1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 Copyright (C) 2000-2001 Qualcomm Incorporated 5 6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 7 8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 19 SOFTWARE IS DISCLAIMED. 20 */ 21 22 /* Bluetooth SCO sockets. */ 23 24 #include <linux/module.h> 25 #include <linux/debugfs.h> 26 #include <linux/seq_file.h> 27 #include <linux/sched/signal.h> 28 #include <linux/uio.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/sco.h> 33 34 static bool disable_esco; 35 36 static const struct proto_ops sco_sock_ops; 37 38 static struct bt_sock_list sco_sk_list = { 39 .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock) 40 }; 41 42 /* ---- SCO connections ---- */ 43 struct sco_conn { 44 struct hci_conn *hcon; 45 46 spinlock_t lock; 47 struct sock *sk; 48 49 struct delayed_work timeout_work; 50 51 unsigned int mtu; 52 struct kref ref; 53 }; 54 55 #define sco_conn_lock(c) spin_lock(&c->lock) 56 #define sco_conn_unlock(c) spin_unlock(&c->lock) 57 58 static void sco_sock_close(struct sock *sk); 59 static void sco_sock_kill(struct sock *sk); 60 61 /* ----- SCO socket info ----- */ 62 #define sco_pi(sk) ((struct sco_pinfo *) sk) 63 64 struct sco_pinfo { 65 struct bt_sock bt; 66 bdaddr_t src; 67 bdaddr_t dst; 68 __u32 flags; 69 __u16 setting; 70 struct bt_codec codec; 71 struct sco_conn *conn; 72 }; 73 74 /* ---- SCO timers ---- */ 75 #define SCO_CONN_TIMEOUT (HZ * 40) 76 #define SCO_DISCONN_TIMEOUT (HZ * 2) 77 78 static void sco_conn_free(struct kref *ref) 79 { 80 struct sco_conn *conn = container_of(ref, struct sco_conn, ref); 81 82 BT_DBG("conn %p", conn); 83 84 if (conn->sk) 85 sco_pi(conn->sk)->conn = NULL; 86 87 if (conn->hcon) { 88 conn->hcon->sco_data = NULL; 89 hci_conn_drop(conn->hcon); 90 } 91 92 /* Ensure no more work items will run since hci_conn has been dropped */ 93 disable_delayed_work_sync(&conn->timeout_work); 94 95 kfree(conn); 96 } 97 98 static void sco_conn_put(struct sco_conn *conn) 99 { 100 if (!conn) 101 return; 102 103 BT_DBG("conn %p refcnt %d", conn, kref_read(&conn->ref)); 104 105 kref_put(&conn->ref, sco_conn_free); 106 } 107 108 static struct sco_conn *sco_conn_hold(struct sco_conn *conn) 109 { 110 BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref)); 111 112 kref_get(&conn->ref); 113 return conn; 114 } 115 116 static struct sco_conn *sco_conn_hold_unless_zero(struct sco_conn *conn) 117 { 118 if (!conn) 119 return NULL; 120 121 BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref)); 122 123 if (!kref_get_unless_zero(&conn->ref)) 124 return NULL; 125 126 return conn; 127 } 128 129 static struct sock *sco_sock_hold(struct sco_conn *conn) 130 { 131 if (!conn || !bt_sock_linked(&sco_sk_list, conn->sk)) 132 return NULL; 133 134 sock_hold(conn->sk); 135 136 return conn->sk; 137 } 138 139 static void sco_sock_timeout(struct work_struct *work) 140 { 141 struct sco_conn *conn = container_of(work, struct sco_conn, 142 timeout_work.work); 143 struct sock *sk; 144 145 conn = sco_conn_hold_unless_zero(conn); 146 if (!conn) 147 return; 148 149 sco_conn_lock(conn); 150 if (!conn->hcon) { 151 sco_conn_unlock(conn); 152 sco_conn_put(conn); 153 return; 154 } 155 sk = sco_sock_hold(conn); 156 sco_conn_unlock(conn); 157 sco_conn_put(conn); 158 159 if (!sk) 160 return; 161 162 BT_DBG("sock %p state %d", sk, sk->sk_state); 163 164 lock_sock(sk); 165 sk->sk_err = ETIMEDOUT; 166 sk->sk_state_change(sk); 167 release_sock(sk); 168 sock_put(sk); 169 } 170 171 static void sco_sock_set_timer(struct sock *sk, long timeout) 172 { 173 if (!sco_pi(sk)->conn) 174 return; 175 176 BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout); 177 cancel_delayed_work(&sco_pi(sk)->conn->timeout_work); 178 schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout); 179 } 180 181 static void sco_sock_clear_timer(struct sock *sk) 182 { 183 if (!sco_pi(sk)->conn) 184 return; 185 186 BT_DBG("sock %p state %d", sk, sk->sk_state); 187 cancel_delayed_work(&sco_pi(sk)->conn->timeout_work); 188 } 189 190 /* ---- SCO connections ---- */ 191 static struct sco_conn *sco_conn_add(struct hci_conn *hcon) 192 { 193 struct sco_conn *conn = hcon->sco_data; 194 195 conn = sco_conn_hold_unless_zero(conn); 196 if (conn) { 197 if (!conn->hcon) { 198 sco_conn_lock(conn); 199 conn->hcon = hcon; 200 sco_conn_unlock(conn); 201 } 202 return conn; 203 } 204 205 conn = kzalloc_obj(struct sco_conn); 206 if (!conn) 207 return NULL; 208 209 kref_init(&conn->ref); 210 spin_lock_init(&conn->lock); 211 INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout); 212 213 hcon->sco_data = conn; 214 conn->hcon = hcon; 215 conn->mtu = hcon->mtu; 216 217 if (hcon->mtu > 0) 218 conn->mtu = hcon->mtu; 219 else 220 conn->mtu = 60; 221 222 BT_DBG("hcon %p conn %p", hcon, conn); 223 224 return conn; 225 } 226 227 /* Delete channel. 228 * Must be called on the locked socket. */ 229 static void sco_chan_del(struct sock *sk, int err) 230 { 231 struct sco_conn *conn; 232 233 conn = sco_pi(sk)->conn; 234 sco_pi(sk)->conn = NULL; 235 236 BT_DBG("sk %p, conn %p, err %d", sk, conn, err); 237 238 if (conn) { 239 sco_conn_lock(conn); 240 conn->sk = NULL; 241 sco_conn_unlock(conn); 242 sco_conn_put(conn); 243 } 244 245 sk->sk_state = BT_CLOSED; 246 sk->sk_err = err; 247 sk->sk_state_change(sk); 248 249 sock_set_flag(sk, SOCK_ZAPPED); 250 } 251 252 static void sco_conn_del(struct hci_conn *hcon, int err) 253 { 254 struct sco_conn *conn = hcon->sco_data; 255 struct sock *sk; 256 257 conn = sco_conn_hold_unless_zero(conn); 258 if (!conn) 259 return; 260 261 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); 262 263 sco_conn_lock(conn); 264 sk = sco_sock_hold(conn); 265 sco_conn_unlock(conn); 266 sco_conn_put(conn); 267 268 if (!sk) { 269 sco_conn_put(conn); 270 return; 271 } 272 273 /* Kill socket */ 274 lock_sock(sk); 275 sco_sock_clear_timer(sk); 276 sco_chan_del(sk, err); 277 release_sock(sk); 278 sock_put(sk); 279 } 280 281 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, 282 struct sock *parent) 283 { 284 BT_DBG("conn %p", conn); 285 286 sco_pi(sk)->conn = conn; 287 conn->sk = sk; 288 289 if (parent) 290 bt_accept_enqueue(parent, sk, true); 291 } 292 293 static int sco_chan_add(struct sco_conn *conn, struct sock *sk, 294 struct sock *parent) 295 { 296 int err = 0; 297 298 sco_conn_lock(conn); 299 if (conn->sk || sco_pi(sk)->conn) 300 err = -EBUSY; 301 else 302 __sco_chan_add(conn, sk, parent); 303 304 sco_conn_unlock(conn); 305 return err; 306 } 307 308 static int sco_connect(struct sock *sk) 309 { 310 struct sco_conn *conn; 311 struct hci_conn *hcon; 312 struct hci_dev *hdev; 313 bdaddr_t src, dst; 314 struct bt_codec codec; 315 __u16 setting; 316 int err, type; 317 318 lock_sock(sk); 319 bacpy(&src, &sco_pi(sk)->src); 320 bacpy(&dst, &sco_pi(sk)->dst); 321 setting = sco_pi(sk)->setting; 322 codec = sco_pi(sk)->codec; 323 release_sock(sk); 324 325 BT_DBG("%pMR -> %pMR", &src, &dst); 326 327 hdev = hci_get_route(&dst, &src, BDADDR_BREDR); 328 if (!hdev) 329 return -EHOSTUNREACH; 330 331 hci_dev_lock(hdev); 332 333 if (lmp_esco_capable(hdev) && !disable_esco) 334 type = ESCO_LINK; 335 else 336 type = SCO_LINK; 337 338 switch (setting & SCO_AIRMODE_MASK) { 339 case SCO_AIRMODE_TRANSP: 340 if (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev)) { 341 err = -EOPNOTSUPP; 342 goto unlock; 343 } 344 break; 345 } 346 347 hcon = hci_connect_sco(hdev, type, &dst, 348 setting, &codec, 349 READ_ONCE(sk->sk_sndtimeo)); 350 if (IS_ERR(hcon)) { 351 err = PTR_ERR(hcon); 352 goto unlock; 353 } 354 355 conn = sco_conn_add(hcon); 356 if (!conn) { 357 hci_conn_drop(hcon); 358 err = -ENOMEM; 359 goto unlock; 360 } 361 362 lock_sock(sk); 363 364 /* Recheck state after reacquiring the socket lock, as another 365 * thread may have changed it (e.g., closed the socket). 366 */ 367 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 368 release_sock(sk); 369 hci_conn_drop(hcon); 370 err = -EBADFD; 371 goto unlock; 372 } 373 374 err = sco_chan_add(conn, sk, NULL); 375 if (err) { 376 release_sock(sk); 377 hci_conn_drop(hcon); 378 goto unlock; 379 } 380 381 /* Update source addr of the socket */ 382 bacpy(&sco_pi(sk)->src, &hcon->src); 383 384 if (hcon->state == BT_CONNECTED) { 385 sco_sock_clear_timer(sk); 386 sk->sk_state = BT_CONNECTED; 387 } else { 388 sk->sk_state = BT_CONNECT; 389 sco_sock_set_timer(sk, READ_ONCE(sk->sk_sndtimeo)); 390 } 391 392 release_sock(sk); 393 394 unlock: 395 hci_dev_unlock(hdev); 396 hci_dev_put(hdev); 397 return err; 398 } 399 400 static int sco_send_frame(struct sock *sk, struct sk_buff *skb, 401 const struct sockcm_cookie *sockc) 402 { 403 struct sco_conn *conn = sco_pi(sk)->conn; 404 int len = skb->len; 405 406 /* Check outgoing MTU */ 407 if (len > conn->mtu) 408 return -EINVAL; 409 410 BT_DBG("sk %p len %d", sk, len); 411 412 hci_setup_tx_timestamp(skb, 1, sockc); 413 hci_send_sco(conn->hcon, skb); 414 415 return len; 416 } 417 418 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb) 419 { 420 struct sock *sk; 421 422 sco_conn_lock(conn); 423 sk = sco_sock_hold(conn); 424 sco_conn_unlock(conn); 425 426 if (!sk) 427 goto drop; 428 429 BT_DBG("sk %p len %u", sk, skb->len); 430 431 if (sk->sk_state != BT_CONNECTED) 432 goto drop_put; 433 434 if (!sock_queue_rcv_skb(sk, skb)) { 435 sock_put(sk); 436 return; 437 } 438 439 drop_put: 440 sock_put(sk); 441 drop: 442 kfree_skb(skb); 443 } 444 445 /* -------- Socket interface ---------- */ 446 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba) 447 { 448 struct sock *sk; 449 450 sk_for_each(sk, &sco_sk_list.head) { 451 if (sk->sk_state != BT_LISTEN) 452 continue; 453 454 if (!bacmp(&sco_pi(sk)->src, ba)) 455 return sk; 456 } 457 458 return NULL; 459 } 460 461 /* Find socket listening on source bdaddr. 462 * Returns closest match. 463 */ 464 static struct sock *sco_get_sock_listen(bdaddr_t *src) 465 { 466 struct sock *sk = NULL, *sk1 = NULL; 467 468 read_lock(&sco_sk_list.lock); 469 470 sk_for_each(sk, &sco_sk_list.head) { 471 if (sk->sk_state != BT_LISTEN) 472 continue; 473 474 /* Exact match. */ 475 if (!bacmp(&sco_pi(sk)->src, src)) 476 break; 477 478 /* Closest match */ 479 if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY)) 480 sk1 = sk; 481 } 482 483 sk = sk ? sk : sk1; 484 if (sk) 485 sock_hold(sk); 486 487 read_unlock(&sco_sk_list.lock); 488 489 return sk; 490 } 491 492 static void sco_sock_destruct(struct sock *sk) 493 { 494 BT_DBG("sk %p", sk); 495 496 sco_conn_put(sco_pi(sk)->conn); 497 498 skb_queue_purge(&sk->sk_receive_queue); 499 skb_queue_purge(&sk->sk_write_queue); 500 skb_queue_purge(&sk->sk_error_queue); 501 } 502 503 static void sco_sock_cleanup_listen(struct sock *parent) 504 { 505 struct sock *sk; 506 507 BT_DBG("parent %p", parent); 508 509 /* Close not yet accepted channels */ 510 while ((sk = bt_accept_dequeue(parent, NULL))) { 511 sco_sock_close(sk); 512 sco_sock_kill(sk); 513 /* Drop the reference handed back by bt_accept_dequeue(). */ 514 sock_put(sk); 515 } 516 517 parent->sk_state = BT_CLOSED; 518 sock_set_flag(parent, SOCK_ZAPPED); 519 } 520 521 /* Kill socket (only if zapped and orphan) 522 * Must be called on unlocked socket. 523 */ 524 static void sco_sock_kill(struct sock *sk) 525 { 526 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 527 return; 528 529 BT_DBG("sk %p state %d", sk, sk->sk_state); 530 531 /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ 532 lock_sock(sk); 533 if (sco_pi(sk)->conn) { 534 sco_conn_lock(sco_pi(sk)->conn); 535 sco_pi(sk)->conn->sk = NULL; 536 sco_conn_unlock(sco_pi(sk)->conn); 537 } 538 release_sock(sk); 539 540 /* Kill poor orphan */ 541 bt_sock_unlink(&sco_sk_list, sk); 542 sock_set_flag(sk, SOCK_DEAD); 543 sock_put(sk); 544 } 545 546 static void __sco_sock_close(struct sock *sk) 547 { 548 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket); 549 550 switch (sk->sk_state) { 551 case BT_LISTEN: 552 sco_sock_cleanup_listen(sk); 553 break; 554 555 case BT_CONNECTED: 556 case BT_CONFIG: 557 case BT_CONNECT2: 558 case BT_CONNECT: 559 case BT_DISCONN: 560 sco_chan_del(sk, ECONNRESET); 561 break; 562 563 default: 564 sock_set_flag(sk, SOCK_ZAPPED); 565 break; 566 } 567 568 } 569 570 /* Must be called on unlocked socket. */ 571 static void sco_sock_close(struct sock *sk) 572 { 573 struct sco_conn *conn; 574 575 lock_sock(sk); 576 conn = sco_pi(sk)->conn; 577 if (conn) 578 sco_conn_hold(conn); 579 release_sock(sk); 580 581 if (conn) 582 disable_delayed_work_sync(&conn->timeout_work); 583 584 lock_sock(sk); 585 __sco_sock_close(sk); 586 release_sock(sk); 587 588 if (conn) 589 sco_conn_put(conn); 590 } 591 592 static void sco_sock_init(struct sock *sk, struct sock *parent) 593 { 594 BT_DBG("sk %p", sk); 595 596 if (parent) { 597 sk->sk_type = parent->sk_type; 598 bt_sk(sk)->flags = bt_sk(parent)->flags; 599 security_sk_clone(parent, sk); 600 } 601 } 602 603 static struct proto sco_proto = { 604 .name = "SCO", 605 .owner = THIS_MODULE, 606 .obj_size = sizeof(struct sco_pinfo) 607 }; 608 609 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, 610 int proto, gfp_t prio, int kern) 611 { 612 struct sock *sk; 613 614 sk = bt_sock_alloc(net, sock, &sco_proto, proto, prio, kern); 615 if (!sk) 616 return NULL; 617 618 sk->sk_destruct = sco_sock_destruct; 619 sk->sk_sndtimeo = SCO_CONN_TIMEOUT; 620 621 sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT; 622 sco_pi(sk)->codec.id = BT_CODEC_CVSD; 623 sco_pi(sk)->codec.cid = 0xffff; 624 sco_pi(sk)->codec.vid = 0xffff; 625 sco_pi(sk)->codec.data_path = 0x00; 626 627 bt_sock_link(&sco_sk_list, sk); 628 return sk; 629 } 630 631 static int sco_sock_create(struct net *net, struct socket *sock, int protocol, 632 int kern) 633 { 634 struct sock *sk; 635 636 BT_DBG("sock %p", sock); 637 638 sock->state = SS_UNCONNECTED; 639 640 if (sock->type != SOCK_SEQPACKET) 641 return -ESOCKTNOSUPPORT; 642 643 sock->ops = &sco_sock_ops; 644 645 sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern); 646 if (!sk) 647 return -ENOMEM; 648 649 sco_sock_init(sk, NULL); 650 return 0; 651 } 652 653 static int sco_sock_bind(struct socket *sock, struct sockaddr_unsized *addr, 654 int addr_len) 655 { 656 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 657 struct sock *sk = sock->sk; 658 int err = 0; 659 660 if (!addr || addr_len < sizeof(struct sockaddr_sco) || 661 addr->sa_family != AF_BLUETOOTH) 662 return -EINVAL; 663 664 BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr); 665 666 lock_sock(sk); 667 668 if (sk->sk_state != BT_OPEN) { 669 err = -EBADFD; 670 goto done; 671 } 672 673 if (sk->sk_type != SOCK_SEQPACKET) { 674 err = -EINVAL; 675 goto done; 676 } 677 678 bacpy(&sco_pi(sk)->src, &sa->sco_bdaddr); 679 680 sk->sk_state = BT_BOUND; 681 682 done: 683 release_sock(sk); 684 return err; 685 } 686 687 static int sco_sock_connect(struct socket *sock, struct sockaddr_unsized *addr, int alen, int flags) 688 { 689 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 690 struct sock *sk = sock->sk; 691 int err; 692 693 BT_DBG("sk %p", sk); 694 695 if (alen < sizeof(struct sockaddr_sco) || 696 addr->sa_family != AF_BLUETOOTH) 697 return -EINVAL; 698 699 lock_sock(sk); 700 701 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { 702 release_sock(sk); 703 return -EBADFD; 704 } 705 706 if (sk->sk_type != SOCK_SEQPACKET) { 707 release_sock(sk); 708 return -EINVAL; 709 } 710 711 /* Set destination address and psm */ 712 bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr); 713 release_sock(sk); 714 715 err = sco_connect(sk); 716 if (err) 717 return err; 718 719 lock_sock(sk); 720 721 err = bt_sock_wait_state(sk, BT_CONNECTED, 722 sock_sndtimeo(sk, flags & O_NONBLOCK)); 723 724 release_sock(sk); 725 return err; 726 } 727 728 static int sco_sock_listen(struct socket *sock, int backlog) 729 { 730 struct sock *sk = sock->sk; 731 bdaddr_t *src = &sco_pi(sk)->src; 732 int err = 0; 733 734 BT_DBG("sk %p backlog %d", sk, backlog); 735 736 lock_sock(sk); 737 738 if (sk->sk_state != BT_BOUND) { 739 err = -EBADFD; 740 goto done; 741 } 742 743 if (sk->sk_type != SOCK_SEQPACKET) { 744 err = -EINVAL; 745 goto done; 746 } 747 748 write_lock(&sco_sk_list.lock); 749 750 if (__sco_get_sock_listen_by_addr(src)) { 751 err = -EADDRINUSE; 752 goto unlock; 753 } 754 755 sk->sk_max_ack_backlog = backlog; 756 sk->sk_ack_backlog = 0; 757 758 sk->sk_state = BT_LISTEN; 759 760 unlock: 761 write_unlock(&sco_sk_list.lock); 762 763 done: 764 release_sock(sk); 765 return err; 766 } 767 768 static int sco_sock_accept(struct socket *sock, struct socket *newsock, 769 struct proto_accept_arg *arg) 770 { 771 DEFINE_WAIT_FUNC(wait, woken_wake_function); 772 struct sock *sk = sock->sk, *ch; 773 long timeo; 774 int err = 0; 775 776 lock_sock(sk); 777 778 timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK); 779 780 BT_DBG("sk %p timeo %ld", sk, timeo); 781 782 /* Wait for an incoming connection. (wake-one). */ 783 add_wait_queue_exclusive(sk_sleep(sk), &wait); 784 while (1) { 785 if (sk->sk_state != BT_LISTEN) { 786 err = -EBADFD; 787 break; 788 } 789 790 ch = bt_accept_dequeue(sk, newsock); 791 if (ch) { 792 /* Drop the bridging ref from bt_accept_dequeue(); 793 * the grafted socket keeps ch alive from here. 794 */ 795 sock_put(ch); 796 break; 797 } 798 799 if (!timeo) { 800 err = -EAGAIN; 801 break; 802 } 803 804 if (signal_pending(current)) { 805 err = sock_intr_errno(timeo); 806 break; 807 } 808 809 release_sock(sk); 810 811 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 812 lock_sock(sk); 813 } 814 remove_wait_queue(sk_sleep(sk), &wait); 815 816 if (err) 817 goto done; 818 819 newsock->state = SS_CONNECTED; 820 821 BT_DBG("new socket %p", ch); 822 823 done: 824 release_sock(sk); 825 return err; 826 } 827 828 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, 829 int peer) 830 { 831 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 832 struct sock *sk = sock->sk; 833 834 BT_DBG("sock %p, sk %p", sock, sk); 835 836 addr->sa_family = AF_BLUETOOTH; 837 838 if (peer) 839 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->dst); 840 else 841 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->src); 842 843 return sizeof(struct sockaddr_sco); 844 } 845 846 static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg, 847 size_t len) 848 { 849 struct sock *sk = sock->sk; 850 struct sk_buff *skb; 851 struct sockcm_cookie sockc; 852 int err; 853 854 BT_DBG("sock %p, sk %p", sock, sk); 855 856 err = sock_error(sk); 857 if (err) 858 return err; 859 860 if (msg->msg_flags & MSG_OOB) 861 return -EOPNOTSUPP; 862 863 hci_sockcm_init(&sockc, sk); 864 865 if (msg->msg_controllen) { 866 err = sock_cmsg_send(sk, msg, &sockc); 867 if (err) 868 return err; 869 } 870 871 skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0); 872 if (IS_ERR(skb)) 873 return PTR_ERR(skb); 874 875 lock_sock(sk); 876 877 if (sk->sk_state == BT_CONNECTED) 878 err = sco_send_frame(sk, skb, &sockc); 879 else 880 err = -ENOTCONN; 881 882 release_sock(sk); 883 884 if (err < 0) 885 kfree_skb(skb); 886 return err; 887 } 888 889 static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting) 890 { 891 struct hci_dev *hdev = conn->hdev; 892 893 BT_DBG("conn %p", conn); 894 895 conn->state = BT_CONFIG; 896 897 if (!lmp_esco_capable(hdev)) { 898 struct hci_cp_accept_conn_req cp; 899 900 bacpy(&cp.bdaddr, &conn->dst); 901 cp.role = 0x00; /* Ignored */ 902 903 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp); 904 } else { 905 struct hci_cp_accept_sync_conn_req cp; 906 907 bacpy(&cp.bdaddr, &conn->dst); 908 cp.pkt_type = cpu_to_le16(conn->pkt_type); 909 910 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 911 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 912 cp.content_format = cpu_to_le16(setting); 913 914 switch (setting & SCO_AIRMODE_MASK) { 915 case SCO_AIRMODE_TRANSP: 916 if (conn->pkt_type & ESCO_2EV3) 917 cp.max_latency = cpu_to_le16(0x0008); 918 else 919 cp.max_latency = cpu_to_le16(0x000D); 920 cp.retrans_effort = 0x02; 921 break; 922 case SCO_AIRMODE_CVSD: 923 cp.max_latency = cpu_to_le16(0xffff); 924 cp.retrans_effort = 0xff; 925 break; 926 default: 927 /* use CVSD settings as fallback */ 928 cp.max_latency = cpu_to_le16(0xffff); 929 cp.retrans_effort = 0xff; 930 break; 931 } 932 933 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, 934 sizeof(cp), &cp); 935 } 936 } 937 938 static int sco_sock_recvmsg(struct socket *sock, struct msghdr *msg, 939 size_t len, int flags) 940 { 941 struct sock *sk = sock->sk; 942 struct sco_pinfo *pi = sco_pi(sk); 943 944 if (unlikely(flags & MSG_ERRQUEUE)) 945 return sock_recv_errqueue(sk, msg, len, SOL_BLUETOOTH, 946 BT_SCM_ERROR); 947 948 lock_sock(sk); 949 950 if (sk->sk_state == BT_CONNECT2 && 951 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) { 952 sco_conn_defer_accept(pi->conn->hcon, pi->setting); 953 sk->sk_state = BT_CONFIG; 954 955 release_sock(sk); 956 return 0; 957 } 958 959 release_sock(sk); 960 961 return bt_sock_recvmsg(sock, msg, len, flags); 962 } 963 964 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, 965 sockptr_t optval, unsigned int optlen) 966 { 967 struct sock *sk = sock->sk; 968 int err = 0; 969 struct bt_voice voice; 970 u32 opt; 971 struct bt_codecs *codecs; 972 struct hci_dev *hdev; 973 __u8 buffer[255]; 974 975 BT_DBG("sk %p", sk); 976 977 lock_sock(sk); 978 979 switch (optname) { 980 981 case BT_DEFER_SETUP: 982 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 983 err = -EINVAL; 984 break; 985 } 986 987 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 988 if (err) 989 break; 990 991 if (opt) 992 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 993 else 994 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 995 break; 996 997 case BT_VOICE: 998 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND && 999 sk->sk_state != BT_CONNECT2) { 1000 err = -EINVAL; 1001 break; 1002 } 1003 1004 voice.setting = sco_pi(sk)->setting; 1005 1006 err = copy_safe_from_sockptr(&voice, sizeof(voice), optval, 1007 optlen); 1008 if (err) 1009 break; 1010 1011 sco_pi(sk)->setting = voice.setting; 1012 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, 1013 BDADDR_BREDR); 1014 if (!hdev) { 1015 err = -EBADFD; 1016 break; 1017 } 1018 1019 switch (sco_pi(sk)->setting & SCO_AIRMODE_MASK) { 1020 case SCO_AIRMODE_TRANSP: 1021 if (enhanced_sync_conn_capable(hdev)) 1022 sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT; 1023 break; 1024 } 1025 1026 hci_dev_put(hdev); 1027 break; 1028 1029 case BT_PKT_STATUS: 1030 err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen); 1031 if (err) 1032 break; 1033 1034 if (opt) 1035 set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags); 1036 else 1037 clear_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags); 1038 break; 1039 1040 case BT_CODEC: 1041 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND && 1042 sk->sk_state != BT_CONNECT2) { 1043 err = -EINVAL; 1044 break; 1045 } 1046 1047 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, 1048 BDADDR_BREDR); 1049 if (!hdev) { 1050 err = -EBADFD; 1051 break; 1052 } 1053 1054 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) { 1055 hci_dev_put(hdev); 1056 err = -EOPNOTSUPP; 1057 break; 1058 } 1059 1060 if (!hdev->get_data_path_id) { 1061 hci_dev_put(hdev); 1062 err = -EOPNOTSUPP; 1063 break; 1064 } 1065 1066 if (optlen < sizeof(struct bt_codecs) || 1067 optlen > sizeof(buffer)) { 1068 hci_dev_put(hdev); 1069 err = -EINVAL; 1070 break; 1071 } 1072 1073 err = copy_struct_from_sockptr(buffer, sizeof(buffer), optval, 1074 optlen); 1075 if (err) { 1076 hci_dev_put(hdev); 1077 break; 1078 } 1079 1080 codecs = (void *)buffer; 1081 1082 if (codecs->num_codecs != 1 || 1083 optlen < struct_size(codecs, codecs, codecs->num_codecs)) { 1084 hci_dev_put(hdev); 1085 err = -EINVAL; 1086 break; 1087 } 1088 1089 sco_pi(sk)->codec = codecs->codecs[0]; 1090 hci_dev_put(hdev); 1091 break; 1092 1093 default: 1094 err = -ENOPROTOOPT; 1095 break; 1096 } 1097 1098 release_sock(sk); 1099 return err; 1100 } 1101 1102 static int sco_sock_getsockopt_old(struct socket *sock, int optname, 1103 sockopt_t *opt) 1104 { 1105 struct sock *sk = sock->sk; 1106 struct sco_options opts; 1107 struct sco_conninfo cinfo; 1108 int err = 0; 1109 size_t len; 1110 1111 BT_DBG("sk %p", sk); 1112 1113 len = opt->optlen; 1114 1115 lock_sock(sk); 1116 1117 switch (optname) { 1118 case SCO_OPTIONS: 1119 if (sk->sk_state != BT_CONNECTED && 1120 !(sk->sk_state == BT_CONNECT2 && 1121 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 1122 err = -ENOTCONN; 1123 break; 1124 } 1125 1126 opts.mtu = sco_pi(sk)->conn->mtu; 1127 1128 BT_DBG("mtu %u", opts.mtu); 1129 1130 len = min(len, sizeof(opts)); 1131 if (copy_to_iter(&opts, len, &opt->iter_out) != len) 1132 err = -EFAULT; 1133 1134 break; 1135 1136 case SCO_CONNINFO: 1137 if (sk->sk_state != BT_CONNECTED && 1138 !(sk->sk_state == BT_CONNECT2 && 1139 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 1140 err = -ENOTCONN; 1141 break; 1142 } 1143 1144 memset(&cinfo, 0, sizeof(cinfo)); 1145 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle; 1146 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3); 1147 1148 len = min(len, sizeof(cinfo)); 1149 if (copy_to_iter(&cinfo, len, &opt->iter_out) != len) 1150 err = -EFAULT; 1151 1152 break; 1153 1154 default: 1155 err = -ENOPROTOOPT; 1156 break; 1157 } 1158 1159 release_sock(sk); 1160 return err; 1161 } 1162 1163 static int sco_sock_getsockopt(struct socket *sock, int level, int optname, 1164 sockopt_t *opt) 1165 { 1166 struct sock *sk = sock->sk; 1167 int len, val, err = 0; 1168 struct bt_voice voice; 1169 u32 phys; 1170 int buf_len; 1171 struct codec_list *c; 1172 u8 num_codecs, i; 1173 struct hci_dev *hdev; 1174 struct hci_codec_caps *caps; 1175 struct bt_codec codec; 1176 1177 BT_DBG("sk %p", sk); 1178 1179 if (level == SOL_SCO) 1180 return sco_sock_getsockopt_old(sock, optname, opt); 1181 1182 len = opt->optlen; 1183 1184 lock_sock(sk); 1185 1186 switch (optname) { 1187 1188 case BT_DEFER_SETUP: 1189 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 1190 err = -EINVAL; 1191 break; 1192 } 1193 1194 val = test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 1195 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) != 1196 sizeof(val)) 1197 err = -EFAULT; 1198 1199 break; 1200 1201 case BT_VOICE: 1202 voice.setting = sco_pi(sk)->setting; 1203 1204 len = min_t(unsigned int, len, sizeof(voice)); 1205 if (copy_to_iter(&voice, len, &opt->iter_out) != len) 1206 err = -EFAULT; 1207 1208 break; 1209 1210 case BT_PHY: 1211 if (sk->sk_state != BT_CONNECTED) { 1212 err = -ENOTCONN; 1213 break; 1214 } 1215 1216 phys = hci_conn_get_phy(sco_pi(sk)->conn->hcon); 1217 1218 if (copy_to_iter(&phys, sizeof(phys), &opt->iter_out) != 1219 sizeof(phys)) 1220 err = -EFAULT; 1221 break; 1222 1223 case BT_PKT_STATUS: 1224 val = test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags); 1225 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) != 1226 sizeof(val)) 1227 err = -EFAULT; 1228 break; 1229 1230 case BT_SNDMTU: 1231 case BT_RCVMTU: 1232 if (sk->sk_state != BT_CONNECTED) { 1233 err = -ENOTCONN; 1234 break; 1235 } 1236 1237 val = sco_pi(sk)->conn->mtu; 1238 if (copy_to_iter(&val, sizeof(val), &opt->iter_out) != 1239 sizeof(val)) 1240 err = -EFAULT; 1241 break; 1242 1243 case BT_CODEC: 1244 num_codecs = 0; 1245 buf_len = 0; 1246 1247 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR); 1248 if (!hdev) { 1249 err = -EBADFD; 1250 break; 1251 } 1252 1253 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) { 1254 hci_dev_put(hdev); 1255 err = -EOPNOTSUPP; 1256 break; 1257 } 1258 1259 if (!hdev->get_data_path_id) { 1260 hci_dev_put(hdev); 1261 err = -EOPNOTSUPP; 1262 break; 1263 } 1264 1265 release_sock(sk); 1266 1267 /* find total buffer size required to copy codec + caps */ 1268 hci_dev_lock(hdev); 1269 list_for_each_entry(c, &hdev->local_codecs, list) { 1270 if (c->transport != HCI_TRANSPORT_SCO_ESCO) 1271 continue; 1272 num_codecs++; 1273 for (i = 0, caps = c->caps; i < c->num_caps; i++) { 1274 buf_len += 1 + caps->len; 1275 caps = (void *)&caps->data[caps->len]; 1276 } 1277 buf_len += sizeof(struct bt_codec); 1278 } 1279 hci_dev_unlock(hdev); 1280 1281 buf_len += sizeof(struct bt_codecs); 1282 if (buf_len > len) { 1283 hci_dev_put(hdev); 1284 return -ENOBUFS; 1285 } 1286 1287 if (copy_to_iter(&num_codecs, sizeof(num_codecs), 1288 &opt->iter_out) != sizeof(num_codecs)) { 1289 hci_dev_put(hdev); 1290 return -EFAULT; 1291 } 1292 1293 /* Iterate all the codecs supported over SCO and populate 1294 * codec data 1295 */ 1296 hci_dev_lock(hdev); 1297 list_for_each_entry(c, &hdev->local_codecs, list) { 1298 if (c->transport != HCI_TRANSPORT_SCO_ESCO) 1299 continue; 1300 1301 codec.id = c->id; 1302 codec.cid = c->cid; 1303 codec.vid = c->vid; 1304 err = hdev->get_data_path_id(hdev, &codec.data_path); 1305 if (err < 0) 1306 break; 1307 codec.num_caps = c->num_caps; 1308 if (copy_to_iter(&codec, sizeof(codec), &opt->iter_out) 1309 != sizeof(codec)) { 1310 err = -EFAULT; 1311 break; 1312 } 1313 1314 /* find codec capabilities data length */ 1315 len = 0; 1316 for (i = 0, caps = c->caps; i < c->num_caps; i++) { 1317 len += 1 + caps->len; 1318 caps = (void *)&caps->data[caps->len]; 1319 } 1320 1321 /* copy codec capabilities data */ 1322 if (len && 1323 copy_to_iter(c->caps, len, &opt->iter_out) != len) { 1324 err = -EFAULT; 1325 break; 1326 } 1327 } 1328 1329 hci_dev_unlock(hdev); 1330 hci_dev_put(hdev); 1331 1332 lock_sock(sk); 1333 1334 if (!err) 1335 opt->optlen = buf_len; 1336 1337 break; 1338 1339 default: 1340 err = -ENOPROTOOPT; 1341 break; 1342 } 1343 1344 release_sock(sk); 1345 return err; 1346 } 1347 1348 static int sco_sock_shutdown(struct socket *sock, int how) 1349 { 1350 struct sock *sk = sock->sk; 1351 int err = 0; 1352 1353 BT_DBG("sock %p, sk %p", sock, sk); 1354 1355 if (!sk) 1356 return 0; 1357 1358 sock_hold(sk); 1359 lock_sock(sk); 1360 1361 if (!sk->sk_shutdown) { 1362 sk->sk_shutdown = SHUTDOWN_MASK; 1363 sco_sock_clear_timer(sk); 1364 __sco_sock_close(sk); 1365 1366 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 1367 !(current->flags & PF_EXITING)) 1368 err = bt_sock_wait_state(sk, BT_CLOSED, 1369 sk->sk_lingertime); 1370 } 1371 1372 release_sock(sk); 1373 sock_put(sk); 1374 1375 return err; 1376 } 1377 1378 static int sco_sock_release(struct socket *sock) 1379 { 1380 struct sock *sk = sock->sk; 1381 int err = 0; 1382 1383 BT_DBG("sock %p, sk %p", sock, sk); 1384 1385 if (!sk) 1386 return 0; 1387 1388 sco_sock_close(sk); 1389 1390 if (sock_flag(sk, SOCK_LINGER) && READ_ONCE(sk->sk_lingertime) && 1391 !(current->flags & PF_EXITING)) { 1392 lock_sock(sk); 1393 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); 1394 release_sock(sk); 1395 } 1396 1397 sock_orphan(sk); 1398 sco_sock_kill(sk); 1399 return err; 1400 } 1401 1402 static void sco_conn_ready(struct sco_conn *conn) 1403 { 1404 struct sock *parent, *sk; 1405 1406 sco_conn_lock(conn); 1407 sk = sco_sock_hold(conn); 1408 sco_conn_unlock(conn); 1409 1410 BT_DBG("conn %p", conn); 1411 1412 if (sk) { 1413 lock_sock(sk); 1414 1415 /* conn->sk may have become NULL if racing with sk close, but 1416 * due to held hdev->lock, it can't become different sk. 1417 */ 1418 if (conn->sk) { 1419 sco_sock_clear_timer(sk); 1420 sk->sk_state = BT_CONNECTED; 1421 sk->sk_state_change(sk); 1422 } 1423 1424 release_sock(sk); 1425 sock_put(sk); 1426 } else { 1427 if (!conn->hcon) 1428 return; 1429 1430 lockdep_assert_held(&conn->hcon->hdev->lock); 1431 1432 parent = sco_get_sock_listen(&conn->hcon->src); 1433 if (!parent) 1434 return; 1435 1436 lock_sock(parent); 1437 1438 sco_conn_lock(conn); 1439 1440 /* hdev->lock guarantees conn->sk == NULL still here */ 1441 1442 if (parent->sk_state != BT_LISTEN) 1443 goto release; 1444 1445 sk = sco_sock_alloc(sock_net(parent), NULL, 1446 BTPROTO_SCO, GFP_ATOMIC, 0); 1447 if (!sk) 1448 goto release; 1449 1450 sco_sock_init(sk, parent); 1451 1452 bacpy(&sco_pi(sk)->src, &conn->hcon->src); 1453 bacpy(&sco_pi(sk)->dst, &conn->hcon->dst); 1454 1455 sco_conn_hold(conn); 1456 hci_conn_hold(conn->hcon); 1457 __sco_chan_add(conn, sk, parent); 1458 1459 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) 1460 sk->sk_state = BT_CONNECT2; 1461 else 1462 sk->sk_state = BT_CONNECTED; 1463 1464 /* Wake up parent */ 1465 parent->sk_data_ready(parent); 1466 1467 release: 1468 sco_conn_unlock(conn); 1469 release_sock(parent); 1470 sock_put(parent); 1471 } 1472 } 1473 1474 /* ----- SCO interface with lower layer (HCI) ----- */ 1475 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) 1476 { 1477 struct sock *sk; 1478 int lm = 0; 1479 1480 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr); 1481 1482 /* Find listening sockets */ 1483 read_lock(&sco_sk_list.lock); 1484 sk_for_each(sk, &sco_sk_list.head) { 1485 if (sk->sk_state != BT_LISTEN) 1486 continue; 1487 1488 if (!bacmp(&sco_pi(sk)->src, &hdev->bdaddr) || 1489 !bacmp(&sco_pi(sk)->src, BDADDR_ANY)) { 1490 lm |= HCI_LM_ACCEPT; 1491 1492 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) 1493 *flags |= HCI_PROTO_DEFER; 1494 break; 1495 } 1496 } 1497 read_unlock(&sco_sk_list.lock); 1498 1499 return lm; 1500 } 1501 1502 static void sco_connect_cfm(struct hci_conn *hcon, __u8 status) 1503 { 1504 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) 1505 return; 1506 1507 BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status); 1508 1509 if (!status) { 1510 struct sco_conn *conn; 1511 1512 conn = sco_conn_add(hcon); 1513 if (conn) { 1514 sco_conn_ready(conn); 1515 sco_conn_put(conn); 1516 } 1517 } else 1518 sco_conn_del(hcon, bt_to_errno(status)); 1519 } 1520 1521 static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason) 1522 { 1523 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) 1524 return; 1525 1526 BT_DBG("hcon %p reason %d", hcon, reason); 1527 1528 sco_conn_del(hcon, bt_to_errno(reason)); 1529 } 1530 1531 int sco_recv_scodata(struct hci_dev *hdev, u16 handle, struct sk_buff *skb) 1532 { 1533 struct hci_conn *hcon; 1534 struct sco_conn *conn; 1535 1536 hci_dev_lock(hdev); 1537 1538 hcon = hci_conn_hash_lookup_handle(hdev, handle); 1539 if (!hcon) { 1540 hci_dev_unlock(hdev); 1541 kfree_skb(skb); 1542 return -ENOENT; 1543 } 1544 1545 conn = sco_conn_hold_unless_zero(hcon->sco_data); 1546 hcon = NULL; 1547 1548 hci_dev_unlock(hdev); 1549 1550 if (!conn) { 1551 kfree_skb(skb); 1552 return -EINVAL; 1553 } 1554 1555 BT_DBG("conn %p len %u", conn, skb->len); 1556 1557 if (skb->len) 1558 sco_recv_frame(conn, skb); 1559 else 1560 kfree_skb(skb); 1561 1562 sco_conn_put(conn); 1563 return 0; 1564 } 1565 1566 static struct hci_cb sco_cb = { 1567 .name = "SCO", 1568 .connect_cfm = sco_connect_cfm, 1569 .disconn_cfm = sco_disconn_cfm, 1570 }; 1571 1572 static int sco_debugfs_show(struct seq_file *f, void *p) 1573 { 1574 struct sock *sk; 1575 1576 read_lock(&sco_sk_list.lock); 1577 1578 sk_for_each(sk, &sco_sk_list.head) { 1579 seq_printf(f, "%pMR %pMR %d\n", &sco_pi(sk)->src, 1580 &sco_pi(sk)->dst, sk->sk_state); 1581 } 1582 1583 read_unlock(&sco_sk_list.lock); 1584 1585 return 0; 1586 } 1587 1588 DEFINE_SHOW_ATTRIBUTE(sco_debugfs); 1589 1590 static struct dentry *sco_debugfs; 1591 1592 static const struct proto_ops sco_sock_ops = { 1593 .family = PF_BLUETOOTH, 1594 .owner = THIS_MODULE, 1595 .release = sco_sock_release, 1596 .bind = sco_sock_bind, 1597 .connect = sco_sock_connect, 1598 .listen = sco_sock_listen, 1599 .accept = sco_sock_accept, 1600 .getname = sco_sock_getname, 1601 .sendmsg = sco_sock_sendmsg, 1602 .recvmsg = sco_sock_recvmsg, 1603 .poll = bt_sock_poll, 1604 .ioctl = bt_sock_ioctl, 1605 .gettstamp = sock_gettstamp, 1606 .mmap = sock_no_mmap, 1607 .socketpair = sock_no_socketpair, 1608 .shutdown = sco_sock_shutdown, 1609 .setsockopt = sco_sock_setsockopt, 1610 .getsockopt_iter = sco_sock_getsockopt 1611 }; 1612 1613 static const struct net_proto_family sco_sock_family_ops = { 1614 .family = PF_BLUETOOTH, 1615 .owner = THIS_MODULE, 1616 .create = sco_sock_create, 1617 }; 1618 1619 int __init sco_init(void) 1620 { 1621 int err; 1622 1623 BUILD_BUG_ON(sizeof(struct sockaddr_sco) > sizeof(struct sockaddr)); 1624 1625 err = proto_register(&sco_proto, 0); 1626 if (err < 0) 1627 return err; 1628 1629 err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops); 1630 if (err < 0) { 1631 BT_ERR("SCO socket registration failed"); 1632 goto error; 1633 } 1634 1635 err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL); 1636 if (err < 0) { 1637 BT_ERR("Failed to create SCO proc file"); 1638 bt_sock_unregister(BTPROTO_SCO); 1639 goto error; 1640 } 1641 1642 BT_INFO("SCO socket layer initialized"); 1643 1644 hci_register_cb(&sco_cb); 1645 1646 if (IS_ERR_OR_NULL(bt_debugfs)) 1647 return 0; 1648 1649 sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs, 1650 NULL, &sco_debugfs_fops); 1651 1652 return 0; 1653 1654 error: 1655 proto_unregister(&sco_proto); 1656 return err; 1657 } 1658 1659 void sco_exit(void) 1660 { 1661 bt_procfs_cleanup(&init_net, "sco"); 1662 1663 debugfs_remove(sco_debugfs); 1664 1665 hci_unregister_cb(&sco_cb); 1666 1667 bt_sock_unregister(BTPROTO_SCO); 1668 1669 proto_unregister(&sco_proto); 1670 } 1671 1672 module_param(disable_esco, bool, 0644); 1673 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation"); 1674