net/bluetooth/sco.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth SCO sockets. */
  26
  27 #include <linux/module.h>
  28 #include <linux/debugfs.h>
  29 #include <linux/seq_file.h>
  30
  31 #include <net/bluetooth/bluetooth.h>
  32 #include <net/bluetooth/hci_core.h>
  33 #include <net/bluetooth/sco.h>
  34
  35 static bool disable_esco;
  36
  37 static const struct proto_ops sco_sock_ops;
  38
  39 static struct bt_sock_list sco_sk_list = {
  40         .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
  41 };
  42
  43 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent);
  44 static void sco_chan_del(struct sock *sk, int err);
  45
  46 static void sco_sock_close(struct sock *sk);
  47 static void sco_sock_kill(struct sock *sk);
  48
  49 /* ---- SCO timers ---- */
  50 static void sco_sock_timeout(unsigned long arg)
  51 {
  52         struct sock *sk = (struct sock *) arg;
  53
  54         BT_DBG("sock %p state %d", sk, sk->sk_state);
  55
  56         bh_lock_sock(sk);
  57         sk->sk_err = ETIMEDOUT;
  58         sk->sk_state_change(sk);
  59         bh_unlock_sock(sk);
  60
  61         sco_sock_kill(sk);
  62         sock_put(sk);
  63 }
  64
  65 static void sco_sock_set_timer(struct sock *sk, long timeout)
  66 {
  67         BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
  68         sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
  69 }
  70
  71 static void sco_sock_clear_timer(struct sock *sk)
  72 {
  73         BT_DBG("sock %p state %d", sk, sk->sk_state);
  74         sk_stop_timer(sk, &sk->sk_timer);
  75 }
  76
  77 /* ---- SCO connections ---- */
  78 static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
  79 {
  80         struct hci_dev *hdev = hcon->hdev;
  81         struct sco_conn *conn = hcon->sco_data;
  82
  83         if (conn)
  84                 return conn;
  85
  86         conn = kzalloc(sizeof(struct sco_conn), GFP_KERNEL);
  87         if (!conn)
  88                 return NULL;
  89
  90         spin_lock_init(&conn->lock);
  91
  92         hcon->sco_data = conn;
  93         conn->hcon = hcon;
  94
  95         conn->src = &hdev->bdaddr;
  96         conn->dst = &hcon->dst;
  97
  98         if (hdev->sco_mtu > 0)
  99                 conn->mtu = hdev->sco_mtu;
 100         else
 101                 conn->mtu = 60;
 102
 103         BT_DBG("hcon %p conn %p", hcon, conn);
 104
 105         return conn;
 106 }
 107
 108 static struct sock *sco_chan_get(struct sco_conn *conn)
 109 {
 110         struct sock *sk = NULL;
 111         sco_conn_lock(conn);
 112         sk = conn->sk;
 113         sco_conn_unlock(conn);
 114         return sk;
 115 }
 116
 117 static int sco_conn_del(struct hci_conn *hcon, int err)
 118 {
 119         struct sco_conn *conn = hcon->sco_data;
 120         struct sock *sk;
 121
 122         if (!conn)
 123                 return 0;
 124
 125         BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 126
 127         /* Kill socket */
 128         sk = sco_chan_get(conn);
 129         if (sk) {
 130                 bh_lock_sock(sk);
 131                 sco_sock_clear_timer(sk);
 132                 sco_chan_del(sk, err);
 133                 bh_unlock_sock(sk);
 134                 sco_sock_kill(sk);
 135         }
 136
 137         hcon->sco_data = NULL;
 138         kfree(conn);
 139         return 0;
 140 }
 141
 142 static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
 143                         struct sock *parent)
 144 {
 145         int err = 0;
 146
 147         sco_conn_lock(conn);
 148         if (conn->sk)
 149                 err = -EBUSY;
 150         else
 151                 __sco_chan_add(conn, sk, parent);
 152
 153         sco_conn_unlock(conn);
 154         return err;
 155 }
 156
 157 static int sco_connect(struct sock *sk)
 158 {
 159         bdaddr_t *src = &bt_sk(sk)->src;
 160         bdaddr_t *dst = &bt_sk(sk)->dst;
 161         struct sco_conn *conn;
 162         struct hci_conn *hcon;
 163         struct hci_dev  *hdev;
 164         int err, type;
 165
 166         BT_DBG("%pMR -> %pMR", src, dst);
 167
 168         hdev = hci_get_route(dst, src);
 169         if (!hdev)
 170                 return -EHOSTUNREACH;
 171
 172         hci_dev_lock(hdev);
 173
 174         if (lmp_esco_capable(hdev) && !disable_esco)
 175                 type = ESCO_LINK;
 176         else
 177                 type = SCO_LINK;
 178
 179         if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT &&
 180             (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) {
 181                 err = -EOPNOTSUPP;
 182                 goto done;
 183         }
 184
 185         hcon = hci_connect_sco(hdev, type, dst, sco_pi(sk)->setting);
 186         if (IS_ERR(hcon)) {
 187                 err = PTR_ERR(hcon);
 188                 goto done;
 189         }
 190
 191         conn = sco_conn_add(hcon);
 192         if (!conn) {
 193                 hci_conn_drop(hcon);
 194                 err = -ENOMEM;
 195                 goto done;
 196         }
 197
 198         /* Update source addr of the socket */
 199         bacpy(src, conn->src);
 200
 201         err = sco_chan_add(conn, sk, NULL);
 202         if (err)
 203                 goto done;
 204
 205         if (hcon->state == BT_CONNECTED) {
 206                 sco_sock_clear_timer(sk);
 207                 sk->sk_state = BT_CONNECTED;
 208         } else {
 209                 sk->sk_state = BT_CONNECT;
 210                 sco_sock_set_timer(sk, sk->sk_sndtimeo);
 211         }
 212
 213 done:
 214         hci_dev_unlock(hdev);
 215         hci_dev_put(hdev);
 216         return err;
 217 }
 218
 219 static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
 220 {
 221         struct sco_conn *conn = sco_pi(sk)->conn;
 222         struct sk_buff *skb;
 223         int err;
 224
 225         /* Check outgoing MTU */
 226         if (len > conn->mtu)
 227                 return -EINVAL;
 228
 229         BT_DBG("sk %p len %d", sk, len);
 230
 231         skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
 232         if (!skb)
 233                 return err;
 234
 235         if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
 236                 kfree_skb(skb);
 237                 return -EFAULT;
 238         }
 239
 240         hci_send_sco(conn->hcon, skb);
 241
 242         return len;
 243 }
 244
 245 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
 246 {
 247         struct sock *sk = sco_chan_get(conn);
 248
 249         if (!sk)
 250                 goto drop;
 251
 252         BT_DBG("sk %p len %d", sk, skb->len);
 253
 254         if (sk->sk_state != BT_CONNECTED)
 255                 goto drop;
 256
 257         if (!sock_queue_rcv_skb(sk, skb))
 258                 return;
 259
 260 drop:
 261         kfree_skb(skb);
 262 }
 263
 264 /* -------- Socket interface ---------- */
 265 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
 266 {
 267         struct sock *sk;
 268
 269         sk_for_each(sk, &sco_sk_list.head) {
 270                 if (sk->sk_state != BT_LISTEN)
 271                         continue;
 272
 273                 if (!bacmp(&bt_sk(sk)->src, ba))
 274                         return sk;
 275         }
 276
 277         return NULL;
 278 }
 279
 280 /* Find socket listening on source bdaddr.
 281  * Returns closest match.
 282  */
 283 static struct sock *sco_get_sock_listen(bdaddr_t *src)
 284 {
 285         struct sock *sk = NULL, *sk1 = NULL;
 286
 287         read_lock(&sco_sk_list.lock);
 288
 289         sk_for_each(sk, &sco_sk_list.head) {
 290                 if (sk->sk_state != BT_LISTEN)
 291                         continue;
 292
 293                 /* Exact match. */
 294                 if (!bacmp(&bt_sk(sk)->src, src))
 295                         break;
 296
 297                 /* Closest match */
 298                 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 299                         sk1 = sk;
 300         }
 301
 302         read_unlock(&sco_sk_list.lock);
 303
 304         return sk ? sk : sk1;
 305 }
 306
 307 static void sco_sock_destruct(struct sock *sk)
 308 {
 309         BT_DBG("sk %p", sk);
 310
 311         skb_queue_purge(&sk->sk_receive_queue);
 312         skb_queue_purge(&sk->sk_write_queue);
 313 }
 314
 315 static void sco_sock_cleanup_listen(struct sock *parent)
 316 {
 317         struct sock *sk;
 318
 319         BT_DBG("parent %p", parent);
 320
 321         /* Close not yet accepted channels */
 322         while ((sk = bt_accept_dequeue(parent, NULL))) {
 323                 sco_sock_close(sk);
 324                 sco_sock_kill(sk);
 325         }
 326
 327         parent->sk_state  = BT_CLOSED;
 328         sock_set_flag(parent, SOCK_ZAPPED);
 329 }
 330
 331 /* Kill socket (only if zapped and orphan)
 332  * Must be called on unlocked socket.
 333  */
 334 static void sco_sock_kill(struct sock *sk)
 335 {
 336         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 337                 return;
 338
 339         BT_DBG("sk %p state %d", sk, sk->sk_state);
 340
 341         /* Kill poor orphan */
 342         bt_sock_unlink(&sco_sk_list, sk);
 343         sock_set_flag(sk, SOCK_DEAD);
 344         sock_put(sk);
 345 }
 346
 347 static void __sco_sock_close(struct sock *sk)
 348 {
 349         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 350
 351         switch (sk->sk_state) {
 352         case BT_LISTEN:
 353                 sco_sock_cleanup_listen(sk);
 354                 break;
 355
 356         case BT_CONNECTED:
 357         case BT_CONFIG:
 358                 if (sco_pi(sk)->conn->hcon) {
 359                         sk->sk_state = BT_DISCONN;
 360                         sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
 361                         hci_conn_drop(sco_pi(sk)->conn->hcon);
 362                         sco_pi(sk)->conn->hcon = NULL;
 363                 } else
 364                         sco_chan_del(sk, ECONNRESET);
 365                 break;
 366
 367         case BT_CONNECT2:
 368         case BT_CONNECT:
 369         case BT_DISCONN:
 370                 sco_chan_del(sk, ECONNRESET);
 371                 break;
 372
 373         default:
 374                 sock_set_flag(sk, SOCK_ZAPPED);
 375                 break;
 376         }
 377 }
 378
 379 /* Must be called on unlocked socket. */
 380 static void sco_sock_close(struct sock *sk)
 381 {
 382         sco_sock_clear_timer(sk);
 383         lock_sock(sk);
 384         __sco_sock_close(sk);
 385         release_sock(sk);
 386         sco_sock_kill(sk);
 387 }
 388
 389 static void sco_sock_init(struct sock *sk, struct sock *parent)
 390 {
 391         BT_DBG("sk %p", sk);
 392
 393         if (parent) {
 394                 sk->sk_type = parent->sk_type;
 395                 bt_sk(sk)->flags = bt_sk(parent)->flags;
 396                 security_sk_clone(parent, sk);
 397         }
 398 }
 399
 400 static struct proto sco_proto = {
 401         .name           = "SCO",
 402         .owner          = THIS_MODULE,
 403         .obj_size       = sizeof(struct sco_pinfo)
 404 };
 405
 406 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 407 {
 408         struct sock *sk;
 409
 410         sk = sk_alloc(net, PF_BLUETOOTH, prio, &sco_proto);
 411         if (!sk)
 412                 return NULL;
 413
 414         sock_init_data(sock, sk);
 415         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 416
 417         sk->sk_destruct = sco_sock_destruct;
 418         sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
 419
 420         sock_reset_flag(sk, SOCK_ZAPPED);
 421
 422         sk->sk_protocol = proto;
 423         sk->sk_state    = BT_OPEN;
 424
 425         sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
 426
 427         setup_timer(&sk->sk_timer, sco_sock_timeout, (unsigned long)sk);
 428
 429         bt_sock_link(&sco_sk_list, sk);
 430         return sk;
 431 }
 432
 433 static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
 434                            int kern)
 435 {
 436         struct sock *sk;
 437
 438         BT_DBG("sock %p", sock);
 439
 440         sock->state = SS_UNCONNECTED;
 441
 442         if (sock->type != SOCK_SEQPACKET)
 443                 return -ESOCKTNOSUPPORT;
 444
 445         sock->ops = &sco_sock_ops;
 446
 447         sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 448         if (!sk)
 449                 return -ENOMEM;
 450
 451         sco_sock_init(sk, NULL);
 452         return 0;
 453 }
 454
 455 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 456 {
 457         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 458         struct sock *sk = sock->sk;
 459         int err = 0;
 460
 461         BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
 462
 463         if (!addr || addr->sa_family != AF_BLUETOOTH)
 464                 return -EINVAL;
 465
 466         lock_sock(sk);
 467
 468         if (sk->sk_state != BT_OPEN) {
 469                 err = -EBADFD;
 470                 goto done;
 471         }
 472
 473         if (sk->sk_type != SOCK_SEQPACKET) {
 474                 err = -EINVAL;
 475                 goto done;
 476         }
 477
 478         bacpy(&bt_sk(sk)->src, &sa->sco_bdaddr);
 479
 480         sk->sk_state = BT_BOUND;
 481
 482 done:
 483         release_sock(sk);
 484         return err;
 485 }
 486
 487 static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 488 {
 489         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 490         struct sock *sk = sock->sk;
 491         int err;
 492
 493         BT_DBG("sk %p", sk);
 494
 495         if (alen < sizeof(struct sockaddr_sco) ||
 496             addr->sa_family != AF_BLUETOOTH)
 497                 return -EINVAL;
 498
 499         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
 500                 return -EBADFD;
 501
 502         if (sk->sk_type != SOCK_SEQPACKET)
 503                 return -EINVAL;
 504
 505         lock_sock(sk);
 506
 507         /* Set destination address and psm */
 508         bacpy(&bt_sk(sk)->dst, &sa->sco_bdaddr);
 509
 510         err = sco_connect(sk);
 511         if (err)
 512                 goto done;
 513
 514         err = bt_sock_wait_state(sk, BT_CONNECTED,
 515                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 516
 517 done:
 518         release_sock(sk);
 519         return err;
 520 }
 521
 522 static int sco_sock_listen(struct socket *sock, int backlog)
 523 {
 524         struct sock *sk = sock->sk;
 525         bdaddr_t *src = &bt_sk(sk)->src;
 526         int err = 0;
 527
 528         BT_DBG("sk %p backlog %d", sk, backlog);
 529
 530         lock_sock(sk);
 531
 532         if (sk->sk_state != BT_BOUND) {
 533                 err = -EBADFD;
 534                 goto done;
 535         }
 536
 537         if (sk->sk_type != SOCK_SEQPACKET) {
 538                 err = -EINVAL;
 539                 goto done;
 540         }
 541
 542         write_lock(&sco_sk_list.lock);
 543
 544         if (__sco_get_sock_listen_by_addr(src)) {
 545                 err = -EADDRINUSE;
 546                 goto unlock;
 547         }
 548
 549         sk->sk_max_ack_backlog = backlog;
 550         sk->sk_ack_backlog = 0;
 551
 552         sk->sk_state = BT_LISTEN;
 553
 554 unlock:
 555         write_unlock(&sco_sk_list.lock);
 556
 557 done:
 558         release_sock(sk);
 559         return err;
 560 }
 561
 562 static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 563 {
 564         DECLARE_WAITQUEUE(wait, current);
 565         struct sock *sk = sock->sk, *ch;
 566         long timeo;
 567         int err = 0;
 568
 569         lock_sock(sk);
 570
 571         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 572
 573         BT_DBG("sk %p timeo %ld", sk, timeo);
 574
 575         /* Wait for an incoming connection. (wake-one). */
 576         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 577         while (1) {
 578                 set_current_state(TASK_INTERRUPTIBLE);
 579
 580                 if (sk->sk_state != BT_LISTEN) {
 581                         err = -EBADFD;
 582                         break;
 583                 }
 584
 585                 ch = bt_accept_dequeue(sk, newsock);
 586                 if (ch)
 587                         break;
 588
 589                 if (!timeo) {
 590                         err = -EAGAIN;
 591                         break;
 592                 }
 593
 594                 if (signal_pending(current)) {
 595                         err = sock_intr_errno(timeo);
 596                         break;
 597                 }
 598
 599                 release_sock(sk);
 600                 timeo = schedule_timeout(timeo);
 601                 lock_sock(sk);
 602         }
 603         __set_current_state(TASK_RUNNING);
 604         remove_wait_queue(sk_sleep(sk), &wait);
 605
 606         if (err)
 607                 goto done;
 608
 609         newsock->state = SS_CONNECTED;
 610
 611         BT_DBG("new socket %p", ch);
 612
 613 done:
 614         release_sock(sk);
 615         return err;
 616 }
 617
 618 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 619 {
 620         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 621         struct sock *sk = sock->sk;
 622
 623         BT_DBG("sock %p, sk %p", sock, sk);
 624
 625         addr->sa_family = AF_BLUETOOTH;
 626         *len = sizeof(struct sockaddr_sco);
 627
 628         if (peer)
 629                 bacpy(&sa->sco_bdaddr, &bt_sk(sk)->dst);
 630         else
 631                 bacpy(&sa->sco_bdaddr, &bt_sk(sk)->src);
 632
 633         return 0;
 634 }
 635
 636 static int sco_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 637                             struct msghdr *msg, size_t len)
 638 {
 639         struct sock *sk = sock->sk;
 640         int err;
 641
 642         BT_DBG("sock %p, sk %p", sock, sk);
 643
 644         err = sock_error(sk);
 645         if (err)
 646                 return err;
 647
 648         if (msg->msg_flags & MSG_OOB)
 649                 return -EOPNOTSUPP;
 650
 651         lock_sock(sk);
 652
 653         if (sk->sk_state == BT_CONNECTED)
 654                 err = sco_send_frame(sk, msg, len);
 655         else
 656                 err = -ENOTCONN;
 657
 658         release_sock(sk);
 659         return err;
 660 }
 661
 662 static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
 663 {
 664         struct hci_dev *hdev = conn->hdev;
 665
 666         BT_DBG("conn %p", conn);
 667
 668         conn->state = BT_CONFIG;
 669
 670         if (!lmp_esco_capable(hdev)) {
 671                 struct hci_cp_accept_conn_req cp;
 672
 673                 bacpy(&cp.bdaddr, &conn->dst);
 674                 cp.role = 0x00; /* Ignored */
 675
 676                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
 677         } else {
 678                 struct hci_cp_accept_sync_conn_req cp;
 679
 680                 bacpy(&cp.bdaddr, &conn->dst);
 681                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
 682
 683                 cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 684                 cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 685                 cp.content_format = cpu_to_le16(setting);
 686
 687                 switch (setting & SCO_AIRMODE_MASK) {
 688                 case SCO_AIRMODE_TRANSP:
 689                         if (conn->pkt_type & ESCO_2EV3)
 690                                 cp.max_latency = __constant_cpu_to_le16(0x0008);
 691                         else
 692                                 cp.max_latency = __constant_cpu_to_le16(0x000D);
 693                         cp.retrans_effort = 0x02;
 694                         break;
 695                 case SCO_AIRMODE_CVSD:
 696                         cp.max_latency = __constant_cpu_to_le16(0xffff);
 697                         cp.retrans_effort = 0xff;
 698                         break;
 699                 }
 700
 701                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
 702                              sizeof(cp), &cp);
 703         }
 704 }
 705
 706 static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 707                             struct msghdr *msg, size_t len, int flags)
 708 {
 709         struct sock *sk = sock->sk;
 710         struct sco_pinfo *pi = sco_pi(sk);
 711
 712         lock_sock(sk);
 713
 714         if (sk->sk_state == BT_CONNECT2 &&
 715             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
 716                 sco_conn_defer_accept(pi->conn->hcon, pi->setting);
 717                 sk->sk_state = BT_CONFIG;
 718
 719                 release_sock(sk);
 720                 return 0;
 721         }
 722
 723         release_sock(sk);
 724
 725         return bt_sock_recvmsg(iocb, sock, msg, len, flags);
 726 }
 727
 728 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 729 {
 730         struct sock *sk = sock->sk;
 731         int len, err = 0;
 732         struct bt_voice voice;
 733         u32 opt;
 734
 735         BT_DBG("sk %p", sk);
 736
 737         lock_sock(sk);
 738
 739         switch (optname) {
 740
 741         case BT_DEFER_SETUP:
 742                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 743                         err = -EINVAL;
 744                         break;
 745                 }
 746
 747                 if (get_user(opt, (u32 __user *) optval)) {
 748                         err = -EFAULT;
 749                         break;
 750                 }
 751
 752                 if (opt)
 753                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 754                 else
 755                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 756                 break;
 757
 758         case BT_VOICE:
 759                 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
 760                     sk->sk_state != BT_CONNECT2) {
 761                         err = -EINVAL;
 762                         break;
 763                 }
 764
 765                 voice.setting = sco_pi(sk)->setting;
 766
 767                 len = min_t(unsigned int, sizeof(voice), optlen);
 768                 if (copy_from_user((char *) &voice, optval, len)) {
 769                         err = -EFAULT;
 770                         break;
 771                 }
 772
 773                 /* Explicitly check for these values */
 774                 if (voice.setting != BT_VOICE_TRANSPARENT &&
 775                     voice.setting != BT_VOICE_CVSD_16BIT) {
 776                         err = -EINVAL;
 777                         break;
 778                 }
 779
 780                 sco_pi(sk)->setting = voice.setting;
 781                 break;
 782
 783         default:
 784                 err = -ENOPROTOOPT;
 785                 break;
 786         }
 787
 788         release_sock(sk);
 789         return err;
 790 }
 791
 792 static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 793 {
 794         struct sock *sk = sock->sk;
 795         struct sco_options opts;
 796         struct sco_conninfo cinfo;
 797         int len, err = 0;
 798
 799         BT_DBG("sk %p", sk);
 800
 801         if (get_user(len, optlen))
 802                 return -EFAULT;
 803
 804         lock_sock(sk);
 805
 806         switch (optname) {
 807         case SCO_OPTIONS:
 808                 if (sk->sk_state != BT_CONNECTED &&
 809                     !(sk->sk_state == BT_CONNECT2 &&
 810                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 811                         err = -ENOTCONN;
 812                         break;
 813                 }
 814
 815                 opts.mtu = sco_pi(sk)->conn->mtu;
 816
 817                 BT_DBG("mtu %d", opts.mtu);
 818
 819                 len = min_t(unsigned int, len, sizeof(opts));
 820                 if (copy_to_user(optval, (char *)&opts, len))
 821                         err = -EFAULT;
 822
 823                 break;
 824
 825         case SCO_CONNINFO:
 826                 if (sk->sk_state != BT_CONNECTED &&
 827                     !(sk->sk_state == BT_CONNECT2 &&
 828                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 829                         err = -ENOTCONN;
 830                         break;
 831                 }
 832
 833                 memset(&cinfo, 0, sizeof(cinfo));
 834                 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
 835                 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
 836
 837                 len = min_t(unsigned int, len, sizeof(cinfo));
 838                 if (copy_to_user(optval, (char *)&cinfo, len))
 839                         err = -EFAULT;
 840
 841                 break;
 842
 843         default:
 844                 err = -ENOPROTOOPT;
 845                 break;
 846         }
 847
 848         release_sock(sk);
 849         return err;
 850 }
 851
 852 static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 853 {
 854         struct sock *sk = sock->sk;
 855         int len, err = 0;
 856         struct bt_voice voice;
 857
 858         BT_DBG("sk %p", sk);
 859
 860         if (level == SOL_SCO)
 861                 return sco_sock_getsockopt_old(sock, optname, optval, optlen);
 862
 863         if (get_user(len, optlen))
 864                 return -EFAULT;
 865
 866         lock_sock(sk);
 867
 868         switch (optname) {
 869
 870         case BT_DEFER_SETUP:
 871                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 872                         err = -EINVAL;
 873                         break;
 874                 }
 875
 876                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 877                              (u32 __user *) optval))
 878                         err = -EFAULT;
 879
 880                 break;
 881
 882         case BT_VOICE:
 883                 voice.setting = sco_pi(sk)->setting;
 884
 885                 len = min_t(unsigned int, len, sizeof(voice));
 886                 if (copy_to_user(optval, (char *)&voice, len))
 887                         err = -EFAULT;
 888
 889                 break;
 890
 891         default:
 892                 err = -ENOPROTOOPT;
 893                 break;
 894         }
 895
 896         release_sock(sk);
 897         return err;
 898 }
 899
 900 static int sco_sock_shutdown(struct socket *sock, int how)
 901 {
 902         struct sock *sk = sock->sk;
 903         int err = 0;
 904
 905         BT_DBG("sock %p, sk %p", sock, sk);
 906
 907         if (!sk)
 908                 return 0;
 909
 910         lock_sock(sk);
 911         if (!sk->sk_shutdown) {
 912                 sk->sk_shutdown = SHUTDOWN_MASK;
 913                 sco_sock_clear_timer(sk);
 914                 __sco_sock_close(sk);
 915
 916                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
 917                     !(current->flags & PF_EXITING))
 918                         err = bt_sock_wait_state(sk, BT_CLOSED,
 919                                                  sk->sk_lingertime);
 920         }
 921         release_sock(sk);
 922         return err;
 923 }
 924
 925 static int sco_sock_release(struct socket *sock)
 926 {
 927         struct sock *sk = sock->sk;
 928         int err = 0;
 929
 930         BT_DBG("sock %p, sk %p", sock, sk);
 931
 932         if (!sk)
 933                 return 0;
 934
 935         sco_sock_close(sk);
 936
 937         if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
 938             !(current->flags & PF_EXITING)) {
 939                 lock_sock(sk);
 940                 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 941                 release_sock(sk);
 942         }
 943
 944         sock_orphan(sk);
 945         sco_sock_kill(sk);
 946         return err;
 947 }
 948
 949 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
 950 {
 951         BT_DBG("conn %p", conn);
 952
 953         sco_pi(sk)->conn = conn;
 954         conn->sk = sk;
 955
 956         if (parent)
 957                 bt_accept_enqueue(parent, sk);
 958 }
 959
 960 /* Delete channel.
 961  * Must be called on the locked socket. */
 962 static void sco_chan_del(struct sock *sk, int err)
 963 {
 964         struct sco_conn *conn;
 965
 966         conn = sco_pi(sk)->conn;
 967
 968         BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
 969
 970         if (conn) {
 971                 sco_conn_lock(conn);
 972                 conn->sk = NULL;
 973                 sco_pi(sk)->conn = NULL;
 974                 sco_conn_unlock(conn);
 975
 976                 if (conn->hcon)
 977                         hci_conn_drop(conn->hcon);
 978         }
 979
 980         sk->sk_state = BT_CLOSED;
 981         sk->sk_err   = err;
 982         sk->sk_state_change(sk);
 983
 984         sock_set_flag(sk, SOCK_ZAPPED);
 985 }
 986
 987 static void sco_conn_ready(struct sco_conn *conn)
 988 {
 989         struct sock *parent;
 990         struct sock *sk = conn->sk;
 991
 992         BT_DBG("conn %p", conn);
 993
 994         if (sk) {
 995                 sco_sock_clear_timer(sk);
 996                 bh_lock_sock(sk);
 997                 sk->sk_state = BT_CONNECTED;
 998                 sk->sk_state_change(sk);
 999                 bh_unlock_sock(sk);
1000         } else {
1001                 sco_conn_lock(conn);
1002
1003                 parent = sco_get_sock_listen(conn->src);
1004                 if (!parent) {
1005                         sco_conn_unlock(conn);
1006                         return;
1007                 }
1008
1009                 bh_lock_sock(parent);
1010
1011                 sk = sco_sock_alloc(sock_net(parent), NULL,
1012                                     BTPROTO_SCO, GFP_ATOMIC);
1013                 if (!sk) {
1014                         bh_unlock_sock(parent);
1015                         sco_conn_unlock(conn);
1016                         return;
1017                 }
1018
1019                 sco_sock_init(sk, parent);
1020
1021                 bacpy(&bt_sk(sk)->src, conn->src);
1022                 bacpy(&bt_sk(sk)->dst, conn->dst);
1023
1024                 hci_conn_hold(conn->hcon);
1025                 __sco_chan_add(conn, sk, parent);
1026
1027                 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
1028                         sk->sk_state = BT_CONNECT2;
1029                 else
1030                         sk->sk_state = BT_CONNECTED;
1031
1032                 /* Wake up parent */
1033                 parent->sk_data_ready(parent, 1);
1034
1035                 bh_unlock_sock(parent);
1036
1037                 sco_conn_unlock(conn);
1038         }
1039 }
1040
1041 /* ----- SCO interface with lower layer (HCI) ----- */
1042 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
1043 {
1044         struct sock *sk;
1045         int lm = 0;
1046
1047         BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1048
1049         /* Find listening sockets */
1050         read_lock(&sco_sk_list.lock);
1051         sk_for_each(sk, &sco_sk_list.head) {
1052                 if (sk->sk_state != BT_LISTEN)
1053                         continue;
1054
1055                 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr) ||
1056                     !bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
1057                         lm |= HCI_LM_ACCEPT;
1058
1059                         if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
1060                                 *flags |= HCI_PROTO_DEFER;
1061                         break;
1062                 }
1063         }
1064         read_unlock(&sco_sk_list.lock);
1065
1066         return lm;
1067 }
1068
1069 void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
1070 {
1071         BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
1072         if (!status) {
1073                 struct sco_conn *conn;
1074
1075                 conn = sco_conn_add(hcon);
1076                 if (conn)
1077                         sco_conn_ready(conn);
1078         } else
1079                 sco_conn_del(hcon, bt_to_errno(status));
1080 }
1081
1082 void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
1083 {
1084         BT_DBG("hcon %p reason %d", hcon, reason);
1085
1086         sco_conn_del(hcon, bt_to_errno(reason));
1087 }
1088
1089 int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
1090 {
1091         struct sco_conn *conn = hcon->sco_data;
1092
1093         if (!conn)
1094                 goto drop;
1095
1096         BT_DBG("conn %p len %d", conn, skb->len);
1097
1098         if (skb->len) {
1099                 sco_recv_frame(conn, skb);
1100                 return 0;
1101         }
1102
1103 drop:
1104         kfree_skb(skb);
1105         return 0;
1106 }
1107
1108 static int sco_debugfs_show(struct seq_file *f, void *p)
1109 {
1110         struct sock *sk;
1111
1112         read_lock(&sco_sk_list.lock);
1113
1114         sk_for_each(sk, &sco_sk_list.head) {
1115                 seq_printf(f, "%pMR %pMR %d\n", &bt_sk(sk)->src,
1116                            &bt_sk(sk)->dst, sk->sk_state);
1117         }
1118
1119         read_unlock(&sco_sk_list.lock);
1120
1121         return 0;
1122 }
1123
1124 static int sco_debugfs_open(struct inode *inode, struct file *file)
1125 {
1126         return single_open(file, sco_debugfs_show, inode->i_private);
1127 }
1128
1129 static const struct file_operations sco_debugfs_fops = {
1130         .open           = sco_debugfs_open,
1131         .read           = seq_read,
1132         .llseek         = seq_lseek,
1133         .release        = single_release,
1134 };
1135
1136 static struct dentry *sco_debugfs;
1137
1138 static const struct proto_ops sco_sock_ops = {
1139         .family         = PF_BLUETOOTH,
1140         .owner          = THIS_MODULE,
1141         .release        = sco_sock_release,
1142         .bind           = sco_sock_bind,
1143         .connect        = sco_sock_connect,
1144         .listen         = sco_sock_listen,
1145         .accept         = sco_sock_accept,
1146         .getname        = sco_sock_getname,
1147         .sendmsg        = sco_sock_sendmsg,
1148         .recvmsg        = sco_sock_recvmsg,
1149         .poll           = bt_sock_poll,
1150         .ioctl          = bt_sock_ioctl,
1151         .mmap           = sock_no_mmap,
1152         .socketpair     = sock_no_socketpair,
1153         .shutdown       = sco_sock_shutdown,
1154         .setsockopt     = sco_sock_setsockopt,
1155         .getsockopt     = sco_sock_getsockopt
1156 };
1157
1158 static const struct net_proto_family sco_sock_family_ops = {
1159         .family = PF_BLUETOOTH,
1160         .owner  = THIS_MODULE,
1161         .create = sco_sock_create,
1162 };
1163
1164 int __init sco_init(void)
1165 {
1166         int err;
1167
1168         err = proto_register(&sco_proto, 0);
1169         if (err < 0)
1170                 return err;
1171
1172         err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
1173         if (err < 0) {
1174                 BT_ERR("SCO socket registration failed");
1175                 goto error;
1176         }
1177
1178         err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL);
1179         if (err < 0) {
1180                 BT_ERR("Failed to create SCO proc file");
1181                 bt_sock_unregister(BTPROTO_SCO);
1182                 goto error;
1183         }
1184
1185         if (bt_debugfs) {
1186                 sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs,
1187                                                   NULL, &sco_debugfs_fops);
1188                 if (!sco_debugfs)
1189                         BT_ERR("Failed to create SCO debug file");
1190         }
1191
1192         BT_INFO("SCO socket layer initialized");
1193
1194         return 0;
1195
1196 error:
1197         proto_unregister(&sco_proto);
1198         return err;
1199 }
1200
1201 void __exit sco_exit(void)
1202 {
1203         bt_procfs_cleanup(&init_net, "sco");
1204
1205         debugfs_remove(sco_debugfs);
1206
1207         bt_sock_unregister(BTPROTO_SCO);
1208
1209         proto_unregister(&sco_proto);
1210 }
1211
1212 module_param(disable_esco, bool, 0644);
1213 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");