xref: /linux/net/bluetooth/sco.c (revision d39d0ed196aa1685bb24771e92f78633c66ac9cb)
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4 
5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6 
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License version 2 as
9    published by the Free Software Foundation;
10 
11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 
20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22    SOFTWARE IS DISCLAIMED.
23 */
24 
25 /* Bluetooth SCO sockets. */
26 
27 #include <linux/module.h>
28 
29 #include <linux/types.h>
30 #include <linux/errno.h>
31 #include <linux/kernel.h>
32 #include <linux/sched.h>
33 #include <linux/slab.h>
34 #include <linux/poll.h>
35 #include <linux/fcntl.h>
36 #include <linux/init.h>
37 #include <linux/interrupt.h>
38 #include <linux/socket.h>
39 #include <linux/skbuff.h>
40 #include <linux/device.h>
41 #include <linux/debugfs.h>
42 #include <linux/seq_file.h>
43 #include <linux/list.h>
44 #include <net/sock.h>
45 
46 #include <asm/system.h>
47 #include <asm/uaccess.h>
48 
49 #include <net/bluetooth/bluetooth.h>
50 #include <net/bluetooth/hci_core.h>
51 #include <net/bluetooth/sco.h>
52 
53 #define VERSION "0.6"
54 
55 static int disable_esco = 0;
56 
57 static const struct proto_ops sco_sock_ops;
58 
59 static struct bt_sock_list sco_sk_list = {
60 	.lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
61 };
62 
63 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent);
64 static void sco_chan_del(struct sock *sk, int err);
65 
66 static int  sco_conn_del(struct hci_conn *conn, int err);
67 
68 static void sco_sock_close(struct sock *sk);
69 static void sco_sock_kill(struct sock *sk);
70 
71 /* ---- SCO timers ---- */
72 static void sco_sock_timeout(unsigned long arg)
73 {
74 	struct sock *sk = (struct sock *) arg;
75 
76 	BT_DBG("sock %p state %d", sk, sk->sk_state);
77 
78 	bh_lock_sock(sk);
79 	sk->sk_err = ETIMEDOUT;
80 	sk->sk_state_change(sk);
81 	bh_unlock_sock(sk);
82 
83 	sco_sock_kill(sk);
84 	sock_put(sk);
85 }
86 
87 static void sco_sock_set_timer(struct sock *sk, long timeout)
88 {
89 	BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
90 	sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
91 }
92 
93 static void sco_sock_clear_timer(struct sock *sk)
94 {
95 	BT_DBG("sock %p state %d", sk, sk->sk_state);
96 	sk_stop_timer(sk, &sk->sk_timer);
97 }
98 
99 /* ---- SCO connections ---- */
100 static struct sco_conn *sco_conn_add(struct hci_conn *hcon, __u8 status)
101 {
102 	struct hci_dev *hdev = hcon->hdev;
103 	struct sco_conn *conn = hcon->sco_data;
104 
105 	if (conn || status)
106 		return conn;
107 
108 	conn = kzalloc(sizeof(struct sco_conn), GFP_ATOMIC);
109 	if (!conn)
110 		return NULL;
111 
112 	spin_lock_init(&conn->lock);
113 
114 	hcon->sco_data = conn;
115 	conn->hcon = hcon;
116 
117 	conn->src = &hdev->bdaddr;
118 	conn->dst = &hcon->dst;
119 
120 	if (hdev->sco_mtu > 0)
121 		conn->mtu = hdev->sco_mtu;
122 	else
123 		conn->mtu = 60;
124 
125 	BT_DBG("hcon %p conn %p", hcon, conn);
126 
127 	return conn;
128 }
129 
130 static inline struct sock *sco_chan_get(struct sco_conn *conn)
131 {
132 	struct sock *sk = NULL;
133 	sco_conn_lock(conn);
134 	sk = conn->sk;
135 	sco_conn_unlock(conn);
136 	return sk;
137 }
138 
139 static int sco_conn_del(struct hci_conn *hcon, int err)
140 {
141 	struct sco_conn *conn;
142 	struct sock *sk;
143 
144 	if (!(conn = hcon->sco_data))
145 		return 0;
146 
147 	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
148 
149 	/* Kill socket */
150 	if ((sk = sco_chan_get(conn))) {
151 		bh_lock_sock(sk);
152 		sco_sock_clear_timer(sk);
153 		sco_chan_del(sk, err);
154 		bh_unlock_sock(sk);
155 		sco_sock_kill(sk);
156 	}
157 
158 	hcon->sco_data = NULL;
159 	kfree(conn);
160 	return 0;
161 }
162 
163 static inline int sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
164 {
165 	int err = 0;
166 
167 	sco_conn_lock(conn);
168 	if (conn->sk)
169 		err = -EBUSY;
170 	else
171 		__sco_chan_add(conn, sk, parent);
172 
173 	sco_conn_unlock(conn);
174 	return err;
175 }
176 
177 static int sco_connect(struct sock *sk)
178 {
179 	bdaddr_t *src = &bt_sk(sk)->src;
180 	bdaddr_t *dst = &bt_sk(sk)->dst;
181 	struct sco_conn *conn;
182 	struct hci_conn *hcon;
183 	struct hci_dev  *hdev;
184 	int err, type;
185 
186 	BT_DBG("%s -> %s", batostr(src), batostr(dst));
187 
188 	if (!(hdev = hci_get_route(dst, src)))
189 		return -EHOSTUNREACH;
190 
191 	hci_dev_lock_bh(hdev);
192 
193 	err = -ENOMEM;
194 
195 	if (lmp_esco_capable(hdev) && !disable_esco)
196 		type = ESCO_LINK;
197 	else
198 		type = SCO_LINK;
199 
200 	hcon = hci_connect(hdev, type, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
201 	if (!hcon)
202 		goto done;
203 
204 	conn = sco_conn_add(hcon, 0);
205 	if (!conn) {
206 		hci_conn_put(hcon);
207 		goto done;
208 	}
209 
210 	/* Update source addr of the socket */
211 	bacpy(src, conn->src);
212 
213 	err = sco_chan_add(conn, sk, NULL);
214 	if (err)
215 		goto done;
216 
217 	if (hcon->state == BT_CONNECTED) {
218 		sco_sock_clear_timer(sk);
219 		sk->sk_state = BT_CONNECTED;
220 	} else {
221 		sk->sk_state = BT_CONNECT;
222 		sco_sock_set_timer(sk, sk->sk_sndtimeo);
223 	}
224 
225 done:
226 	hci_dev_unlock_bh(hdev);
227 	hci_dev_put(hdev);
228 	return err;
229 }
230 
231 static inline int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
232 {
233 	struct sco_conn *conn = sco_pi(sk)->conn;
234 	struct sk_buff *skb;
235 	int err, count;
236 
237 	/* Check outgoing MTU */
238 	if (len > conn->mtu)
239 		return -EINVAL;
240 
241 	BT_DBG("sk %p len %d", sk, len);
242 
243 	count = min_t(unsigned int, conn->mtu, len);
244 	skb = bt_skb_send_alloc(sk, count,
245 			msg->msg_flags & MSG_DONTWAIT, &err);
246 	if (!skb)
247 		return err;
248 
249 	if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
250 		kfree_skb(skb);
251 		return -EFAULT;
252 	}
253 
254 	hci_send_sco(conn->hcon, skb);
255 
256 	return count;
257 }
258 
259 static inline void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
260 {
261 	struct sock *sk = sco_chan_get(conn);
262 
263 	if (!sk)
264 		goto drop;
265 
266 	BT_DBG("sk %p len %d", sk, skb->len);
267 
268 	if (sk->sk_state != BT_CONNECTED)
269 		goto drop;
270 
271 	if (!sock_queue_rcv_skb(sk, skb))
272 		return;
273 
274 drop:
275 	kfree_skb(skb);
276 }
277 
278 /* -------- Socket interface ---------- */
279 static struct sock *__sco_get_sock_by_addr(bdaddr_t *ba)
280 {
281 	struct sock *sk;
282 	struct hlist_node *node;
283 
284 	sk_for_each(sk, node, &sco_sk_list.head)
285 		if (!bacmp(&bt_sk(sk)->src, ba))
286 			goto found;
287 	sk = NULL;
288 found:
289 	return sk;
290 }
291 
292 /* Find socket listening on source bdaddr.
293  * Returns closest match.
294  */
295 static struct sock *sco_get_sock_listen(bdaddr_t *src)
296 {
297 	struct sock *sk = NULL, *sk1 = NULL;
298 	struct hlist_node *node;
299 
300 	read_lock(&sco_sk_list.lock);
301 
302 	sk_for_each(sk, node, &sco_sk_list.head) {
303 		if (sk->sk_state != BT_LISTEN)
304 			continue;
305 
306 		/* Exact match. */
307 		if (!bacmp(&bt_sk(sk)->src, src))
308 			break;
309 
310 		/* Closest match */
311 		if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
312 			sk1 = sk;
313 	}
314 
315 	read_unlock(&sco_sk_list.lock);
316 
317 	return node ? sk : sk1;
318 }
319 
320 static void sco_sock_destruct(struct sock *sk)
321 {
322 	BT_DBG("sk %p", sk);
323 
324 	skb_queue_purge(&sk->sk_receive_queue);
325 	skb_queue_purge(&sk->sk_write_queue);
326 }
327 
328 static void sco_sock_cleanup_listen(struct sock *parent)
329 {
330 	struct sock *sk;
331 
332 	BT_DBG("parent %p", parent);
333 
334 	/* Close not yet accepted channels */
335 	while ((sk = bt_accept_dequeue(parent, NULL))) {
336 		sco_sock_close(sk);
337 		sco_sock_kill(sk);
338 	}
339 
340 	parent->sk_state  = BT_CLOSED;
341 	sock_set_flag(parent, SOCK_ZAPPED);
342 }
343 
344 /* Kill socket (only if zapped and orphan)
345  * Must be called on unlocked socket.
346  */
347 static void sco_sock_kill(struct sock *sk)
348 {
349 	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
350 		return;
351 
352 	BT_DBG("sk %p state %d", sk, sk->sk_state);
353 
354 	/* Kill poor orphan */
355 	bt_sock_unlink(&sco_sk_list, sk);
356 	sock_set_flag(sk, SOCK_DEAD);
357 	sock_put(sk);
358 }
359 
360 static void __sco_sock_close(struct sock *sk)
361 {
362 	BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
363 
364 	switch (sk->sk_state) {
365 	case BT_LISTEN:
366 		sco_sock_cleanup_listen(sk);
367 		break;
368 
369 	case BT_CONNECTED:
370 	case BT_CONFIG:
371 	case BT_CONNECT:
372 	case BT_DISCONN:
373 		sco_chan_del(sk, ECONNRESET);
374 		break;
375 
376 	default:
377 		sock_set_flag(sk, SOCK_ZAPPED);
378 		break;
379 	}
380 }
381 
382 /* Must be called on unlocked socket. */
383 static void sco_sock_close(struct sock *sk)
384 {
385 	sco_sock_clear_timer(sk);
386 	lock_sock(sk);
387 	__sco_sock_close(sk);
388 	release_sock(sk);
389 	sco_sock_kill(sk);
390 }
391 
392 static void sco_sock_init(struct sock *sk, struct sock *parent)
393 {
394 	BT_DBG("sk %p", sk);
395 
396 	if (parent)
397 		sk->sk_type = parent->sk_type;
398 }
399 
400 static struct proto sco_proto = {
401 	.name		= "SCO",
402 	.owner		= THIS_MODULE,
403 	.obj_size	= sizeof(struct sco_pinfo)
404 };
405 
406 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
407 {
408 	struct sock *sk;
409 
410 	sk = sk_alloc(net, PF_BLUETOOTH, prio, &sco_proto);
411 	if (!sk)
412 		return NULL;
413 
414 	sock_init_data(sock, sk);
415 	INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
416 
417 	sk->sk_destruct = sco_sock_destruct;
418 	sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
419 
420 	sock_reset_flag(sk, SOCK_ZAPPED);
421 
422 	sk->sk_protocol = proto;
423 	sk->sk_state    = BT_OPEN;
424 
425 	setup_timer(&sk->sk_timer, sco_sock_timeout, (unsigned long)sk);
426 
427 	bt_sock_link(&sco_sk_list, sk);
428 	return sk;
429 }
430 
431 static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
432 			   int kern)
433 {
434 	struct sock *sk;
435 
436 	BT_DBG("sock %p", sock);
437 
438 	sock->state = SS_UNCONNECTED;
439 
440 	if (sock->type != SOCK_SEQPACKET)
441 		return -ESOCKTNOSUPPORT;
442 
443 	sock->ops = &sco_sock_ops;
444 
445 	sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC);
446 	if (!sk)
447 		return -ENOMEM;
448 
449 	sco_sock_init(sk, NULL);
450 	return 0;
451 }
452 
453 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
454 {
455 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
456 	struct sock *sk = sock->sk;
457 	bdaddr_t *src = &sa->sco_bdaddr;
458 	int err = 0;
459 
460 	BT_DBG("sk %p %s", sk, batostr(&sa->sco_bdaddr));
461 
462 	if (!addr || addr->sa_family != AF_BLUETOOTH)
463 		return -EINVAL;
464 
465 	lock_sock(sk);
466 
467 	if (sk->sk_state != BT_OPEN) {
468 		err = -EBADFD;
469 		goto done;
470 	}
471 
472 	write_lock_bh(&sco_sk_list.lock);
473 
474 	if (bacmp(src, BDADDR_ANY) && __sco_get_sock_by_addr(src)) {
475 		err = -EADDRINUSE;
476 	} else {
477 		/* Save source address */
478 		bacpy(&bt_sk(sk)->src, &sa->sco_bdaddr);
479 		sk->sk_state = BT_BOUND;
480 	}
481 
482 	write_unlock_bh(&sco_sk_list.lock);
483 
484 done:
485 	release_sock(sk);
486 	return err;
487 }
488 
489 static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
490 {
491 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
492 	struct sock *sk = sock->sk;
493 	int err = 0;
494 
495 
496 	BT_DBG("sk %p", sk);
497 
498 	if (alen < sizeof(struct sockaddr_sco) ||
499 	    addr->sa_family != AF_BLUETOOTH)
500 		return -EINVAL;
501 
502 	if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
503 		return -EBADFD;
504 
505 	if (sk->sk_type != SOCK_SEQPACKET)
506 		return -EINVAL;
507 
508 	lock_sock(sk);
509 
510 	/* Set destination address and psm */
511 	bacpy(&bt_sk(sk)->dst, &sa->sco_bdaddr);
512 
513 	if ((err = sco_connect(sk)))
514 		goto done;
515 
516 	err = bt_sock_wait_state(sk, BT_CONNECTED,
517 			sock_sndtimeo(sk, flags & O_NONBLOCK));
518 
519 done:
520 	release_sock(sk);
521 	return err;
522 }
523 
524 static int sco_sock_listen(struct socket *sock, int backlog)
525 {
526 	struct sock *sk = sock->sk;
527 	int err = 0;
528 
529 	BT_DBG("sk %p backlog %d", sk, backlog);
530 
531 	lock_sock(sk);
532 
533 	if (sk->sk_state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
534 		err = -EBADFD;
535 		goto done;
536 	}
537 
538 	sk->sk_max_ack_backlog = backlog;
539 	sk->sk_ack_backlog = 0;
540 	sk->sk_state = BT_LISTEN;
541 
542 done:
543 	release_sock(sk);
544 	return err;
545 }
546 
547 static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flags)
548 {
549 	DECLARE_WAITQUEUE(wait, current);
550 	struct sock *sk = sock->sk, *ch;
551 	long timeo;
552 	int err = 0;
553 
554 	lock_sock(sk);
555 
556 	if (sk->sk_state != BT_LISTEN) {
557 		err = -EBADFD;
558 		goto done;
559 	}
560 
561 	timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
562 
563 	BT_DBG("sk %p timeo %ld", sk, timeo);
564 
565 	/* Wait for an incoming connection. (wake-one). */
566 	add_wait_queue_exclusive(sk_sleep(sk), &wait);
567 	while (!(ch = bt_accept_dequeue(sk, newsock))) {
568 		set_current_state(TASK_INTERRUPTIBLE);
569 		if (!timeo) {
570 			err = -EAGAIN;
571 			break;
572 		}
573 
574 		release_sock(sk);
575 		timeo = schedule_timeout(timeo);
576 		lock_sock(sk);
577 
578 		if (sk->sk_state != BT_LISTEN) {
579 			err = -EBADFD;
580 			break;
581 		}
582 
583 		if (signal_pending(current)) {
584 			err = sock_intr_errno(timeo);
585 			break;
586 		}
587 	}
588 	set_current_state(TASK_RUNNING);
589 	remove_wait_queue(sk_sleep(sk), &wait);
590 
591 	if (err)
592 		goto done;
593 
594 	newsock->state = SS_CONNECTED;
595 
596 	BT_DBG("new socket %p", ch);
597 
598 done:
599 	release_sock(sk);
600 	return err;
601 }
602 
603 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
604 {
605 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
606 	struct sock *sk = sock->sk;
607 
608 	BT_DBG("sock %p, sk %p", sock, sk);
609 
610 	addr->sa_family = AF_BLUETOOTH;
611 	*len = sizeof(struct sockaddr_sco);
612 
613 	if (peer)
614 		bacpy(&sa->sco_bdaddr, &bt_sk(sk)->dst);
615 	else
616 		bacpy(&sa->sco_bdaddr, &bt_sk(sk)->src);
617 
618 	return 0;
619 }
620 
621 static int sco_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
622 			    struct msghdr *msg, size_t len)
623 {
624 	struct sock *sk = sock->sk;
625 	int err;
626 
627 	BT_DBG("sock %p, sk %p", sock, sk);
628 
629 	err = sock_error(sk);
630 	if (err)
631 		return err;
632 
633 	if (msg->msg_flags & MSG_OOB)
634 		return -EOPNOTSUPP;
635 
636 	lock_sock(sk);
637 
638 	if (sk->sk_state == BT_CONNECTED)
639 		err = sco_send_frame(sk, msg, len);
640 	else
641 		err = -ENOTCONN;
642 
643 	release_sock(sk);
644 	return err;
645 }
646 
647 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
648 {
649 	struct sock *sk = sock->sk;
650 	int err = 0;
651 
652 	BT_DBG("sk %p", sk);
653 
654 	lock_sock(sk);
655 
656 	switch (optname) {
657 	default:
658 		err = -ENOPROTOOPT;
659 		break;
660 	}
661 
662 	release_sock(sk);
663 	return err;
664 }
665 
666 static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
667 {
668 	struct sock *sk = sock->sk;
669 	struct sco_options opts;
670 	struct sco_conninfo cinfo;
671 	int len, err = 0;
672 
673 	BT_DBG("sk %p", sk);
674 
675 	if (get_user(len, optlen))
676 		return -EFAULT;
677 
678 	lock_sock(sk);
679 
680 	switch (optname) {
681 	case SCO_OPTIONS:
682 		if (sk->sk_state != BT_CONNECTED) {
683 			err = -ENOTCONN;
684 			break;
685 		}
686 
687 		opts.mtu = sco_pi(sk)->conn->mtu;
688 
689 		BT_DBG("mtu %d", opts.mtu);
690 
691 		len = min_t(unsigned int, len, sizeof(opts));
692 		if (copy_to_user(optval, (char *)&opts, len))
693 			err = -EFAULT;
694 
695 		break;
696 
697 	case SCO_CONNINFO:
698 		if (sk->sk_state != BT_CONNECTED) {
699 			err = -ENOTCONN;
700 			break;
701 		}
702 
703 		cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
704 		memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
705 
706 		len = min_t(unsigned int, len, sizeof(cinfo));
707 		if (copy_to_user(optval, (char *)&cinfo, len))
708 			err = -EFAULT;
709 
710 		break;
711 
712 	default:
713 		err = -ENOPROTOOPT;
714 		break;
715 	}
716 
717 	release_sock(sk);
718 	return err;
719 }
720 
721 static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
722 {
723 	struct sock *sk = sock->sk;
724 	int len, err = 0;
725 
726 	BT_DBG("sk %p", sk);
727 
728 	if (level == SOL_SCO)
729 		return sco_sock_getsockopt_old(sock, optname, optval, optlen);
730 
731 	if (get_user(len, optlen))
732 		return -EFAULT;
733 
734 	lock_sock(sk);
735 
736 	switch (optname) {
737 	default:
738 		err = -ENOPROTOOPT;
739 		break;
740 	}
741 
742 	release_sock(sk);
743 	return err;
744 }
745 
746 static int sco_sock_shutdown(struct socket *sock, int how)
747 {
748 	struct sock *sk = sock->sk;
749 	int err = 0;
750 
751 	BT_DBG("sock %p, sk %p", sock, sk);
752 
753 	if (!sk)
754 		return 0;
755 
756 	lock_sock(sk);
757 	if (!sk->sk_shutdown) {
758 		sk->sk_shutdown = SHUTDOWN_MASK;
759 		sco_sock_clear_timer(sk);
760 		__sco_sock_close(sk);
761 
762 		if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
763 			err = bt_sock_wait_state(sk, BT_CLOSED,
764 							sk->sk_lingertime);
765 	}
766 	release_sock(sk);
767 	return err;
768 }
769 
770 static int sco_sock_release(struct socket *sock)
771 {
772 	struct sock *sk = sock->sk;
773 	int err = 0;
774 
775 	BT_DBG("sock %p, sk %p", sock, sk);
776 
777 	if (!sk)
778 		return 0;
779 
780 	sco_sock_close(sk);
781 
782 	if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) {
783 		lock_sock(sk);
784 		err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
785 		release_sock(sk);
786 	}
787 
788 	sock_orphan(sk);
789 	sco_sock_kill(sk);
790 	return err;
791 }
792 
793 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
794 {
795 	BT_DBG("conn %p", conn);
796 
797 	sco_pi(sk)->conn = conn;
798 	conn->sk = sk;
799 
800 	if (parent)
801 		bt_accept_enqueue(parent, sk);
802 }
803 
804 /* Delete channel.
805  * Must be called on the locked socket. */
806 static void sco_chan_del(struct sock *sk, int err)
807 {
808 	struct sco_conn *conn;
809 
810 	conn = sco_pi(sk)->conn;
811 
812 	BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
813 
814 	if (conn) {
815 		sco_conn_lock(conn);
816 		conn->sk = NULL;
817 		sco_pi(sk)->conn = NULL;
818 		sco_conn_unlock(conn);
819 		hci_conn_put(conn->hcon);
820 	}
821 
822 	sk->sk_state = BT_CLOSED;
823 	sk->sk_err   = err;
824 	sk->sk_state_change(sk);
825 
826 	sock_set_flag(sk, SOCK_ZAPPED);
827 }
828 
829 static void sco_conn_ready(struct sco_conn *conn)
830 {
831 	struct sock *parent, *sk;
832 
833 	BT_DBG("conn %p", conn);
834 
835 	sco_conn_lock(conn);
836 
837 	if ((sk = conn->sk)) {
838 		sco_sock_clear_timer(sk);
839 		bh_lock_sock(sk);
840 		sk->sk_state = BT_CONNECTED;
841 		sk->sk_state_change(sk);
842 		bh_unlock_sock(sk);
843 	} else {
844 		parent = sco_get_sock_listen(conn->src);
845 		if (!parent)
846 			goto done;
847 
848 		bh_lock_sock(parent);
849 
850 		sk = sco_sock_alloc(sock_net(parent), NULL,
851 				BTPROTO_SCO, GFP_ATOMIC);
852 		if (!sk) {
853 			bh_unlock_sock(parent);
854 			goto done;
855 		}
856 
857 		sco_sock_init(sk, parent);
858 
859 		bacpy(&bt_sk(sk)->src, conn->src);
860 		bacpy(&bt_sk(sk)->dst, conn->dst);
861 
862 		hci_conn_hold(conn->hcon);
863 		__sco_chan_add(conn, sk, parent);
864 
865 		sk->sk_state = BT_CONNECTED;
866 
867 		/* Wake up parent */
868 		parent->sk_data_ready(parent, 1);
869 
870 		bh_unlock_sock(parent);
871 	}
872 
873 done:
874 	sco_conn_unlock(conn);
875 }
876 
877 /* ----- SCO interface with lower layer (HCI) ----- */
878 static int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type)
879 {
880 	register struct sock *sk;
881 	struct hlist_node *node;
882 	int lm = 0;
883 
884 	if (type != SCO_LINK && type != ESCO_LINK)
885 		return 0;
886 
887 	BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
888 
889 	/* Find listening sockets */
890 	read_lock(&sco_sk_list.lock);
891 	sk_for_each(sk, node, &sco_sk_list.head) {
892 		if (sk->sk_state != BT_LISTEN)
893 			continue;
894 
895 		if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr) ||
896 				!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
897 			lm |= HCI_LM_ACCEPT;
898 			break;
899 		}
900 	}
901 	read_unlock(&sco_sk_list.lock);
902 
903 	return lm;
904 }
905 
906 static int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
907 {
908 	BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
909 
910 	if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
911 		return 0;
912 
913 	if (!status) {
914 		struct sco_conn *conn;
915 
916 		conn = sco_conn_add(hcon, status);
917 		if (conn)
918 			sco_conn_ready(conn);
919 	} else
920 		sco_conn_del(hcon, bt_err(status));
921 
922 	return 0;
923 }
924 
925 static int sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
926 {
927 	BT_DBG("hcon %p reason %d", hcon, reason);
928 
929 	if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
930 		return 0;
931 
932 	sco_conn_del(hcon, bt_err(reason));
933 
934 	return 0;
935 }
936 
937 static int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
938 {
939 	struct sco_conn *conn = hcon->sco_data;
940 
941 	if (!conn)
942 		goto drop;
943 
944 	BT_DBG("conn %p len %d", conn, skb->len);
945 
946 	if (skb->len) {
947 		sco_recv_frame(conn, skb);
948 		return 0;
949 	}
950 
951 drop:
952 	kfree_skb(skb);
953 	return 0;
954 }
955 
956 static int sco_debugfs_show(struct seq_file *f, void *p)
957 {
958 	struct sock *sk;
959 	struct hlist_node *node;
960 
961 	read_lock_bh(&sco_sk_list.lock);
962 
963 	sk_for_each(sk, node, &sco_sk_list.head) {
964 		seq_printf(f, "%s %s %d\n", batostr(&bt_sk(sk)->src),
965 				batostr(&bt_sk(sk)->dst), sk->sk_state);
966 	}
967 
968 	read_unlock_bh(&sco_sk_list.lock);
969 
970 	return 0;
971 }
972 
973 static int sco_debugfs_open(struct inode *inode, struct file *file)
974 {
975 	return single_open(file, sco_debugfs_show, inode->i_private);
976 }
977 
978 static const struct file_operations sco_debugfs_fops = {
979 	.open		= sco_debugfs_open,
980 	.read		= seq_read,
981 	.llseek		= seq_lseek,
982 	.release	= single_release,
983 };
984 
985 static struct dentry *sco_debugfs;
986 
987 static const struct proto_ops sco_sock_ops = {
988 	.family		= PF_BLUETOOTH,
989 	.owner		= THIS_MODULE,
990 	.release	= sco_sock_release,
991 	.bind		= sco_sock_bind,
992 	.connect	= sco_sock_connect,
993 	.listen		= sco_sock_listen,
994 	.accept		= sco_sock_accept,
995 	.getname	= sco_sock_getname,
996 	.sendmsg	= sco_sock_sendmsg,
997 	.recvmsg	= bt_sock_recvmsg,
998 	.poll		= bt_sock_poll,
999 	.ioctl		= bt_sock_ioctl,
1000 	.mmap		= sock_no_mmap,
1001 	.socketpair	= sock_no_socketpair,
1002 	.shutdown	= sco_sock_shutdown,
1003 	.setsockopt	= sco_sock_setsockopt,
1004 	.getsockopt	= sco_sock_getsockopt
1005 };
1006 
1007 static const struct net_proto_family sco_sock_family_ops = {
1008 	.family	= PF_BLUETOOTH,
1009 	.owner	= THIS_MODULE,
1010 	.create	= sco_sock_create,
1011 };
1012 
1013 static struct hci_proto sco_hci_proto = {
1014 	.name		= "SCO",
1015 	.id		= HCI_PROTO_SCO,
1016 	.connect_ind	= sco_connect_ind,
1017 	.connect_cfm	= sco_connect_cfm,
1018 	.disconn_cfm	= sco_disconn_cfm,
1019 	.recv_scodata	= sco_recv_scodata
1020 };
1021 
1022 static int __init sco_init(void)
1023 {
1024 	int err;
1025 
1026 	err = proto_register(&sco_proto, 0);
1027 	if (err < 0)
1028 		return err;
1029 
1030 	err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
1031 	if (err < 0) {
1032 		BT_ERR("SCO socket registration failed");
1033 		goto error;
1034 	}
1035 
1036 	err = hci_register_proto(&sco_hci_proto);
1037 	if (err < 0) {
1038 		BT_ERR("SCO protocol registration failed");
1039 		bt_sock_unregister(BTPROTO_SCO);
1040 		goto error;
1041 	}
1042 
1043 	if (bt_debugfs) {
1044 		sco_debugfs = debugfs_create_file("sco", 0444,
1045 					bt_debugfs, NULL, &sco_debugfs_fops);
1046 		if (!sco_debugfs)
1047 			BT_ERR("Failed to create SCO debug file");
1048 	}
1049 
1050 	BT_INFO("SCO (Voice Link) ver %s", VERSION);
1051 	BT_INFO("SCO socket layer initialized");
1052 
1053 	return 0;
1054 
1055 error:
1056 	proto_unregister(&sco_proto);
1057 	return err;
1058 }
1059 
1060 static void __exit sco_exit(void)
1061 {
1062 	debugfs_remove(sco_debugfs);
1063 
1064 	if (bt_sock_unregister(BTPROTO_SCO) < 0)
1065 		BT_ERR("SCO socket unregistration failed");
1066 
1067 	if (hci_unregister_proto(&sco_hci_proto) < 0)
1068 		BT_ERR("SCO protocol unregistration failed");
1069 
1070 	proto_unregister(&sco_proto);
1071 }
1072 
1073 module_init(sco_init);
1074 module_exit(sco_exit);
1075 
1076 module_param(disable_esco, bool, 0644);
1077 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");
1078 
1079 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1080 MODULE_DESCRIPTION("Bluetooth SCO ver " VERSION);
1081 MODULE_VERSION(VERSION);
1082 MODULE_LICENSE("GPL");
1083 MODULE_ALIAS("bt-proto-2");
1084