kref ref; 53 }; 54 55 #define sco_conn_lock(c) spin_lock(&c->lock) 56 #define sco_conn_unlock(c) spin_unlock(&c->lock) 57 58 static void sco_sock_close(struct sock *sk); 59 static void sco_sock_kill(struct sock *sk); 60 61 /* ----- SCO socket info ----- */ 62 #define sco_pi(sk) ((struct sco_pinfo *) sk) 63 64 struct sco_pinfo { 65 struct bt_sock bt; 66 bdaddr_t src; 67 bdaddr_t dst; 68 __u32 flags; 69 __u16 setting; 70 struct bt_codec codec; 71 struct sco_conn *conn; 72 }; 73 74 /* ---- SCO timers ---- */ 75 #define SCO_CONN_TIMEOUT (HZ * 40) 76 #define SCO_DISCONN_TIMEOUT (HZ * 2) 77 78 static void sco_conn_free(struct kref *ref) 79 { 80 struct sco_conn *conn = container_of(ref, struct sco_conn, ref); 81 82 BT_DBG("conn %p", conn); 83 84 if (conn->sk) 85 sco_pi(conn->sk)->conn = NULL; 86 87 /* hcon->sco_data is cleared and the association's reference on the 88 * sco_conn is dropped in sco_conn_del() under hdev->lock, and the 89 * hci_conn is now owned by the socket (held in __sco_chan_add() and 90 * dropped in sco_chan_del()/sco_sock_destruct()), so there is nothing 91 * left to release towards hcon here. 92 */ 93 94 /* Ensure no more work items will run before the connection is freed */ 95 disable_delayed_work_sync(&conn->timeout_work); 96 97 kfree(conn); 98 } 99 100 static void sco_conn_put(struct sco_conn *conn) 101 { 102 if (!conn) 103 return; 104 105 BT_DBG("conn %p refcnt %d", conn, kref_read(&conn->ref)); 106 107 kref_put(&conn->ref, sco_conn_free); 108 } 109 110 static struct sco_conn *sco_conn_hold(struct sco_conn *conn) 111 { 112 BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref)); 113 114 kref_get(&conn->ref); 115 return conn; 116 } 117 118 static struct sco_conn *sco_conn_hold_unless_zero(struct sco_conn *conn) 119 { 120 if (!conn) 121 return NULL; 122 123 BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref)); 124 125 if (!kref_get_unless_zero(&conn->ref)) 126 return NULL; 127 128 return conn; 129 } 130 131 static struct sock *sco_sock_hold(struct sco_conn *conn) 132 { 133 if (!conn || !bt_sock_linked(&sco_sk_list, conn->sk)) 134 return NULL; 135 136 sock_hold(conn->sk); 137 138 return conn->sk; 139 } 140 141 static void sco_sock_timeout(struct work_struct *work) 142 { 143 struct sco_conn *conn = container_of(work, struct sco_conn, 144 timeout_work.work); 145 struct sock *sk; 146 147 conn = sco_conn_hold_unless_zero(conn); 148 if (!conn) 149 return; 150 151 sco_conn_lock(conn); 152 if (!conn->hcon) { 153 sco_conn_unlock(conn); 154 sco_conn_put(conn); 155 return; 156 } 157 sk = sco_sock_hold(conn); 158 sco_conn_unlock(conn); 159 sco_conn_put(conn); 160 161 if (!sk) 162 return; 163 164 BT_DBG("sock %p state %d", sk, sk->sk_state); 165 166 lock_sock(sk); 167 sk->sk_err = ETIMEDOUT; 168 sk->sk_state_change(sk); 169 release_sock(sk); 170 sock_put(sk); 171 } 172 173 static void sco_sock_set_timer(struct sock *sk, long timeout) 174 { 175 if (!sco_pi(sk)->conn) 176 return; 177 178 BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout); 179 cancel_delayed_work(&sco_pi(sk)->conn->timeout_work); 180 schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout); 181 } 182 183 static void sco_sock_clear_timer(struct sock *sk) 184 { 185 if (!sco_pi(sk)->conn) 186 return; 187 188 BT_DBG("sock %p state %d", sk, sk->sk_state); 189 cancel_delayed_work(&sco_pi(sk)->conn->timeout_work); 190 } 191 192 /* ---- SCO connections ---- */ 193 /* Returns a new reference the caller must drop with sco_conn_put(). The 194 * hcon->sco_data association holds its own reference on the sco_conn for the 195 * connection's lifetime; it is dropped in sco_conn_del() under hdev->lock. 196 * @hcon is not consumed: the hci_conn reference is taken and owned by the 197 * socket in __sco_chan_add(). 198 */ 199 static struct sco_conn *sco_conn_add(struct hci_conn *hcon) 200 { 201 struct sco_conn *conn = hcon->sco_data; 202 203 conn = sco_conn_hold_unless_zero(conn); 204 if (conn) 205 return conn; 206 207 conn = kzalloc_obj(struct sco_conn); 208 if (!conn) 209 return NULL; 210 211 kref_init(&conn->ref); 212 spin_lock_init(&conn->lock); 213 INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout); 214 215 hcon->sco_data = conn; 216 conn->hcon = hcon; 217 conn->mtu = hcon->mtu; 218 219 if (hcon->mtu > 0) 220 conn->mtu = hcon->mtu; 221 else 222 conn->mtu = 60; 223 224 BT_DBG("hcon %p conn %p", hcon, conn); 225 226 /* kref_init() above set the association reference owned by 227 * hcon->sco_data; hand the caller its own reference. 228 */ 229 return sco_conn_hold(conn); 230 } 231 232 /* Delete channel. 233 * Must be called on the locked socket. */ 234 static void sco_chan_del(struct sock *sk, int err) 235 { 236 struct sco_conn *conn; 237 238 conn = sco_pi(sk)->conn; 239 sco_pi(sk)->conn = NULL; 240 241 BT_DBG("sk %p, conn %p, err %d", sk, conn, err); 242 243 if (conn) { 244 struct hci_conn *hcon; 245 246 sco_conn_lock(conn); 247 hcon = conn->hcon; 248 sco_conn_unlock(conn); 249 250 /* Drop the socket's hci_conn reference BEFORE clearing 251 * conn->sk, so sco_conn_del() on another CPU cannot free 252 * the hci_conn while we still hold a pointer to it. 253 */ 254 if (hcon) 255 hci_conn_drop(hcon); 256 257 sco_conn_lock(conn); 258 conn->sk = NULL; 259 sco_conn_unlock(conn); 260 sco_conn_put(conn); 261 } 262 263 sk->sk_state = BT_CLOSED; 264 sk->sk_err = err; 265 sk->sk_state_change(sk); 266 267 sock_set_flag(sk, SOCK_ZAPPED); 268 } 269 270 static void sco_conn_del(struct hci_conn *hcon, int err) 271 { 272 struct sco_conn *conn = hcon->sco_data; 273 struct sock *sk; 274 275 conn = sco_conn_hold_unless_zero(conn); 276 if (!conn) 277 return; 278 279 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); 280 281 /* Detach from the hci_conn and drop the association's reference. 282 * The caller holds hdev->lock, which serialises this against the 283 * read of hcon->sco_data in sco_recv_scodata(). 284 */ 285 hcon->sco_data = NULL; 286 sco_conn_put(conn); 287 288 sco_conn_lock(conn); 289 sk = sco_sock_hold(conn); 290 sco_conn_unlock(conn); 291 sco_conn_put(conn); 292 293 if (!sk) 294 return; 295 296 /* Kill socket */ 297 lock_sock(sk); 298 sco_sock_clear_timer(sk); 299 sco_chan_del(sk, err); 300 release_sock(sk); 301 sock_put(sk); 302 } 303 304 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, 305 struct sock *parent) 306 { 307 BT_DBG("conn %p", conn); 308 309 sco_pi(sk)->conn = sco_conn_hold(conn); 310 conn->sk = sk; 311 312 /* The socket owns an hci_conn reference for as long as it stays 313 * attached; it is dropped in sco_chan_del()/sco_sock_destruct(). 314 */ 315 hci_conn_hold(conn->hcon); 316 317 if (parent) 318 bt_accept_enqueue(parent, sk, true); 319 } 320 321 static int sco_chan_add(struct sco_conn *conn, struct sock *sk, 322 struct sock *parent) 323 { 324 int err = 0; 325 326 sco_conn_lock(conn); 327 if (conn->sk || sco_pi(sk)->conn) 328 err = -EBUSY; 329 else 330 __sco_chan_add(conn, sk, parent); 331 332 sco_conn_unlock(conn); 333 return err; 334 } 335 336 static int sco_connect(struct sock *sk) 337 { 338 struct sco_conn *conn; 339 struct hci_conn *hcon; 340 struct hci_dev *hdev; 341 bdaddr_t src, dst; 342 struct bt_codec codec; 343 __u16 setting; 344 int err, type; 345 346 lock_sock(sk); 347 bacpy(&src, &sco_pi(sk)->src); 348 bacpy(&dst, &sco_pi(sk)->dst); 349 setting = sco_pi(sk)->setting; 350 codec = sco_pi(sk)->codec; 351 release_sock(sk); 352 353 BT_DBG("%pMR -> %pMR", &src, &dst); 354 355 hdev = hci_get_route(&dst, &src, BDADDR_BREDR); 356 if (!hdev) 357 return -EHOSTUNREACH; 358 359 hci_dev_lock(hdev); 360 361 if (lmp_esco_capable(hdev) && !disable_esco) 362 type = ESCO_LINK; 363 else 364 type = SCO_LINK; 365 366 switch (setting & SCO_AIRMODE_MASK) { 367 case SCO_AIRMODE_TRANSP: 368 if (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev)) { 369 err = -EOPNOTSUPP; 370 goto unlock; 371 } 372 break; 373 } 374 375 hcon = hci_connect_sco(hdev, type, &dst, 376 setting, &codec, 377 READ_ONCE(sk->sk_sndtimeo)); 378 if (IS_ERR(hcon)) { 379 err = PTR_ERR(hcon); 380 goto unlock; 381 } 382 383 conn = sco_conn_add(hcon); 384 if (!conn) { 385 hci_conn_drop(hcon); 386 err = -ENOMEM; 387 goto unlock; 388 } 389 390 lock_sock(sk); 391 392 /* Recheck state after reacquiring the socket lock, as another 393 * thread may have changed it (e.g., closed the socket). 394 */ 395 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 396 release_sock(sk); 397 sco_conn_put(conn); 398 hci_conn_drop(hcon); 399 err = -EBADFD; 400 goto unlock; 401 } 402 403 err = sco_chan_add(conn, sk, NULL); 404 sco_conn_put(conn); 405 if (err) { 406 release_sock(sk); 407 hci_conn_drop(hcon); 408 goto unlock; 409 } 410 411 /* __sco_chan_add() took its own hci_conn reference; drop ours. */ 412 hci_conn_drop(hcon); 413 414 /* Update source addr of the socket */ 415 bacpy(&sco_pi(sk)->src, &hcon->src); 416 417 if (hcon->state == BT_CONNECTED) { 418 sco_sock_clear_timer(sk); 419 sk->sk_state = BT_CONNECTED; 420 } else { 421 sk->sk_state = BT_CONNECT; 422 sco_sock_set_timer(sk, READ_ONCE(sk->sk_sndtimeo)); 423 } 424 425 release_sock(sk); 426 427 unlock: 428 hci_dev_unlock(hdev); 429 hci_dev_put(hdev); 430 return err; 431 } 432 433 static int sco_send_frame(struct sock *sk, struct sk_buff *skb, 434 const struct sockcm_cookie *sockc) 435 { 436 struct sco_conn *conn = sco_pi(sk)->conn; 437 int len = skb->len; 438 439 /* Check outgoing MTU */ 440 if (len > conn->mtu) 441 return -EINVAL; 442 443 BT_DBG("sk %p len %d", sk, len); 444 445 hci_setup_tx_timestamp(skb, 1, sockc); 446 hci_send_sco(conn->hcon, skb); 447 448 return len; 449 } 450 451 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb) 452 { 453 struct sock *sk; 454 455 sco_conn_lock(conn); 456 sk = sco_sock_hold(conn); 457 sco_conn_unlock(conn); 458 459 if (!sk) 460 goto drop; 461 462 BT_DBG("sk %p len %u", sk, skb->len); 463 464 if (sk->sk_state != BT_CONNECTED) 465 goto drop_put; 466 467 if (!sock_queue_rcv_skb(sk, skb)) { 468 sock_put(sk); 469 return; 470 } 471 472 drop_put: 473 sock_put(sk); 474 drop: 475 kfree_skb(skb); 476 } 477 478 /* -------- Socket interface ---------- */ 479 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba) 480 { 481 struct sock *sk; 482 483 sk_for_each(sk, &sco_sk_list.head) { 484 if (sk->sk_state != BT_LISTEN) 485 continue; 486 487 if (!bacmp(&sco_pi(sk)->src, ba)) 488 return sk; 489 } 490 491 return NULL; 492 } 493 494 /* Find socket listening on source bdaddr. 495 * Returns closest match. 496 */ 497 static struct sock *sco_get_sock_listen(bdaddr_t *src) 498 { 499 struct sock *sk = NULL, *sk1 = NULL; 500 501 read_lock(&sco_sk_list.lock); 502 503 sk_for_each(sk, &sco_sk_list.head) { 504 if (sk->sk_state != BT_LISTEN) 505 continue; 506 507 /* Exact match. */ 508 if (!bacmp(&sco_pi(sk)->src, src)) 509 break; 510 511 /* Closest match */ 512 if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY)) 513 sk1 = sk; 514 } 515 516 sk = sk ? sk : sk1; 517 if (sk) 518 sock_hold(sk); 519 520 read_unlock(&sco_sk_list.lock); 521 522 return sk; 523 } 524 525 static void sco_sock_destruct(struct sock *sk) 526 { 527 struct sco_conn *conn = sco_pi(sk)->conn; 528 529 BT_DBG("sk %p", sk); 530 531 /* If the channel was not already torn down via sco_chan_del(), drop 532 * the socket's own references here. 533 */ 534 if (conn) { 535 struct hci_conn *hcon; 536 537 sco_conn_lock(conn); 538 hcon = conn->hcon; 539 sco_conn_unlock(conn); 540 541 if (hcon) 542 hci_conn_drop(hcon); 543 sco_pi(sk)->conn = NULL; 544 sco_conn_put(conn); 545 } 546 547 skb_queue_purge(&sk->sk_receive_queue); 548 skb_queue_purge(&sk->sk_write_queue); 549 skb_queue_purge(&sk->sk_error_queue); 550 } 551 552 static void sco_sock_cleanup_listen(struct sock *parent) 553 { 554 struct sock *sk; 555 556 BT_DBG("parent %p", parent); 557 558 /* Close not yet accepted channels */ 559 while ((sk = bt_accept_dequeue(parent, NULL))) { 560 sco_sock_close(sk); 561 sco_sock_kill(sk); 562 /* Drop the reference handed back by bt_accept_dequeue(). */ 563 sock_put(sk); 564 } 565 566 parent->sk_state = BT_CLOSED; 567 sock_set_flag(parent, SOCK_ZAPPED); 568 } 569 570 /* Kill socket (only if zapped and orphan) 571 * Must be called on unlocked socket. 572 */ 573 static void sco_sock_kill(struct sock *sk) 574 { 575 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 576 return; 577 578 BT_DBG("sk %p state %d", sk, sk->sk_state); 579 580 /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ 581 lock_sock(sk); 582 if (sco_pi(sk)->conn) { 583 sco_conn_lock(sco_pi(sk)->conn); 584 sco_pi(sk)->conn->sk = NULL; 585 sco_conn_unlock(sco_pi(sk)->conn); 586 } 587 release_sock(sk); 588 589 /* Kill poor orphan */ 590 bt_sock_unlink(&sco_sk_list, sk); 591 sock_set_flag(sk, SOCK_DEAD); 592 sock_put(sk); 593 } 594 595 static void __sco_sock_close(struct sock *sk) 596 { 597 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket); 598 599 switch (sk->sk_state) { 600 case BT_LISTEN: 601 sco_sock_cleanup_listen(sk); 602 break; 603 604 case BT_CONNECTED: 605 case BT_CONFIG: 606 case BT_CONNECT2: 607 case BT_CONNECT: 608 case BT_DISCONN: 609 sco_chan_del(sk, ECONNRESET); 610 break; 611 612 default: 613 sock_set_flag(sk, SOCK_ZAPPED); 614 break; 615 } 616 617 } 618 619 /* Must be called on unlocked socket. */ 620 static void sco_sock_close(struct sock *sk) 621 { 622 struct sco_conn *conn; 623 624 lock_sock(sk); 625 conn = sco_pi(sk)->conn; 626 if (conn) 627 sco_conn_hold(conn); 628 release_sock(sk); 629 630 if (conn) 631 disable_delayed_work_sync(&conn->timeout_work); 632 633 lock_sock(sk); 634 __sco_sock_close(sk); 635 release_sock(sk); 636 637 if (conn) 638 sco_conn_put(conn); 639 } 640 641 static void sco_sock_init(struct sock *sk, struct sock *parent) 642 { 643 BT_DBG("sk %p", sk); 644 645 if (parent) { 646 sk->sk_type = parent->sk_type; 647 bt_sk(sk)->flags = bt_sk(parent)->flags; 648 security_sk_clone(parent, sk); 649 } 650 } 651 652 static struct proto sco_proto = { 653 .name = "SCO", 654 .owner = THIS_MODULE, 655 .obj_size = sizeof(struct sco_pinfo) 656 }; 657 658 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, 659 int proto, gfp_t prio, int kern) 660 { 661 struct sock *sk; 662 663 sk = bt_sock_alloc(net, sock, &sco_proto, proto, prio, kern); 664 if (!sk) 665 return NULL; 666 667 sk->sk_destruct = sco_sock_destruct; 668 sk->sk_sndtimeo = SCO_CONN_TIMEOUT; 669 670 sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT; 671 sco_pi(sk)->codec.id = BT_CODEC_CVSD; 672 sco_pi(sk)->codec.cid = 0xffff; 673 sco_pi(sk)->codec.vid = 0xffff; 674 sco_pi(sk)->codec.data_path = 0x00; 675 676 bt_sock_link(&sco_sk_list, sk); 677 return sk; 678 } 679 680 static int sco_sock_create(struct net *net, struct socket *sock, int protocol, 681 int kern) 682 { 683 struct sock *sk; 684 685 BT_DBG("sock %p", sock); 686 687 sock->state = SS_UNCONNECTED; 688 689 if (sock->type != SOCK_SEQPACKET) 690 return -ESOCKTNOSUPPORT; 691 692 sock->ops = &sco_sock_ops; 693 694 sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern); 695 if (!sk) 696 return -ENOMEM; 697 698 sco_sock_init(sk, NULL); 699 return 0; 700 } 701 702 static int sco_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, 703 int addr_len) 704 { 705 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 706 struct sock *sk = sock->sk; 707 int err = 0; 708 709 if (!addr || addr_len < sizeof(struct sockaddr_sco) || 710 addr->sa_family != AF_BLUETOOTH) 711 return -EINVAL; 712 713 BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr); 714 715 lock_sock(sk); 716 717 if (sk->sk_state != BT_OPEN) { 718 err = -EBADFD; 719 goto done; 720 } 721 722 if (sk->sk_type != SOCK_SEQPACKET) { 723 err = -EINVAL; 724 goto done; 725 } 726 727 bacpy(&sco_pi(sk)->src, &sa->sco_bdaddr); 728 729 sk->sk_state = BT_BOUND; 730 731 done: 732 release_sock(sk); 733 return err; 734 } 735 736 static int sco_sock_connect(struct socket *sock, struct sockaddr_unsized *addr, int alen, int flags) 737 { 738 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 739 struct sock *sk = sock->sk; 740 int err; 741 742 BT_DBG("sk %p", sk); 743 744 if (alen < sizeof(struct sockaddr_sco) || 745 addr->sa_family != AF_BLUETOOTH) 746 return -EINVAL; 747 748 lock_sock(sk); 749 750 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 751 release_sock(sk); 752 return -EBADFD; 753 } 754 755 if (sk->sk_type != SOCK_SEQPACKET) { 756 release_sock(sk); 757 return -EINVAL; 758 } 759 760 /* Set destination address and psm */ 761 bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr); 762 release_sock(sk); 763 764 err = sco_connect(sk); 765 if (err) 766 return err; 767 768 lock_sock(sk); 769 770 err = bt_sock_wait_state(sk, BT_CONNECTED, 771 sock_sndtimeo(sk, flags & O_NONBLOCK)); 772 773 release_sock(sk); 774 return err; 775 } 776 777 static int sco_sock_listen(struct socket *sock, int backlog) 778 { 779 struct sock *sk = sock->sk; 780 bdaddr_t *src = &sco_pi(sk)->src; 781 int err = 0; 782 783 BT_DBG("sk %p backlog %d", sk, backlog); 784 785 lock_sock(sk); 786 787 if (sk->sk_state != BT_BOUND) { 788 err = -EBADFD; 789 goto done; 790 } 791 792 if (sk->sk_type != SOCK_SEQPACKET) { 793 err = -EINVAL; 794 goto done; 795 } 796 797 write_lock(&sco_sk_list.lock); 798 799 if (__sco_get_sock_listen_by_addr(src)) { 800 err = -EADDRINUSE; 801 goto unlock; 802 } 803 804 sk->sk_max_ack_backlog = backlog; 805 sk->sk_ack_backlog = 0; 806 807 sk->sk_state = BT_LISTEN; 808 809 unlock: 810 write_unlock(&sco_sk_list.lock); 811 812 done: 813 release_sock(sk); 814 return err; 815 } 816 817 static int sco_sock_accept(struct socket *sock, struct socket *newsock, 818 struct proto_accept_arg *arg) 819 { 820 DEFINE_WAIT_FUNC(wait, woken_wake_function); 821 struct sock *sk = sock->sk, *ch; 822 long timeo; 823 int err = 0; 824 825 lock_sock(sk); 826 827 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK); 828 829 BT_DBG("sk %p timeo %ld", sk, timeo); 830 831 /* Wait for an incoming connection. (wake-one). */ 832 add_wait_queue_exclusive(sk_sleep(sk), &wait); 833 while (1) { 834 if (sk->sk_state != BT_LISTEN) { 835 err = -EBADFD; 836 break; 837 } 838 839 ch = bt_accept_dequeue(sk, newsock); 840 if (ch) { 841 /* Drop the bridging ref from bt_accept_dequeue(); 842 * the grafted socket keeps ch alive from here. 843 */ 844 sock_put(ch); 845 break; 846 } 847 848 if (!timeo) { 849 err = -EAGAIN; 850 break; 851 } 852 853 if (signal_pending(current)) { 854 err = sock_intr_errno(timeo); 855 break; 856 } 857 858 release_sock(sk); 859 860 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 861 lock_sock(sk); 862 } 863 remove_wait_queue(sk_sleep(sk), &wait); 864 865 if (err) 866 goto done; 867 868 newsock->state = SS_CONNECTED; 869 870 BT_DBG("new socket %p", ch); 871 872 done: 873 release_sock(sk); 874 return err; 875 } 876 877 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, 878 int peer) 879 { 880 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 881 struct sock *sk = sock->sk; 882 883 BT_DBG("sock %p, sk %p", sock, sk); 884 885 addr->sa_family = AF_BLUETOOTH; 886 887 if (peer) 888 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->dst); 889 else 890 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->src); 891 892 return sizeof(struct sockaddr_sco); 893 } 894 895 static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg, 896 size_t len) 897 { 898 struct sock *sk = sock->sk; 899 struct sk_buff *skb; 900 struct sockcm_cookie sockc; 901 int err; 902 903 BT_DBG("sock %p, sk %p", sock, sk); 904 905 err = sock_error(sk); 906 if (err) 907 return err; 908 909 if (msg->msg_flags & MSG_OOB) 910 return -EOPNOTSUPP; 911 912 hci_sockcm_init(&sockc, sk); 913 914 if (msg->msg_controllen) { 915 err = sock_cmsg_send(sk, msg, &sockc); 916 if (err) 917 return err; 918 } 919 920 skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0); 921 if (IS_ERR(skb)) 922 return PTR_ERR(skb); 923 924 lock_sock(sk); 925 926 if (sk->sk_state == BT_CONNECTED) 927 err = sco_send_frame(sk, skb, &sockc); 928 else 929 err = -ENOTCONN; 930 931 release_sock(sk); 932 933 if (err < 0) 934 kfree_skb(skb); 935 return err; 936 } 937 938 static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting) 939 { 940 struct hci_dev *hdev = conn->hdev; 941 942 BT_DBG("conn %p", conn); 943 944 conn->state = BT_CONFIG; 945 946 if (!lmp_esco_capable(hdev)) { 947 struct hci_cp_accept_conn_req cp; 948 949 bacpy(&cp.bdaddr, &conn->dst); 950 cp.role = 0x00; /* Ignored */ 951 952 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp); 953 } else { 954 struct hci_cp_accept_sync_conn_req cp; 955 956 bacpy(&cp.bdaddr, &conn->dst); 957 cp.pkt_type = cpu_to_le16(conn->pkt_type); 958 959 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 960 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 961 cp.content_format = cpu_to_le16(setting); 962 963 switch (setting & SCO_AIRMODE_MASK) { 964 case SCO_AIRMODE_TRANSP: 965 if (conn->pkt_type & ESCO_2EV3) 966 cp.max_latency = cpu_to_le16(0x0008); 967 else 968 cp.max_latency = cpu_to_le16(0x000D); 969 cp.retrans_effort = 0x02; 970 break; 971 case SCO_AIRMODE_CVSD: 972 cp.max_latency = cpu_to_le16(0xffff); 973 cp.retrans_effort = 0xff; 974 break; 975 default: 976 /* use CVSD settings as fallback */ 977 cp.max_latency = cpu_to_le16(0xffff); 978 cp.retrans_effort = 0xff; 979 break; 980 } 981 982 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, 983 sizeof(cp), &cp); 984 } 985 } 986 987 static int sco_sock_recvmsg(struct socket *sock, struct msghdr *msg, 988 size_t len, int flags) 989 { 990 struct sock *sk = sock->sk; 991 struct sco_pinfo *pi = sco_pi(sk); 992 993 if (unlikely(flags & MSG_ERRQUEUE)) 994 return sock_recv_errqueue(sk, msg, len, SOL_BLUETOOTH, 995 BT_SCM_ERROR); 996 997 lock_sock(sk); 998 999 if (sk->sk_state == BT_CONNECT2 && 1000 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) { 1001 sco_conn_defer_accept(pi->conn->hcon, pi->setting); 1002 sk->sk_state = BT_CONFIG; 1003 1004 release_sock(sk); 1005 return 0; 1006 } 1007 1008 release_sock(sk); 1009 1010 return bt_sock_recvmsg(sock, msg, len, flags); 1011 } 1012 1013 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, 1014 sockptr_t optval, unsigned int optlen) 1015 { 1016 struct sock *sk = sock->sk; 1017 int err = 0; 1018 struct bt_voice voice; 1019 u32 opt; 1020 struct bt_codecs *codecs; 1021 struct hci_dev *hdev; 1022 __u8 buffer[255]; 1023 1024 BT_DBG("sk %p", sk); 1025 1026 lock_sock(sk); 1027 1028 switch (optname) { 1029 1030 case BT_DEFER_SETUP: 1031 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 1032 err = -EINVAL; 1033 break; 1034 } 1035 1036 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1037 if (err) 1038 break; 1039 1040 assign_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags, opt); 1041 break; 1042 1043 case BT_VOICE: 1044 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND && 1045 sk->sk_state != BT_CONNECT2) { 1046 err = -EINVAL; 1047 break; 1048 } 1049 1050 voice.setting = sco_pi(sk)->setting; 1051 1052 err = copy_safe_from_sockptr(&voice, sizeof(voice), optval, 1053 optlen); 1054 if (err) 1055 break; 1056 1057 sco_pi(sk)->setting = voice.setting; 1058 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, 1059 BDADDR_BREDR); 1060 if (!hdev) { 1061 err = -EBADFD; 1062 break; 1063 } 1064 1065 switch (sco_pi(sk)->setting & SCO_AIRMODE_MASK) { 1066 case SCO_AIRMODE_TRANSP: 1067 if (enhanced_sync_conn_capable(hdev)) 1068 sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT; 1069 break; 1070 } 1071 1072 hci_dev_put(hdev); 1073 break; 1074 1075 case BT_PKT_STATUS: 1076 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1077 if (err) 1078 break; 1079 1080 assign_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags, opt); 1081 break; 1082 1083 case BT_CODEC: 1084 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND && 1085 sk->sk_state != BT_CONNECT2) { 1086 err = -EINVAL; 1087 break; 1088 } 1089 1090 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, 1091 BDADDR_BREDR); 1092 if (!hdev) { 1093 err = -EBADFD; 1094 break; 1095 } 1096 1097 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) { 1098 hci_dev_put(hdev); 1099 err = -EOPNOTSUPP; 1100 break; 1101 } 1102 1103 if (!hdev->get_data_path_id) { 1104 hci_dev_put(hdev); 1105 err = -EOPNOTSUPP; 1106 break; 1107 } 1108 1109 if (optlen < sizeof(struct bt_codecs) || 1110 optlen > sizeof(buffer)) { 1111 hci_dev_put(hdev); 1112 err = -EINVAL; 1113 break; 1114 } 1115 1116 err = copy_struct_from_sockptr(buffer, sizeof(buffer), optval, 1117 optlen); 1118 if (err) { 1119 hci_dev_put(hdev); 1120 break; 1121 } 1122 1123 codecs = (void *)buffer; 1124 1125 if (codecs->num_codecs != 1 || 1126 optlen < struct_size(codecs, codecs, codecs->num_codecs)) { 1127 hci_dev_put(hdev); 1128 err = -EINVAL; 1129 break; 1130 } 1131 1132 sco_pi(sk)->codec = codecs->codecs[0]; 1133 hci_dev_put(hdev); 1134 break; 1135 1136 default: 1137 err = -ENOPROTOOPT; 1138 break; 1139 } 1140 1141 release_sock(sk); 1142 return err; 1143 } 1144 1145 static int sco_sock_getsockopt_old(struct socket *sock, int optname, 1146 sockopt_t *opt) 1147 { 1148 struct sock *sk = sock->sk; 1149 struct sco_options opts; 1150 struct sco_conninfo cinfo; 1151 int err = 0; 1152 size_t len; 1153 1154 BT_DBG("sk %p", sk); 1155 1156 len = opt->optlen; 1157 1158 lock_sock(sk); 1159 1160 switch (optname) { 1161 case SCO_OPTIONS: 1162 if (sk->sk_state != BT_CONNECTED && 1163 !(sk->sk_state == BT_CONNECT2 && 1164 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 1165 err = -ENOTCONN; 1166 break; 1167 } 1168 1169 opts.mtu = sco_pi(sk)->conn->mtu; 1170 1171 BT_DBG("mtu %u", opts.mtu); 1172 1173 len = min(len, sizeof(opts)); 1174 if (copy_to_iter(&opts, len, &opt->iter_out) != len) 1175 err = -EFAULT; 1176 1177 break; 1178 1179 case SCO_CONNINFO: 1180 if (sk->sk_state != BT_CONNECTED && 1181 !(sk->sk_state == BT_CONNECT2 && 1182 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 1183 err = -ENOTCONN; 1184 break; 1185 } 1186 1187 memset(&cinfo, 0, sizeof(cinfo)); 1188 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle; 1189 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3); 1190 1191 len = min(len, sizeof(cinfo)); 1192 if (copy_to_iter(&cinfo, len, &opt->iter_out) != len) 1193 err = -EFAULT; 1194 1195 break; 1196 1197 default: 1198 err = -ENOPROTOOPT; 1199 break; 1200 } 1201 1202 release_sock(sk); 1203 return err; 1204 } 1205 1206 static int sco_sock_getsockopt(struct socket *sock, int level, int optname, 1207 sockopt_t *opt) 1208 { 1209 struct sock *sk = sock->sk; 1210 int len, val, err = 0; 1211 struct bt_voice voice; 1212 u32 phys; 1213 int buf_len; 1214 struct codec_list *c; 1215 u8 num_codecs, i; 1216 struct hci_dev *hdev; 1217 struct hci_codec_caps *caps; 1218 struct bt_codec codec; 1219 1220 BT_DBG("sk %p", sk); 1221 1222 if (level == SOL_SCO) 1223 return sco_sock_getsockopt_old(sock, optname, opt); 1224 1225 len = opt->optlen; 1226 1227 lock_sock(sk); 1228 1229 switch (optname) { 1230 1231 case BT_DEFER_SETUP: 1232 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 1233 err = -EINVAL; 1234 break; 1235 } 1236 1237 val = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 1238 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) != 1239 sizeof(val)) 1240 err = -EFAULT; 1241 1242 break; 1243 1244 case BT_VOICE: 1245 voice.setting = sco_pi(sk)->setting; 1246 1247 len = min_t(unsigned int, len, sizeof(voice)); 1248 if (copy_to_iter(&voice, len, &opt->iter_out) != len) 1249 err = -EFAULT; 1250 1251 break; 1252 1253 case BT_PHY: 1254 if (sk->sk_state != BT_CONNECTED) { 1255 err = -ENOTCONN; 1256 break; 1257 } 1258 1259 phys = hci_conn_get_phy(sco_pi(sk)->conn->hcon); 1260 1261 if (copy_to_iter(&phys, sizeof(phys), &opt->iter_out) != 1262 sizeof(phys)) 1263 err = -EFAULT; 1264 break; 1265 1266 case BT_PKT_STATUS: 1267 val = test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags); 1268 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) != 1269 sizeof(val)) 1270 err = -EFAULT; 1271 break; 1272 1273 case BT_SNDMTU: 1274 case BT_RCVMTU: 1275 if (sk->sk_state != BT_CONNECTED) { 1276 err = -ENOTCONN; 1277 break; 1278 } 1279 1280 val = sco_pi(sk)->conn->mtu; 1281 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) != 1282 sizeof(val)) 1283 err = -EFAULT; 1284 break; 1285 1286 case BT_CODEC: 1287 num_codecs = 0; 1288 buf_len = 0; 1289 1290 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR); 1291 if (!hdev) { 1292 err = -EBADFD; 1293 break; 1294 } 1295 1296 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) { 1297 hci_dev_put(hdev); 1298 err = -EOPNOTSUPP; 1299 break; 1300 } 1301 1302 if (!hdev->get_data_path_id) { 1303 hci_dev_put(hdev); 1304 err = -EOPNOTSUPP; 1305 break; 1306 } 1307 1308 release_sock(sk); 1309 1310 /* find total buffer size required to copy codec + caps */ 1311 hci_dev_lock(hdev); 1312 list_for_each_entry(c, &hdev->local_codecs, list) { 1313 if (c->transport != HCI_TRANSPORT_SCO_ESCO) 1314 continue; 1315 num_codecs++; 1316 for (i = 0, caps = c->caps; i < c->num_caps; i++) { 1317 buf_len += 1 + caps->len; 1318 caps = (void *)&caps->data[caps->len]; 1319 } 1320 buf_len += sizeof(struct bt_codec); 1321 } 1322 hci_dev_unlock(hdev); 1323 1324 buf_len += sizeof(struct bt_codecs); 1325 if (buf_len > len) { 1326 hci_dev_put(hdev); 1327 return -ENOBUFS; 1328 } 1329 1330 if (copy_to_iter(&num_codecs, sizeof(num_codecs), 1331 &opt->iter_out) != sizeof(num_codecs)) { 1332 hci_dev_put(hdev); 1333 return -EFAULT; 1334 } 1335 1336 /* Iterate all the codecs supported over SCO and populate 1337 * codec data 1338 */ 1339 hci_dev_lock(hdev); 1340 list_for_each_entry(c, &hdev->local_codecs, list) { 1341 if (c->transport != HCI_TRANSPORT_SCO_ESCO) 1342 continue; 1343 1344 codec.id = c->id; 1345 codec.cid = c->cid; 1346 codec.vid = c->vid; 1347 err = hdev->get_data_path_id(hdev, &codec.data_path); 1348 if (err < 0) 1349 break; 1350 codec.num_caps = c->num_caps; 1351 if (copy_to_iter(&codec, sizeof(codec), &opt->iter_out) 1352 != sizeof(codec)) { 1353 err = -EFAULT; 1354 break; 1355 } 1356 1357 /* find codec capabilities data length */ 1358 len = 0; 1359 for (i = 0, caps = c->caps; i < c->num_caps; i++) { 1360 len += 1 + caps->len; 1361 caps = (void *)&caps->data[caps->len]; 1362 } 1363 1364 /* copy codec capabilities data */ 1365 if (len && 1366 copy_to_iter(c->caps, len, &opt->iter_out) != len) { 1367 err = -EFAULT; 1368 break; 1369 } 1370 } 1371 1372 hci_dev_unlock(hdev); 1373 hci_dev_put(hdev); 1374 1375 lock_sock(sk); 1376 1377 if (!err) 1378 opt->optlen = buf_len; 1379 1380 break; 1381 1382 default: 1383 err = -ENOPROTOOPT; 1384 break; 1385 } 1386 1387 release_sock(sk); 1388 return err; 1389 } 1390 1391 static int sco_sock_shutdown(struct socket *sock, int how) 1392 { 1393 struct sock *sk = sock->sk; 1394 int err = 0; 1395 1396 BT_DBG("sock %p, sk %p", sock, sk); 1397 1398 if (!sk) 1399 return 0; 1400 1401 sock_hold(sk); 1402 lock_sock(sk); 1403 1404 if (!sk->sk_shutdown) { 1405 sk->sk_shutdown = SHUTDOWN_MASK; 1406 sco_sock_clear_timer(sk); 1407 __sco_sock_close(sk); 1408 1409 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 1410 !(current->flags & PF_EXITING)) 1411 err = bt_sock_wait_state(sk, BT_CLOSED, 1412 sk->sk_lingertime); 1413 } 1414 1415 release_sock(sk); 1416 sock_put(sk); 1417 1418 return err; 1419 } 1420 1421 static int sco_sock_release(struct socket *sock) 1422 { 1423 struct sock *sk = sock->sk; 1424 int err = 0; 1425 1426 BT_DBG("sock %p, sk %p", sock, sk); 1427 1428 if (!sk) 1429 return 0; 1430 1431 sco_sock_close(sk); 1432 1433 if (sock_flag(sk, SOCK_LINGER) && READ_ONCE(sk->sk_lingertime) && 1434 !(current->flags & PF_EXITING)) { 1435 lock_sock(sk); 1436 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); 1437 release_sock(sk); 1438 } 1439 1440 sock_orphan(sk); 1441 sco_sock_kill(sk); 1442 return err; 1443 } 1444 1445 static void sco_conn_ready(struct sco_conn *conn) 1446 { 1447 struct sock *parent, *sk; 1448 1449 sco_conn_lock(conn); 1450 sk = sco_sock_hold(conn); 1451 sco_conn_unlock(conn); 1452 1453 BT_DBG("conn %p", conn); 1454 1455 if (sk) { 1456 lock_sock(sk); 1457 1458 /* conn->sk may have become NULL if racing with sk close, but 1459 * due to held hdev->lock, it can't become different sk. 1460 */ 1461 if (conn->sk) { 1462 sco_sock_clear_timer(sk); 1463 sk->sk_state = BT_CONNECTED; 1464 sk->sk_state_change(sk); 1465 } 1466 1467 release_sock(sk); 1468 sock_put(sk); 1469 } else { 1470 if (!conn->hcon) 1471 return; 1472 1473 lockdep_assert_held(&conn->hcon->hdev->lock); 1474 1475 parent = sco_get_sock_listen(&conn->hcon->src); 1476 if (!parent) 1477 return; 1478 1479 lock_sock(parent); 1480 1481 sco_conn_lock(conn); 1482 1483 /* hdev->lock guarantees conn->sk == NULL still here */ 1484 1485 if (parent->sk_state != BT_LISTEN) 1486 goto release; 1487 1488 sk = sco_sock_alloc(sock_net(parent), NULL, 1489 BTPROTO_SCO, GFP_ATOMIC, 0); 1490 if (!sk) 1491 goto release; 1492 1493 sco_sock_init(sk, parent); 1494 1495 bacpy(&sco_pi(sk)->src, &conn->hcon->src); 1496 bacpy(&sco_pi(sk)->dst, &conn->hcon->dst); 1497 1498 __sco_chan_add(conn, sk, parent); 1499 1500 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) 1501 sk->sk_state = BT_CONNECT2; 1502 else 1503 sk->sk_state = BT_CONNECTED; 1504 1505 /* Wake up parent */ 1506 parent->sk_data_ready(parent); 1507 1508 release: 1509 sco_conn_unlock(conn); 1510 release_sock(parent); 1511 sock_put(parent); 1512 } 1513 } 1514 1515 /* ----- SCO interface with lower layer (HCI) ----- */ 1516 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) 1517 { 1518 struct sock *sk; 1519 int lm = 0; 1520 1521 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr); 1522 1523 /* Find listening sockets */ 1524 read_lock(&sco_sk_list.lock); 1525 sk_for_each(sk, &sco_sk_list.head) { 1526 if (sk->sk_state != BT_LISTEN) 1527 continue; 1528 1529 if (!bacmp(&sco_pi(sk)->src, &hdev->bdaddr) || 1530 !bacmp(&sco_pi(sk)->src, BDADDR_ANY)) { 1531 lm |= HCI_LM_ACCEPT; 1532 1533 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) 1534 *flags |= HCI_PROTO_DEFER; 1535 break; 1536 } 1537 } 1538 read_unlock(&sco_sk_list.lock); 1539 1540 return lm; 1541 } 1542 1543 static void sco_connect_cfm(struct hci_conn *hcon, __u8 status) 1544 { 1545 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) 1546 return; 1547 1548 BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status); 1549 1550 if (!status) { 1551 struct sco_conn *conn; 1552 1553 conn = sco_conn_add(hcon); 1554 if (conn) { 1555 sco_conn_ready(conn); 1556 sco_conn_put(conn); 1557 } 1558 } else 1559 sco_conn_del(hcon, bt_to_errno(status)); 1560 } 1561 1562 static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason) 1563 { 1564 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) 1565 return; 1566 1567 BT_DBG("hcon %p reason %d", hcon, reason); 1568 1569 sco_conn_del(hcon, bt_to_errno(reason)); 1570 } 1571 1572 int sco_recv_scodata(struct hci_dev *hdev, u16 handle, struct sk_buff *skb) 1573 { 1574 struct hci_conn *hcon; 1575 struct sco_conn *conn; 1576 1577 hci_dev_lock(hdev); 1578 1579 hcon = hci_conn_hash_lookup_handle(hdev, handle); 1580 if (!hcon) { 1581 hci_dev_unlock(hdev); 1582 kfree_skb(skb); 1583 return -ENOENT; 1584 } 1585 1586 conn = sco_conn_hold_unless_zero(hcon->sco_data); 1587 hcon = NULL; 1588 1589 hci_dev_unlock(hdev); 1590 1591 if (!conn) { 1592 kfree_skb(skb); 1593 return -EINVAL; 1594 } 1595 1596 BT_DBG("conn %p len %u", conn, skb->len); 1597 1598 if (skb->len) 1599 sco_recv_frame(conn, skb); 1600 else 1601 kfree_skb(skb); 1602 1603 sco_conn_put(conn); 1604 return 0; 1605 } 1606 1607 static struct hci_cb sco_cb = { 1608 .name = "SCO", 1609 .connect_cfm = sco_connect_cfm, 1610 .disconn_cfm = sco_disconn_cfm, 1611 }; 1612 1613 static int sco_debugfs_show(struct seq_file *f, void *p) 1614 { 1615 struct sock *sk; 1616 1617 read_lock(&sco_sk_list.lock); 1618 1619 sk_for_each(sk, &sco_sk_list.head) { 1620 seq_printf(f, "%pMR %pMR %d\n", &sco_pi(sk)->src, 1621 &sco_pi(sk)->dst, sk->sk_state); 1622 } 1623 1624 read_unlock(&sco_sk_list.lock); 1625 1626 return 0; 1627 } 1628 1629 DEFINE_SHOW_ATTRIBUTE(sco_debugfs); 1630 1631 static struct dentry *sco_debugfs; 1632 1633 static const struct proto_ops sco_sock_ops = { 1634 .family = PF_BLUETOOTH, 1635 .owner = THIS_MODULE, 1636 .release = sco_sock_release, 1637 .bind = sco_sock_bind, 1638 .connect = sco_sock_connect, 1639 .listen = sco_sock_listen, 1640 .accept = sco_sock_accept, 1641 .getname = sco_sock_getname, 1642 .sendmsg = sco_sock_sendmsg, 1643 .recvmsg = sco_sock_recvmsg, 1644 .poll = bt_sock_poll, 1645 .ioctl = bt_sock_ioctl, 1646 .gettstamp = sock_gettstamp, 1647 .mmap = sock_no_mmap, 1648 .socketpair = sock_no_socketpair, 1649 .shutdown = sco_sock_shutdown, 1650 .setsockopt = sco_sock_setsockopt, 1651 .getsockopt_iter = sco_sock_getsockopt 1652 }; 1653 1654 static const struct net_proto_family sco_sock_family_ops = { 1655 .family = PF_BLUETOOTH, 1656 .owner = THIS_MODULE, 1657 .create = sco_sock_create, 1658 }; 1659 1660 int __init sco_init(void) 1661 { 1662 int err; 1663 1664 BUILD_BUG_ON(sizeof(struct sockaddr_sco) > sizeof(struct sockaddr)); 1665 1666 err = proto_register(&sco_proto, 0); 1667 if (err < 0) 1668 return err; 1669 1670 err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops); 1671 if (err < 0) { 1672 BT_ERR("SCO socket registration failed"); 1673 goto error; 1674 } 1675 1676 err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL); 1677 if (err < 0) { 1678 BT_ERR("Failed to create SCO proc file"); 1679 bt_sock_unregister(BTPROTO_SCO); 1680 goto error; 1681 } 1682 1683 BT_INFO("SCO socket layer initialized"); 1684 1685 hci_register_cb(&sco_cb); 1686 1687 if (IS_ERR_OR_NULL(bt_debugfs)) 1688 return 0; 1689 1690 sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs, 1691 NULL, &sco_debugfs_fops); 1692 1693 return 0; 1694 1695 error: 1696 proto_unregister(&sco_proto); 1697 return err; 1698 } 1699 1700 void sco_exit(void) 1701 { 1702 bt_procfs_cleanup(&init_net, "sco"); 1703 1704 debugfs_remove(sco_debugfs); 1705 1706 hci_unregister_cb(&sco_cb); 1707 1708 bt_sock_unregister(BTPROTO_SCO); 1709 1710 proto_unregister(&sco_proto); 1711 } 1712 1713 module_param(disable_esco, bool, 0644); 1714 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation"); 1715