net/bluetooth/sco.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth SCO sockets. */
  26
  27 #include <linux/module.h>
  28 #include <linux/debugfs.h>
  29 #include <linux/seq_file.h>
  30
  31 #include <net/bluetooth/bluetooth.h>
  32 #include <net/bluetooth/hci_core.h>
  33 #include <net/bluetooth/sco.h>
  34
  35 static bool disable_esco;
  36
  37 static const struct proto_ops sco_sock_ops;
  38
  39 static struct bt_sock_list sco_sk_list = {
  40         .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
  41 };
  42
  43 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent);
  44 static void sco_chan_del(struct sock *sk, int err);
  45
  46 static void sco_sock_close(struct sock *sk);
  47 static void sco_sock_kill(struct sock *sk);
  48
  49 /* ---- SCO timers ---- */
  50 static void sco_sock_timeout(unsigned long arg)
  51 {
  52         struct sock *sk = (struct sock *) arg;
  53
  54         BT_DBG("sock %p state %d", sk, sk->sk_state);
  55
  56         bh_lock_sock(sk);
  57         sk->sk_err = ETIMEDOUT;
  58         sk->sk_state_change(sk);
  59         bh_unlock_sock(sk);
  60
  61         sco_sock_kill(sk);
  62         sock_put(sk);
  63 }
  64
  65 static void sco_sock_set_timer(struct sock *sk, long timeout)
  66 {
  67         BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
  68         sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
  69 }
  70
  71 static void sco_sock_clear_timer(struct sock *sk)
  72 {
  73         BT_DBG("sock %p state %d", sk, sk->sk_state);
  74         sk_stop_timer(sk, &sk->sk_timer);
  75 }
  76
  77 /* ---- SCO connections ---- */
  78 static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
  79 {
  80         struct hci_dev *hdev = hcon->hdev;
  81         struct sco_conn *conn = hcon->sco_data;
  82
  83         if (conn)
  84                 return conn;
  85
  86         conn = kzalloc(sizeof(struct sco_conn), GFP_KERNEL);
  87         if (!conn)
  88                 return NULL;
  89
  90         spin_lock_init(&conn->lock);
  91
  92         hcon->sco_data = conn;
  93         conn->hcon = hcon;
  94
  95         conn->src = &hdev->bdaddr;
  96         conn->dst = &hcon->dst;
  97
  98         if (hdev->sco_mtu > 0)
  99                 conn->mtu = hdev->sco_mtu;
 100         else
 101                 conn->mtu = 60;
 102
 103         BT_DBG("hcon %p conn %p", hcon, conn);
 104
 105         return conn;
 106 }
 107
 108 static struct sock *sco_chan_get(struct sco_conn *conn)
 109 {
 110         struct sock *sk = NULL;
 111         sco_conn_lock(conn);
 112         sk = conn->sk;
 113         sco_conn_unlock(conn);
 114         return sk;
 115 }
 116
 117 static int sco_conn_del(struct hci_conn *hcon, int err)
 118 {
 119         struct sco_conn *conn = hcon->sco_data;
 120         struct sock *sk;
 121
 122         if (!conn)
 123                 return 0;
 124
 125         BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 126
 127         /* Kill socket */
 128         sk = sco_chan_get(conn);
 129         if (sk) {
 130                 bh_lock_sock(sk);
 131                 sco_sock_clear_timer(sk);
 132                 sco_chan_del(sk, err);
 133                 bh_unlock_sock(sk);
 134                 sco_sock_kill(sk);
 135         }
 136
 137         hcon->sco_data = NULL;
 138         kfree(conn);
 139         return 0;
 140 }
 141
 142 static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
 143                         struct sock *parent)
 144 {
 145         int err = 0;
 146
 147         sco_conn_lock(conn);
 148         if (conn->sk)
 149                 err = -EBUSY;
 150         else
 151                 __sco_chan_add(conn, sk, parent);
 152
 153         sco_conn_unlock(conn);
 154         return err;
 155 }
 156
 157 static int sco_connect(struct sock *sk)
 158 {
 159         bdaddr_t *src = &bt_sk(sk)->src;
 160         bdaddr_t *dst = &bt_sk(sk)->dst;
 161         struct sco_conn *conn;
 162         struct hci_conn *hcon;
 163         struct hci_dev  *hdev;
 164         int err, type;
 165
 166         BT_DBG("%pMR -> %pMR", src, dst);
 167
 168         hdev = hci_get_route(dst, src);
 169         if (!hdev)
 170                 return -EHOSTUNREACH;
 171
 172         hci_dev_lock(hdev);
 173
 174         if (lmp_esco_capable(hdev) && !disable_esco)
 175                 type = ESCO_LINK;
 176         else
 177                 type = SCO_LINK;
 178
 179         if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT &&
 180             (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) {
 181                 err = -EOPNOTSUPP;
 182                 goto done;
 183         }
 184
 185         hcon = hci_connect_sco(hdev, type, dst, sco_pi(sk)->setting);
 186         if (IS_ERR(hcon)) {
 187                 err = PTR_ERR(hcon);
 188                 goto done;
 189         }
 190
 191         conn = sco_conn_add(hcon);
 192         if (!conn) {
 193                 hci_conn_drop(hcon);
 194                 err = -ENOMEM;
 195                 goto done;
 196         }
 197
 198         /* Update source addr of the socket */
 199         bacpy(src, conn->src);
 200
 201         err = sco_chan_add(conn, sk, NULL);
 202         if (err)
 203                 goto done;
 204
 205         if (hcon->state == BT_CONNECTED) {
 206                 sco_sock_clear_timer(sk);
 207                 sk->sk_state = BT_CONNECTED;
 208         } else {
 209                 sk->sk_state = BT_CONNECT;
 210                 sco_sock_set_timer(sk, sk->sk_sndtimeo);
 211         }
 212
 213 done:
 214         hci_dev_unlock(hdev);
 215         hci_dev_put(hdev);
 216         return err;
 217 }
 218
 219 static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
 220 {
 221         struct sco_conn *conn = sco_pi(sk)->conn;
 222         struct sk_buff *skb;
 223         int err;
 224
 225         /* Check outgoing MTU */
 226         if (len > conn->mtu)
 227                 return -EINVAL;
 228
 229         BT_DBG("sk %p len %d", sk, len);
 230
 231         skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
 232         if (!skb)
 233                 return err;
 234
 235         if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
 236                 kfree_skb(skb);
 237                 return -EFAULT;
 238         }
 239
 240         hci_send_sco(conn->hcon, skb);
 241
 242         return len;
 243 }
 244
 245 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
 246 {
 247         struct sock *sk = sco_chan_get(conn);
 248
 249         if (!sk)
 250                 goto drop;
 251
 252         BT_DBG("sk %p len %d", sk, skb->len);
 253
 254         if (sk->sk_state != BT_CONNECTED)
 255                 goto drop;
 256
 257         if (!sock_queue_rcv_skb(sk, skb))
 258                 return;
 259
 260 drop:
 261         kfree_skb(skb);
 262 }
 263
 264 /* -------- Socket interface ---------- */
 265 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
 266 {
 267         struct sock *sk;
 268
 269         sk_for_each(sk, &sco_sk_list.head) {
 270                 if (sk->sk_state != BT_LISTEN)
 271                         continue;
 272
 273                 if (!bacmp(&bt_sk(sk)->src, ba))
 274                         return sk;
 275         }
 276
 277         return NULL;
 278 }
 279
 280 /* Find socket listening on source bdaddr.
 281  * Returns closest match.
 282  */
 283 static struct sock *sco_get_sock_listen(bdaddr_t *src)
 284 {
 285         struct sock *sk = NULL, *sk1 = NULL;
 286
 287         read_lock(&sco_sk_list.lock);
 288
 289         sk_for_each(sk, &sco_sk_list.head) {
 290                 if (sk->sk_state != BT_LISTEN)
 291                         continue;
 292
 293                 /* Exact match. */
 294                 if (!bacmp(&bt_sk(sk)->src, src))
 295                         break;
 296
 297                 /* Closest match */
 298                 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 299                         sk1 = sk;
 300         }
 301
 302         read_unlock(&sco_sk_list.lock);
 303
 304         return sk ? sk : sk1;
 305 }
 306
 307 static void sco_sock_destruct(struct sock *sk)
 308 {
 309         BT_DBG("sk %p", sk);
 310
 311         skb_queue_purge(&sk->sk_receive_queue);
 312         skb_queue_purge(&sk->sk_write_queue);
 313 }
 314
 315 static void sco_sock_cleanup_listen(struct sock *parent)
 316 {
 317         struct sock *sk;
 318
 319         BT_DBG("parent %p", parent);
 320
 321         /* Close not yet accepted channels */
 322         while ((sk = bt_accept_dequeue(parent, NULL))) {
 323                 sco_sock_close(sk);
 324                 sco_sock_kill(sk);
 325         }
 326
 327         parent->sk_state  = BT_CLOSED;
 328         sock_set_flag(parent, SOCK_ZAPPED);
 329 }
 330
 331 /* Kill socket (only if zapped and orphan)
 332  * Must be called on unlocked socket.
 333  */
 334 static void sco_sock_kill(struct sock *sk)
 335 {
 336         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 337                 return;
 338
 339         BT_DBG("sk %p state %d", sk, sk->sk_state);
 340
 341         /* Kill poor orphan */
 342         bt_sock_unlink(&sco_sk_list, sk);
 343         sock_set_flag(sk, SOCK_DEAD);
 344         sock_put(sk);
 345 }
 346
 347 static void __sco_sock_close(struct sock *sk)
 348 {
 349         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 350
 351         switch (sk->sk_state) {
 352         case BT_LISTEN:
 353                 sco_sock_cleanup_listen(sk);
 354                 break;
 355
 356         case BT_CONNECTED:
 357         case BT_CONFIG:
 358                 if (sco_pi(sk)->conn->hcon) {
 359                         sk->sk_state = BT_DISCONN;
 360                         sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
 361                         hci_conn_drop(sco_pi(sk)->conn->hcon);
 362                         sco_pi(sk)->conn->hcon = NULL;
 363                 } else
 364                         sco_chan_del(sk, ECONNRESET);
 365                 break;
 366
 367         case BT_CONNECT2:
 368         case BT_CONNECT:
 369         case BT_DISCONN:
 370                 sco_chan_del(sk, ECONNRESET);
 371                 break;
 372
 373         default:
 374                 sock_set_flag(sk, SOCK_ZAPPED);
 375                 break;
 376         }
 377 }
 378
 379 /* Must be called on unlocked socket. */
 380 static void sco_sock_close(struct sock *sk)
 381 {
 382         sco_sock_clear_timer(sk);
 383         lock_sock(sk);
 384         __sco_sock_close(sk);
 385         release_sock(sk);
 386         sco_sock_kill(sk);
 387 }
 388
 389 static void sco_sock_init(struct sock *sk, struct sock *parent)
 390 {
 391         BT_DBG("sk %p", sk);
 392
 393         if (parent) {
 394                 sk->sk_type = parent->sk_type;
 395                 bt_sk(sk)->flags = bt_sk(parent)->flags;
 396                 security_sk_clone(parent, sk);
 397         }
 398 }
 399
 400 static struct proto sco_proto = {
 401         .name           = "SCO",
 402         .owner          = THIS_MODULE,
 403         .obj_size       = sizeof(struct sco_pinfo)
 404 };
 405
 406 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 407 {
 408         struct sock *sk;
 409
 410         sk = sk_alloc(net, PF_BLUETOOTH, prio, &sco_proto);
 411         if (!sk)
 412                 return NULL;
 413
 414         sock_init_data(sock, sk);
 415         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 416
 417         sk->sk_destruct = sco_sock_destruct;
 418         sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
 419
 420         sock_reset_flag(sk, SOCK_ZAPPED);
 421
 422         sk->sk_protocol = proto;
 423         sk->sk_state    = BT_OPEN;
 424
 425         sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
 426
 427         setup_timer(&sk->sk_timer, sco_sock_timeout, (unsigned long)sk);
 428
 429         bt_sock_link(&sco_sk_list, sk);
 430         return sk;
 431 }
 432
 433 static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
 434                            int kern)
 435 {
 436         struct sock *sk;
 437
 438         BT_DBG("sock %p", sock);
 439
 440         sock->state = SS_UNCONNECTED;
 441
 442         if (sock->type != SOCK_SEQPACKET)
 443                 return -ESOCKTNOSUPPORT;
 444
 445         sock->ops = &sco_sock_ops;
 446
 447         sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 448         if (!sk)
 449                 return -ENOMEM;
 450
 451         sco_sock_init(sk, NULL);
 452         return 0;
 453 }
 454
 455 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 456 {
 457         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 458         struct sock *sk = sock->sk;
 459         int err = 0;
 460
 461         BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
 462
 463         if (!addr || addr->sa_family != AF_BLUETOOTH)
 464                 return -EINVAL;
 465
 466         lock_sock(sk);
 467
 468         if (sk->sk_state != BT_OPEN) {
 469                 err = -EBADFD;
 470                 goto done;
 471         }
 472
 473         if (sk->sk_type != SOCK_SEQPACKET) {
 474                 err = -EINVAL;
 475                 goto done;
 476         }
 477
 478         bacpy(&bt_sk(sk)->src, &sa->sco_bdaddr);
 479
 480         sk->sk_state = BT_BOUND;
 481
 482 done:
 483         release_sock(sk);
 484         return err;
 485 }
 486
 487 static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 488 {
 489         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 490         struct sock *sk = sock->sk;
 491         int err;
 492
 493         BT_DBG("sk %p", sk);
 494
 495         if (alen < sizeof(struct sockaddr_sco) ||
 496             addr->sa_family != AF_BLUETOOTH)
 497                 return -EINVAL;
 498
 499         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
 500                 return -EBADFD;
 501
 502         if (sk->sk_type != SOCK_SEQPACKET)
 503                 return -EINVAL;
 504
 505         lock_sock(sk);
 506
 507         /* Set destination address and psm */
 508         bacpy(&bt_sk(sk)->dst, &sa->sco_bdaddr);
 509
 510         err = sco_connect(sk);
 511         if (err)
 512                 goto done;
 513
 514         err = bt_sock_wait_state(sk, BT_CONNECTED,
 515                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 516
 517 done:
 518         release_sock(sk);
 519         return err;
 520 }
 521
 522 static int sco_sock_listen(struct socket *sock, int backlog)
 523 {
 524         struct sock *sk = sock->sk;
 525         bdaddr_t *src = &bt_sk(sk)->src;
 526         int err = 0;
 527
 528         BT_DBG("sk %p backlog %d", sk, backlog);
 529
 530         lock_sock(sk);
 531
 532         if (sk->sk_state != BT_BOUND) {
 533                 err = -EBADFD;
 534                 goto done;
 535         }
 536
 537         if (sk->sk_type != SOCK_SEQPACKET) {
 538                 err = -EINVAL;
 539                 goto done;
 540         }
 541
 542         write_lock(&sco_sk_list.lock);
 543
 544         if (__sco_get_sock_listen_by_addr(src)) {
 545                 err = -EADDRINUSE;
 546                 goto unlock;
 547         }
 548
 549         sk->sk_max_ack_backlog = backlog;
 550         sk->sk_ack_backlog = 0;
 551
 552         sk->sk_state = BT_LISTEN;
 553
 554 unlock:
 555         write_unlock(&sco_sk_list.lock);
 556
 557 done:
 558         release_sock(sk);
 559         return err;
 560 }
 561
 562 static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 563 {
 564         DECLARE_WAITQUEUE(wait, current);
 565         struct sock *sk = sock->sk, *ch;
 566         long timeo;
 567         int err = 0;
 568
 569         lock_sock(sk);
 570
 571         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 572
 573         BT_DBG("sk %p timeo %ld", sk, timeo);
 574
 575         /* Wait for an incoming connection. (wake-one). */
 576         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 577         while (1) {
 578                 set_current_state(TASK_INTERRUPTIBLE);
 579
 580                 if (sk->sk_state != BT_LISTEN) {
 581                         err = -EBADFD;
 582                         break;
 583                 }
 584
 585                 ch = bt_accept_dequeue(sk, newsock);
 586                 if (ch)
 587                         break;
 588
 589                 if (!timeo) {
 590                         err = -EAGAIN;
 591                         break;
 592                 }
 593
 594                 if (signal_pending(current)) {
 595                         err = sock_intr_errno(timeo);
 596                         break;
 597                 }
 598
 599                 release_sock(sk);
 600                 timeo = schedule_timeout(timeo);
 601                 lock_sock(sk);
 602         }
 603         __set_current_state(TASK_RUNNING);
 604         remove_wait_queue(sk_sleep(sk), &wait);
 605
 606         if (err)
 607                 goto done;
 608
 609         newsock->state = SS_CONNECTED;
 610
 611         BT_DBG("new socket %p", ch);
 612
 613 done:
 614         release_sock(sk);
 615         return err;
 616 }
 617
 618 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 619 {
 620         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 621         struct sock *sk = sock->sk;
 622
 623         BT_DBG("sock %p, sk %p", sock, sk);
 624
 625         addr->sa_family = AF_BLUETOOTH;
 626         *len = sizeof(struct sockaddr_sco);
 627
 628         if (peer)
 629                 bacpy(&sa->sco_bdaddr, &bt_sk(sk)->dst);
 630         else
 631                 bacpy(&sa->sco_bdaddr, &bt_sk(sk)->src);
 632
 633         return 0;
 634 }
 635
 636 static int sco_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 637                             struct msghdr *msg, size_t len)
 638 {
 639         struct sock *sk = sock->sk;
 640         int err;
 641
 642         BT_DBG("sock %p, sk %p", sock, sk);
 643
 644         err = sock_error(sk);
 645         if (err)
 646                 return err;
 647
 648         if (msg->msg_flags & MSG_OOB)
 649                 return -EOPNOTSUPP;
 650
 651         lock_sock(sk);
 652
 653         if (sk->sk_state == BT_CONNECTED)
 654                 err = sco_send_frame(sk, msg, len);
 655         else
 656                 err = -ENOTCONN;
 657
 658         release_sock(sk);
 659         return err;
 660 }
 661
 662 static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
 663 {
 664         struct hci_dev *hdev = conn->hdev;
 665
 666         BT_DBG("conn %p", conn);
 667
 668         conn->state = BT_CONFIG;
 669
 670         if (!lmp_esco_capable(hdev)) {
 671                 struct hci_cp_accept_conn_req cp;
 672
 673                 bacpy(&cp.bdaddr, &conn->dst);
 674                 cp.role = 0x00; /* Ignored */
 675
 676                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
 677         } else {
 678                 struct hci_cp_accept_sync_conn_req cp;
 679
 680                 bacpy(&cp.bdaddr, &conn->dst);
 681                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
 682
 683                 cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 684                 cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
 685                 cp.content_format = cpu_to_le16(setting);
 686
 687                 switch (setting & SCO_AIRMODE_MASK) {
 688                 case SCO_AIRMODE_TRANSP:
 689                         if (conn->pkt_type & ESCO_2EV3)
 690                                 cp.max_latency = __constant_cpu_to_le16(0x0008);
 691                         else
 692                                 cp.max_latency = __constant_cpu_to_le16(0x000D);
 693                         cp.retrans_effort = 0x02;
 694                         break;
 695                 case SCO_AIRMODE_CVSD:
 696                         cp.max_latency = __constant_cpu_to_le16(0xffff);
 697                         cp.retrans_effort = 0xff;
 698                         break;
 699                 }
 700
 701                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
 702                              sizeof(cp), &cp);
 703         }
 704 }
 705
 706 static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 707                             struct msghdr *msg, size_t len, int flags)
 708 {
 709         struct sock *sk = sock->sk;
 710         struct sco_pinfo *pi = sco_pi(sk);
 711
 712         lock_sock(sk);
 713
 714         if (sk->sk_state == BT_CONNECT2 &&
 715             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
 716                 sco_conn_defer_accept(pi->conn->hcon, pi->setting);
 717                 sk->sk_state = BT_CONFIG;
 718
 719                 release_sock(sk);
 720                 return 0;
 721         }
 722
 723         release_sock(sk);
 724
 725         return bt_sock_recvmsg(iocb, sock, msg, len, flags);
 726 }
 727
 728 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 729 {
 730         struct sock *sk = sock->sk;
 731         int len, err = 0;
 732         struct bt_voice voice;
 733         u32 opt;
 734
 735         BT_DBG("sk %p", sk);
 736
 737         lock_sock(sk);
 738
 739         switch (optname) {
 740
 741         case BT_DEFER_SETUP:
 742                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 743                         err = -EINVAL;
 744                         break;
 745                 }
 746
 747                 if (get_user(opt, (u32 __user *) optval)) {
 748                         err = -EFAULT;
 749                         break;
 750                 }
 751
 752                 if (opt)
 753                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 754                 else
 755                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 756                 break;
 757
 758         case BT_VOICE:
 759                 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
 760                     sk->sk_state != BT_CONNECT2) {
 761                         err = -EINVAL;
 762                         break;
 763                 }
 764
 765                 voice.setting = sco_pi(sk)->setting;
 766
 767                 len = min_t(unsigned int, sizeof(voice), optlen);
 768                 if (copy_from_user((char *) &voice, optval, len)) {
 769                         err = -EFAULT;
 770                         break;
 771                 }
 772
 773                 /* Explicitly check for these values */
 774                 if (voice.setting != BT_VOICE_TRANSPARENT &&
 775                     voice.setting != BT_VOICE_CVSD_16BIT) {
 776                         err = -EINVAL;
 777                         break;
 778                 }
 779
 780                 sco_pi(sk)->setting = voice.setting;
 781                 break;
 782
 783         default:
 784                 err = -ENOPROTOOPT;
 785                 break;
 786         }
 787
 788         release_sock(sk);
 789         return err;
 790 }
 791
 792 static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 793 {
 794         struct sock *sk = sock->sk;
 795         struct sco_options opts;
 796         struct sco_conninfo cinfo;
 797         int len, err = 0;
 798
 799         BT_DBG("sk %p", sk);
 800
 801         if (get_user(len, optlen))
 802                 return -EFAULT;
 803
 804         lock_sock(sk);
 805
 806         switch (optname) {
 807         case SCO_OPTIONS:
 808                 if (sk->sk_state != BT_CONNECTED &&
 809                     !(sk->sk_state == BT_CONNECT2 &&
 810                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 811                         err = -ENOTCONN;
 812                         break;
 813                 }
 814
 815                 opts.mtu = sco_pi(sk)->conn->mtu;
 816
 817                 BT_DBG("mtu %d", opts.mtu);
 818
 819                 len = min_t(unsigned int, len, sizeof(opts));
 820                 if (copy_to_user(optval, (char *)&opts, len))
 821                         err = -EFAULT;
 822
 823                 break;
 824
 825         case SCO_CONNINFO:
 826                 if (sk->sk_state != BT_CONNECTED &&
 827                     !(sk->sk_state == BT_CONNECT2 &&
 828                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 829                         err = -ENOTCONN;
 830                         break;
 831                 }
 832
 833                 memset(&cinfo, 0, sizeof(cinfo));
 834                 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
 835                 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
 836
 837                 len = min_t(unsigned int, len, sizeof(cinfo));
 838                 if (copy_to_user(optval, (char *)&cinfo, len))
 839                         err = -EFAULT;
 840
 841                 break;
 842
 843         default:
 844                 err = -ENOPROTOOPT;
 845                 break;
 846         }
 847
 848         release_sock(sk);
 849         return err;
 850 }
 851
 852 static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 853 {
 854         struct sock *sk = sock->sk;
 855         int len, err = 0;
 856         struct bt_voice voice;
 857
 858         BT_DBG("sk %p", sk);
 859
 860         if (level == SOL_SCO)
 861                 return sco_sock_getsockopt_old(sock, optname, optval, optlen);
 862
 863         if (get_user(len, optlen))
 864                 return -EFAULT;
 865
 866         lock_sock(sk);
 867
 868         switch (optname) {
 869
 870         case BT_DEFER_SETUP:
 871                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 872                         err = -EINVAL;
 873                         break;
 874                 }
 875
 876                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 877                              (u32 __user *) optval))
 878                         err = -EFAULT;
 879
 880                 break;
 881
 882         case BT_VOICE:
 883                 voice.setting = sco_pi(sk)->setting;
 884
 885                 len = min_t(unsigned int, len, sizeof(voice));
 886                 if (copy_to_user(optval, (char *)&voice, len))
 887                         err = -EFAULT;
 888
 889                 break;
 890
 891         default:
 892                 err = -ENOPROTOOPT;
 893                 break;
 894         }
 895
 896         release_sock(sk);
 897         return err;
 898 }
 899
 900 static int sco_sock_shutdown(struct socket *sock, int how)
 901 {
 902         struct sock *sk = sock->sk;
 903         int err = 0;
 904
 905         BT_DBG("sock %p, sk %p", sock, sk);
 906
 907         if (!sk)
 908                 return 0;
 909
 910         lock_sock(sk);
 911         if (!sk->sk_shutdown) {
 912                 sk->sk_shutdown = SHUTDOWN_MASK;
 913                 sco_sock_clear_timer(sk);
 914                 __sco_sock_close(sk);
 915
 916                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 917                         err = bt_sock_wait_state(sk, BT_CLOSED,
 918                                                  sk->sk_lingertime);
 919         }
 920         release_sock(sk);
 921         return err;
 922 }
 923
 924 static int sco_sock_release(struct socket *sock)
 925 {
 926         struct sock *sk = sock->sk;
 927         int err = 0;
 928
 929         BT_DBG("sock %p, sk %p", sock, sk);
 930
 931         if (!sk)
 932                 return 0;
 933
 934         sco_sock_close(sk);
 935
 936         if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) {
 937                 lock_sock(sk);
 938                 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 939                 release_sock(sk);
 940         }
 941
 942         sock_orphan(sk);
 943         sco_sock_kill(sk);
 944         return err;
 945 }
 946
 947 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
 948 {
 949         BT_DBG("conn %p", conn);
 950
 951         sco_pi(sk)->conn = conn;
 952         conn->sk = sk;
 953
 954         if (parent)
 955                 bt_accept_enqueue(parent, sk);
 956 }
 957
 958 /* Delete channel.
 959  * Must be called on the locked socket. */
 960 static void sco_chan_del(struct sock *sk, int err)
 961 {
 962         struct sco_conn *conn;
 963
 964         conn = sco_pi(sk)->conn;
 965
 966         BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
 967
 968         if (conn) {
 969                 sco_conn_lock(conn);
 970                 conn->sk = NULL;
 971                 sco_pi(sk)->conn = NULL;
 972                 sco_conn_unlock(conn);
 973
 974                 if (conn->hcon)
 975                         hci_conn_drop(conn->hcon);
 976         }
 977
 978         sk->sk_state = BT_CLOSED;
 979         sk->sk_err   = err;
 980         sk->sk_state_change(sk);
 981
 982         sock_set_flag(sk, SOCK_ZAPPED);
 983 }
 984
 985 static void sco_conn_ready(struct sco_conn *conn)
 986 {
 987         struct sock *parent;
 988         struct sock *sk = conn->sk;
 989
 990         BT_DBG("conn %p", conn);
 991
 992         if (sk) {
 993                 sco_sock_clear_timer(sk);
 994                 bh_lock_sock(sk);
 995                 sk->sk_state = BT_CONNECTED;
 996                 sk->sk_state_change(sk);
 997                 bh_unlock_sock(sk);
 998         } else {
 999                 sco_conn_lock(conn);
1000
1001                 parent = sco_get_sock_listen(conn->src);
1002                 if (!parent) {
1003                         sco_conn_unlock(conn);
1004                         return;
1005                 }
1006
1007                 bh_lock_sock(parent);
1008
1009                 sk = sco_sock_alloc(sock_net(parent), NULL,
1010                                     BTPROTO_SCO, GFP_ATOMIC);
1011                 if (!sk) {
1012                         bh_unlock_sock(parent);
1013                         sco_conn_unlock(conn);
1014                         return;
1015                 }
1016
1017                 sco_sock_init(sk, parent);
1018
1019                 bacpy(&bt_sk(sk)->src, conn->src);
1020                 bacpy(&bt_sk(sk)->dst, conn->dst);
1021
1022                 hci_conn_hold(conn->hcon);
1023                 __sco_chan_add(conn, sk, parent);
1024
1025                 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
1026                         sk->sk_state = BT_CONNECT2;
1027                 else
1028                         sk->sk_state = BT_CONNECTED;
1029
1030                 /* Wake up parent */
1031                 parent->sk_data_ready(parent, 1);
1032
1033                 bh_unlock_sock(parent);
1034
1035                 sco_conn_unlock(conn);
1036         }
1037 }
1038
1039 /* ----- SCO interface with lower layer (HCI) ----- */
1040 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
1041 {
1042         struct sock *sk;
1043         int lm = 0;
1044
1045         BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1046
1047         /* Find listening sockets */
1048         read_lock(&sco_sk_list.lock);
1049         sk_for_each(sk, &sco_sk_list.head) {
1050                 if (sk->sk_state != BT_LISTEN)
1051                         continue;
1052
1053                 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr) ||
1054                     !bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
1055                         lm |= HCI_LM_ACCEPT;
1056
1057                         if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
1058                                 *flags |= HCI_PROTO_DEFER;
1059                         break;
1060                 }
1061         }
1062         read_unlock(&sco_sk_list.lock);
1063
1064         return lm;
1065 }
1066
1067 void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
1068 {
1069         BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
1070         if (!status) {
1071                 struct sco_conn *conn;
1072
1073                 conn = sco_conn_add(hcon);
1074                 if (conn)
1075                         sco_conn_ready(conn);
1076         } else
1077                 sco_conn_del(hcon, bt_to_errno(status));
1078 }
1079
1080 void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
1081 {
1082         BT_DBG("hcon %p reason %d", hcon, reason);
1083
1084         sco_conn_del(hcon, bt_to_errno(reason));
1085 }
1086
1087 int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
1088 {
1089         struct sco_conn *conn = hcon->sco_data;
1090
1091         if (!conn)
1092                 goto drop;
1093
1094         BT_DBG("conn %p len %d", conn, skb->len);
1095
1096         if (skb->len) {
1097                 sco_recv_frame(conn, skb);
1098                 return 0;
1099         }
1100
1101 drop:
1102         kfree_skb(skb);
1103         return 0;
1104 }
1105
1106 static int sco_debugfs_show(struct seq_file *f, void *p)
1107 {
1108         struct sock *sk;
1109
1110         read_lock(&sco_sk_list.lock);
1111
1112         sk_for_each(sk, &sco_sk_list.head) {
1113                 seq_printf(f, "%pMR %pMR %d\n", &bt_sk(sk)->src,
1114                            &bt_sk(sk)->dst, sk->sk_state);
1115         }
1116
1117         read_unlock(&sco_sk_list.lock);
1118
1119         return 0;
1120 }
1121
1122 static int sco_debugfs_open(struct inode *inode, struct file *file)
1123 {
1124         return single_open(file, sco_debugfs_show, inode->i_private);
1125 }
1126
1127 static const struct file_operations sco_debugfs_fops = {
1128         .open           = sco_debugfs_open,
1129         .read           = seq_read,
1130         .llseek         = seq_lseek,
1131         .release        = single_release,
1132 };
1133
1134 static struct dentry *sco_debugfs;
1135
1136 static const struct proto_ops sco_sock_ops = {
1137         .family         = PF_BLUETOOTH,
1138         .owner          = THIS_MODULE,
1139         .release        = sco_sock_release,
1140         .bind           = sco_sock_bind,
1141         .connect        = sco_sock_connect,
1142         .listen         = sco_sock_listen,
1143         .accept         = sco_sock_accept,
1144         .getname        = sco_sock_getname,
1145         .sendmsg        = sco_sock_sendmsg,
1146         .recvmsg        = sco_sock_recvmsg,
1147         .poll           = bt_sock_poll,
1148         .ioctl          = bt_sock_ioctl,
1149         .mmap           = sock_no_mmap,
1150         .socketpair     = sock_no_socketpair,
1151         .shutdown       = sco_sock_shutdown,
1152         .setsockopt     = sco_sock_setsockopt,
1153         .getsockopt     = sco_sock_getsockopt
1154 };
1155
1156 static const struct net_proto_family sco_sock_family_ops = {
1157         .family = PF_BLUETOOTH,
1158         .owner  = THIS_MODULE,
1159         .create = sco_sock_create,
1160 };
1161
1162 int __init sco_init(void)
1163 {
1164         int err;
1165
1166         err = proto_register(&sco_proto, 0);
1167         if (err < 0)
1168                 return err;
1169
1170         err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
1171         if (err < 0) {
1172                 BT_ERR("SCO socket registration failed");
1173                 goto error;
1174         }
1175
1176         err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL);
1177         if (err < 0) {
1178                 BT_ERR("Failed to create SCO proc file");
1179                 bt_sock_unregister(BTPROTO_SCO);
1180                 goto error;
1181         }
1182
1183         if (bt_debugfs) {
1184                 sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs,
1185                                                   NULL, &sco_debugfs_fops);
1186                 if (!sco_debugfs)
1187                         BT_ERR("Failed to create SCO debug file");
1188         }
1189
1190         BT_INFO("SCO socket layer initialized");
1191
1192         return 0;
1193
1194 error:
1195         proto_unregister(&sco_proto);
1196         return err;
1197 }
1198
1199 void __exit sco_exit(void)
1200 {
1201         bt_procfs_cleanup(&init_net, "sco");
1202
1203         debugfs_remove(sco_debugfs);
1204
1205         bt_sock_unregister(BTPROTO_SCO);
1206
1207         proto_unregister(&sco_proto);
1208 }
1209
1210 module_param(disable_esco, bool, 0644);
1211 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");