net/bluetooth/sco.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth SCO sockets. */
  26
  27 #include <linux/module.h>
  28 #include <linux/debugfs.h>
  29 #include <linux/seq_file.h>
  30
  31 #include <net/bluetooth/bluetooth.h>
  32 #include <net/bluetooth/hci_core.h>
  33 #include <net/bluetooth/sco.h>
  34
  35 static bool disable_esco;
  36
  37 static const struct proto_ops sco_sock_ops;
  38
  39 static struct bt_sock_list sco_sk_list = {
  40         .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
  41 };
  42
  43 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent);
  44 static void sco_chan_del(struct sock *sk, int err);
  45
  46 static void sco_sock_close(struct sock *sk);
  47 static void sco_sock_kill(struct sock *sk);
  48
  49 /* ----- SCO socket info ----- */
  50 #define sco_pi(sk) ((struct sco_pinfo *) sk)
  51
  52 struct sco_pinfo {
  53         struct bt_sock  bt;
  54         bdaddr_t        src;
  55         bdaddr_t        dst;
  56         __u32           flags;
  57         __u16           setting;
  58         struct sco_conn *conn;
  59 };
  60
  61 /* ---- SCO timers ---- */
  62 static void sco_sock_timeout(unsigned long arg)
  63 {
  64         struct sock *sk = (struct sock *) arg;
  65
  66         BT_DBG("sock %p state %d", sk, sk->sk_state);
  67
  68         bh_lock_sock(sk);
  69         sk->sk_err = ETIMEDOUT;
  70         sk->sk_state_change(sk);
  71         bh_unlock_sock(sk);
  72
  73         sco_sock_kill(sk);
  74         sock_put(sk);
  75 }
  76
  77 static void sco_sock_set_timer(struct sock *sk, long timeout)
  78 {
  79         BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
  80         sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
  81 }
  82
  83 static void sco_sock_clear_timer(struct sock *sk)
  84 {
  85         BT_DBG("sock %p state %d", sk, sk->sk_state);
  86         sk_stop_timer(sk, &sk->sk_timer);
  87 }
  88
  89 /* ---- SCO connections ---- */
  90 static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
  91 {
  92         struct hci_dev *hdev = hcon->hdev;
  93         struct sco_conn *conn = hcon->sco_data;
  94
  95         if (conn)
  96                 return conn;
  97
  98         conn = kzalloc(sizeof(struct sco_conn), GFP_KERNEL);
  99         if (!conn)
 100                 return NULL;
 101
 102         spin_lock_init(&conn->lock);
 103
 104         hcon->sco_data = conn;
 105         conn->hcon = hcon;
 106
 107         if (hdev->sco_mtu > 0)
 108                 conn->mtu = hdev->sco_mtu;
 109         else
 110                 conn->mtu = 60;
 111
 112         BT_DBG("hcon %p conn %p", hcon, conn);
 113
 114         return conn;
 115 }
 116
 117 static struct sock *sco_chan_get(struct sco_conn *conn)
 118 {
 119         struct sock *sk = NULL;
 120         sco_conn_lock(conn);
 121         sk = conn->sk;
 122         sco_conn_unlock(conn);
 123         return sk;
 124 }
 125
 126 static int sco_conn_del(struct hci_conn *hcon, int err)
 127 {
 128         struct sco_conn *conn = hcon->sco_data;
 129         struct sock *sk;
 130
 131         if (!conn)
 132                 return 0;
 133
 134         BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 135
 136         /* Kill socket */
 137         sk = sco_chan_get(conn);
 138         if (sk) {
 139                 bh_lock_sock(sk);
 140                 sco_sock_clear_timer(sk);
 141                 sco_chan_del(sk, err);
 142                 bh_unlock_sock(sk);
 143                 sco_sock_kill(sk);
 144         }
 145
 146         hcon->sco_data = NULL;
 147         kfree(conn);
 148         return 0;
 149 }
 150
 151 static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
 152                         struct sock *parent)
 153 {
 154         int err = 0;
 155
 156         sco_conn_lock(conn);
 157         if (conn->sk)
 158                 err = -EBUSY;
 159         else
 160                 __sco_chan_add(conn, sk, parent);
 161
 162         sco_conn_unlock(conn);
 163         return err;
 164 }
 165
 166 static int sco_connect(struct sock *sk)
 167 {
 168         struct sco_conn *conn;
 169         struct hci_conn *hcon;
 170         struct hci_dev  *hdev;
 171         int err, type;
 172
 173         BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst);
 174
 175         hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src);
 176         if (!hdev)
 177                 return -EHOSTUNREACH;
 178
 179         hci_dev_lock(hdev);
 180
 181         if (lmp_esco_capable(hdev) && !disable_esco)
 182                 type = ESCO_LINK;
 183         else
 184                 type = SCO_LINK;
 185
 186         if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT &&
 187             (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) {
 188                 err = -EOPNOTSUPP;
 189                 goto done;
 190         }
 191
 192         hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst,
 193                                sco_pi(sk)->setting);
 194         if (IS_ERR(hcon)) {
 195                 err = PTR_ERR(hcon);
 196                 goto done;
 197         }
 198
 199         conn = sco_conn_add(hcon);
 200         if (!conn) {
 201                 hci_conn_drop(hcon);
 202                 err = -ENOMEM;
 203                 goto done;
 204         }
 205
 206         /* Update source addr of the socket */
 207         bacpy(&sco_pi(sk)->src, &hcon->src);
 208
 209         err = sco_chan_add(conn, sk, NULL);
 210         if (err)
 211                 goto done;
 212
 213         if (hcon->state == BT_CONNECTED) {
 214                 sco_sock_clear_timer(sk);
 215                 sk->sk_state = BT_CONNECTED;
 216         } else {
 217                 sk->sk_state = BT_CONNECT;
 218                 sco_sock_set_timer(sk, sk->sk_sndtimeo);
 219         }
 220
 221 done:
 222         hci_dev_unlock(hdev);
 223         hci_dev_put(hdev);
 224         return err;
 225 }
 226
 227 static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
 228 {
 229         struct sco_conn *conn = sco_pi(sk)->conn;
 230         struct sk_buff *skb;
 231         int err;
 232
 233         /* Check outgoing MTU */
 234         if (len > conn->mtu)
 235                 return -EINVAL;
 236
 237         BT_DBG("sk %p len %d", sk, len);
 238
 239         skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
 240         if (!skb)
 241                 return err;
 242
 243         if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
 244                 kfree_skb(skb);
 245                 return -EFAULT;
 246         }
 247
 248         hci_send_sco(conn->hcon, skb);
 249
 250         return len;
 251 }
 252
 253 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
 254 {
 255         struct sock *sk = sco_chan_get(conn);
 256
 257         if (!sk)
 258                 goto drop;
 259
 260         BT_DBG("sk %p len %d", sk, skb->len);
 261
 262         if (sk->sk_state != BT_CONNECTED)
 263                 goto drop;
 264
 265         if (!sock_queue_rcv_skb(sk, skb))
 266                 return;
 267
 268 drop:
 269         kfree_skb(skb);
 270 }
 271
 272 /* -------- Socket interface ---------- */
 273 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
 274 {
 275         struct sock *sk;
 276
 277         sk_for_each(sk, &sco_sk_list.head) {
 278                 if (sk->sk_state != BT_LISTEN)
 279                         continue;
 280
 281                 if (!bacmp(&sco_pi(sk)->src, ba))
 282                         return sk;
 283         }
 284
 285         return NULL;
 286 }
 287
 288 /* Find socket listening on source bdaddr.
 289  * Returns closest match.
 290  */
 291 static struct sock *sco_get_sock_listen(bdaddr_t *src)
 292 {
 293         struct sock *sk = NULL, *sk1 = NULL;
 294
 295         read_lock(&sco_sk_list.lock);
 296
 297         sk_for_each(sk, &sco_sk_list.head) {
 298                 if (sk->sk_state != BT_LISTEN)
 299                         continue;
 300
 301                 /* Exact match. */
 302                 if (!bacmp(&sco_pi(sk)->src, src))
 303                         break;
 304
 305                 /* Closest match */
 306                 if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY))
 307                         sk1 = sk;
 308         }
 309
 310         read_unlock(&sco_sk_list.lock);
 311
 312         return sk ? sk : sk1;
 313 }
 314
 315 static void sco_sock_destruct(struct sock *sk)
 316 {
 317         BT_DBG("sk %p", sk);
 318
 319         skb_queue_purge(&sk->sk_receive_queue);
 320         skb_queue_purge(&sk->sk_write_queue);
 321 }
 322
 323 static void sco_sock_cleanup_listen(struct sock *parent)
 324 {
 325         struct sock *sk;
 326
 327         BT_DBG("parent %p", parent);
 328
 329         /* Close not yet accepted channels */
 330         while ((sk = bt_accept_dequeue(parent, NULL))) {
 331                 sco_sock_close(sk);
 332                 sco_sock_kill(sk);
 333         }
 334
 335         parent->sk_state  = BT_CLOSED;
 336         sock_set_flag(parent, SOCK_ZAPPED);
 337 }
 338
 339 /* Kill socket (only if zapped and orphan)
 340  * Must be called on unlocked socket.
 341  */
 342 static void sco_sock_kill(struct sock *sk)
 343 {
 344         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 345                 return;
 346
 347         BT_DBG("sk %p state %d", sk, sk->sk_state);
 348
 349         /* Kill poor orphan */
 350         bt_sock_unlink(&sco_sk_list, sk);
 351         sock_set_flag(sk, SOCK_DEAD);
 352         sock_put(sk);
 353 }
 354
 355 static void __sco_sock_close(struct sock *sk)
 356 {
 357         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 358
 359         switch (sk->sk_state) {
 360         case BT_LISTEN:
 361                 sco_sock_cleanup_listen(sk);
 362                 break;
 363
 364         case BT_CONNECTED:
 365         case BT_CONFIG:
 366                 if (sco_pi(sk)->conn->hcon) {
 367                         sk->sk_state = BT_DISCONN;
 368                         sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
 369                         hci_conn_drop(sco_pi(sk)->conn->hcon);
 370                         sco_pi(sk)->conn->hcon = NULL;
 371                 } else
 372                         sco_chan_del(sk, ECONNRESET);
 373                 break;
 374
 375         case BT_CONNECT2:
 376         case BT_CONNECT:
 377         case BT_DISCONN:
 378                 sco_chan_del(sk, ECONNRESET);
 379                 break;
 380
 381         default:
 382                 sock_set_flag(sk, SOCK_ZAPPED);
 383                 break;
 384         }
 385 }
 386
 387 /* Must be called on unlocked socket. */
 388 static void sco_sock_close(struct sock *sk)
 389 {
 390         sco_sock_clear_timer(sk);
 391         lock_sock(sk);
 392         __sco_sock_close(sk);
 393         release_sock(sk);
 394         sco_sock_kill(sk);
 395 }
 396
 397 static void sco_sock_init(struct sock *sk, struct sock *parent)
 398 {
 399         BT_DBG("sk %p", sk);
 400
 401         if (parent) {
 402                 sk->sk_type = parent->sk_type;
 403                 bt_sk(sk)->flags = bt_sk(parent)->flags;
 404                 security_sk_clone(parent, sk);
 405         }
 406 }
 407
 408 static struct proto sco_proto = {
 409         .name           = "SCO",
 410         .owner          = THIS_MODULE,
 411         .obj_size       = sizeof(struct sco_pinfo)
 412 };
 413
 414 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 415 {
 416         struct sock *sk;
 417
 418         sk = sk_alloc(net, PF_BLUETOOTH, prio, &sco_proto);
 419         if (!sk)
 420                 return NULL;
 421
 422         sock_init_data(sock, sk);
 423         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 424
 425         sk->sk_destruct = sco_sock_destruct;
 426         sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
 427
 428         sock_reset_flag(sk, SOCK_ZAPPED);
 429
 430         sk->sk_protocol = proto;
 431         sk->sk_state    = BT_OPEN;
 432
 433         sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
 434
 435         setup_timer(&sk->sk_timer, sco_sock_timeout, (unsigned long)sk);
 436
 437         bt_sock_link(&sco_sk_list, sk);
 438         return sk;
 439 }
 440
 441 static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
 442                            int kern)
 443 {
 444         struct sock *sk;
 445
 446         BT_DBG("sock %p", sock);
 447
 448         sock->state = SS_UNCONNECTED;
 449
 450         if (sock->type != SOCK_SEQPACKET)
 451                 return -ESOCKTNOSUPPORT;
 452
 453         sock->ops = &sco_sock_ops;
 454
 455         sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 456         if (!sk)
 457                 return -ENOMEM;
 458
 459         sco_sock_init(sk, NULL);
 460         return 0;
 461 }
 462
 463 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 464 {
 465         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 466         struct sock *sk = sock->sk;
 467         int err = 0;
 468
 469         BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
 470
 471         if (!addr || addr->sa_family != AF_BLUETOOTH)
 472                 return -EINVAL;
 473
 474         lock_sock(sk);
 475
 476         if (sk->sk_state != BT_OPEN) {
 477                 err = -EBADFD;
 478                 goto done;
 479         }
 480
 481         if (sk->sk_type != SOCK_SEQPACKET) {
 482                 err = -EINVAL;
 483                 goto done;
 484         }
 485
 486         bacpy(&sco_pi(sk)->src, &sa->sco_bdaddr);
 487
 488         sk->sk_state = BT_BOUND;
 489
 490 done:
 491         release_sock(sk);
 492         return err;
 493 }
 494
 495 static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 496 {
 497         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 498         struct sock *sk = sock->sk;
 499         int err;
 500
 501         BT_DBG("sk %p", sk);
 502
 503         if (alen < sizeof(struct sockaddr_sco) ||
 504             addr->sa_family != AF_BLUETOOTH)
 505                 return -EINVAL;
 506
 507         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
 508                 return -EBADFD;
 509
 510         if (sk->sk_type != SOCK_SEQPACKET)
 511                 return -EINVAL;
 512
 513         lock_sock(sk);
 514
 515         /* Set destination address and psm */
 516         bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr);
 517
 518         err = sco_connect(sk);
 519         if (err)
 520                 goto done;
 521
 522         err = bt_sock_wait_state(sk, BT_CONNECTED,
 523                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 524
 525 done:
 526         release_sock(sk);
 527         return err;
 528 }
 529
 530 static int sco_sock_listen(struct socket *sock, int backlog)
 531 {
 532         struct sock *sk = sock->sk;
 533         bdaddr_t *src = &sco_pi(sk)->src;
 534         int err = 0;
 535
 536         BT_DBG("sk %p backlog %d", sk, backlog);
 537
 538         lock_sock(sk);
 539
 540         if (sk->sk_state != BT_BOUND) {
 541                 err = -EBADFD;
 542                 goto done;
 543         }
 544
 545         if (sk->sk_type != SOCK_SEQPACKET) {
 546                 err = -EINVAL;
 547                 goto done;
 548         }
 549
 550         write_lock(&sco_sk_list.lock);
 551
 552         if (__sco_get_sock_listen_by_addr(src)) {
 553                 err = -EADDRINUSE;
 554                 goto unlock;
 555         }
 556
 557         sk->sk_max_ack_backlog = backlog;
 558         sk->sk_ack_backlog = 0;
 559
 560         sk->sk_state = BT_LISTEN;
 561
 562 unlock:
 563         write_unlock(&sco_sk_list.lock);
 564
 565 done:
 566         release_sock(sk);
 567         return err;
 568 }
 569
 570 static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 571 {
 572         DECLARE_WAITQUEUE(wait, current);
 573         struct sock *sk = sock->sk, *ch;
 574         long timeo;
 575         int err = 0;
 576
 577         lock_sock(sk);
 578
 579         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 580
 581         BT_DBG("sk %p timeo %ld", sk, timeo);
 582
 583         /* Wait for an incoming connection. (wake-one). */
 584         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 585         while (1) {
 586                 set_current_state(TASK_INTERRUPTIBLE);
 587
 588                 if (sk->sk_state != BT_LISTEN) {
 589                         err = -EBADFD;
 590                         break;
 591                 }
 592
 593                 ch = bt_accept_dequeue(sk, newsock);
 594                 if (ch)
 595                         break;
 596
 597                 if (!timeo) {
 598                         err = -EAGAIN;
 599                         break;
 600                 }
 601
 602                 if (signal_pending(current)) {
 603                         err = sock_intr_errno(timeo);
 604                         break;
 605                 }
 606
 607                 release_sock(sk);
 608                 timeo = schedule_timeout(timeo);
 609                 lock_sock(sk);
 610         }
 611         __set_current_state(TASK_RUNNING);
 612         remove_wait_queue(sk_sleep(sk), &wait);
 613
 614         if (err)
 615                 goto done;
 616
 617         newsock->state = SS_CONNECTED;
 618
 619         BT_DBG("new socket %p", ch);
 620
 621 done:
 622         release_sock(sk);
 623         return err;
 624 }
 625
 626 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 627 {
 628         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 629         struct sock *sk = sock->sk;
 630
 631         BT_DBG("sock %p, sk %p", sock, sk);
 632
 633         addr->sa_family = AF_BLUETOOTH;
 634         *len = sizeof(struct sockaddr_sco);
 635
 636         if (peer)
 637                 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->dst);
 638         else
 639                 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->src);
 640
 641         return 0;
 642 }
 643
 644 static int sco_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 645                             struct msghdr *msg, size_t len)
 646 {
 647         struct sock *sk = sock->sk;
 648         int err;
 649
 650         BT_DBG("sock %p, sk %p", sock, sk);
 651
 652         err = sock_error(sk);
 653         if (err)
 654                 return err;
 655
 656         if (msg->msg_flags & MSG_OOB)
 657                 return -EOPNOTSUPP;
 658
 659         lock_sock(sk);
 660
 661         if (sk->sk_state == BT_CONNECTED)
 662                 err = sco_send_frame(sk, msg, len);
 663         else
 664                 err = -ENOTCONN;
 665
 666         release_sock(sk);
 667         return err;
 668 }
 669
 670 static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
 671 {
 672         struct hci_dev *hdev = conn->hdev;
 673
 674         BT_DBG("conn %p", conn);
 675
 676         conn->state = BT_CONFIG;
 677
 678         if (!lmp_esco_capable(hdev)) {
 679                 struct hci_cp_accept_conn_req cp;
 680
 681                 bacpy(&cp.bdaddr, &conn->dst);
 682                 cp.role = 0x00; /* Ignored */
 683
 684                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
 685         } else {
 686                 struct hci_cp_accept_sync_conn_req cp;
 687
 688                 bacpy(&cp.bdaddr, &conn->dst);
 689                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
 690
 691                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 692                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 693                 cp.content_format = cpu_to_le16(setting);
 694
 695                 switch (setting & SCO_AIRMODE_MASK) {
 696                 case SCO_AIRMODE_TRANSP:
 697                         if (conn->pkt_type & ESCO_2EV3)
 698                                 cp.max_latency = cpu_to_le16(0x0008);
 699                         else
 700                                 cp.max_latency = cpu_to_le16(0x000D);
 701                         cp.retrans_effort = 0x02;
 702                         break;
 703                 case SCO_AIRMODE_CVSD:
 704                         cp.max_latency = cpu_to_le16(0xffff);
 705                         cp.retrans_effort = 0xff;
 706                         break;
 707                 }
 708
 709                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
 710                              sizeof(cp), &cp);
 711         }
 712 }
 713
 714 static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 715                             struct msghdr *msg, size_t len, int flags)
 716 {
 717         struct sock *sk = sock->sk;
 718         struct sco_pinfo *pi = sco_pi(sk);
 719
 720         lock_sock(sk);
 721
 722         if (sk->sk_state == BT_CONNECT2 &&
 723             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
 724                 sco_conn_defer_accept(pi->conn->hcon, pi->setting);
 725                 sk->sk_state = BT_CONFIG;
 726
 727                 release_sock(sk);
 728                 return 0;
 729         }
 730
 731         release_sock(sk);
 732
 733         return bt_sock_recvmsg(iocb, sock, msg, len, flags);
 734 }
 735
 736 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 737 {
 738         struct sock *sk = sock->sk;
 739         int len, err = 0;
 740         struct bt_voice voice;
 741         u32 opt;
 742
 743         BT_DBG("sk %p", sk);
 744
 745         lock_sock(sk);
 746
 747         switch (optname) {
 748
 749         case BT_DEFER_SETUP:
 750                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 751                         err = -EINVAL;
 752                         break;
 753                 }
 754
 755                 if (get_user(opt, (u32 __user *) optval)) {
 756                         err = -EFAULT;
 757                         break;
 758                 }
 759
 760                 if (opt)
 761                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 762                 else
 763                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 764                 break;
 765
 766         case BT_VOICE:
 767                 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
 768                     sk->sk_state != BT_CONNECT2) {
 769                         err = -EINVAL;
 770                         break;
 771                 }
 772
 773                 voice.setting = sco_pi(sk)->setting;
 774
 775                 len = min_t(unsigned int, sizeof(voice), optlen);
 776                 if (copy_from_user((char *) &voice, optval, len)) {
 777                         err = -EFAULT;
 778                         break;
 779                 }
 780
 781                 /* Explicitly check for these values */
 782                 if (voice.setting != BT_VOICE_TRANSPARENT &&
 783                     voice.setting != BT_VOICE_CVSD_16BIT) {
 784                         err = -EINVAL;
 785                         break;
 786                 }
 787
 788                 sco_pi(sk)->setting = voice.setting;
 789                 break;
 790
 791         default:
 792                 err = -ENOPROTOOPT;
 793                 break;
 794         }
 795
 796         release_sock(sk);
 797         return err;
 798 }
 799
 800 static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 801 {
 802         struct sock *sk = sock->sk;
 803         struct sco_options opts;
 804         struct sco_conninfo cinfo;
 805         int len, err = 0;
 806
 807         BT_DBG("sk %p", sk);
 808
 809         if (get_user(len, optlen))
 810                 return -EFAULT;
 811
 812         lock_sock(sk);
 813
 814         switch (optname) {
 815         case SCO_OPTIONS:
 816                 if (sk->sk_state != BT_CONNECTED &&
 817                     !(sk->sk_state == BT_CONNECT2 &&
 818                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 819                         err = -ENOTCONN;
 820                         break;
 821                 }
 822
 823                 opts.mtu = sco_pi(sk)->conn->mtu;
 824
 825                 BT_DBG("mtu %d", opts.mtu);
 826
 827                 len = min_t(unsigned int, len, sizeof(opts));
 828                 if (copy_to_user(optval, (char *)&opts, len))
 829                         err = -EFAULT;
 830
 831                 break;
 832
 833         case SCO_CONNINFO:
 834                 if (sk->sk_state != BT_CONNECTED &&
 835                     !(sk->sk_state == BT_CONNECT2 &&
 836                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 837                         err = -ENOTCONN;
 838                         break;
 839                 }
 840
 841                 memset(&cinfo, 0, sizeof(cinfo));
 842                 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
 843                 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
 844
 845                 len = min_t(unsigned int, len, sizeof(cinfo));
 846                 if (copy_to_user(optval, (char *)&cinfo, len))
 847                         err = -EFAULT;
 848
 849                 break;
 850
 851         default:
 852                 err = -ENOPROTOOPT;
 853                 break;
 854         }
 855
 856         release_sock(sk);
 857         return err;
 858 }
 859
 860 static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 861 {
 862         struct sock *sk = sock->sk;
 863         int len, err = 0;
 864         struct bt_voice voice;
 865
 866         BT_DBG("sk %p", sk);
 867
 868         if (level == SOL_SCO)
 869                 return sco_sock_getsockopt_old(sock, optname, optval, optlen);
 870
 871         if (get_user(len, optlen))
 872                 return -EFAULT;
 873
 874         lock_sock(sk);
 875
 876         switch (optname) {
 877
 878         case BT_DEFER_SETUP:
 879                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 880                         err = -EINVAL;
 881                         break;
 882                 }
 883
 884                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 885                              (u32 __user *) optval))
 886                         err = -EFAULT;
 887
 888                 break;
 889
 890         case BT_VOICE:
 891                 voice.setting = sco_pi(sk)->setting;
 892
 893                 len = min_t(unsigned int, len, sizeof(voice));
 894                 if (copy_to_user(optval, (char *)&voice, len))
 895                         err = -EFAULT;
 896
 897                 break;
 898
 899         default:
 900                 err = -ENOPROTOOPT;
 901                 break;
 902         }
 903
 904         release_sock(sk);
 905         return err;
 906 }
 907
 908 static int sco_sock_shutdown(struct socket *sock, int how)
 909 {
 910         struct sock *sk = sock->sk;
 911         int err = 0;
 912
 913         BT_DBG("sock %p, sk %p", sock, sk);
 914
 915         if (!sk)
 916                 return 0;
 917
 918         lock_sock(sk);
 919         if (!sk->sk_shutdown) {
 920                 sk->sk_shutdown = SHUTDOWN_MASK;
 921                 sco_sock_clear_timer(sk);
 922                 __sco_sock_close(sk);
 923
 924                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 925                         err = bt_sock_wait_state(sk, BT_CLOSED,
 926                                                  sk->sk_lingertime);
 927         }
 928         release_sock(sk);
 929         return err;
 930 }
 931
 932 static int sco_sock_release(struct socket *sock)
 933 {
 934         struct sock *sk = sock->sk;
 935         int err = 0;
 936
 937         BT_DBG("sock %p, sk %p", sock, sk);
 938
 939         if (!sk)
 940                 return 0;
 941
 942         sco_sock_close(sk);
 943
 944         if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) {
 945                 lock_sock(sk);
 946                 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 947                 release_sock(sk);
 948         }
 949
 950         sock_orphan(sk);
 951         sco_sock_kill(sk);
 952         return err;
 953 }
 954
 955 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
 956 {
 957         BT_DBG("conn %p", conn);
 958
 959         sco_pi(sk)->conn = conn;
 960         conn->sk = sk;
 961
 962         if (parent)
 963                 bt_accept_enqueue(parent, sk);
 964 }
 965
 966 /* Delete channel.
 967  * Must be called on the locked socket. */
 968 static void sco_chan_del(struct sock *sk, int err)
 969 {
 970         struct sco_conn *conn;
 971
 972         conn = sco_pi(sk)->conn;
 973
 974         BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
 975
 976         if (conn) {
 977                 sco_conn_lock(conn);
 978                 conn->sk = NULL;
 979                 sco_pi(sk)->conn = NULL;
 980                 sco_conn_unlock(conn);
 981
 982                 if (conn->hcon)
 983                         hci_conn_drop(conn->hcon);
 984         }
 985
 986         sk->sk_state = BT_CLOSED;
 987         sk->sk_err   = err;
 988         sk->sk_state_change(sk);
 989
 990         sock_set_flag(sk, SOCK_ZAPPED);
 991 }
 992
 993 static void sco_conn_ready(struct sco_conn *conn)
 994 {
 995         struct sock *parent;
 996         struct sock *sk = conn->sk;
 997
 998         BT_DBG("conn %p", conn);
 999
1000         if (sk) {
1001                 sco_sock_clear_timer(sk);
1002                 bh_lock_sock(sk);
1003                 sk->sk_state = BT_CONNECTED;
1004                 sk->sk_state_change(sk);
1005                 bh_unlock_sock(sk);
1006         } else {
1007                 sco_conn_lock(conn);
1008
1009                 parent = sco_get_sock_listen(&conn->hcon->src);
1010                 if (!parent) {
1011                         sco_conn_unlock(conn);
1012                         return;
1013                 }
1014
1015                 bh_lock_sock(parent);
1016
1017                 sk = sco_sock_alloc(sock_net(parent), NULL,
1018                                     BTPROTO_SCO, GFP_ATOMIC);
1019                 if (!sk) {
1020                         bh_unlock_sock(parent);
1021                         sco_conn_unlock(conn);
1022                         return;
1023                 }
1024
1025                 sco_sock_init(sk, parent);
1026
1027                 bacpy(&sco_pi(sk)->src, &conn->hcon->src);
1028                 bacpy(&sco_pi(sk)->dst, &conn->hcon->dst);
1029
1030                 hci_conn_hold(conn->hcon);
1031                 __sco_chan_add(conn, sk, parent);
1032
1033                 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
1034                         sk->sk_state = BT_CONNECT2;
1035                 else
1036                         sk->sk_state = BT_CONNECTED;
1037
1038                 /* Wake up parent */
1039                 parent->sk_data_ready(parent);
1040
1041                 bh_unlock_sock(parent);
1042
1043                 sco_conn_unlock(conn);
1044         }
1045 }
1046
1047 /* ----- SCO interface with lower layer (HCI) ----- */
1048 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
1049 {
1050         struct sock *sk;
1051         int lm = 0;
1052
1053         BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1054
1055         /* Find listening sockets */
1056         read_lock(&sco_sk_list.lock);
1057         sk_for_each(sk, &sco_sk_list.head) {
1058                 if (sk->sk_state != BT_LISTEN)
1059                         continue;
1060
1061                 if (!bacmp(&sco_pi(sk)->src, &hdev->bdaddr) ||
1062                     !bacmp(&sco_pi(sk)->src, BDADDR_ANY)) {
1063                         lm |= HCI_LM_ACCEPT;
1064
1065                         if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
1066                                 *flags |= HCI_PROTO_DEFER;
1067                         break;
1068                 }
1069         }
1070         read_unlock(&sco_sk_list.lock);
1071
1072         return lm;
1073 }
1074
1075 void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
1076 {
1077         BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
1078         if (!status) {
1079                 struct sco_conn *conn;
1080
1081                 conn = sco_conn_add(hcon);
1082                 if (conn)
1083                         sco_conn_ready(conn);
1084         } else
1085                 sco_conn_del(hcon, bt_to_errno(status));
1086 }
1087
1088 void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
1089 {
1090         BT_DBG("hcon %p reason %d", hcon, reason);
1091
1092         sco_conn_del(hcon, bt_to_errno(reason));
1093 }
1094
1095 int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
1096 {
1097         struct sco_conn *conn = hcon->sco_data;
1098
1099         if (!conn)
1100                 goto drop;
1101
1102         BT_DBG("conn %p len %d", conn, skb->len);
1103
1104         if (skb->len) {
1105                 sco_recv_frame(conn, skb);
1106                 return 0;
1107         }
1108
1109 drop:
1110         kfree_skb(skb);
1111         return 0;
1112 }
1113
1114 static int sco_debugfs_show(struct seq_file *f, void *p)
1115 {
1116         struct sock *sk;
1117
1118         read_lock(&sco_sk_list.lock);
1119
1120         sk_for_each(sk, &sco_sk_list.head) {
1121                 seq_printf(f, "%pMR %pMR %d\n", &sco_pi(sk)->src,
1122                            &sco_pi(sk)->dst, sk->sk_state);
1123         }
1124
1125         read_unlock(&sco_sk_list.lock);
1126
1127         return 0;
1128 }
1129
1130 static int sco_debugfs_open(struct inode *inode, struct file *file)
1131 {
1132         return single_open(file, sco_debugfs_show, inode->i_private);
1133 }
1134
1135 static const struct file_operations sco_debugfs_fops = {
1136         .open           = sco_debugfs_open,
1137         .read           = seq_read,
1138         .llseek         = seq_lseek,
1139         .release        = single_release,
1140 };
1141
1142 static struct dentry *sco_debugfs;
1143
1144 static const struct proto_ops sco_sock_ops = {
1145         .family         = PF_BLUETOOTH,
1146         .owner          = THIS_MODULE,
1147         .release        = sco_sock_release,
1148         .bind           = sco_sock_bind,
1149         .connect        = sco_sock_connect,
1150         .listen         = sco_sock_listen,
1151         .accept         = sco_sock_accept,
1152         .getname        = sco_sock_getname,
1153         .sendmsg        = sco_sock_sendmsg,
1154         .recvmsg        = sco_sock_recvmsg,
1155         .poll           = bt_sock_poll,
1156         .ioctl          = bt_sock_ioctl,
1157         .mmap           = sock_no_mmap,
1158         .socketpair     = sock_no_socketpair,
1159         .shutdown       = sco_sock_shutdown,
1160         .setsockopt     = sco_sock_setsockopt,
1161         .getsockopt     = sco_sock_getsockopt
1162 };
1163
1164 static const struct net_proto_family sco_sock_family_ops = {
1165         .family = PF_BLUETOOTH,
1166         .owner  = THIS_MODULE,
1167         .create = sco_sock_create,
1168 };
1169
1170 int __init sco_init(void)
1171 {
1172         int err;
1173
1174         err = proto_register(&sco_proto, 0);
1175         if (err < 0)
1176                 return err;
1177
1178         err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
1179         if (err < 0) {
1180                 BT_ERR("SCO socket registration failed");
1181                 goto error;
1182         }
1183
1184         err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL);
1185         if (err < 0) {
1186                 BT_ERR("Failed to create SCO proc file");
1187                 bt_sock_unregister(BTPROTO_SCO);
1188                 goto error;
1189         }
1190
1191         BT_INFO("SCO socket layer initialized");
1192
1193         if (IS_ERR_OR_NULL(bt_debugfs))
1194                 return 0;
1195
1196         sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs,
1197                                           NULL, &sco_debugfs_fops);
1198
1199         return 0;
1200
1201 error:
1202         proto_unregister(&sco_proto);
1203         return err;
1204 }
1205
1206 void __exit sco_exit(void)
1207 {
1208         bt_procfs_cleanup(&init_net, "sco");
1209
1210         debugfs_remove(sco_debugfs);
1211
1212         bt_sock_unregister(BTPROTO_SCO);
1213
1214         proto_unregister(&sco_proto);
1215 }
1216
1217 module_param(disable_esco, bool, 0644);
1218 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");