1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth SCO sockets. */ 26 27 #include <linux/module.h> 28 #include <linux/debugfs.h> 29 #include <linux/seq_file.h> 30 #include <linux/sched/signal.h> 31 32 #include <net/bluetooth/bluetooth.h> 33 #include <net/bluetooth/hci_core.h> 34 #include <net/bluetooth/sco.h> 35 36 static bool disable_esco; 37 38 static const struct proto_ops sco_sock_ops; 39 40 static struct bt_sock_list sco_sk_list = { 41 .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock) 42 }; 43 44 /* ---- SCO connections ---- */ 45 struct sco_conn { 46 struct hci_conn *hcon; 47 48 spinlock_t lock; 49 struct sock *sk; 50 51 struct delayed_work timeout_work; 52 53 unsigned int mtu; 54 }; 55 56 #define sco_conn_lock(c) spin_lock(&c->lock) 57 #define sco_conn_unlock(c) spin_unlock(&c->lock) 58 59 static void sco_sock_close(struct sock *sk); 60 static void sco_sock_kill(struct sock *sk); 61 62 /* ----- SCO socket info ----- */ 63 #define sco_pi(sk) ((struct sco_pinfo *) sk) 64 65 struct sco_pinfo { 66 struct bt_sock bt; 67 bdaddr_t src; 68 bdaddr_t dst; 69 __u32 flags; 70 __u16 setting; 71 struct bt_codec codec; 72 struct sco_conn *conn; 73 }; 74 75 /* ---- SCO timers ---- */ 76 #define SCO_CONN_TIMEOUT (HZ * 40) 77 #define SCO_DISCONN_TIMEOUT (HZ * 2) 78 79 static void sco_sock_timeout(struct work_struct *work) 80 { 81 struct sco_conn *conn = container_of(work, struct sco_conn, 82 timeout_work.work); 83 struct sock *sk; 84 85 sco_conn_lock(conn); 86 sk = conn->sk; 87 if (sk) 88 sock_hold(sk); 89 sco_conn_unlock(conn); 90 91 if (!sk) 92 return; 93 94 BT_DBG("sock %p state %d", sk, sk->sk_state); 95 96 lock_sock(sk); 97 sk->sk_err = ETIMEDOUT; 98 sk->sk_state_change(sk); 99 release_sock(sk); 100 sock_put(sk); 101 } 102 103 static void sco_sock_set_timer(struct sock *sk, long timeout) 104 { 105 if (!sco_pi(sk)->conn) 106 return; 107 108 BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout); 109 cancel_delayed_work(&sco_pi(sk)->conn->timeout_work); 110 schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout); 111 } 112 113 static void sco_sock_clear_timer(struct sock *sk) 114 { 115 if (!sco_pi(sk)->conn) 116 return; 117 118 BT_DBG("sock %p state %d", sk, sk->sk_state); 119 cancel_delayed_work(&sco_pi(sk)->conn->timeout_work); 120 } 121 122 /* ---- SCO connections ---- */ 123 static struct sco_conn *sco_conn_add(struct hci_conn *hcon) 124 { 125 struct hci_dev *hdev = hcon->hdev; 126 struct sco_conn *conn = hcon->sco_data; 127 128 if (conn) { 129 if (!conn->hcon) 130 conn->hcon = hcon; 131 return conn; 132 } 133 134 conn = kzalloc(sizeof(struct sco_conn), GFP_KERNEL); 135 if (!conn) 136 return NULL; 137 138 spin_lock_init(&conn->lock); 139 INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout); 140 141 hcon->sco_data = conn; 142 conn->hcon = hcon; 143 144 if (hdev->sco_mtu > 0) 145 conn->mtu = hdev->sco_mtu; 146 else 147 conn->mtu = 60; 148 149 BT_DBG("hcon %p conn %p", hcon, conn); 150 151 return conn; 152 } 153 154 /* Delete channel. 155 * Must be called on the locked socket. */ 156 static void sco_chan_del(struct sock *sk, int err) 157 { 158 struct sco_conn *conn; 159 160 conn = sco_pi(sk)->conn; 161 162 BT_DBG("sk %p, conn %p, err %d", sk, conn, err); 163 164 if (conn) { 165 sco_conn_lock(conn); 166 conn->sk = NULL; 167 sco_pi(sk)->conn = NULL; 168 sco_conn_unlock(conn); 169 170 if (conn->hcon) 171 hci_conn_drop(conn->hcon); 172 } 173 174 sk->sk_state = BT_CLOSED; 175 sk->sk_err = err; 176 sk->sk_state_change(sk); 177 178 sock_set_flag(sk, SOCK_ZAPPED); 179 } 180 181 static void sco_conn_del(struct hci_conn *hcon, int err) 182 { 183 struct sco_conn *conn = hcon->sco_data; 184 struct sock *sk; 185 186 if (!conn) 187 return; 188 189 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); 190 191 /* Kill socket */ 192 sco_conn_lock(conn); 193 sk = conn->sk; 194 if (sk) 195 sock_hold(sk); 196 sco_conn_unlock(conn); 197 198 if (sk) { 199 lock_sock(sk); 200 sco_sock_clear_timer(sk); 201 sco_chan_del(sk, err); 202 release_sock(sk); 203 sock_put(sk); 204 } 205 206 /* Ensure no more work items will run before freeing conn. */ 207 cancel_delayed_work_sync(&conn->timeout_work); 208 209 hcon->sco_data = NULL; 210 kfree(conn); 211 } 212 213 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, 214 struct sock *parent) 215 { 216 BT_DBG("conn %p", conn); 217 218 sco_pi(sk)->conn = conn; 219 conn->sk = sk; 220 221 if (parent) 222 bt_accept_enqueue(parent, sk, true); 223 } 224 225 static int sco_chan_add(struct sco_conn *conn, struct sock *sk, 226 struct sock *parent) 227 { 228 int err = 0; 229 230 sco_conn_lock(conn); 231 if (conn->sk) 232 err = -EBUSY; 233 else 234 __sco_chan_add(conn, sk, parent); 235 236 sco_conn_unlock(conn); 237 return err; 238 } 239 240 static int sco_connect(struct sock *sk) 241 { 242 struct sco_conn *conn; 243 struct hci_conn *hcon; 244 struct hci_dev *hdev; 245 int err, type; 246 247 BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst); 248 249 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR); 250 if (!hdev) 251 return -EHOSTUNREACH; 252 253 hci_dev_lock(hdev); 254 255 if (lmp_esco_capable(hdev) && !disable_esco) 256 type = ESCO_LINK; 257 else 258 type = SCO_LINK; 259 260 if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT && 261 (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) { 262 err = -EOPNOTSUPP; 263 goto unlock; 264 } 265 266 hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst, 267 sco_pi(sk)->setting, &sco_pi(sk)->codec); 268 if (IS_ERR(hcon)) { 269 err = PTR_ERR(hcon); 270 goto unlock; 271 } 272 273 conn = sco_conn_add(hcon); 274 if (!conn) { 275 hci_conn_drop(hcon); 276 err = -ENOMEM; 277 goto unlock; 278 } 279 280 lock_sock(sk); 281 282 err = sco_chan_add(conn, sk, NULL); 283 if (err) { 284 release_sock(sk); 285 goto unlock; 286 } 287 288 /* Update source addr of the socket */ 289 bacpy(&sco_pi(sk)->src, &hcon->src); 290 291 if (hcon->state == BT_CONNECTED) { 292 sco_sock_clear_timer(sk); 293 sk->sk_state = BT_CONNECTED; 294 } else { 295 sk->sk_state = BT_CONNECT; 296 sco_sock_set_timer(sk, sk->sk_sndtimeo); 297 } 298 299 release_sock(sk); 300 301 unlock: 302 hci_dev_unlock(hdev); 303 hci_dev_put(hdev); 304 return err; 305 } 306 307 static int sco_send_frame(struct sock *sk, struct sk_buff *skb) 308 { 309 struct sco_conn *conn = sco_pi(sk)->conn; 310 int len = skb->len; 311 312 /* Check outgoing MTU */ 313 if (len > conn->mtu) 314 return -EINVAL; 315 316 BT_DBG("sk %p len %d", sk, len); 317 318 hci_send_sco(conn->hcon, skb); 319 320 return len; 321 } 322 323 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb) 324 { 325 struct sock *sk; 326 327 sco_conn_lock(conn); 328 sk = conn->sk; 329 sco_conn_unlock(conn); 330 331 if (!sk) 332 goto drop; 333 334 BT_DBG("sk %p len %u", sk, skb->len); 335 336 if (sk->sk_state != BT_CONNECTED) 337 goto drop; 338 339 if (!sock_queue_rcv_skb(sk, skb)) 340 return; 341 342 drop: 343 kfree_skb(skb); 344 } 345 346 /* -------- Socket interface ---------- */ 347 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba) 348 { 349 struct sock *sk; 350 351 sk_for_each(sk, &sco_sk_list.head) { 352 if (sk->sk_state != BT_LISTEN) 353 continue; 354 355 if (!bacmp(&sco_pi(sk)->src, ba)) 356 return sk; 357 } 358 359 return NULL; 360 } 361 362 /* Find socket listening on source bdaddr. 363 * Returns closest match. 364 */ 365 static struct sock *sco_get_sock_listen(bdaddr_t *src) 366 { 367 struct sock *sk = NULL, *sk1 = NULL; 368 369 read_lock(&sco_sk_list.lock); 370 371 sk_for_each(sk, &sco_sk_list.head) { 372 if (sk->sk_state != BT_LISTEN) 373 continue; 374 375 /* Exact match. */ 376 if (!bacmp(&sco_pi(sk)->src, src)) 377 break; 378 379 /* Closest match */ 380 if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY)) 381 sk1 = sk; 382 } 383 384 read_unlock(&sco_sk_list.lock); 385 386 return sk ? sk : sk1; 387 } 388 389 static void sco_sock_destruct(struct sock *sk) 390 { 391 BT_DBG("sk %p", sk); 392 393 skb_queue_purge(&sk->sk_receive_queue); 394 skb_queue_purge(&sk->sk_write_queue); 395 } 396 397 static void sco_sock_cleanup_listen(struct sock *parent) 398 { 399 struct sock *sk; 400 401 BT_DBG("parent %p", parent); 402 403 /* Close not yet accepted channels */ 404 while ((sk = bt_accept_dequeue(parent, NULL))) { 405 sco_sock_close(sk); 406 sco_sock_kill(sk); 407 } 408 409 parent->sk_state = BT_CLOSED; 410 sock_set_flag(parent, SOCK_ZAPPED); 411 } 412 413 /* Kill socket (only if zapped and orphan) 414 * Must be called on unlocked socket. 415 */ 416 static void sco_sock_kill(struct sock *sk) 417 { 418 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) 419 return; 420 421 BT_DBG("sk %p state %d", sk, sk->sk_state); 422 423 /* Kill poor orphan */ 424 bt_sock_unlink(&sco_sk_list, sk); 425 sock_set_flag(sk, SOCK_DEAD); 426 sock_put(sk); 427 } 428 429 static void __sco_sock_close(struct sock *sk) 430 { 431 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket); 432 433 switch (sk->sk_state) { 434 case BT_LISTEN: 435 sco_sock_cleanup_listen(sk); 436 break; 437 438 case BT_CONNECTED: 439 case BT_CONFIG: 440 if (sco_pi(sk)->conn->hcon) { 441 sk->sk_state = BT_DISCONN; 442 sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT); 443 sco_conn_lock(sco_pi(sk)->conn); 444 hci_conn_drop(sco_pi(sk)->conn->hcon); 445 sco_pi(sk)->conn->hcon = NULL; 446 sco_conn_unlock(sco_pi(sk)->conn); 447 } else 448 sco_chan_del(sk, ECONNRESET); 449 break; 450 451 case BT_CONNECT2: 452 case BT_CONNECT: 453 case BT_DISCONN: 454 sco_chan_del(sk, ECONNRESET); 455 break; 456 457 default: 458 sock_set_flag(sk, SOCK_ZAPPED); 459 break; 460 } 461 462 } 463 464 /* Must be called on unlocked socket. */ 465 static void sco_sock_close(struct sock *sk) 466 { 467 lock_sock(sk); 468 sco_sock_clear_timer(sk); 469 __sco_sock_close(sk); 470 release_sock(sk); 471 } 472 473 static void sco_sock_init(struct sock *sk, struct sock *parent) 474 { 475 BT_DBG("sk %p", sk); 476 477 if (parent) { 478 sk->sk_type = parent->sk_type; 479 bt_sk(sk)->flags = bt_sk(parent)->flags; 480 security_sk_clone(parent, sk); 481 } 482 } 483 484 static struct proto sco_proto = { 485 .name = "SCO", 486 .owner = THIS_MODULE, 487 .obj_size = sizeof(struct sco_pinfo) 488 }; 489 490 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, 491 int proto, gfp_t prio, int kern) 492 { 493 struct sock *sk; 494 495 sk = bt_sock_alloc(net, sock, &sco_proto, proto, prio, kern); 496 if (!sk) 497 return NULL; 498 499 sk->sk_destruct = sco_sock_destruct; 500 sk->sk_sndtimeo = SCO_CONN_TIMEOUT; 501 502 sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT; 503 sco_pi(sk)->codec.id = BT_CODEC_CVSD; 504 sco_pi(sk)->codec.cid = 0xffff; 505 sco_pi(sk)->codec.vid = 0xffff; 506 sco_pi(sk)->codec.data_path = 0x00; 507 508 bt_sock_link(&sco_sk_list, sk); 509 return sk; 510 } 511 512 static int sco_sock_create(struct net *net, struct socket *sock, int protocol, 513 int kern) 514 { 515 struct sock *sk; 516 517 BT_DBG("sock %p", sock); 518 519 sock->state = SS_UNCONNECTED; 520 521 if (sock->type != SOCK_SEQPACKET) 522 return -ESOCKTNOSUPPORT; 523 524 sock->ops = &sco_sock_ops; 525 526 sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern); 527 if (!sk) 528 return -ENOMEM; 529 530 sco_sock_init(sk, NULL); 531 return 0; 532 } 533 534 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, 535 int addr_len) 536 { 537 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 538 struct sock *sk = sock->sk; 539 int err = 0; 540 541 if (!addr || addr_len < sizeof(struct sockaddr_sco) || 542 addr->sa_family != AF_BLUETOOTH) 543 return -EINVAL; 544 545 BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr); 546 547 lock_sock(sk); 548 549 if (sk->sk_state != BT_OPEN) { 550 err = -EBADFD; 551 goto done; 552 } 553 554 if (sk->sk_type != SOCK_SEQPACKET) { 555 err = -EINVAL; 556 goto done; 557 } 558 559 bacpy(&sco_pi(sk)->src, &sa->sco_bdaddr); 560 561 sk->sk_state = BT_BOUND; 562 563 done: 564 release_sock(sk); 565 return err; 566 } 567 568 static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags) 569 { 570 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 571 struct sock *sk = sock->sk; 572 int err; 573 574 BT_DBG("sk %p", sk); 575 576 if (alen < sizeof(struct sockaddr_sco) || 577 addr->sa_family != AF_BLUETOOTH) 578 return -EINVAL; 579 580 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) 581 return -EBADFD; 582 583 if (sk->sk_type != SOCK_SEQPACKET) 584 err = -EINVAL; 585 586 lock_sock(sk); 587 /* Set destination address and psm */ 588 bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr); 589 release_sock(sk); 590 591 err = sco_connect(sk); 592 if (err) 593 return err; 594 595 lock_sock(sk); 596 597 err = bt_sock_wait_state(sk, BT_CONNECTED, 598 sock_sndtimeo(sk, flags & O_NONBLOCK)); 599 600 release_sock(sk); 601 return err; 602 } 603 604 static int sco_sock_listen(struct socket *sock, int backlog) 605 { 606 struct sock *sk = sock->sk; 607 bdaddr_t *src = &sco_pi(sk)->src; 608 int err = 0; 609 610 BT_DBG("sk %p backlog %d", sk, backlog); 611 612 lock_sock(sk); 613 614 if (sk->sk_state != BT_BOUND) { 615 err = -EBADFD; 616 goto done; 617 } 618 619 if (sk->sk_type != SOCK_SEQPACKET) { 620 err = -EINVAL; 621 goto done; 622 } 623 624 write_lock(&sco_sk_list.lock); 625 626 if (__sco_get_sock_listen_by_addr(src)) { 627 err = -EADDRINUSE; 628 goto unlock; 629 } 630 631 sk->sk_max_ack_backlog = backlog; 632 sk->sk_ack_backlog = 0; 633 634 sk->sk_state = BT_LISTEN; 635 636 unlock: 637 write_unlock(&sco_sk_list.lock); 638 639 done: 640 release_sock(sk); 641 return err; 642 } 643 644 static int sco_sock_accept(struct socket *sock, struct socket *newsock, 645 int flags, bool kern) 646 { 647 DEFINE_WAIT_FUNC(wait, woken_wake_function); 648 struct sock *sk = sock->sk, *ch; 649 long timeo; 650 int err = 0; 651 652 lock_sock(sk); 653 654 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK); 655 656 BT_DBG("sk %p timeo %ld", sk, timeo); 657 658 /* Wait for an incoming connection. (wake-one). */ 659 add_wait_queue_exclusive(sk_sleep(sk), &wait); 660 while (1) { 661 if (sk->sk_state != BT_LISTEN) { 662 err = -EBADFD; 663 break; 664 } 665 666 ch = bt_accept_dequeue(sk, newsock); 667 if (ch) 668 break; 669 670 if (!timeo) { 671 err = -EAGAIN; 672 break; 673 } 674 675 if (signal_pending(current)) { 676 err = sock_intr_errno(timeo); 677 break; 678 } 679 680 release_sock(sk); 681 682 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); 683 lock_sock(sk); 684 } 685 remove_wait_queue(sk_sleep(sk), &wait); 686 687 if (err) 688 goto done; 689 690 newsock->state = SS_CONNECTED; 691 692 BT_DBG("new socket %p", ch); 693 694 done: 695 release_sock(sk); 696 return err; 697 } 698 699 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, 700 int peer) 701 { 702 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; 703 struct sock *sk = sock->sk; 704 705 BT_DBG("sock %p, sk %p", sock, sk); 706 707 addr->sa_family = AF_BLUETOOTH; 708 709 if (peer) 710 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->dst); 711 else 712 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->src); 713 714 return sizeof(struct sockaddr_sco); 715 } 716 717 static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg, 718 size_t len) 719 { 720 struct sock *sk = sock->sk; 721 struct sk_buff *skb; 722 int err; 723 724 BT_DBG("sock %p, sk %p", sock, sk); 725 726 err = sock_error(sk); 727 if (err) 728 return err; 729 730 if (msg->msg_flags & MSG_OOB) 731 return -EOPNOTSUPP; 732 733 skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0); 734 if (IS_ERR(skb)) 735 return PTR_ERR(skb); 736 737 lock_sock(sk); 738 739 if (sk->sk_state == BT_CONNECTED) 740 err = sco_send_frame(sk, skb); 741 else 742 err = -ENOTCONN; 743 744 release_sock(sk); 745 746 if (err < 0) 747 kfree_skb(skb); 748 return err; 749 } 750 751 static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting) 752 { 753 struct hci_dev *hdev = conn->hdev; 754 755 BT_DBG("conn %p", conn); 756 757 conn->state = BT_CONFIG; 758 759 if (!lmp_esco_capable(hdev)) { 760 struct hci_cp_accept_conn_req cp; 761 762 bacpy(&cp.bdaddr, &conn->dst); 763 cp.role = 0x00; /* Ignored */ 764 765 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp); 766 } else { 767 struct hci_cp_accept_sync_conn_req cp; 768 769 bacpy(&cp.bdaddr, &conn->dst); 770 cp.pkt_type = cpu_to_le16(conn->pkt_type); 771 772 cp.tx_bandwidth = cpu_to_le32(0x00001f40); 773 cp.rx_bandwidth = cpu_to_le32(0x00001f40); 774 cp.content_format = cpu_to_le16(setting); 775 776 switch (setting & SCO_AIRMODE_MASK) { 777 case SCO_AIRMODE_TRANSP: 778 if (conn->pkt_type & ESCO_2EV3) 779 cp.max_latency = cpu_to_le16(0x0008); 780 else 781 cp.max_latency = cpu_to_le16(0x000D); 782 cp.retrans_effort = 0x02; 783 break; 784 case SCO_AIRMODE_CVSD: 785 cp.max_latency = cpu_to_le16(0xffff); 786 cp.retrans_effort = 0xff; 787 break; 788 default: 789 /* use CVSD settings as fallback */ 790 cp.max_latency = cpu_to_le16(0xffff); 791 cp.retrans_effort = 0xff; 792 break; 793 } 794 795 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, 796 sizeof(cp), &cp); 797 } 798 } 799 800 static int sco_sock_recvmsg(struct socket *sock, struct msghdr *msg, 801 size_t len, int flags) 802 { 803 struct sock *sk = sock->sk; 804 struct sco_pinfo *pi = sco_pi(sk); 805 806 lock_sock(sk); 807 808 if (sk->sk_state == BT_CONNECT2 && 809 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) { 810 sco_conn_defer_accept(pi->conn->hcon, pi->setting); 811 sk->sk_state = BT_CONFIG; 812 813 release_sock(sk); 814 return 0; 815 } 816 817 release_sock(sk); 818 819 return bt_sock_recvmsg(sock, msg, len, flags); 820 } 821 822 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, 823 sockptr_t optval, unsigned int optlen) 824 { 825 struct sock *sk = sock->sk; 826 int err = 0; 827 struct bt_voice voice; 828 u32 opt; 829 struct bt_codecs *codecs; 830 struct hci_dev *hdev; 831 __u8 buffer[255]; 832 833 BT_DBG("sk %p", sk); 834 835 lock_sock(sk); 836 837 switch (optname) { 838 839 case BT_DEFER_SETUP: 840 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 841 err = -EINVAL; 842 break; 843 } 844 845 err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); 846 if (err) 847 break; 848 849 if (opt) 850 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 851 else 852 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); 853 break; 854 855 case BT_VOICE: 856 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND && 857 sk->sk_state != BT_CONNECT2) { 858 err = -EINVAL; 859 break; 860 } 861 862 voice.setting = sco_pi(sk)->setting; 863 864 err = bt_copy_from_sockptr(&voice, sizeof(voice), optval, 865 optlen); 866 if (err) 867 break; 868 869 /* Explicitly check for these values */ 870 if (voice.setting != BT_VOICE_TRANSPARENT && 871 voice.setting != BT_VOICE_CVSD_16BIT) { 872 err = -EINVAL; 873 break; 874 } 875 876 sco_pi(sk)->setting = voice.setting; 877 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, 878 BDADDR_BREDR); 879 if (!hdev) { 880 err = -EBADFD; 881 break; 882 } 883 if (enhanced_sync_conn_capable(hdev) && 884 voice.setting == BT_VOICE_TRANSPARENT) 885 sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT; 886 hci_dev_put(hdev); 887 break; 888 889 case BT_PKT_STATUS: 890 err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); 891 if (err) 892 break; 893 894 if (opt) 895 set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags); 896 else 897 clear_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags); 898 break; 899 900 case BT_CODEC: 901 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND && 902 sk->sk_state != BT_CONNECT2) { 903 err = -EINVAL; 904 break; 905 } 906 907 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, 908 BDADDR_BREDR); 909 if (!hdev) { 910 err = -EBADFD; 911 break; 912 } 913 914 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) { 915 hci_dev_put(hdev); 916 err = -EOPNOTSUPP; 917 break; 918 } 919 920 if (!hdev->get_data_path_id) { 921 hci_dev_put(hdev); 922 err = -EOPNOTSUPP; 923 break; 924 } 925 926 if (optlen < sizeof(struct bt_codecs) || 927 optlen > sizeof(buffer)) { 928 hci_dev_put(hdev); 929 err = -EINVAL; 930 break; 931 } 932 933 err = bt_copy_from_sockptr(buffer, optlen, optval, optlen); 934 if (err) { 935 hci_dev_put(hdev); 936 break; 937 } 938 939 codecs = (void *)buffer; 940 941 if (codecs->num_codecs > 1) { 942 hci_dev_put(hdev); 943 err = -EINVAL; 944 break; 945 } 946 947 sco_pi(sk)->codec = codecs->codecs[0]; 948 hci_dev_put(hdev); 949 break; 950 951 default: 952 err = -ENOPROTOOPT; 953 break; 954 } 955 956 release_sock(sk); 957 return err; 958 } 959 960 static int sco_sock_getsockopt_old(struct socket *sock, int optname, 961 char __user *optval, int __user *optlen) 962 { 963 struct sock *sk = sock->sk; 964 struct sco_options opts; 965 struct sco_conninfo cinfo; 966 int len, err = 0; 967 968 BT_DBG("sk %p", sk); 969 970 if (get_user(len, optlen)) 971 return -EFAULT; 972 973 lock_sock(sk); 974 975 switch (optname) { 976 case SCO_OPTIONS: 977 if (sk->sk_state != BT_CONNECTED && 978 !(sk->sk_state == BT_CONNECT2 && 979 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 980 err = -ENOTCONN; 981 break; 982 } 983 984 opts.mtu = sco_pi(sk)->conn->mtu; 985 986 BT_DBG("mtu %u", opts.mtu); 987 988 len = min_t(unsigned int, len, sizeof(opts)); 989 if (copy_to_user(optval, (char *)&opts, len)) 990 err = -EFAULT; 991 992 break; 993 994 case SCO_CONNINFO: 995 if (sk->sk_state != BT_CONNECTED && 996 !(sk->sk_state == BT_CONNECT2 && 997 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) { 998 err = -ENOTCONN; 999 break; 1000 } 1001 1002 memset(&cinfo, 0, sizeof(cinfo)); 1003 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle; 1004 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3); 1005 1006 len = min_t(unsigned int, len, sizeof(cinfo)); 1007 if (copy_to_user(optval, (char *)&cinfo, len)) 1008 err = -EFAULT; 1009 1010 break; 1011 1012 default: 1013 err = -ENOPROTOOPT; 1014 break; 1015 } 1016 1017 release_sock(sk); 1018 return err; 1019 } 1020 1021 static int sco_sock_getsockopt(struct socket *sock, int level, int optname, 1022 char __user *optval, int __user *optlen) 1023 { 1024 struct sock *sk = sock->sk; 1025 int len, err = 0; 1026 struct bt_voice voice; 1027 u32 phys; 1028 int buf_len; 1029 struct codec_list *c; 1030 u8 num_codecs, i, __user *ptr; 1031 struct hci_dev *hdev; 1032 struct hci_codec_caps *caps; 1033 struct bt_codec codec; 1034 1035 BT_DBG("sk %p", sk); 1036 1037 if (level == SOL_SCO) 1038 return sco_sock_getsockopt_old(sock, optname, optval, optlen); 1039 1040 if (get_user(len, optlen)) 1041 return -EFAULT; 1042 1043 lock_sock(sk); 1044 1045 switch (optname) { 1046 1047 case BT_DEFER_SETUP: 1048 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) { 1049 err = -EINVAL; 1050 break; 1051 } 1052 1053 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags), 1054 (u32 __user *)optval)) 1055 err = -EFAULT; 1056 1057 break; 1058 1059 case BT_VOICE: 1060 voice.setting = sco_pi(sk)->setting; 1061 1062 len = min_t(unsigned int, len, sizeof(voice)); 1063 if (copy_to_user(optval, (char *)&voice, len)) 1064 err = -EFAULT; 1065 1066 break; 1067 1068 case BT_PHY: 1069 if (sk->sk_state != BT_CONNECTED) { 1070 err = -ENOTCONN; 1071 break; 1072 } 1073 1074 phys = hci_conn_get_phy(sco_pi(sk)->conn->hcon); 1075 1076 if (put_user(phys, (u32 __user *) optval)) 1077 err = -EFAULT; 1078 break; 1079 1080 case BT_PKT_STATUS: 1081 if (put_user(test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags), 1082 (int __user *)optval)) 1083 err = -EFAULT; 1084 break; 1085 1086 case BT_SNDMTU: 1087 case BT_RCVMTU: 1088 if (sk->sk_state != BT_CONNECTED) { 1089 err = -ENOTCONN; 1090 break; 1091 } 1092 1093 if (put_user(sco_pi(sk)->conn->mtu, (u32 __user *)optval)) 1094 err = -EFAULT; 1095 break; 1096 1097 case BT_CODEC: 1098 num_codecs = 0; 1099 buf_len = 0; 1100 1101 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR); 1102 if (!hdev) { 1103 err = -EBADFD; 1104 break; 1105 } 1106 1107 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) { 1108 hci_dev_put(hdev); 1109 err = -EOPNOTSUPP; 1110 break; 1111 } 1112 1113 if (!hdev->get_data_path_id) { 1114 hci_dev_put(hdev); 1115 err = -EOPNOTSUPP; 1116 break; 1117 } 1118 1119 release_sock(sk); 1120 1121 /* find total buffer size required to copy codec + caps */ 1122 hci_dev_lock(hdev); 1123 list_for_each_entry(c, &hdev->local_codecs, list) { 1124 if (c->transport != HCI_TRANSPORT_SCO_ESCO) 1125 continue; 1126 num_codecs++; 1127 for (i = 0, caps = c->caps; i < c->num_caps; i++) { 1128 buf_len += 1 + caps->len; 1129 caps = (void *)&caps->data[caps->len]; 1130 } 1131 buf_len += sizeof(struct bt_codec); 1132 } 1133 hci_dev_unlock(hdev); 1134 1135 buf_len += sizeof(struct bt_codecs); 1136 if (buf_len > len) { 1137 hci_dev_put(hdev); 1138 return -ENOBUFS; 1139 } 1140 ptr = optval; 1141 1142 if (put_user(num_codecs, ptr)) { 1143 hci_dev_put(hdev); 1144 return -EFAULT; 1145 } 1146 ptr += sizeof(num_codecs); 1147 1148 /* Iterate all the codecs supported over SCO and populate 1149 * codec data 1150 */ 1151 hci_dev_lock(hdev); 1152 list_for_each_entry(c, &hdev->local_codecs, list) { 1153 if (c->transport != HCI_TRANSPORT_SCO_ESCO) 1154 continue; 1155 1156 codec.id = c->id; 1157 codec.cid = c->cid; 1158 codec.vid = c->vid; 1159 err = hdev->get_data_path_id(hdev, &codec.data_path); 1160 if (err < 0) 1161 break; 1162 codec.num_caps = c->num_caps; 1163 if (copy_to_user(ptr, &codec, sizeof(codec))) { 1164 err = -EFAULT; 1165 break; 1166 } 1167 ptr += sizeof(codec); 1168 1169 /* find codec capabilities data length */ 1170 len = 0; 1171 for (i = 0, caps = c->caps; i < c->num_caps; i++) { 1172 len += 1 + caps->len; 1173 caps = (void *)&caps->data[caps->len]; 1174 } 1175 1176 /* copy codec capabilities data */ 1177 if (len && copy_to_user(ptr, c->caps, len)) { 1178 err = -EFAULT; 1179 break; 1180 } 1181 ptr += len; 1182 } 1183 1184 hci_dev_unlock(hdev); 1185 hci_dev_put(hdev); 1186 1187 lock_sock(sk); 1188 1189 if (!err && put_user(buf_len, optlen)) 1190 err = -EFAULT; 1191 1192 break; 1193 1194 default: 1195 err = -ENOPROTOOPT; 1196 break; 1197 } 1198 1199 release_sock(sk); 1200 return err; 1201 } 1202 1203 static int sco_sock_shutdown(struct socket *sock, int how) 1204 { 1205 struct sock *sk = sock->sk; 1206 int err = 0; 1207 1208 BT_DBG("sock %p, sk %p", sock, sk); 1209 1210 if (!sk) 1211 return 0; 1212 1213 sock_hold(sk); 1214 lock_sock(sk); 1215 1216 if (!sk->sk_shutdown) { 1217 sk->sk_shutdown = SHUTDOWN_MASK; 1218 sco_sock_clear_timer(sk); 1219 __sco_sock_close(sk); 1220 1221 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime && 1222 !(current->flags & PF_EXITING)) 1223 err = bt_sock_wait_state(sk, BT_CLOSED, 1224 sk->sk_lingertime); 1225 } 1226 1227 release_sock(sk); 1228 sock_put(sk); 1229 1230 return err; 1231 } 1232 1233 static int sco_sock_release(struct socket *sock) 1234 { 1235 struct sock *sk = sock->sk; 1236 int err = 0; 1237 1238 BT_DBG("sock %p, sk %p", sock, sk); 1239 1240 if (!sk) 1241 return 0; 1242 1243 sco_sock_close(sk); 1244 1245 if (sock_flag(sk, SOCK_LINGER) && READ_ONCE(sk->sk_lingertime) && 1246 !(current->flags & PF_EXITING)) { 1247 lock_sock(sk); 1248 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime); 1249 release_sock(sk); 1250 } 1251 1252 sock_orphan(sk); 1253 sco_sock_kill(sk); 1254 return err; 1255 } 1256 1257 static void sco_conn_ready(struct sco_conn *conn) 1258 { 1259 struct sock *parent; 1260 struct sock *sk = conn->sk; 1261 1262 BT_DBG("conn %p", conn); 1263 1264 if (sk) { 1265 lock_sock(sk); 1266 sco_sock_clear_timer(sk); 1267 sk->sk_state = BT_CONNECTED; 1268 sk->sk_state_change(sk); 1269 release_sock(sk); 1270 } else { 1271 sco_conn_lock(conn); 1272 1273 if (!conn->hcon) { 1274 sco_conn_unlock(conn); 1275 return; 1276 } 1277 1278 parent = sco_get_sock_listen(&conn->hcon->src); 1279 if (!parent) { 1280 sco_conn_unlock(conn); 1281 return; 1282 } 1283 1284 lock_sock(parent); 1285 1286 sk = sco_sock_alloc(sock_net(parent), NULL, 1287 BTPROTO_SCO, GFP_ATOMIC, 0); 1288 if (!sk) { 1289 release_sock(parent); 1290 sco_conn_unlock(conn); 1291 return; 1292 } 1293 1294 sco_sock_init(sk, parent); 1295 1296 bacpy(&sco_pi(sk)->src, &conn->hcon->src); 1297 bacpy(&sco_pi(sk)->dst, &conn->hcon->dst); 1298 1299 hci_conn_hold(conn->hcon); 1300 __sco_chan_add(conn, sk, parent); 1301 1302 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) 1303 sk->sk_state = BT_CONNECT2; 1304 else 1305 sk->sk_state = BT_CONNECTED; 1306 1307 /* Wake up parent */ 1308 parent->sk_data_ready(parent); 1309 1310 release_sock(parent); 1311 1312 sco_conn_unlock(conn); 1313 } 1314 } 1315 1316 /* ----- SCO interface with lower layer (HCI) ----- */ 1317 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) 1318 { 1319 struct sock *sk; 1320 int lm = 0; 1321 1322 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr); 1323 1324 /* Find listening sockets */ 1325 read_lock(&sco_sk_list.lock); 1326 sk_for_each(sk, &sco_sk_list.head) { 1327 if (sk->sk_state != BT_LISTEN) 1328 continue; 1329 1330 if (!bacmp(&sco_pi(sk)->src, &hdev->bdaddr) || 1331 !bacmp(&sco_pi(sk)->src, BDADDR_ANY)) { 1332 lm |= HCI_LM_ACCEPT; 1333 1334 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) 1335 *flags |= HCI_PROTO_DEFER; 1336 break; 1337 } 1338 } 1339 read_unlock(&sco_sk_list.lock); 1340 1341 return lm; 1342 } 1343 1344 static void sco_connect_cfm(struct hci_conn *hcon, __u8 status) 1345 { 1346 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) 1347 return; 1348 1349 BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status); 1350 1351 if (!status) { 1352 struct sco_conn *conn; 1353 1354 conn = sco_conn_add(hcon); 1355 if (conn) 1356 sco_conn_ready(conn); 1357 } else 1358 sco_conn_del(hcon, bt_to_errno(status)); 1359 } 1360 1361 static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason) 1362 { 1363 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) 1364 return; 1365 1366 BT_DBG("hcon %p reason %d", hcon, reason); 1367 1368 sco_conn_del(hcon, bt_to_errno(reason)); 1369 } 1370 1371 void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb) 1372 { 1373 struct sco_conn *conn = hcon->sco_data; 1374 1375 if (!conn) 1376 goto drop; 1377 1378 BT_DBG("conn %p len %u", conn, skb->len); 1379 1380 if (skb->len) { 1381 sco_recv_frame(conn, skb); 1382 return; 1383 } 1384 1385 drop: 1386 kfree_skb(skb); 1387 } 1388 1389 static struct hci_cb sco_cb = { 1390 .name = "SCO", 1391 .connect_cfm = sco_connect_cfm, 1392 .disconn_cfm = sco_disconn_cfm, 1393 }; 1394 1395 static int sco_debugfs_show(struct seq_file *f, void *p) 1396 { 1397 struct sock *sk; 1398 1399 read_lock(&sco_sk_list.lock); 1400 1401 sk_for_each(sk, &sco_sk_list.head) { 1402 seq_printf(f, "%pMR %pMR %d\n", &sco_pi(sk)->src, 1403 &sco_pi(sk)->dst, sk->sk_state); 1404 } 1405 1406 read_unlock(&sco_sk_list.lock); 1407 1408 return 0; 1409 } 1410 1411 DEFINE_SHOW_ATTRIBUTE(sco_debugfs); 1412 1413 static struct dentry *sco_debugfs; 1414 1415 static const struct proto_ops sco_sock_ops = { 1416 .family = PF_BLUETOOTH, 1417 .owner = THIS_MODULE, 1418 .release = sco_sock_release, 1419 .bind = sco_sock_bind, 1420 .connect = sco_sock_connect, 1421 .listen = sco_sock_listen, 1422 .accept = sco_sock_accept, 1423 .getname = sco_sock_getname, 1424 .sendmsg = sco_sock_sendmsg, 1425 .recvmsg = sco_sock_recvmsg, 1426 .poll = bt_sock_poll, 1427 .ioctl = bt_sock_ioctl, 1428 .gettstamp = sock_gettstamp, 1429 .mmap = sock_no_mmap, 1430 .socketpair = sock_no_socketpair, 1431 .shutdown = sco_sock_shutdown, 1432 .setsockopt = sco_sock_setsockopt, 1433 .getsockopt = sco_sock_getsockopt 1434 }; 1435 1436 static const struct net_proto_family sco_sock_family_ops = { 1437 .family = PF_BLUETOOTH, 1438 .owner = THIS_MODULE, 1439 .create = sco_sock_create, 1440 }; 1441 1442 int __init sco_init(void) 1443 { 1444 int err; 1445 1446 BUILD_BUG_ON(sizeof(struct sockaddr_sco) > sizeof(struct sockaddr)); 1447 1448 err = proto_register(&sco_proto, 0); 1449 if (err < 0) 1450 return err; 1451 1452 err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops); 1453 if (err < 0) { 1454 BT_ERR("SCO socket registration failed"); 1455 goto error; 1456 } 1457 1458 err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL); 1459 if (err < 0) { 1460 BT_ERR("Failed to create SCO proc file"); 1461 bt_sock_unregister(BTPROTO_SCO); 1462 goto error; 1463 } 1464 1465 BT_INFO("SCO socket layer initialized"); 1466 1467 hci_register_cb(&sco_cb); 1468 1469 if (IS_ERR_OR_NULL(bt_debugfs)) 1470 return 0; 1471 1472 sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs, 1473 NULL, &sco_debugfs_fops); 1474 1475 return 0; 1476 1477 error: 1478 proto_unregister(&sco_proto); 1479 return err; 1480 } 1481 1482 void sco_exit(void) 1483 { 1484 bt_procfs_cleanup(&init_net, "sco"); 1485 1486 debugfs_remove(sco_debugfs); 1487 1488 hci_unregister_cb(&sco_cb); 1489 1490 bt_sock_unregister(BTPROTO_SCO); 1491 1492 proto_unregister(&sco_proto); 1493 } 1494 1495 module_param(disable_esco, bool, 0644); 1496 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation"); 1497