net/bluetooth/sco.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth SCO sockets. */
  26
  27 #include <linux/module.h>
  28 #include <linux/debugfs.h>
  29 #include <linux/seq_file.h>
  30
  31 #include <net/bluetooth/bluetooth.h>
  32 #include <net/bluetooth/hci_core.h>
  33 #include <net/bluetooth/sco.h>
  34
  35 static bool disable_esco;
  36
  37 static const struct proto_ops sco_sock_ops;
  38
  39 static struct bt_sock_list sco_sk_list = {
  40         .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
  41 };
  42
  43 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent);
  44 static void sco_chan_del(struct sock *sk, int err);
  45
  46 static void sco_sock_close(struct sock *sk);
  47 static void sco_sock_kill(struct sock *sk);
  48
  49 /* ---- SCO timers ---- */
  50 static void sco_sock_timeout(unsigned long arg)
  51 {
  52         struct sock *sk = (struct sock *) arg;
  53
  54         BT_DBG("sock %p state %d", sk, sk->sk_state);
  55
  56         bh_lock_sock(sk);
  57         sk->sk_err = ETIMEDOUT;
  58         sk->sk_state_change(sk);
  59         bh_unlock_sock(sk);
  60
  61         sco_sock_kill(sk);
  62         sock_put(sk);
  63 }
  64
  65 static void sco_sock_set_timer(struct sock *sk, long timeout)
  66 {
  67         BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
  68         sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
  69 }
  70
  71 static void sco_sock_clear_timer(struct sock *sk)
  72 {
  73         BT_DBG("sock %p state %d", sk, sk->sk_state);
  74         sk_stop_timer(sk, &sk->sk_timer);
  75 }
  76
  77 /* ---- SCO connections ---- */
  78 static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
  79 {
  80         struct hci_dev *hdev = hcon->hdev;
  81         struct sco_conn *conn = hcon->sco_data;
  82
  83         if (conn)
  84                 return conn;
  85
  86         conn = kzalloc(sizeof(struct sco_conn), GFP_ATOMIC);
  87         if (!conn)
  88                 return NULL;
  89
  90         spin_lock_init(&conn->lock);
  91
  92         hcon->sco_data = conn;
  93         conn->hcon = hcon;
  94
  95         conn->src = &hdev->bdaddr;
  96         conn->dst = &hcon->dst;
  97
  98         if (hdev->sco_mtu > 0)
  99                 conn->mtu = hdev->sco_mtu;
 100         else
 101                 conn->mtu = 60;
 102
 103         BT_DBG("hcon %p conn %p", hcon, conn);
 104
 105         return conn;
 106 }
 107
 108 static struct sock *sco_chan_get(struct sco_conn *conn)
 109 {
 110         struct sock *sk = NULL;
 111         sco_conn_lock(conn);
 112         sk = conn->sk;
 113         sco_conn_unlock(conn);
 114         return sk;
 115 }
 116
 117 static int sco_conn_del(struct hci_conn *hcon, int err)
 118 {
 119         struct sco_conn *conn = hcon->sco_data;
 120         struct sock *sk;
 121
 122         if (!conn)
 123                 return 0;
 124
 125         BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 126
 127         /* Kill socket */
 128         sk = sco_chan_get(conn);
 129         if (sk) {
 130                 bh_lock_sock(sk);
 131                 sco_sock_clear_timer(sk);
 132                 sco_chan_del(sk, err);
 133                 bh_unlock_sock(sk);
 134                 sco_sock_kill(sk);
 135         }
 136
 137         hcon->sco_data = NULL;
 138         kfree(conn);
 139         return 0;
 140 }
 141
 142 static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
 143                         struct sock *parent)
 144 {
 145         int err = 0;
 146
 147         sco_conn_lock(conn);
 148         if (conn->sk)
 149                 err = -EBUSY;
 150         else
 151                 __sco_chan_add(conn, sk, parent);
 152
 153         sco_conn_unlock(conn);
 154         return err;
 155 }
 156
 157 static int sco_connect(struct sock *sk)
 158 {
 159         bdaddr_t *src = &bt_sk(sk)->src;
 160         bdaddr_t *dst = &bt_sk(sk)->dst;
 161         struct sco_conn *conn;
 162         struct hci_conn *hcon;
 163         struct hci_dev  *hdev;
 164         int err, type;
 165
 166         BT_DBG("%pMR -> %pMR", src, dst);
 167
 168         hdev = hci_get_route(dst, src);
 169         if (!hdev)
 170                 return -EHOSTUNREACH;
 171
 172         hci_dev_lock(hdev);
 173
 174         if (lmp_esco_capable(hdev) && !disable_esco)
 175                 type = ESCO_LINK;
 176         else
 177                 type = SCO_LINK;
 178
 179         hcon = hci_connect(hdev, type, dst, BDADDR_BREDR, BT_SECURITY_LOW,
 180                            HCI_AT_NO_BONDING);
 181         if (IS_ERR(hcon)) {
 182                 err = PTR_ERR(hcon);
 183                 goto done;
 184         }
 185
 186         conn = sco_conn_add(hcon);
 187         if (!conn) {
 188                 hci_conn_put(hcon);
 189                 err = -ENOMEM;
 190                 goto done;
 191         }
 192
 193         /* Update source addr of the socket */
 194         bacpy(src, conn->src);
 195
 196         err = sco_chan_add(conn, sk, NULL);
 197         if (err)
 198                 goto done;
 199
 200         if (hcon->state == BT_CONNECTED) {
 201                 sco_sock_clear_timer(sk);
 202                 sk->sk_state = BT_CONNECTED;
 203         } else {
 204                 sk->sk_state = BT_CONNECT;
 205                 sco_sock_set_timer(sk, sk->sk_sndtimeo);
 206         }
 207
 208 done:
 209         hci_dev_unlock(hdev);
 210         hci_dev_put(hdev);
 211         return err;
 212 }
 213
 214 static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
 215 {
 216         struct sco_conn *conn = sco_pi(sk)->conn;
 217         struct sk_buff *skb;
 218         int err;
 219
 220         /* Check outgoing MTU */
 221         if (len > conn->mtu)
 222                 return -EINVAL;
 223
 224         BT_DBG("sk %p len %d", sk, len);
 225
 226         skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
 227         if (!skb)
 228                 return err;
 229
 230         if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
 231                 kfree_skb(skb);
 232                 return -EFAULT;
 233         }
 234
 235         hci_send_sco(conn->hcon, skb);
 236
 237         return len;
 238 }
 239
 240 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
 241 {
 242         struct sock *sk = sco_chan_get(conn);
 243
 244         if (!sk)
 245                 goto drop;
 246
 247         BT_DBG("sk %p len %d", sk, skb->len);
 248
 249         if (sk->sk_state != BT_CONNECTED)
 250                 goto drop;
 251
 252         if (!sock_queue_rcv_skb(sk, skb))
 253                 return;
 254
 255 drop:
 256         kfree_skb(skb);
 257 }
 258
 259 /* -------- Socket interface ---------- */
 260 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
 261 {
 262         struct hlist_node *node;
 263         struct sock *sk;
 264
 265         sk_for_each(sk, node, &sco_sk_list.head) {
 266                 if (sk->sk_state != BT_LISTEN)
 267                         continue;
 268
 269                 if (!bacmp(&bt_sk(sk)->src, ba))
 270                         return sk;
 271         }
 272
 273         return NULL;
 274 }
 275
 276 /* Find socket listening on source bdaddr.
 277  * Returns closest match.
 278  */
 279 static struct sock *sco_get_sock_listen(bdaddr_t *src)
 280 {
 281         struct sock *sk = NULL, *sk1 = NULL;
 282         struct hlist_node *node;
 283
 284         read_lock(&sco_sk_list.lock);
 285
 286         sk_for_each(sk, node, &sco_sk_list.head) {
 287                 if (sk->sk_state != BT_LISTEN)
 288                         continue;
 289
 290                 /* Exact match. */
 291                 if (!bacmp(&bt_sk(sk)->src, src))
 292                         break;
 293
 294                 /* Closest match */
 295                 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 296                         sk1 = sk;
 297         }
 298
 299         read_unlock(&sco_sk_list.lock);
 300
 301         return node ? sk : sk1;
 302 }
 303
 304 static void sco_sock_destruct(struct sock *sk)
 305 {
 306         BT_DBG("sk %p", sk);
 307
 308         skb_queue_purge(&sk->sk_receive_queue);
 309         skb_queue_purge(&sk->sk_write_queue);
 310 }
 311
 312 static void sco_sock_cleanup_listen(struct sock *parent)
 313 {
 314         struct sock *sk;
 315
 316         BT_DBG("parent %p", parent);
 317
 318         /* Close not yet accepted channels */
 319         while ((sk = bt_accept_dequeue(parent, NULL))) {
 320                 sco_sock_close(sk);
 321                 sco_sock_kill(sk);
 322         }
 323
 324         parent->sk_state  = BT_CLOSED;
 325         sock_set_flag(parent, SOCK_ZAPPED);
 326 }
 327
 328 /* Kill socket (only if zapped and orphan)
 329  * Must be called on unlocked socket.
 330  */
 331 static void sco_sock_kill(struct sock *sk)
 332 {
 333         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 334                 return;
 335
 336         BT_DBG("sk %p state %d", sk, sk->sk_state);
 337
 338         /* Kill poor orphan */
 339         bt_sock_unlink(&sco_sk_list, sk);
 340         sock_set_flag(sk, SOCK_DEAD);
 341         sock_put(sk);
 342 }
 343
 344 static void __sco_sock_close(struct sock *sk)
 345 {
 346         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 347
 348         switch (sk->sk_state) {
 349         case BT_LISTEN:
 350                 sco_sock_cleanup_listen(sk);
 351                 break;
 352
 353         case BT_CONNECTED:
 354         case BT_CONFIG:
 355                 if (sco_pi(sk)->conn->hcon) {
 356                         sk->sk_state = BT_DISCONN;
 357                         sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
 358                         hci_conn_put(sco_pi(sk)->conn->hcon);
 359                         sco_pi(sk)->conn->hcon = NULL;
 360                 } else
 361                         sco_chan_del(sk, ECONNRESET);
 362                 break;
 363
 364         case BT_CONNECT2:
 365         case BT_CONNECT:
 366         case BT_DISCONN:
 367                 sco_chan_del(sk, ECONNRESET);
 368                 break;
 369
 370         default:
 371                 sock_set_flag(sk, SOCK_ZAPPED);
 372                 break;
 373         }
 374 }
 375
 376 /* Must be called on unlocked socket. */
 377 static void sco_sock_close(struct sock *sk)
 378 {
 379         sco_sock_clear_timer(sk);
 380         lock_sock(sk);
 381         __sco_sock_close(sk);
 382         release_sock(sk);
 383         sco_sock_kill(sk);
 384 }
 385
 386 static void sco_sock_init(struct sock *sk, struct sock *parent)
 387 {
 388         BT_DBG("sk %p", sk);
 389
 390         if (parent) {
 391                 sk->sk_type = parent->sk_type;
 392                 bt_sk(sk)->flags = bt_sk(parent)->flags;
 393                 security_sk_clone(parent, sk);
 394         }
 395 }
 396
 397 static struct proto sco_proto = {
 398         .name           = "SCO",
 399         .owner          = THIS_MODULE,
 400         .obj_size       = sizeof(struct sco_pinfo)
 401 };
 402
 403 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 404 {
 405         struct sock *sk;
 406
 407         sk = sk_alloc(net, PF_BLUETOOTH, prio, &sco_proto);
 408         if (!sk)
 409                 return NULL;
 410
 411         sock_init_data(sock, sk);
 412         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 413
 414         sk->sk_destruct = sco_sock_destruct;
 415         sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
 416
 417         sock_reset_flag(sk, SOCK_ZAPPED);
 418
 419         sk->sk_protocol = proto;
 420         sk->sk_state    = BT_OPEN;
 421
 422         setup_timer(&sk->sk_timer, sco_sock_timeout, (unsigned long)sk);
 423
 424         bt_sock_link(&sco_sk_list, sk);
 425         return sk;
 426 }
 427
 428 static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
 429                            int kern)
 430 {
 431         struct sock *sk;
 432
 433         BT_DBG("sock %p", sock);
 434
 435         sock->state = SS_UNCONNECTED;
 436
 437         if (sock->type != SOCK_SEQPACKET)
 438                 return -ESOCKTNOSUPPORT;
 439
 440         sock->ops = &sco_sock_ops;
 441
 442         sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 443         if (!sk)
 444                 return -ENOMEM;
 445
 446         sco_sock_init(sk, NULL);
 447         return 0;
 448 }
 449
 450 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 451 {
 452         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 453         struct sock *sk = sock->sk;
 454         int err = 0;
 455
 456         BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
 457
 458         if (!addr || addr->sa_family != AF_BLUETOOTH)
 459                 return -EINVAL;
 460
 461         lock_sock(sk);
 462
 463         if (sk->sk_state != BT_OPEN) {
 464                 err = -EBADFD;
 465                 goto done;
 466         }
 467
 468         if (sk->sk_type != SOCK_SEQPACKET) {
 469                 err = -EINVAL;
 470                 goto done;
 471         }
 472
 473         bacpy(&bt_sk(sk)->src, &sa->sco_bdaddr);
 474
 475         sk->sk_state = BT_BOUND;
 476
 477 done:
 478         release_sock(sk);
 479         return err;
 480 }
 481
 482 static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 483 {
 484         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 485         struct sock *sk = sock->sk;
 486         int err = 0;
 487
 488
 489         BT_DBG("sk %p", sk);
 490
 491         if (alen < sizeof(struct sockaddr_sco) ||
 492             addr->sa_family != AF_BLUETOOTH)
 493                 return -EINVAL;
 494
 495         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
 496                 return -EBADFD;
 497
 498         if (sk->sk_type != SOCK_SEQPACKET)
 499                 return -EINVAL;
 500
 501         lock_sock(sk);
 502
 503         /* Set destination address and psm */
 504         bacpy(&bt_sk(sk)->dst, &sa->sco_bdaddr);
 505
 506         err = sco_connect(sk);
 507         if (err)
 508                 goto done;
 509
 510         err = bt_sock_wait_state(sk, BT_CONNECTED,
 511                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 512
 513 done:
 514         release_sock(sk);
 515         return err;
 516 }
 517
 518 static int sco_sock_listen(struct socket *sock, int backlog)
 519 {
 520         struct sock *sk = sock->sk;
 521         bdaddr_t *src = &bt_sk(sk)->src;
 522         int err = 0;
 523
 524         BT_DBG("sk %p backlog %d", sk, backlog);
 525
 526         lock_sock(sk);
 527
 528         if (sk->sk_state != BT_BOUND) {
 529                 err = -EBADFD;
 530                 goto done;
 531         }
 532
 533         if (sk->sk_type != SOCK_SEQPACKET) {
 534                 err = -EINVAL;
 535                 goto done;
 536         }
 537
 538         write_lock(&sco_sk_list.lock);
 539
 540         if (__sco_get_sock_listen_by_addr(src)) {
 541                 err = -EADDRINUSE;
 542                 goto unlock;
 543         }
 544
 545         sk->sk_max_ack_backlog = backlog;
 546         sk->sk_ack_backlog = 0;
 547
 548         sk->sk_state = BT_LISTEN;
 549
 550 unlock:
 551         write_unlock(&sco_sk_list.lock);
 552
 553 done:
 554         release_sock(sk);
 555         return err;
 556 }
 557
 558 static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 559 {
 560         DECLARE_WAITQUEUE(wait, current);
 561         struct sock *sk = sock->sk, *ch;
 562         long timeo;
 563         int err = 0;
 564
 565         lock_sock(sk);
 566
 567         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 568
 569         BT_DBG("sk %p timeo %ld", sk, timeo);
 570
 571         /* Wait for an incoming connection. (wake-one). */
 572         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 573         while (1) {
 574                 set_current_state(TASK_INTERRUPTIBLE);
 575
 576                 if (sk->sk_state != BT_LISTEN) {
 577                         err = -EBADFD;
 578                         break;
 579                 }
 580
 581                 ch = bt_accept_dequeue(sk, newsock);
 582                 if (ch)
 583                         break;
 584
 585                 if (!timeo) {
 586                         err = -EAGAIN;
 587                         break;
 588                 }
 589
 590                 if (signal_pending(current)) {
 591                         err = sock_intr_errno(timeo);
 592                         break;
 593                 }
 594
 595                 release_sock(sk);
 596                 timeo = schedule_timeout(timeo);
 597                 lock_sock(sk);
 598         }
 599         __set_current_state(TASK_RUNNING);
 600         remove_wait_queue(sk_sleep(sk), &wait);
 601
 602         if (err)
 603                 goto done;
 604
 605         newsock->state = SS_CONNECTED;
 606
 607         BT_DBG("new socket %p", ch);
 608
 609 done:
 610         release_sock(sk);
 611         return err;
 612 }
 613
 614 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 615 {
 616         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 617         struct sock *sk = sock->sk;
 618
 619         BT_DBG("sock %p, sk %p", sock, sk);
 620
 621         addr->sa_family = AF_BLUETOOTH;
 622         *len = sizeof(struct sockaddr_sco);
 623
 624         if (peer)
 625                 bacpy(&sa->sco_bdaddr, &bt_sk(sk)->dst);
 626         else
 627                 bacpy(&sa->sco_bdaddr, &bt_sk(sk)->src);
 628
 629         return 0;
 630 }
 631
 632 static int sco_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 633                             struct msghdr *msg, size_t len)
 634 {
 635         struct sock *sk = sock->sk;
 636         int err;
 637
 638         BT_DBG("sock %p, sk %p", sock, sk);
 639
 640         err = sock_error(sk);
 641         if (err)
 642                 return err;
 643
 644         if (msg->msg_flags & MSG_OOB)
 645                 return -EOPNOTSUPP;
 646
 647         lock_sock(sk);
 648
 649         if (sk->sk_state == BT_CONNECTED)
 650                 err = sco_send_frame(sk, msg, len);
 651         else
 652                 err = -ENOTCONN;
 653
 654         release_sock(sk);
 655         return err;
 656 }
 657
 658 static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 659                             struct msghdr *msg, size_t len, int flags)
 660 {
 661         struct sock *sk = sock->sk;
 662         struct sco_pinfo *pi = sco_pi(sk);
 663
 664         lock_sock(sk);
 665
 666         if (sk->sk_state == BT_CONNECT2 &&
 667             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
 668                 hci_conn_accept(pi->conn->hcon, 0);
 669                 sk->sk_state = BT_CONFIG;
 670
 671                 release_sock(sk);
 672                 return 0;
 673         }
 674
 675         release_sock(sk);
 676
 677         return bt_sock_recvmsg(iocb, sock, msg, len, flags);
 678 }
 679
 680 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 681 {
 682         struct sock *sk = sock->sk;
 683         int err = 0;
 684         u32 opt;
 685
 686         BT_DBG("sk %p", sk);
 687
 688         lock_sock(sk);
 689
 690         switch (optname) {
 691
 692         case BT_DEFER_SETUP:
 693                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 694                         err = -EINVAL;
 695                         break;
 696                 }
 697
 698                 if (get_user(opt, (u32 __user *) optval)) {
 699                         err = -EFAULT;
 700                         break;
 701                 }
 702
 703                 if (opt)
 704                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 705                 else
 706                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 707                 break;
 708
 709         default:
 710                 err = -ENOPROTOOPT;
 711                 break;
 712         }
 713
 714         release_sock(sk);
 715         return err;
 716 }
 717
 718 static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 719 {
 720         struct sock *sk = sock->sk;
 721         struct sco_options opts;
 722         struct sco_conninfo cinfo;
 723         int len, err = 0;
 724
 725         BT_DBG("sk %p", sk);
 726
 727         if (get_user(len, optlen))
 728                 return -EFAULT;
 729
 730         lock_sock(sk);
 731
 732         switch (optname) {
 733         case SCO_OPTIONS:
 734                 if (sk->sk_state != BT_CONNECTED) {
 735                         err = -ENOTCONN;
 736                         break;
 737                 }
 738
 739                 opts.mtu = sco_pi(sk)->conn->mtu;
 740
 741                 BT_DBG("mtu %d", opts.mtu);
 742
 743                 len = min_t(unsigned int, len, sizeof(opts));
 744                 if (copy_to_user(optval, (char *)&opts, len))
 745                         err = -EFAULT;
 746
 747                 break;
 748
 749         case SCO_CONNINFO:
 750                 if (sk->sk_state != BT_CONNECTED) {
 751                         err = -ENOTCONN;
 752                         break;
 753                 }
 754
 755                 memset(&cinfo, 0, sizeof(cinfo));
 756                 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
 757                 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
 758
 759                 len = min_t(unsigned int, len, sizeof(cinfo));
 760                 if (copy_to_user(optval, (char *)&cinfo, len))
 761                         err = -EFAULT;
 762
 763                 break;
 764
 765         default:
 766                 err = -ENOPROTOOPT;
 767                 break;
 768         }
 769
 770         release_sock(sk);
 771         return err;
 772 }
 773
 774 static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 775 {
 776         struct sock *sk = sock->sk;
 777         int len, err = 0;
 778
 779         BT_DBG("sk %p", sk);
 780
 781         if (level == SOL_SCO)
 782                 return sco_sock_getsockopt_old(sock, optname, optval, optlen);
 783
 784         if (get_user(len, optlen))
 785                 return -EFAULT;
 786
 787         lock_sock(sk);
 788
 789         switch (optname) {
 790
 791         case BT_DEFER_SETUP:
 792                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 793                         err = -EINVAL;
 794                         break;
 795                 }
 796
 797                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 798                              (u32 __user *) optval))
 799                         err = -EFAULT;
 800
 801                 break;
 802
 803         default:
 804                 err = -ENOPROTOOPT;
 805                 break;
 806         }
 807
 808         release_sock(sk);
 809         return err;
 810 }
 811
 812 static int sco_sock_shutdown(struct socket *sock, int how)
 813 {
 814         struct sock *sk = sock->sk;
 815         int err = 0;
 816
 817         BT_DBG("sock %p, sk %p", sock, sk);
 818
 819         if (!sk)
 820                 return 0;
 821
 822         lock_sock(sk);
 823         if (!sk->sk_shutdown) {
 824                 sk->sk_shutdown = SHUTDOWN_MASK;
 825                 sco_sock_clear_timer(sk);
 826                 __sco_sock_close(sk);
 827
 828                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 829                         err = bt_sock_wait_state(sk, BT_CLOSED,
 830                                                  sk->sk_lingertime);
 831         }
 832         release_sock(sk);
 833         return err;
 834 }
 835
 836 static int sco_sock_release(struct socket *sock)
 837 {
 838         struct sock *sk = sock->sk;
 839         int err = 0;
 840
 841         BT_DBG("sock %p, sk %p", sock, sk);
 842
 843         if (!sk)
 844                 return 0;
 845
 846         sco_sock_close(sk);
 847
 848         if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) {
 849                 lock_sock(sk);
 850                 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 851                 release_sock(sk);
 852         }
 853
 854         sock_orphan(sk);
 855         sco_sock_kill(sk);
 856         return err;
 857 }
 858
 859 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
 860 {
 861         BT_DBG("conn %p", conn);
 862
 863         sco_pi(sk)->conn = conn;
 864         conn->sk = sk;
 865
 866         if (parent)
 867                 bt_accept_enqueue(parent, sk);
 868 }
 869
 870 /* Delete channel.
 871  * Must be called on the locked socket. */
 872 static void sco_chan_del(struct sock *sk, int err)
 873 {
 874         struct sco_conn *conn;
 875
 876         conn = sco_pi(sk)->conn;
 877
 878         BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
 879
 880         if (conn) {
 881                 sco_conn_lock(conn);
 882                 conn->sk = NULL;
 883                 sco_pi(sk)->conn = NULL;
 884                 sco_conn_unlock(conn);
 885
 886                 if (conn->hcon)
 887                         hci_conn_put(conn->hcon);
 888         }
 889
 890         sk->sk_state = BT_CLOSED;
 891         sk->sk_err   = err;
 892         sk->sk_state_change(sk);
 893
 894         sock_set_flag(sk, SOCK_ZAPPED);
 895 }
 896
 897 static void sco_conn_ready(struct sco_conn *conn)
 898 {
 899         struct sock *parent;
 900         struct sock *sk = conn->sk;
 901
 902         BT_DBG("conn %p", conn);
 903
 904         sco_conn_lock(conn);
 905
 906         if (sk) {
 907                 sco_sock_clear_timer(sk);
 908                 bh_lock_sock(sk);
 909                 sk->sk_state = BT_CONNECTED;
 910                 sk->sk_state_change(sk);
 911                 bh_unlock_sock(sk);
 912         } else {
 913                 parent = sco_get_sock_listen(conn->src);
 914                 if (!parent)
 915                         goto done;
 916
 917                 bh_lock_sock(parent);
 918
 919                 sk = sco_sock_alloc(sock_net(parent), NULL,
 920                                     BTPROTO_SCO, GFP_ATOMIC);
 921                 if (!sk) {
 922                         bh_unlock_sock(parent);
 923                         goto done;
 924                 }
 925
 926                 sco_sock_init(sk, parent);
 927
 928                 bacpy(&bt_sk(sk)->src, conn->src);
 929                 bacpy(&bt_sk(sk)->dst, conn->dst);
 930
 931                 hci_conn_hold(conn->hcon);
 932                 __sco_chan_add(conn, sk, parent);
 933
 934                 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
 935                         sk->sk_state = BT_CONNECT2;
 936                 else
 937                         sk->sk_state = BT_CONNECTED;
 938
 939                 /* Wake up parent */
 940                 parent->sk_data_ready(parent, 1);
 941
 942                 bh_unlock_sock(parent);
 943         }
 944
 945 done:
 946         sco_conn_unlock(conn);
 947 }
 948
 949 /* ----- SCO interface with lower layer (HCI) ----- */
 950 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
 951 {
 952         struct sock *sk;
 953         struct hlist_node *node;
 954         int lm = 0;
 955
 956         BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
 957
 958         /* Find listening sockets */
 959         read_lock(&sco_sk_list.lock);
 960         sk_for_each(sk, node, &sco_sk_list.head) {
 961                 if (sk->sk_state != BT_LISTEN)
 962                         continue;
 963
 964                 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr) ||
 965                     !bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
 966                         lm |= HCI_LM_ACCEPT;
 967
 968                         if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
 969                                 *flags |= HCI_PROTO_DEFER;
 970                         break;
 971                 }
 972         }
 973         read_unlock(&sco_sk_list.lock);
 974
 975         return lm;
 976 }
 977
 978 void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
 979 {
 980         BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
 981         if (!status) {
 982                 struct sco_conn *conn;
 983
 984                 conn = sco_conn_add(hcon);
 985                 if (conn)
 986                         sco_conn_ready(conn);
 987         } else
 988                 sco_conn_del(hcon, bt_to_errno(status));
 989 }
 990
 991 void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
 992 {
 993         BT_DBG("hcon %p reason %d", hcon, reason);
 994
 995         sco_conn_del(hcon, bt_to_errno(reason));
 996 }
 997
 998 int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
 999 {
1000         struct sco_conn *conn = hcon->sco_data;
1001
1002         if (!conn)
1003                 goto drop;
1004
1005         BT_DBG("conn %p len %d", conn, skb->len);
1006
1007         if (skb->len) {
1008                 sco_recv_frame(conn, skb);
1009                 return 0;
1010         }
1011
1012 drop:
1013         kfree_skb(skb);
1014         return 0;
1015 }
1016
1017 static int sco_debugfs_show(struct seq_file *f, void *p)
1018 {
1019         struct sock *sk;
1020         struct hlist_node *node;
1021
1022         read_lock(&sco_sk_list.lock);
1023
1024         sk_for_each(sk, node, &sco_sk_list.head) {
1025                 seq_printf(f, "%pMR %pMR %d\n", &bt_sk(sk)->src,
1026                            &bt_sk(sk)->dst, sk->sk_state);
1027         }
1028
1029         read_unlock(&sco_sk_list.lock);
1030
1031         return 0;
1032 }
1033
1034 static int sco_debugfs_open(struct inode *inode, struct file *file)
1035 {
1036         return single_open(file, sco_debugfs_show, inode->i_private);
1037 }
1038
1039 static const struct file_operations sco_debugfs_fops = {
1040         .open           = sco_debugfs_open,
1041         .read           = seq_read,
1042         .llseek         = seq_lseek,
1043         .release        = single_release,
1044 };
1045
1046 static struct dentry *sco_debugfs;
1047
1048 static const struct proto_ops sco_sock_ops = {
1049         .family         = PF_BLUETOOTH,
1050         .owner          = THIS_MODULE,
1051         .release        = sco_sock_release,
1052         .bind           = sco_sock_bind,
1053         .connect        = sco_sock_connect,
1054         .listen         = sco_sock_listen,
1055         .accept         = sco_sock_accept,
1056         .getname        = sco_sock_getname,
1057         .sendmsg        = sco_sock_sendmsg,
1058         .recvmsg        = sco_sock_recvmsg,
1059         .poll           = bt_sock_poll,
1060         .ioctl          = bt_sock_ioctl,
1061         .mmap           = sock_no_mmap,
1062         .socketpair     = sock_no_socketpair,
1063         .shutdown       = sco_sock_shutdown,
1064         .setsockopt     = sco_sock_setsockopt,
1065         .getsockopt     = sco_sock_getsockopt
1066 };
1067
1068 static const struct net_proto_family sco_sock_family_ops = {
1069         .family = PF_BLUETOOTH,
1070         .owner  = THIS_MODULE,
1071         .create = sco_sock_create,
1072 };
1073
1074 int __init sco_init(void)
1075 {
1076         int err;
1077
1078         err = proto_register(&sco_proto, 0);
1079         if (err < 0)
1080                 return err;
1081
1082         err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
1083         if (err < 0) {
1084                 BT_ERR("SCO socket registration failed");
1085                 goto error;
1086         }
1087
1088         err = bt_procfs_init(THIS_MODULE, &init_net, "sco", &sco_sk_list, NULL);
1089         if (err < 0) {
1090                 BT_ERR("Failed to create SCO proc file");
1091                 bt_sock_unregister(BTPROTO_SCO);
1092                 goto error;
1093         }
1094
1095         if (bt_debugfs) {
1096                 sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs,
1097                                                   NULL, &sco_debugfs_fops);
1098                 if (!sco_debugfs)
1099                         BT_ERR("Failed to create SCO debug file");
1100         }
1101
1102         BT_INFO("SCO socket layer initialized");
1103
1104         return 0;
1105
1106 error:
1107         proto_unregister(&sco_proto);
1108         return err;
1109 }
1110
1111 void __exit sco_exit(void)
1112 {
1113         bt_procfs_cleanup(&init_net, "sco");
1114
1115         debugfs_remove(sco_debugfs);
1116
1117         if (bt_sock_unregister(BTPROTO_SCO) < 0)
1118                 BT_ERR("SCO socket unregistration failed");
1119
1120         proto_unregister(&sco_proto);
1121 }
1122
1123 module_param(disable_esco, bool, 0644);
1124 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");