1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth SCO sockets. */ 26 27 #include <linux/module.h> 28 #include <linux/debugfs.h> 29 #include <linux/seq_file.h> 30 31 #include <net/bluetooth/bluetooth.h> 32 #include <net/bluetooth/hci_core.h> 33 #include <net/bluetooth/sco.h> 34 35 static bool disable_esco; 36 37 static const struct proto_ops sco_sock_ops; 38 39 static struct bt_sock_list sco_sk_list = { 40 .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock) 41 }; 42 43 /* ---- SCO connections ---- */ 44 struct sco_conn { 45 struct hci_conn *hcon; 46 47 spinlock_t lock; 48 struct sock *sk; 49 50 unsigned int mtu; 51 }; 52 53 #define sco_conn_lock(c) spin_lock(&c->lock); 54 #define sco_conn_unlock(c) spin_unlock(&c->lock); 55 56 static void sco_sock_close(struct sock *sk); 57 static void sco_sock_kill(struct sock *sk); 58 59 /* ----- SCO socket info ----- */ 60 #define sco_pi(sk) ((struct sco_pinfo *) sk) 61 62 struct sco_pinfo { 63 struct bt_sock bt; 64 bdaddr_t src; 65 bdaddr_t dst; 66 __u32 flags; 67 __u16 setting; 68 struct sco_conn *conn; 69 }; 70 71 /* ---- SCO timers ---- */ 72 #define SCO_CONN_TIMEOUT (HZ * 40) 73 #define SCO_DISCONN_TIMEOUT (HZ * 2) 74 75 static void sco_sock_timeout(unsigned long arg) 76 { 77 struct sock *sk = (struct sock *) arg; 78 79 BT_DBG("sock %p state %d", sk, sk->sk_state); 80 81 bh_lock_sock(sk); 82 sk->sk_err = ETIMEDOUT; 83 sk->sk_state_change(sk); 84 bh_unlock_sock(sk); 85 86 sco_sock_kill(sk); 87 sock_put(sk); 88 } 89 90 static void sco_sock_set_timer(struct sock *sk, long timeout) 91 { 92 BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout); 93 sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout); 94 } 95 96 static void sco_sock_clear_timer(struct sock *sk) 97 { 98 BT_DBG("sock %p state %d", sk, sk->sk_state); 99 sk_stop_timer(sk, &sk->sk_timer); 100 } 101 102 /* ---- SCO connections ---- */ 103 static struct sco_conn *sco_conn_add(struct hci_conn *hcon) 104 { 105 struct hci_dev *hdev = hcon->hdev; 106 struct sco_conn *conn = hcon->sco_data; 107 108 if (conn) 109 return conn; 110 111 conn = kzalloc(sizeof(struct sco_conn), GFP_KERNEL); 112 if (!conn) 113 return NULL; 114 115 spin_lock_init(&conn->lock); 116 117 hcon->sco_data = conn; 118 conn->hcon = hcon; 119 120 if (hdev->sco_mtu > 0) 121 conn->mtu = hdev->sco_mtu; 122 else 123 conn->mtu = 60; 124 125 BT_DBG("hcon %p conn %p", hcon, conn); 126 127 return conn; 128 } 129 130 /* Delete channel. 131 * Must be called on the locked socket. */ 132 static void sco_chan_del(struct sock *sk, int err) 133 { 134 struct sco_conn *conn; 135 136 conn = sco_pi(sk)->conn; 137 138 BT_DBG("sk %p, conn %p, err %d", sk, conn, err); 139 140 if (conn) { 141 sco_conn_lock(conn); 142 conn->sk = NULL; 143 sco_pi(sk)->conn = NULL; 144 sco_conn_unlock(conn); 145 146 if (conn->hcon) 147 hci_conn_drop(conn->hcon); 148 } 149 150 sk->sk_state = BT_CLOSED; 151 sk->sk_err = err; 152 sk->sk_state_change(sk); 153 154 sock_set_flag(sk, SOCK_ZAPPED); 155 } 156 157 static int sco_conn_del(struct hci_conn *hcon, int err) 158 { 159 struct sco_conn *conn = hcon->sco_data; 160 struct sock *sk; 161 162 if (!conn) 163 return 0; 164 165 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); 166 167 /* Kill socket */ 168 sco_conn_lock(conn); 169 sk = conn->sk; 170 sco_conn_unlock(conn); 171 172 if (sk) { 173 bh_lock_sock(sk); 174 sco_sock_clear_timer(sk); 175 sco_chan_del(sk, err); 176 bh_unlock_sock(sk); 177 sco_sock_kill(sk); 178 } 179 180 hcon->sco_data = NULL; 181 kfree(conn); 182 return 0; 183 } 184 185 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent) 186 { 187 BT_DBG("conn %p", conn); 188 189 sco_pi(sk)->conn = conn; 190 conn->sk = sk; 191 192 if (parent) 193 bt_accept_enqueue(parent, sk); 194 } 195 196 static int sco_chan_add(struct sco_conn *conn, struct sock *sk, 197 struct sock *parent) 198 { 199 int err = 0; 200 201 sco_conn_lock(conn); 202 if (conn->sk) 203 err = -EBUSY; 204 else 205 __sco_chan_add(conn, sk, parent); 206 207 sco_conn_unlock(conn); 208 return err; 209 } 210 211 static int sco_connect(struct sock *sk) 212 { 213 struct sco_conn *conn; 214 struct hci_conn *hcon; 215 struct hci_dev *hdev; 216 int err, type; 217 218 BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst); 219 220 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src); 221 if (!hdev) 222 return -EHOSTUNREACH; 223 224 hci_dev_lock(hdev); 225 226 if (lmp_esco_capable(hdev) && !disable_esco) 227 type = ESCO_LINK; 228 else 229 type = SCO_LINK; 230 231 if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT && 232 (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) { 233 err = -EOPNOTSUPP; 234 goto done; 235 } 236 237 hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst, 238 sco_pi(sk)->setting); 239 if (IS_ERR(hcon)) { 240 err = PTR_ERR(hcon); 241 goto done; 242 } 243 244 conn = sco_conn_add(hcon); 245 if (!conn) { 246 hci_conn_drop(hcon); 247 err = -ENOMEM; 248 goto done; 249 } 250 251 /* Update source addr of the socket */ 252 bacpy(&sco_pi(sk)->src, &hcon->src); 253 254 err = sco_chan_add(conn, sk, NULL); 255 if (err) 256 goto done; 257 258 if (hcon->state == BT_CONNECTED) { 259 sco_sock_clear_timer(sk); 260 sk->sk_state = BT_CONNECTED; 261 } else { 262 sk->sk_state = BT_CONNECT; 263 sco_sock_set_timer(sk, sk->sk_sndtimeo); 264 } 265 266 done: 267 hci_dev_unlock(hdev); 268 hci_dev_put(hdev); 269 return err; 270 } 271 272 static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len) 273 { 274 struct sco_conn *conn = sco_pi(sk)->conn; 275 struct sk_buff *skb; 276 int err; 277 278 /* Check outgoing MTU */ 279 if (len > conn->mtu) 280 return -EINVAL; 281 282 BT_DBG("sk %p len %d", sk, len); 283 284 skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err); 285 if (!skb) 286 return err; 287 288 if (memcpy_from_msg(skb_put(skb, len), msg, len)) { 289 kfree_skb(skb); 290 return -EFAULT; 291 } 292 293 hci_send_sco(conn->hcon, skb); 294 295 return len; 296 } 297 298 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb) 299 { 300 struct sock *sk; 301 302 sco_conn_lock(conn); 303 sk = conn->sk; 304 sco_conn_unlock(conn); 305 306 if (!sk) 307 goto drop; 308 309 BT_DBG("sk %p len %d", sk, skb->len); 310 311 if (sk->sk_state != BT_CONNECTED) 312 goto drop; 313 314 if (!sock_queue_rcv_skb(sk, skb)) 315 return; 316 317 drop: 318 kfree_skb(skb); 319 } 320 321 /* -------- Socket interface ---------- */ 322 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba) 323 { 324 struct sock *sk; 325 326 sk_for_each(sk, &sco_sk_list.head) { 327 if (sk->sk_state != BT_LISTEN) 328 continue; 329 330 if (!bacmp(&sco_pi(sk)->src, ba)) 331 return sk; 332 } 333 334 return NULL; 335 } 336 337 /* Find socket listening on source bdaddr. 338 * Returns closest match. 339 */ 340 static struct sock *sco_get_sock_listen(bdaddr_t *src) 341 { 342 struct sock *sk = NULL, *sk1 = NULL; 343 344 read_lock(&sco_sk_list.lock); 345 346 sk_for_each(sk, &sco_sk_list.head) { 347 if (sk->sk_state != BT_LISTEN) 348 continue; 349 350 /* Exact match. */ 351 if (!bacmp(&sco_pi(sk)->src, src)) 352 break; 353 354 /* Closest match */ 355 if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY)) 356 sk1 = sk; 357 } 358 359 read_unlock(&sco_sk_list.lock); 360 361 return sk ? sk : sk1; 362 } 363 364 static void sco_sock_destruct(struct sock *sk) 365 { 366 BT_DBG("sk %p", sk); 367 368 skb_queue_purge(&sk->sk_receive_queue); 369 skb_queue_purge(&sk->sk_write_queue); 370 } 371 372 static void sco_sock_cleanup_listen(struct sock *parent) 373 { 374 struct sock *sk; 375 376 BT_DBG("parent %p", parent); 377 378 /* Close not yet accepted channels */ 379 while ((sk = bt_accept_dequeue(parent, NULL))) { 380 sco_sock_close(sk); 381 sco_sock_kill(sk); 382 } 383 384 parent->sk_state = BT_CLOSED; 385 sock_set_flag(parent, SOCK_ZAPPED); 386 } 387 388 /* Kill socket (only if zapped and orphan) 389 * Must be called on unlocked socket. 390 */ 391 static void sco_sock_kill(struct sock *sk) 392 { 393 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 394 return; 395 396 BT_DBG("sk %p state %d", sk, sk->sk_state); 397 398 /* Kill poor orphan */ 399 bt_sock_unlink(&sco_sk_list, sk); 400 sock_set_flag(sk, SOCK_DEAD); 401 sock_put(sk); 402 } 403 404 static void __sco_sock_close(struct sock *sk) 405 { 406 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket); 407 408 switch (sk->sk_state) { 409 case BT_LISTEN: 410 sco_sock_cleanup_listen(sk); 411 break; 412 413 case BT_CONNECTED: 414 case BT_CONFIG: 415 if (sco_pi(sk)->conn->hcon) { 416 sk->sk_state = BT_DISCONN; 417 sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT); 418 hci_conn_drop(sco_pi(sk)->conn->hcon); 419 sco_pi(sk)->conn->hcon = NULL; 420 } else 421 sco_chan_del(sk, ECONNRESET); 422 break; 423 424 case BT_CONNECT2: 425 case BT_CONNECT: 426 case BT_DISCONN: 427 sco_chan_del(sk, ECONNRESET); 428 break; 429 430 default: 431 sock_set_flag(sk, SOCK_ZAPPED); 432 break; 433 } 434 } 435 436 /* Must be called on unlocked socket. */ 437 static void sco_sock_close(struct sock *sk) 438 { 439 sco_sock_clear_timer(sk); 440 lock_sock(sk); 441 __sco_sock_close(sk); 442 release_sock(sk); 443 sco_sock_kill(sk); 444 } 445 446 static void sco_sock_init(struct sock *sk, struct sock *parent) 447 { 448 BT_DBG("sk %p", sk); 449 450 if (parent) { 451 sk->sk_type = parent->sk_type; 452 bt_sk(sk)->flags = bt_sk(parent)->flags; 453 security_sk_clone(parent, sk); 454 } 455 } 456 457 static struct proto sco_proto = { 458 .name = "SCO", 459 .owner = THIS_MODULE, 460 .obj_size = sizeof(struct sco_pinfo) 461 }; 462 463 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio, int kern) 464 { 465 struct sock *sk; 466 467 sk = sk_alloc(net, PF_BLUETOOTH, prio, &sco_proto, kern); 468 if (!sk) 469 return NULL; 470 471 sock_init_data(sock, sk); 472 INIT_LIST_HEAD(&bt_sk(sk)->accept_q); 473 474 sk->sk_destruct = sco_sock_destruct; 475 sk->sk_sndtimeo = SCO_CONN_TIMEOUT; 476 477 sock_reset_flag(sk, SOCK_ZAPPED); 478 479 sk->sk_protocol = proto; 480 sk->sk_state = BT_OPEN; 481 482 sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT; 483 484 setup_timer(&sk->sk_timer, sco_sock_timeout, (unsigned long)sk); 485 486 bt_sock_link(&sco_sk_list, sk); 487 return sk; 488 } 489 490 static int sco_sock_create(struct net *net, struct socket *sock, int protocol, 491 int kern) 492 { 493 struct sock *sk; 494 495 BT_DBG("sock %p", sock); 496 497 sock->state = SS_UNCONNECTED; 498 499 if (sock->type != SOCK_SEQPACKET) 500 return -ESOCKTNOSUPPORT; 501 502 sock->ops = &sco_sock_ops; 503 504 sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern); 505 if (!sk) 506 return -ENOMEM; 507 508 sco_sock_init(sk, NULL); 509 return 0; 510 } 511 512 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len) 513 { 514 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 515 struct sock *sk = sock->sk; 516 int err = 0; 517 518 BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr); 519 520 if (!addr || addr->sa_family != AF_BLUETOOTH) 521 return -EINVAL; 522 523 lock_sock(sk); 524 525 if (sk->sk_state != BT_OPEN) { 526 err = -EBADFD; 527 goto done; 528 } 529 530 if (sk->sk_type != SOCK_SEQPACKET) { 531 err = -EINVAL; 532 goto done; 533 } 534 535 bacpy(&sco_pi(sk)->src, &sa->sco_bdaddr); 536 537 sk->sk_state = BT_BOUND; 538 539 done: 540 release_sock(sk); 541 return err; 542 } 543 544 static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags) 545 { 546 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 547 struct sock *sk = sock->sk; 548 int err; 549 550 BT_DBG("sk %p", sk); 551 552 if (alen < sizeof(struct sockaddr_sco) || 553 addr->sa_family != AF_BLUETOOTH) 554 return -EINVAL; 555 556 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) 557 return -EBADFD; 558 559 if (sk->sk_type != SOCK_SEQPACKET) 560 return -EINVAL; 561 562 lock_sock(sk); 563 564 /* Set destination address and psm */ 565 bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr); 566 567 err = sco_connect(sk); 568 if (err) 569 goto done; 570 571 err = bt_sock_wait_state(sk, BT_CONNECTED, 572 sock_sndtimeo(sk, flags & O_NONBLOCK)); 573 574 done: 575 release_sock(sk); 576 return err; 577 } 578 579 static int sco_sock_listen(struct socket *sock, int backlog) 580 { 581 struct sock *sk = sock->sk; 582 bdaddr_t *src = &sco_pi(sk)->src; 583 int err = 0; 584 585 BT_DBG("sk %p backlog %d", sk, backlog); 586 587 lock_sock(sk); 588 589 if (sk->sk_state != BT_BOUND) { 590 err = -EBADFD; 591 goto done; 592 } 593 594 if (sk->sk_type != SOCK_SEQPACKET) { 595 err = -EINVAL; 596 goto done; 597 } 598 599 write_lock(&sco_sk_list.lock); 600 601 if (__sco_get_sock_listen_by_addr(src)) { 602 err = -EADDRINUSE; 603 goto unlock; 604 } 605 606 sk->sk_max_ack_backlog = backlog; 607 sk->sk_ack_backlog = 0; 608 609 sk->sk_state = BT_LISTEN; 610 611 unlock: 612 write_unlock(&sco_sk_list.lock); 613 614 done: 615 release_sock(sk); 616 return err; 617 } 618 619 static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flags) 620 { 621 DEFINE_WAIT_FUNC(wait, woken_wake_function); 622 struct sock *sk = sock->sk, *ch; 623 long timeo; 624 int err = 0; 625 626 lock_sock(sk); 627 628 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK); 629 630 BT_DBG("sk %p timeo %ld", sk, timeo); 631 632 /* Wait for an incoming connection. (wake-one). */ 633 add_wait_queue_exclusive(sk_sleep(sk), &wait); 634 while (1) { 635 if (sk->sk_state != BT_LISTEN) { 636 err = -EBADFD; 637 break; 638 } 639 640 ch = bt_accept_dequeue(sk, newsock); 641 if (ch) 642 break; 643 644 if (!timeo) { 645 err = -EAGAIN; 646 break; 647 } 648 649 if (signal_pending(current)) { 650 err = sock_intr_errno(timeo); 651 break; 652 } 653 654 release_sock(sk); 655 656 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 657 lock_sock(sk); 658 } 659 remove_wait_queue(sk_sleep(sk), &wait); 660 661 if (err) 662 goto done; 663 664 newsock->state = SS_CONNECTED; 665 666 BT_DBG("new socket %p", ch); 667 668 done: 669 release_sock(sk); 670 return err; 671 } 672 673 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer) 674 { 675 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 676 struct sock *sk = sock->sk; 677 678 BT_DBG("sock %p, sk %p", sock, sk); 679 680 addr->sa_family = AF_BLUETOOTH; 681 *len = sizeof(struct sockaddr_sco); 682 683 if (peer) 684 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->dst); 685 else 686 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->src); 687 688 return 0; 689 } 690 691 static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg, 692 size_t len) 693 { 694 struct sock *sk = sock->sk; 695 int err; 696 697 BT_DBG("sock %p, sk %p", sock, sk); 698 699 err = sock_error(sk); 700 if (err) 701 return err; 702 703 if (msg->msg_flags & MSG_OOB) 704 return -EOPNOTSUPP; 705 706 lock_sock(sk); 707 708 if (sk->sk_state == BT_CONNECTED) 709 err = sco_send_frame(sk, msg, len); 710 else 711 err = -ENOTCONN; 712 713 release_sock(sk); 714 return err; 715 } 716 717 static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting) 718 { 719 struct hci_dev *hdev = conn->hdev; 720 721 BT_DBG("conn %p", conn); 722 723 conn->state = BT_CONFIG; 724 725 if (!lmp_esco_capable(hdev)) { 726 struct hci_cp_accept_conn_req cp; 727 728 bacpy(&cp.bdaddr, &conn->dst); 729 cp.role = 0x00; /* Ignored */ 730 731 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp); 732 } else { 733 struct hci_cp_accept_sync_conn_req cp; 734 735 bacpy(&cp.bdaddr, &conn->dst); 736 cp.pkt_type = cpu_to_le16(conn->pkt_type); 737 738 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 739 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 740 cp.content_format = cpu_to_le16(setting); 741 742 switch (setting & SCO_AIRMODE_MASK) { 743 case SCO_AIRMODE_TRANSP: 744 if (conn->pkt_type & ESCO_2EV3) 745 cp.max_latency = cpu_to_le16(0x0008); 746 else 747 cp.max_latency = cpu_to_le16(0x000D); 748 cp.retrans_effort = 0x02; 749 break; 750 case SCO_AIRMODE_CVSD: 751 cp.max_latency = cpu_to_le16(0xffff); 752 cp.retrans_effort = 0xff; 753 break; 754 } 755 756 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, 757 sizeof(cp), &cp); 758 } 759 } 760 761 static int sco_sock_recvmsg(struct socket *sock, struct msghdr *msg, 762 size_t len, int flags) 763 { 764 struct sock *sk = sock->sk; 765 struct sco_pinfo *pi = sco_pi(sk); 766 767 lock_sock(sk); 768 769 if (sk->sk_state == BT_CONNECT2 && 770 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) { 771 sco_conn_defer_accept(pi->conn->hcon, pi->setting); 772 sk->sk_state = BT_CONFIG; 773 774 release_sock(sk); 775 return 0; 776 } 777 778 release_sock(sk); 779 780 return bt_sock_recvmsg(sock, msg, len, flags); 781 } 782 783 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen) 784 { 785 struct sock *sk = sock->sk; 786 int len, err = 0; 787 struct bt_voice voice; 788 u32 opt; 789 790 BT_DBG("sk %p", sk); 791 792 lock_sock(sk); 793 794 switch (optname) { 795 796 case BT_DEFER_SETUP: 797 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 798 err = -EINVAL; 799 break; 800 } 801 802 if (get_user(opt, (u32 __user *) optval)) { 803 err = -EFAULT; 804 break; 805 } 806 807 if (opt) 808 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 809 else 810 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 811 break; 812 813 case BT_VOICE: 814 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND && 815 sk->sk_state != BT_CONNECT2) { 816 err = -EINVAL; 817 break; 818 } 819 820 voice.setting = sco_pi(sk)->setting; 821 822 len = min_t(unsigned int, sizeof(voice), optlen); 823 if (copy_from_user((char *) &voice, optval, len)) { 824 err = -EFAULT; 825 break; 826 } 827 828 /* Explicitly check for these values */ 829 if (voice.setting != BT_VOICE_TRANSPARENT && 830 voice.setting != BT_VOICE_CVSD_16BIT) { 831 err = -EINVAL; 832 break; 833 } 834 835 sco_pi(sk)->setting = voice.setting; 836 break; 837 838 default: 839 err = -ENOPROTOOPT; 840 break; 841 } 842 843 release_sock(sk); 844 return err; 845 } 846 847 static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen) 848 { 849 struct sock *sk = sock->sk; 850 struct sco_options opts; 851 struct sco_conninfo cinfo; 852 int len, err = 0; 853 854 BT_DBG("sk %p", sk); 855 856 if (get_user(len, optlen)) 857 return -EFAULT; 858 859 lock_sock(sk); 860 861 switch (optname) { 862 case SCO_OPTIONS: 863 if (sk->sk_state != BT_CONNECTED && 864 !(sk->sk_state == BT_CONNECT2 && 865 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 866 err = -ENOTCONN; 867 break; 868 } 869 870 opts.mtu = sco_pi(sk)->conn->mtu; 871 872 BT_DBG("mtu %d", opts.mtu); 873 874 len = min_t(unsigned int, len, sizeof(opts)); 875 if (copy_to_user(optval, (char *)&opts, len)) 876 err = -EFAULT; 877 878 break; 879 880 case SCO_CONNINFO: 881 if (sk->sk_state != BT_CONNECTED && 882 !(sk->sk_state == BT_CONNECT2 && 883 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 884 err = -ENOTCONN; 885 break; 886 } 887 888 memset(&cinfo, 0, sizeof(cinfo)); 889 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle; 890 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3); 891 892 len = min_t(unsigned int, len, sizeof(cinfo)); 893 if (copy_to_user(optval, (char *)&cinfo, len)) 894 err = -EFAULT; 895 896 break; 897 898 default: 899 err = -ENOPROTOOPT; 900 break; 901 } 902 903 release_sock(sk); 904 return err; 905 } 906 907 static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen) 908 { 909 struct sock *sk = sock->sk; 910 int len, err = 0; 911 struct bt_voice voice; 912 913 BT_DBG("sk %p", sk); 914 915 if (level == SOL_SCO) 916 return sco_sock_getsockopt_old(sock, optname, optval, optlen); 917 918 if (get_user(len, optlen)) 919 return -EFAULT; 920 921 lock_sock(sk); 922 923 switch (optname) { 924 925 case BT_DEFER_SETUP: 926 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 927 err = -EINVAL; 928 break; 929 } 930 931 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags), 932 (u32 __user *) optval)) 933 err = -EFAULT; 934 935 break; 936 937 case BT_VOICE: 938 voice.setting = sco_pi(sk)->setting; 939 940 len = min_t(unsigned int, len, sizeof(voice)); 941 if (copy_to_user(optval, (char *)&voice, len)) 942 err = -EFAULT; 943 944 break; 945 946 default: 947 err = -ENOPROTOOPT; 948 break; 949 } 950 951 release_sock(sk); 952 return err; 953 } 954 955 static int sco_sock_shutdown(struct socket *sock, int how) 956 { 957 struct sock *sk = sock->sk; 958 int err = 0; 959 960 BT_DBG("sock %p, sk %p", sock, sk); 961 962 if (!sk) 963 return 0; 964 965 lock_sock(sk); 966 if (!sk->sk_shutdown) { 967 sk->sk_shutdown = SHUTDOWN_MASK; 968 sco_sock_clear_timer(sk); 969 __sco_sock_close(sk); 970 971 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 972 !(current->flags & PF_EXITING)) 973 err = bt_sock_wait_state(sk, BT_CLOSED, 974 sk->sk_lingertime); 975 } 976 release_sock(sk); 977 return err; 978 } 979 980 static int sco_sock_release(struct socket *sock) 981 { 982 struct sock *sk = sock->sk; 983 int err = 0; 984 985 BT_DBG("sock %p, sk %p", sock, sk); 986 987 if (!sk) 988 return 0; 989 990 sco_sock_close(sk); 991 992 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 993 !(current->flags & PF_EXITING)) { 994 lock_sock(sk); 995 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); 996 release_sock(sk); 997 } 998 999 sock_orphan(sk); 1000 sco_sock_kill(sk); 1001 return err; 1002 } 1003 1004 static void sco_conn_ready(struct sco_conn *conn) 1005 { 1006 struct sock *parent; 1007 struct sock *sk = conn->sk; 1008 1009 BT_DBG("conn %p", conn); 1010 1011 if (sk) { 1012 sco_sock_clear_timer(sk); 1013 bh_lock_sock(sk); 1014 sk->sk_state = BT_CONNECTED; 1015 sk->sk_state_change(sk); 1016 bh_unlock_sock(sk); 1017 } else { 1018 sco_conn_lock(conn); 1019 1020 parent = sco_get_sock_listen(&conn->hcon->src); 1021 if (!parent) { 1022 sco_conn_unlock(conn); 1023 return; 1024 } 1025 1026 bh_lock_sock(parent); 1027 1028 sk = sco_sock_alloc(sock_net(parent), NULL, 1029 BTPROTO_SCO, GFP_ATOMIC, 0); 1030 if (!sk) { 1031 bh_unlock_sock(parent); 1032 sco_conn_unlock(conn); 1033 return; 1034 } 1035 1036 sco_sock_init(sk, parent); 1037 1038 bacpy(&sco_pi(sk)->src, &conn->hcon->src); 1039 bacpy(&sco_pi(sk)->dst, &conn->hcon->dst); 1040 1041 hci_conn_hold(conn->hcon); 1042 __sco_chan_add(conn, sk, parent); 1043 1044 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) 1045 sk->sk_state = BT_CONNECT2; 1046 else 1047 sk->sk_state = BT_CONNECTED; 1048 1049 /* Wake up parent */ 1050 parent->sk_data_ready(parent); 1051 1052 bh_unlock_sock(parent); 1053 1054 sco_conn_unlock(conn); 1055 } 1056 } 1057 1058 /* ----- SCO interface with lower layer (HCI) ----- */ 1059 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) 1060 { 1061 struct sock *sk; 1062 int lm = 0; 1063 1064 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr); 1065 1066 /* Find listening sockets */ 1067 read_lock(&sco_sk_list.lock); 1068 sk_for_each(sk, &sco_sk_list.head) { 1069 if (sk->sk_state != BT_LISTEN) 1070 continue; 1071 1072 if (!bacmp(&sco_pi(sk)->src, &hdev->bdaddr) || 1073 !bacmp(&sco_pi(sk)->src, BDADDR_ANY)) { 1074 lm |= HCI_LM_ACCEPT; 1075 1076 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) 1077 *flags |= HCI_PROTO_DEFER; 1078 break; 1079 } 1080 } 1081 read_unlock(&sco_sk_list.lock); 1082 1083 return lm; 1084 } 1085 1086 static void sco_connect_cfm(struct hci_conn *hcon, __u8 status) 1087 { 1088 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) 1089 return; 1090 1091 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status); 1092 1093 if (!status) { 1094 struct sco_conn *conn; 1095 1096 conn = sco_conn_add(hcon); 1097 if (conn) 1098 sco_conn_ready(conn); 1099 } else 1100 sco_conn_del(hcon, bt_to_errno(status)); 1101 } 1102 1103 static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason) 1104 { 1105 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) 1106 return; 1107 1108 BT_DBG("hcon %p reason %d", hcon, reason); 1109 1110 sco_conn_del(hcon, bt_to_errno(reason)); 1111 } 1112 1113 void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb) 1114 { 1115 struct sco_conn *conn = hcon->sco_data; 1116 1117 if (!conn) 1118 goto drop; 1119 1120 BT_DBG("conn %p len %d", conn, skb->len); 1121 1122 if (skb->len) { 1123 sco_recv_frame(conn, skb); 1124 return; 1125 } 1126 1127 drop: 1128 kfree_skb(skb); 1129 } 1130 1131 static struct hci_cb sco_cb = { 1132 .name = "SCO", 1133 .connect_cfm = sco_connect_cfm, 1134 .disconn_cfm = sco_disconn_cfm, 1135 }; 1136 1137 static int sco_debugfs_show(struct seq_file *f, void *p) 1138 { 1139 struct sock *sk; 1140 1141 read_lock(&sco_sk_list.lock); 1142 1143 sk_for_each(sk, &sco_sk_list.head) { 1144 seq_printf(f, "%pMR %pMR %d\n", &sco_pi(sk)->src, 1145 &sco_pi(sk)->dst, sk->sk_state); 1146 } 1147 1148 read_unlock(&sco_sk_list.lock); 1149 1150 return 0; 1151 } 1152 1153 static int sco_debugfs_open(struct inode *inode, struct file *file) 1154 { 1155 return single_open(file, sco_debugfs_show, inode->i_private); 1156 } 1157 1158 static const struct file_operations sco_debugfs_fops = { 1159 .open = sco_debugfs_open, 1160 .read = seq_read, 1161 .llseek = seq_lseek, 1162 .release = single_release, 1163 }; 1164 1165 static struct dentry *sco_debugfs; 1166 1167 static const struct proto_ops sco_sock_ops = { 1168 .family = PF_BLUETOOTH, 1169 .owner = THIS_MODULE, 1170 .release = sco_sock_release, 1171 .bind = sco_sock_bind, 1172 .connect = sco_sock_connect, 1173 .listen = sco_sock_listen, 1174 .accept = sco_sock_accept, 1175 .getname = sco_sock_getname, 1176 .sendmsg = sco_sock_sendmsg, 1177 .recvmsg = sco_sock_recvmsg, 1178 .poll = bt_sock_poll, 1179 .ioctl = bt_sock_ioctl, 1180 .mmap = sock_no_mmap, 1181 .socketpair = sock_no_socketpair, 1182 .shutdown = sco_sock_shutdown, 1183 .setsockopt = sco_sock_setsockopt, 1184 .getsockopt = sco_sock_getsockopt 1185 }; 1186 1187 static const struct net_proto_family sco_sock_family_ops = { 1188 .family = PF_BLUETOOTH, 1189 .owner = THIS_MODULE, 1190 .create = sco_sock_create, 1191 }; 1192 1193 int __init sco_init(void) 1194 { 1195 int err; 1196 1197 BUILD_BUG_ON(sizeof(struct sockaddr_sco) > sizeof(struct sockaddr)); 1198 1199 err = proto_register(&sco_proto, 0); 1200 if (err < 0) 1201 return err; 1202 1203 err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops); 1204 if (err < 0) { 1205 BT_ERR("SCO socket registration failed"); 1206 goto error; 1207 } 1208 1209 err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL); 1210 if (err < 0) { 1211 BT_ERR("Failed to create SCO proc file"); 1212 bt_sock_unregister(BTPROTO_SCO); 1213 goto error; 1214 } 1215 1216 BT_INFO("SCO socket layer initialized"); 1217 1218 hci_register_cb(&sco_cb); 1219 1220 if (IS_ERR_OR_NULL(bt_debugfs)) 1221 return 0; 1222 1223 sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs, 1224 NULL, &sco_debugfs_fops); 1225 1226 return 0; 1227 1228 error: 1229 proto_unregister(&sco_proto); 1230 return err; 1231 } 1232 1233 void sco_exit(void) 1234 { 1235 bt_procfs_cleanup(&init_net, "sco"); 1236 1237 debugfs_remove(sco_debugfs); 1238 1239 hci_unregister_cb(&sco_cb); 1240 1241 bt_sock_unregister(BTPROTO_SCO); 1242 1243 proto_unregister(&sco_proto); 1244 } 1245 1246 module_param(disable_esco, bool, 0644); 1247 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation"); 1248