1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 Copyright (C) 2000-2001 Qualcomm Incorporated 5 6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 7 8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 19 SOFTWARE IS DISCLAIMED. 20 */ 21 22 /* Bluetooth SCO sockets. */ 23 24 #include <linux/module.h> 25 #include <linux/debugfs.h> 26 #include <linux/seq_file.h> 27 #include <linux/sched/signal.h> 28 #include <linux/uio.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/sco.h> 33 34 static bool disable_esco; 35 36 static const struct proto_ops sco_sock_ops; 37 38 static struct bt_sock_list sco_sk_list = { 39 .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock) 40 }; 41 42 /* ---- SCO connections ---- */ 43 struct sco_conn { 44 struct hci_conn *hcon; 45 46 spinlock_t lock; 47 struct sock *sk; 48 49 struct delayed_work timeout_work; 50 51 unsigned int mtu; 52 struct kref ref; 53 }; 54 55 #define sco_conn_lock(c) spin_lock(&c->lock) 56 #define sco_conn_unlock(c) spin_unlock(&c->lock) 57 58 static void sco_sock_close(struct sock *sk); 59 static void sco_sock_kill(struct sock *sk); 60 61 /* ----- SCO socket info ----- */ 62 #define sco_pi(sk) ((struct sco_pinfo *) sk) 63 64 struct sco_pinfo { 65 struct bt_sock bt; 66 bdaddr_t src; 67 bdaddr_t dst; 68 __u32 flags; 69 __u16 setting; 70 struct bt_codec codec; 71 struct sco_conn *conn; 72 }; 73 74 /* ---- SCO timers ---- */ 75 #define SCO_CONN_TIMEOUT (HZ * 40) 76 #define SCO_DISCONN_TIMEOUT (HZ * 2) 77 78 static void sco_conn_free(struct kref *ref) 79 { 80 struct sco_conn *conn = container_of(ref, struct sco_conn, ref); 81 82 BT_DBG("conn %p", conn); 83 84 if (conn->sk) 85 sco_pi(conn->sk)->conn = NULL; 86 87 if (conn->hcon) { 88 conn->hcon->sco_data = NULL; 89 hci_conn_drop(conn->hcon); 90 } 91 92 /* Ensure no more work items will run since hci_conn has been dropped */ 93 disable_delayed_work_sync(&conn->timeout_work); 94 95 kfree(conn); 96 } 97 98 static void sco_conn_put(struct sco_conn *conn) 99 { 100 if (!conn) 101 return; 102 103 BT_DBG("conn %p refcnt %d", conn, kref_read(&conn->ref)); 104 105 kref_put(&conn->ref, sco_conn_free); 106 } 107 108 static struct sco_conn *sco_conn_hold(struct sco_conn *conn) 109 { 110 BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref)); 111 112 kref_get(&conn->ref); 113 return conn; 114 } 115 116 static struct sco_conn *sco_conn_hold_unless_zero(struct sco_conn *conn) 117 { 118 if (!conn) 119 return NULL; 120 121 BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref)); 122 123 if (!kref_get_unless_zero(&conn->ref)) 124 return NULL; 125 126 return conn; 127 } 128 129 static struct sock *sco_sock_hold(struct sco_conn *conn) 130 { 131 if (!conn || !bt_sock_linked(&sco_sk_list, conn->sk)) 132 return NULL; 133 134 sock_hold(conn->sk); 135 136 return conn->sk; 137 } 138 139 static void sco_sock_timeout(struct work_struct *work) 140 { 141 struct sco_conn *conn = container_of(work, struct sco_conn, 142 timeout_work.work); 143 struct sock *sk; 144 145 conn = sco_conn_hold_unless_zero(conn); 146 if (!conn) 147 return; 148 149 sco_conn_lock(conn); 150 if (!conn->hcon) { 151 sco_conn_unlock(conn); 152 sco_conn_put(conn); 153 return; 154 } 155 sk = sco_sock_hold(conn); 156 sco_conn_unlock(conn); 157 sco_conn_put(conn); 158 159 if (!sk) 160 return; 161 162 BT_DBG("sock %p state %d", sk, sk->sk_state); 163 164 lock_sock(sk); 165 sk->sk_err = ETIMEDOUT; 166 sk->sk_state_change(sk); 167 release_sock(sk); 168 sock_put(sk); 169 } 170 171 static void sco_sock_set_timer(struct sock *sk, long timeout) 172 { 173 if (!sco_pi(sk)->conn) 174 return; 175 176 BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout); 177 cancel_delayed_work(&sco_pi(sk)->conn->timeout_work); 178 schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout); 179 } 180 181 static void sco_sock_clear_timer(struct sock *sk) 182 { 183 if (!sco_pi(sk)->conn) 184 return; 185 186 BT_DBG("sock %p state %d", sk, sk->sk_state); 187 cancel_delayed_work(&sco_pi(sk)->conn->timeout_work); 188 } 189 190 /* ---- SCO connections ---- */ 191 /* Consumes a reference on @hcon, which the returned sco_conn owns until it is 192 * freed. On failure (NULL return) the reference is left for the caller to drop. 193 */ 194 static struct sco_conn *sco_conn_add(struct hci_conn *hcon) 195 { 196 struct sco_conn *conn = hcon->sco_data; 197 198 conn = sco_conn_hold_unless_zero(conn); 199 if (conn) { 200 if (!conn->hcon) { 201 sco_conn_lock(conn); 202 conn->hcon = hcon; 203 sco_conn_unlock(conn); 204 } else { 205 /* conn already owns a reference on hcon */ 206 hci_conn_drop(hcon); 207 } 208 return conn; 209 } 210 211 conn = kzalloc_obj(struct sco_conn); 212 if (!conn) 213 return NULL; 214 215 kref_init(&conn->ref); 216 spin_lock_init(&conn->lock); 217 INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout); 218 219 hcon->sco_data = conn; 220 conn->hcon = hcon; 221 conn->mtu = hcon->mtu; 222 223 if (hcon->mtu > 0) 224 conn->mtu = hcon->mtu; 225 else 226 conn->mtu = 60; 227 228 BT_DBG("hcon %p conn %p", hcon, conn); 229 230 return conn; 231 } 232 233 /* Delete channel. 234 * Must be called on the locked socket. */ 235 static void sco_chan_del(struct sock *sk, int err) 236 { 237 struct sco_conn *conn; 238 239 conn = sco_pi(sk)->conn; 240 sco_pi(sk)->conn = NULL; 241 242 BT_DBG("sk %p, conn %p, err %d", sk, conn, err); 243 244 if (conn) { 245 sco_conn_lock(conn); 246 conn->sk = NULL; 247 sco_conn_unlock(conn); 248 sco_conn_put(conn); 249 } 250 251 sk->sk_state = BT_CLOSED; 252 sk->sk_err = err; 253 sk->sk_state_change(sk); 254 255 sock_set_flag(sk, SOCK_ZAPPED); 256 } 257 258 static void sco_conn_del(struct hci_conn *hcon, int err) 259 { 260 struct sco_conn *conn = hcon->sco_data; 261 struct sock *sk; 262 263 conn = sco_conn_hold_unless_zero(conn); 264 if (!conn) 265 return; 266 267 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); 268 269 sco_conn_lock(conn); 270 sk = sco_sock_hold(conn); 271 sco_conn_unlock(conn); 272 sco_conn_put(conn); 273 274 if (!sk) 275 return; 276 277 /* Kill socket */ 278 lock_sock(sk); 279 sco_sock_clear_timer(sk); 280 sco_chan_del(sk, err); 281 release_sock(sk); 282 sock_put(sk); 283 } 284 285 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, 286 struct sock *parent) 287 { 288 BT_DBG("conn %p", conn); 289 290 sco_pi(sk)->conn = sco_conn_hold(conn); 291 conn->sk = sk; 292 293 if (parent) 294 bt_accept_enqueue(parent, sk, true); 295 } 296 297 static int sco_chan_add(struct sco_conn *conn, struct sock *sk, 298 struct sock *parent) 299 { 300 int err = 0; 301 302 sco_conn_lock(conn); 303 if (conn->sk || sco_pi(sk)->conn) 304 err = -EBUSY; 305 else 306 __sco_chan_add(conn, sk, parent); 307 308 sco_conn_unlock(conn); 309 return err; 310 } 311 312 static int sco_connect(struct sock *sk) 313 { 314 struct sco_conn *conn; 315 struct hci_conn *hcon; 316 struct hci_dev *hdev; 317 bdaddr_t src, dst; 318 struct bt_codec codec; 319 __u16 setting; 320 int err, type; 321 322 lock_sock(sk); 323 bacpy(&src, &sco_pi(sk)->src); 324 bacpy(&dst, &sco_pi(sk)->dst); 325 setting = sco_pi(sk)->setting; 326 codec = sco_pi(sk)->codec; 327 release_sock(sk); 328 329 BT_DBG("%pMR -> %pMR", &src, &dst); 330 331 hdev = hci_get_route(&dst, &src, BDADDR_BREDR); 332 if (!hdev) 333 return -EHOSTUNREACH; 334 335 hci_dev_lock(hdev); 336 337 if (lmp_esco_capable(hdev) && !disable_esco) 338 type = ESCO_LINK; 339 else 340 type = SCO_LINK; 341 342 switch (setting & SCO_AIRMODE_MASK) { 343 case SCO_AIRMODE_TRANSP: 344 if (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev)) { 345 err = -EOPNOTSUPP; 346 goto unlock; 347 } 348 break; 349 } 350 351 hcon = hci_connect_sco(hdev, type, &dst, 352 setting, &codec, 353 READ_ONCE(sk->sk_sndtimeo)); 354 if (IS_ERR(hcon)) { 355 err = PTR_ERR(hcon); 356 goto unlock; 357 } 358 359 conn = sco_conn_add(hcon); 360 if (!conn) { 361 hci_conn_drop(hcon); 362 err = -ENOMEM; 363 goto unlock; 364 } 365 366 lock_sock(sk); 367 368 /* Recheck state after reacquiring the socket lock, as another 369 * thread may have changed it (e.g., closed the socket). 370 */ 371 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 372 release_sock(sk); 373 sco_conn_put(conn); 374 err = -EBADFD; 375 goto unlock; 376 } 377 378 err = sco_chan_add(conn, sk, NULL); 379 sco_conn_put(conn); 380 if (err) { 381 release_sock(sk); 382 goto unlock; 383 } 384 385 /* Update source addr of the socket */ 386 bacpy(&sco_pi(sk)->src, &hcon->src); 387 388 if (hcon->state == BT_CONNECTED) { 389 sco_sock_clear_timer(sk); 390 sk->sk_state = BT_CONNECTED; 391 } else { 392 sk->sk_state = BT_CONNECT; 393 sco_sock_set_timer(sk, READ_ONCE(sk->sk_sndtimeo)); 394 } 395 396 release_sock(sk); 397 398 unlock: 399 hci_dev_unlock(hdev); 400 hci_dev_put(hdev); 401 return err; 402 } 403 404 static int sco_send_frame(struct sock *sk, struct sk_buff *skb, 405 const struct sockcm_cookie *sockc) 406 { 407 struct sco_conn *conn = sco_pi(sk)->conn; 408 int len = skb->len; 409 410 /* Check outgoing MTU */ 411 if (len > conn->mtu) 412 return -EINVAL; 413 414 BT_DBG("sk %p len %d", sk, len); 415 416 hci_setup_tx_timestamp(skb, 1, sockc); 417 hci_send_sco(conn->hcon, skb); 418 419 return len; 420 } 421 422 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb) 423 { 424 struct sock *sk; 425 426 sco_conn_lock(conn); 427 sk = sco_sock_hold(conn); 428 sco_conn_unlock(conn); 429 430 if (!sk) 431 goto drop; 432 433 BT_DBG("sk %p len %u", sk, skb->len); 434 435 if (sk->sk_state != BT_CONNECTED) 436 goto drop_put; 437 438 if (!sock_queue_rcv_skb(sk, skb)) { 439 sock_put(sk); 440 return; 441 } 442 443 drop_put: 444 sock_put(sk); 445 drop: 446 kfree_skb(skb); 447 } 448 449 /* -------- Socket interface ---------- */ 450 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba) 451 { 452 struct sock *sk; 453 454 sk_for_each(sk, &sco_sk_list.head) { 455 if (sk->sk_state != BT_LISTEN) 456 continue; 457 458 if (!bacmp(&sco_pi(sk)->src, ba)) 459 return sk; 460 } 461 462 return NULL; 463 } 464 465 /* Find socket listening on source bdaddr. 466 * Returns closest match. 467 */ 468 static struct sock *sco_get_sock_listen(bdaddr_t *src) 469 { 470 struct sock *sk = NULL, *sk1 = NULL; 471 472 read_lock(&sco_sk_list.lock); 473 474 sk_for_each(sk, &sco_sk_list.head) { 475 if (sk->sk_state != BT_LISTEN) 476 continue; 477 478 /* Exact match. */ 479 if (!bacmp(&sco_pi(sk)->src, src)) 480 break; 481 482 /* Closest match */ 483 if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY)) 484 sk1 = sk; 485 } 486 487 sk = sk ? sk : sk1; 488 if (sk) 489 sock_hold(sk); 490 491 read_unlock(&sco_sk_list.lock); 492 493 return sk; 494 } 495 496 static void sco_sock_destruct(struct sock *sk) 497 { 498 BT_DBG("sk %p", sk); 499 500 sco_conn_put(sco_pi(sk)->conn); 501 502 skb_queue_purge(&sk->sk_receive_queue); 503 skb_queue_purge(&sk->sk_write_queue); 504 skb_queue_purge(&sk->sk_error_queue); 505 } 506 507 static void sco_sock_cleanup_listen(struct sock *parent) 508 { 509 struct sock *sk; 510 511 BT_DBG("parent %p", parent); 512 513 /* Close not yet accepted channels */ 514 while ((sk = bt_accept_dequeue(parent, NULL))) { 515 sco_sock_close(sk); 516 sco_sock_kill(sk); 517 /* Drop the reference handed back by bt_accept_dequeue(). */ 518 sock_put(sk); 519 } 520 521 parent->sk_state = BT_CLOSED; 522 sock_set_flag(parent, SOCK_ZAPPED); 523 } 524 525 /* Kill socket (only if zapped and orphan) 526 * Must be called on unlocked socket. 527 */ 528 static void sco_sock_kill(struct sock *sk) 529 { 530 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 531 return; 532 533 BT_DBG("sk %p state %d", sk, sk->sk_state); 534 535 /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ 536 lock_sock(sk); 537 if (sco_pi(sk)->conn) { 538 sco_conn_lock(sco_pi(sk)->conn); 539 sco_pi(sk)->conn->sk = NULL; 540 sco_conn_unlock(sco_pi(sk)->conn); 541 } 542 release_sock(sk); 543 544 /* Kill poor orphan */ 545 bt_sock_unlink(&sco_sk_list, sk); 546 sock_set_flag(sk, SOCK_DEAD); 547 sock_put(sk); 548 } 549 550 static void __sco_sock_close(struct sock *sk) 551 { 552 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket); 553 554 switch (sk->sk_state) { 555 case BT_LISTEN: 556 sco_sock_cleanup_listen(sk); 557 break; 558 559 case BT_CONNECTED: 560 case BT_CONFIG: 561 case BT_CONNECT2: 562 case BT_CONNECT: 563 case BT_DISCONN: 564 sco_chan_del(sk, ECONNRESET); 565 break; 566 567 default: 568 sock_set_flag(sk, SOCK_ZAPPED); 569 break; 570 } 571 572 } 573 574 /* Must be called on unlocked socket. */ 575 static void sco_sock_close(struct sock *sk) 576 { 577 struct sco_conn *conn; 578 579 lock_sock(sk); 580 conn = sco_pi(sk)->conn; 581 if (conn) 582 sco_conn_hold(conn); 583 release_sock(sk); 584 585 if (conn) 586 disable_delayed_work_sync(&conn->timeout_work); 587 588 lock_sock(sk); 589 __sco_sock_close(sk); 590 release_sock(sk); 591 592 if (conn) 593 sco_conn_put(conn); 594 } 595 596 static void sco_sock_init(struct sock *sk, struct sock *parent) 597 { 598 BT_DBG("sk %p", sk); 599 600 if (parent) { 601 sk->sk_type = parent->sk_type; 602 bt_sk(sk)->flags = bt_sk(parent)->flags; 603 security_sk_clone(parent, sk); 604 } 605 } 606 607 static struct proto sco_proto = { 608 .name = "SCO", 609 .owner = THIS_MODULE, 610 .obj_size = sizeof(struct sco_pinfo) 611 }; 612 613 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, 614 int proto, gfp_t prio, int kern) 615 { 616 struct sock *sk; 617 618 sk = bt_sock_alloc(net, sock, &sco_proto, proto, prio, kern); 619 if (!sk) 620 return NULL; 621 622 sk->sk_destruct = sco_sock_destruct; 623 sk->sk_sndtimeo = SCO_CONN_TIMEOUT; 624 625 sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT; 626 sco_pi(sk)->codec.id = BT_CODEC_CVSD; 627 sco_pi(sk)->codec.cid = 0xffff; 628 sco_pi(sk)->codec.vid = 0xffff; 629 sco_pi(sk)->codec.data_path = 0x00; 630 631 bt_sock_link(&sco_sk_list, sk); 632 return sk; 633 } 634 635 static int sco_sock_create(struct net *net, struct socket *sock, int protocol, 636 int kern) 637 { 638 struct sock *sk; 639 640 BT_DBG("sock %p", sock); 641 642 sock->state = SS_UNCONNECTED; 643 644 if (sock->type != SOCK_SEQPACKET) 645 return -ESOCKTNOSUPPORT; 646 647 sock->ops = &sco_sock_ops; 648 649 sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern); 650 if (!sk) 651 return -ENOMEM; 652 653 sco_sock_init(sk, NULL); 654 return 0; 655 } 656 657 static int sco_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, 658 int addr_len) 659 { 660 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 661 struct sock *sk = sock->sk; 662 int err = 0; 663 664 if (!addr || addr_len < sizeof(struct sockaddr_sco) || 665 addr->sa_family != AF_BLUETOOTH) 666 return -EINVAL; 667 668 BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr); 669 670 lock_sock(sk); 671 672 if (sk->sk_state != BT_OPEN) { 673 err = -EBADFD; 674 goto done; 675 } 676 677 if (sk->sk_type != SOCK_SEQPACKET) { 678 err = -EINVAL; 679 goto done; 680 } 681 682 bacpy(&sco_pi(sk)->src, &sa->sco_bdaddr); 683 684 sk->sk_state = BT_BOUND; 685 686 done: 687 release_sock(sk); 688 return err; 689 } 690 691 static int sco_sock_connect(struct socket *sock, struct sockaddr_unsized *addr, int alen, int flags) 692 { 693 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 694 struct sock *sk = sock->sk; 695 int err; 696 697 BT_DBG("sk %p", sk); 698 699 if (alen < sizeof(struct sockaddr_sco) || 700 addr->sa_family != AF_BLUETOOTH) 701 return -EINVAL; 702 703 lock_sock(sk); 704 705 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 706 release_sock(sk); 707 return -EBADFD; 708 } 709 710 if (sk->sk_type != SOCK_SEQPACKET) { 711 release_sock(sk); 712 return -EINVAL; 713 } 714 715 /* Set destination address and psm */ 716 bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr); 717 release_sock(sk); 718 719 err = sco_connect(sk); 720 if (err) 721 return err; 722 723 lock_sock(sk); 724 725 err = bt_sock_wait_state(sk, BT_CONNECTED, 726 sock_sndtimeo(sk, flags & O_NONBLOCK)); 727 728 release_sock(sk); 729 return err; 730 } 731 732 static int sco_sock_listen(struct socket *sock, int backlog) 733 { 734 struct sock *sk = sock->sk; 735 bdaddr_t *src = &sco_pi(sk)->src; 736 int err = 0; 737 738 BT_DBG("sk %p backlog %d", sk, backlog); 739 740 lock_sock(sk); 741 742 if (sk->sk_state != BT_BOUND) { 743 err = -EBADFD; 744 goto done; 745 } 746 747 if (sk->sk_type != SOCK_SEQPACKET) { 748 err = -EINVAL; 749 goto done; 750 } 751 752 write_lock(&sco_sk_list.lock); 753 754 if (__sco_get_sock_listen_by_addr(src)) { 755 err = -EADDRINUSE; 756 goto unlock; 757 } 758 759 sk->sk_max_ack_backlog = backlog; 760 sk->sk_ack_backlog = 0; 761 762 sk->sk_state = BT_LISTEN; 763 764 unlock: 765 write_unlock(&sco_sk_list.lock); 766 767 done: 768 release_sock(sk); 769 return err; 770 } 771 772 static int sco_sock_accept(struct socket *sock, struct socket *newsock, 773 struct proto_accept_arg *arg) 774 { 775 DEFINE_WAIT_FUNC(wait, woken_wake_function); 776 struct sock *sk = sock->sk, *ch; 777 long timeo; 778 int err = 0; 779 780 lock_sock(sk); 781 782 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK); 783 784 BT_DBG("sk %p timeo %ld", sk, timeo); 785 786 /* Wait for an incoming connection. (wake-one). */ 787 add_wait_queue_exclusive(sk_sleep(sk), &wait); 788 while (1) { 789 if (sk->sk_state != BT_LISTEN) { 790 err = -EBADFD; 791 break; 792 } 793 794 ch = bt_accept_dequeue(sk, newsock); 795 if (ch) { 796 /* Drop the bridging ref from bt_accept_dequeue(); 797 * the grafted socket keeps ch alive from here. 798 */ 799 sock_put(ch); 800 break; 801 } 802 803 if (!timeo) { 804 err = -EAGAIN; 805 break; 806 } 807 808 if (signal_pending(current)) { 809 err = sock_intr_errno(timeo); 810 break; 811 } 812 813 release_sock(sk); 814 815 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 816 lock_sock(sk); 817 } 818 remove_wait_queue(sk_sleep(sk), &wait); 819 820 if (err) 821 goto done; 822 823 newsock->state = SS_CONNECTED; 824 825 BT_DBG("new socket %p", ch); 826 827 done: 828 release_sock(sk); 829 return err; 830 } 831 832 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, 833 int peer) 834 { 835 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 836 struct sock *sk = sock->sk; 837 838 BT_DBG("sock %p, sk %p", sock, sk); 839 840 addr->sa_family = AF_BLUETOOTH; 841 842 if (peer) 843 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->dst); 844 else 845 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->src); 846 847 return sizeof(struct sockaddr_sco); 848 } 849 850 static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg, 851 size_t len) 852 { 853 struct sock *sk = sock->sk; 854 struct sk_buff *skb; 855 struct sockcm_cookie sockc; 856 int err; 857 858 BT_DBG("sock %p, sk %p", sock, sk); 859 860 err = sock_error(sk); 861 if (err) 862 return err; 863 864 if (msg->msg_flags & MSG_OOB) 865 return -EOPNOTSUPP; 866 867 hci_sockcm_init(&sockc, sk); 868 869 if (msg->msg_controllen) { 870 err = sock_cmsg_send(sk, msg, &sockc); 871 if (err) 872 return err; 873 } 874 875 skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0); 876 if (IS_ERR(skb)) 877 return PTR_ERR(skb); 878 879 lock_sock(sk); 880 881 if (sk->sk_state == BT_CONNECTED) 882 err = sco_send_frame(sk, skb, &sockc); 883 else 884 err = -ENOTCONN; 885 886 release_sock(sk); 887 888 if (err < 0) 889 kfree_skb(skb); 890 return err; 891 } 892 893 static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting) 894 { 895 struct hci_dev *hdev = conn->hdev; 896 897 BT_DBG("conn %p", conn); 898 899 conn->state = BT_CONFIG; 900 901 if (!lmp_esco_capable(hdev)) { 902 struct hci_cp_accept_conn_req cp; 903 904 bacpy(&cp.bdaddr, &conn->dst); 905 cp.role = 0x00; /* Ignored */ 906 907 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp); 908 } else { 909 struct hci_cp_accept_sync_conn_req cp; 910 911 bacpy(&cp.bdaddr, &conn->dst); 912 cp.pkt_type = cpu_to_le16(conn->pkt_type); 913 914 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 915 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 916 cp.content_format = cpu_to_le16(setting); 917 918 switch (setting & SCO_AIRMODE_MASK) { 919 case SCO_AIRMODE_TRANSP: 920 if (conn->pkt_type & ESCO_2EV3) 921 cp.max_latency = cpu_to_le16(0x0008); 922 else 923 cp.max_latency = cpu_to_le16(0x000D); 924 cp.retrans_effort = 0x02; 925 break; 926 case SCO_AIRMODE_CVSD: 927 cp.max_latency = cpu_to_le16(0xffff); 928 cp.retrans_effort = 0xff; 929 break; 930 default: 931 /* use CVSD settings as fallback */ 932 cp.max_latency = cpu_to_le16(0xffff); 933 cp.retrans_effort = 0xff; 934 break; 935 } 936 937 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, 938 sizeof(cp), &cp); 939 } 940 } 941 942 static int sco_sock_recvmsg(struct socket *sock, struct msghdr *msg, 943 size_t len, int flags) 944 { 945 struct sock *sk = sock->sk; 946 struct sco_pinfo *pi = sco_pi(sk); 947 948 if (unlikely(flags & MSG_ERRQUEUE)) 949 return sock_recv_errqueue(sk, msg, len, SOL_BLUETOOTH, 950 BT_SCM_ERROR); 951 952 lock_sock(sk); 953 954 if (sk->sk_state == BT_CONNECT2 && 955 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) { 956 sco_conn_defer_accept(pi->conn->hcon, pi->setting); 957 sk->sk_state = BT_CONFIG; 958 959 release_sock(sk); 960 return 0; 961 } 962 963 release_sock(sk); 964 965 return bt_sock_recvmsg(sock, msg, len, flags); 966 } 967 968 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, 969 sockptr_t optval, unsigned int optlen) 970 { 971 struct sock *sk = sock->sk; 972 int err = 0; 973 struct bt_voice voice; 974 u32 opt; 975 struct bt_codecs *codecs; 976 struct hci_dev *hdev; 977 __u8 buffer[255]; 978 979 BT_DBG("sk %p", sk); 980 981 lock_sock(sk); 982 983 switch (optname) { 984 985 case BT_DEFER_SETUP: 986 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 987 err = -EINVAL; 988 break; 989 } 990 991 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 992 if (err) 993 break; 994 995 if (opt) 996 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 997 else 998 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 999 break; 1000 1001 case BT_VOICE: 1002 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND && 1003 sk->sk_state != BT_CONNECT2) { 1004 err = -EINVAL; 1005 break; 1006 } 1007 1008 voice.setting = sco_pi(sk)->setting; 1009 1010 err = copy_safe_from_sockptr(&voice, sizeof(voice), optval, 1011 optlen); 1012 if (err) 1013 break; 1014 1015 sco_pi(sk)->setting = voice.setting; 1016 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, 1017 BDADDR_BREDR); 1018 if (!hdev) { 1019 err = -EBADFD; 1020 break; 1021 } 1022 1023 switch (sco_pi(sk)->setting & SCO_AIRMODE_MASK) { 1024 case SCO_AIRMODE_TRANSP: 1025 if (enhanced_sync_conn_capable(hdev)) 1026 sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT; 1027 break; 1028 } 1029 1030 hci_dev_put(hdev); 1031 break; 1032 1033 case BT_PKT_STATUS: 1034 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1035 if (err) 1036 break; 1037 1038 if (opt) 1039 set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags); 1040 else 1041 clear_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags); 1042 break; 1043 1044 case BT_CODEC: 1045 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND && 1046 sk->sk_state != BT_CONNECT2) { 1047 err = -EINVAL; 1048 break; 1049 } 1050 1051 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, 1052 BDADDR_BREDR); 1053 if (!hdev) { 1054 err = -EBADFD; 1055 break; 1056 } 1057 1058 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) { 1059 hci_dev_put(hdev); 1060 err = -EOPNOTSUPP; 1061 break; 1062 } 1063 1064 if (!hdev->get_data_path_id) { 1065 hci_dev_put(hdev); 1066 err = -EOPNOTSUPP; 1067 break; 1068 } 1069 1070 if (optlen < sizeof(struct bt_codecs) || 1071 optlen > sizeof(buffer)) { 1072 hci_dev_put(hdev); 1073 err = -EINVAL; 1074 break; 1075 } 1076 1077 err = copy_struct_from_sockptr(buffer, sizeof(buffer), optval, 1078 optlen); 1079 if (err) { 1080 hci_dev_put(hdev); 1081 break; 1082 } 1083 1084 codecs = (void *)buffer; 1085 1086 if (codecs->num_codecs != 1 || 1087 optlen < struct_size(codecs, codecs, codecs->num_codecs)) { 1088 hci_dev_put(hdev); 1089 err = -EINVAL; 1090 break; 1091 } 1092 1093 sco_pi(sk)->codec = codecs->codecs[0]; 1094 hci_dev_put(hdev); 1095 break; 1096 1097 default: 1098 err = -ENOPROTOOPT; 1099 break; 1100 } 1101 1102 release_sock(sk); 1103 return err; 1104 } 1105 1106 static int sco_sock_getsockopt_old(struct socket *sock, int optname, 1107 sockopt_t *opt) 1108 { 1109 struct sock *sk = sock->sk; 1110 struct sco_options opts; 1111 struct sco_conninfo cinfo; 1112 int err = 0; 1113 size_t len; 1114 1115 BT_DBG("sk %p", sk); 1116 1117 len = opt->optlen; 1118 1119 lock_sock(sk); 1120 1121 switch (optname) { 1122 case SCO_OPTIONS: 1123 if (sk->sk_state != BT_CONNECTED && 1124 !(sk->sk_state == BT_CONNECT2 && 1125 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 1126 err = -ENOTCONN; 1127 break; 1128 } 1129 1130 opts.mtu = sco_pi(sk)->conn->mtu; 1131 1132 BT_DBG("mtu %u", opts.mtu); 1133 1134 len = min(len, sizeof(opts)); 1135 if (copy_to_iter(&opts, len, &opt->iter_out) != len) 1136 err = -EFAULT; 1137 1138 break; 1139 1140 case SCO_CONNINFO: 1141 if (sk->sk_state != BT_CONNECTED && 1142 !(sk->sk_state == BT_CONNECT2 && 1143 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 1144 err = -ENOTCONN; 1145 break; 1146 } 1147 1148 memset(&cinfo, 0, sizeof(cinfo)); 1149 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle; 1150 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3); 1151 1152 len = min(len, sizeof(cinfo)); 1153 if (copy_to_iter(&cinfo, len, &opt->iter_out) != len) 1154 err = -EFAULT; 1155 1156 break; 1157 1158 default: 1159 err = -ENOPROTOOPT; 1160 break; 1161 } 1162 1163 release_sock(sk); 1164 return err; 1165 } 1166 1167 static int sco_sock_getsockopt(struct socket *sock, int level, int optname, 1168 sockopt_t *opt) 1169 { 1170 struct sock *sk = sock->sk; 1171 int len, val, err = 0; 1172 struct bt_voice voice; 1173 u32 phys; 1174 int buf_len; 1175 struct codec_list *c; 1176 u8 num_codecs, i; 1177 struct hci_dev *hdev; 1178 struct hci_codec_caps *caps; 1179 struct bt_codec codec; 1180 1181 BT_DBG("sk %p", sk); 1182 1183 if (level == SOL_SCO) 1184 return sco_sock_getsockopt_old(sock, optname, opt); 1185 1186 len = opt->optlen; 1187 1188 lock_sock(sk); 1189 1190 switch (optname) { 1191 1192 case BT_DEFER_SETUP: 1193 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 1194 err = -EINVAL; 1195 break; 1196 } 1197 1198 val = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 1199 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) != 1200 sizeof(val)) 1201 err = -EFAULT; 1202 1203 break; 1204 1205 case BT_VOICE: 1206 voice.setting = sco_pi(sk)->setting; 1207 1208 len = min_t(unsigned int, len, sizeof(voice)); 1209 if (copy_to_iter(&voice, len, &opt->iter_out) != len) 1210 err = -EFAULT; 1211 1212 break; 1213 1214 case BT_PHY: 1215 if (sk->sk_state != BT_CONNECTED) { 1216 err = -ENOTCONN; 1217 break; 1218 } 1219 1220 phys = hci_conn_get_phy(sco_pi(sk)->conn->hcon); 1221 1222 if (copy_to_iter(&phys, sizeof(phys), &opt->iter_out) != 1223 sizeof(phys)) 1224 err = -EFAULT; 1225 break; 1226 1227 case BT_PKT_STATUS: 1228 val = test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags); 1229 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) != 1230 sizeof(val)) 1231 err = -EFAULT; 1232 break; 1233 1234 case BT_SNDMTU: 1235 case BT_RCVMTU: 1236 if (sk->sk_state != BT_CONNECTED) { 1237 err = -ENOTCONN; 1238 break; 1239 } 1240 1241 val = sco_pi(sk)->conn->mtu; 1242 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) != 1243 sizeof(val)) 1244 err = -EFAULT; 1245 break; 1246 1247 case BT_CODEC: 1248 num_codecs = 0; 1249 buf_len = 0; 1250 1251 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR); 1252 if (!hdev) { 1253 err = -EBADFD; 1254 break; 1255 } 1256 1257 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) { 1258 hci_dev_put(hdev); 1259 err = -EOPNOTSUPP; 1260 break; 1261 } 1262 1263 if (!hdev->get_data_path_id) { 1264 hci_dev_put(hdev); 1265 err = -EOPNOTSUPP; 1266 break; 1267 } 1268 1269 release_sock(sk); 1270 1271 /* find total buffer size required to copy codec + caps */ 1272 hci_dev_lock(hdev); 1273 list_for_each_entry(c, &hdev->local_codecs, list) { 1274 if (c->transport != HCI_TRANSPORT_SCO_ESCO) 1275 continue; 1276 num_codecs++; 1277 for (i = 0, caps = c->caps; i < c->num_caps; i++) { 1278 buf_len += 1 + caps->len; 1279 caps = (void *)&caps->data[caps->len]; 1280 } 1281 buf_len += sizeof(struct bt_codec); 1282 } 1283 hci_dev_unlock(hdev); 1284 1285 buf_len += sizeof(struct bt_codecs); 1286 if (buf_len > len) { 1287 hci_dev_put(hdev); 1288 return -ENOBUFS; 1289 } 1290 1291 if (copy_to_iter(&num_codecs, sizeof(num_codecs), 1292 &opt->iter_out) != sizeof(num_codecs)) { 1293 hci_dev_put(hdev); 1294 return -EFAULT; 1295 } 1296 1297 /* Iterate all the codecs supported over SCO and populate 1298 * codec data 1299 */ 1300 hci_dev_lock(hdev); 1301 list_for_each_entry(c, &hdev->local_codecs, list) { 1302 if (c->transport != HCI_TRANSPORT_SCO_ESCO) 1303 continue; 1304 1305 codec.id = c->id; 1306 codec.cid = c->cid; 1307 codec.vid = c->vid; 1308 err = hdev->get_data_path_id(hdev, &codec.data_path); 1309 if (err < 0) 1310 break; 1311 codec.num_caps = c->num_caps; 1312 if (copy_to_iter(&codec, sizeof(codec), &opt->iter_out) 1313 != sizeof(codec)) { 1314 err = -EFAULT; 1315 break; 1316 } 1317 1318 /* find codec capabilities data length */ 1319 len = 0; 1320 for (i = 0, caps = c->caps; i < c->num_caps; i++) { 1321 len += 1 + caps->len; 1322 caps = (void *)&caps->data[caps->len]; 1323 } 1324 1325 /* copy codec capabilities data */ 1326 if (len && 1327 copy_to_iter(c->caps, len, &opt->iter_out) != len) { 1328 err = -EFAULT; 1329 break; 1330 } 1331 } 1332 1333 hci_dev_unlock(hdev); 1334 hci_dev_put(hdev); 1335 1336 lock_sock(sk); 1337 1338 if (!err) 1339 opt->optlen = buf_len; 1340 1341 break; 1342 1343 default: 1344 err = -ENOPROTOOPT; 1345 break; 1346 } 1347 1348 release_sock(sk); 1349 return err; 1350 } 1351 1352 static int sco_sock_shutdown(struct socket *sock, int how) 1353 { 1354 struct sock *sk = sock->sk; 1355 int err = 0; 1356 1357 BT_DBG("sock %p, sk %p", sock, sk); 1358 1359 if (!sk) 1360 return 0; 1361 1362 sock_hold(sk); 1363 lock_sock(sk); 1364 1365 if (!sk->sk_shutdown) { 1366 sk->sk_shutdown = SHUTDOWN_MASK; 1367 sco_sock_clear_timer(sk); 1368 __sco_sock_close(sk); 1369 1370 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 1371 !(current->flags & PF_EXITING)) 1372 err = bt_sock_wait_state(sk, BT_CLOSED, 1373 sk->sk_lingertime); 1374 } 1375 1376 release_sock(sk); 1377 sock_put(sk); 1378 1379 return err; 1380 } 1381 1382 static int sco_sock_release(struct socket *sock) 1383 { 1384 struct sock *sk = sock->sk; 1385 int err = 0; 1386 1387 BT_DBG("sock %p, sk %p", sock, sk); 1388 1389 if (!sk) 1390 return 0; 1391 1392 sco_sock_close(sk); 1393 1394 if (sock_flag(sk, SOCK_LINGER) && READ_ONCE(sk->sk_lingertime) && 1395 !(current->flags & PF_EXITING)) { 1396 lock_sock(sk); 1397 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); 1398 release_sock(sk); 1399 } 1400 1401 sock_orphan(sk); 1402 sco_sock_kill(sk); 1403 return err; 1404 } 1405 1406 static void sco_conn_ready(struct sco_conn *conn) 1407 { 1408 struct sock *parent, *sk; 1409 1410 sco_conn_lock(conn); 1411 sk = sco_sock_hold(conn); 1412 sco_conn_unlock(conn); 1413 1414 BT_DBG("conn %p", conn); 1415 1416 if (sk) { 1417 lock_sock(sk); 1418 1419 /* conn->sk may have become NULL if racing with sk close, but 1420 * due to held hdev->lock, it can't become different sk. 1421 */ 1422 if (conn->sk) { 1423 sco_sock_clear_timer(sk); 1424 sk->sk_state = BT_CONNECTED; 1425 sk->sk_state_change(sk); 1426 } 1427 1428 release_sock(sk); 1429 sock_put(sk); 1430 } else { 1431 if (!conn->hcon) 1432 return; 1433 1434 lockdep_assert_held(&conn->hcon->hdev->lock); 1435 1436 parent = sco_get_sock_listen(&conn->hcon->src); 1437 if (!parent) 1438 return; 1439 1440 lock_sock(parent); 1441 1442 sco_conn_lock(conn); 1443 1444 /* hdev->lock guarantees conn->sk == NULL still here */ 1445 1446 if (parent->sk_state != BT_LISTEN) 1447 goto release; 1448 1449 sk = sco_sock_alloc(sock_net(parent), NULL, 1450 BTPROTO_SCO, GFP_ATOMIC, 0); 1451 if (!sk) 1452 goto release; 1453 1454 sco_sock_init(sk, parent); 1455 1456 bacpy(&sco_pi(sk)->src, &conn->hcon->src); 1457 bacpy(&sco_pi(sk)->dst, &conn->hcon->dst); 1458 1459 __sco_chan_add(conn, sk, parent); 1460 1461 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) 1462 sk->sk_state = BT_CONNECT2; 1463 else 1464 sk->sk_state = BT_CONNECTED; 1465 1466 /* Wake up parent */ 1467 parent->sk_data_ready(parent); 1468 1469 release: 1470 sco_conn_unlock(conn); 1471 release_sock(parent); 1472 sock_put(parent); 1473 } 1474 } 1475 1476 /* ----- SCO interface with lower layer (HCI) ----- */ 1477 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) 1478 { 1479 struct sock *sk; 1480 int lm = 0; 1481 1482 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr); 1483 1484 /* Find listening sockets */ 1485 read_lock(&sco_sk_list.lock); 1486 sk_for_each(sk, &sco_sk_list.head) { 1487 if (sk->sk_state != BT_LISTEN) 1488 continue; 1489 1490 if (!bacmp(&sco_pi(sk)->src, &hdev->bdaddr) || 1491 !bacmp(&sco_pi(sk)->src, BDADDR_ANY)) { 1492 lm |= HCI_LM_ACCEPT; 1493 1494 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) 1495 *flags |= HCI_PROTO_DEFER; 1496 break; 1497 } 1498 } 1499 read_unlock(&sco_sk_list.lock); 1500 1501 return lm; 1502 } 1503 1504 static void sco_connect_cfm(struct hci_conn *hcon, __u8 status) 1505 { 1506 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) 1507 return; 1508 1509 BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status); 1510 1511 if (!status) { 1512 struct sco_conn *conn; 1513 1514 conn = sco_conn_add(hci_conn_hold(hcon)); 1515 if (conn) { 1516 sco_conn_ready(conn); 1517 sco_conn_put(conn); 1518 } else { 1519 hci_conn_drop(hcon); 1520 } 1521 } else 1522 sco_conn_del(hcon, bt_to_errno(status)); 1523 } 1524 1525 static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason) 1526 { 1527 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) 1528 return; 1529 1530 BT_DBG("hcon %p reason %d", hcon, reason); 1531 1532 sco_conn_del(hcon, bt_to_errno(reason)); 1533 } 1534 1535 int sco_recv_scodata(struct hci_dev *hdev, u16 handle, struct sk_buff *skb) 1536 { 1537 struct hci_conn *hcon; 1538 struct sco_conn *conn; 1539 1540 hci_dev_lock(hdev); 1541 1542 hcon = hci_conn_hash_lookup_handle(hdev, handle); 1543 if (!hcon) { 1544 hci_dev_unlock(hdev); 1545 kfree_skb(skb); 1546 return -ENOENT; 1547 } 1548 1549 conn = sco_conn_hold_unless_zero(hcon->sco_data); 1550 hcon = NULL; 1551 1552 hci_dev_unlock(hdev); 1553 1554 if (!conn) { 1555 kfree_skb(skb); 1556 return -EINVAL; 1557 } 1558 1559 BT_DBG("conn %p len %u", conn, skb->len); 1560 1561 if (skb->len) 1562 sco_recv_frame(conn, skb); 1563 else 1564 kfree_skb(skb); 1565 1566 sco_conn_put(conn); 1567 return 0; 1568 } 1569 1570 static struct hci_cb sco_cb = { 1571 .name = "SCO", 1572 .connect_cfm = sco_connect_cfm, 1573 .disconn_cfm = sco_disconn_cfm, 1574 }; 1575 1576 static int sco_debugfs_show(struct seq_file *f, void *p) 1577 { 1578 struct sock *sk; 1579 1580 read_lock(&sco_sk_list.lock); 1581 1582 sk_for_each(sk, &sco_sk_list.head) { 1583 seq_printf(f, "%pMR %pMR %d\n", &sco_pi(sk)->src, 1584 &sco_pi(sk)->dst, sk->sk_state); 1585 } 1586 1587 read_unlock(&sco_sk_list.lock); 1588 1589 return 0; 1590 } 1591 1592 DEFINE_SHOW_ATTRIBUTE(sco_debugfs); 1593 1594 static struct dentry *sco_debugfs; 1595 1596 static const struct proto_ops sco_sock_ops = { 1597 .family = PF_BLUETOOTH, 1598 .owner = THIS_MODULE, 1599 .release = sco_sock_release, 1600 .bind = sco_sock_bind, 1601 .connect = sco_sock_connect, 1602 .listen = sco_sock_listen, 1603 .accept = sco_sock_accept, 1604 .getname = sco_sock_getname, 1605 .sendmsg = sco_sock_sendmsg, 1606 .recvmsg = sco_sock_recvmsg, 1607 .poll = bt_sock_poll, 1608 .ioctl = bt_sock_ioctl, 1609 .gettstamp = sock_gettstamp, 1610 .mmap = sock_no_mmap, 1611 .socketpair = sock_no_socketpair, 1612 .shutdown = sco_sock_shutdown, 1613 .setsockopt = sco_sock_setsockopt, 1614 .getsockopt_iter = sco_sock_getsockopt 1615 }; 1616 1617 static const struct net_proto_family sco_sock_family_ops = { 1618 .family = PF_BLUETOOTH, 1619 .owner = THIS_MODULE, 1620 .create = sco_sock_create, 1621 }; 1622 1623 int __init sco_init(void) 1624 { 1625 int err; 1626 1627 BUILD_BUG_ON(sizeof(struct sockaddr_sco) > sizeof(struct sockaddr)); 1628 1629 err = proto_register(&sco_proto, 0); 1630 if (err < 0) 1631 return err; 1632 1633 err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops); 1634 if (err < 0) { 1635 BT_ERR("SCO socket registration failed"); 1636 goto error; 1637 } 1638 1639 err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL); 1640 if (err < 0) { 1641 BT_ERR("Failed to create SCO proc file"); 1642 bt_sock_unregister(BTPROTO_SCO); 1643 goto error; 1644 } 1645 1646 BT_INFO("SCO socket layer initialized"); 1647 1648 hci_register_cb(&sco_cb); 1649 1650 if (IS_ERR_OR_NULL(bt_debugfs)) 1651 return 0; 1652 1653 sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs, 1654 NULL, &sco_debugfs_fops); 1655 1656 return 0; 1657 1658 error: 1659 proto_unregister(&sco_proto); 1660 return err; 1661 } 1662 1663 void sco_exit(void) 1664 { 1665 bt_procfs_cleanup(&init_net, "sco"); 1666 1667 debugfs_remove(sco_debugfs); 1668 1669 hci_unregister_cb(&sco_cb); 1670 1671 bt_sock_unregister(BTPROTO_SCO); 1672 1673 proto_unregister(&sco_proto); 1674 } 1675 1676 module_param(disable_esco, bool, 0644); 1677 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation"); 1678