xref: /openbmc/linux/net/bluetooth/sco.c (revision a1e58bbd)
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4 
5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6 
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License version 2 as
9    published by the Free Software Foundation;
10 
11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 
20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22    SOFTWARE IS DISCLAIMED.
23 */
24 
25 /* Bluetooth SCO sockets. */
26 
27 #include <linux/module.h>
28 
29 #include <linux/types.h>
30 #include <linux/errno.h>
31 #include <linux/kernel.h>
32 #include <linux/sched.h>
33 #include <linux/slab.h>
34 #include <linux/poll.h>
35 #include <linux/fcntl.h>
36 #include <linux/init.h>
37 #include <linux/interrupt.h>
38 #include <linux/socket.h>
39 #include <linux/skbuff.h>
40 #include <linux/device.h>
41 #include <linux/list.h>
42 #include <net/sock.h>
43 
44 #include <asm/system.h>
45 #include <asm/uaccess.h>
46 
47 #include <net/bluetooth/bluetooth.h>
48 #include <net/bluetooth/hci_core.h>
49 #include <net/bluetooth/sco.h>
50 
51 #ifndef CONFIG_BT_SCO_DEBUG
52 #undef  BT_DBG
53 #define BT_DBG(D...)
54 #endif
55 
56 #define VERSION "0.5"
57 
58 static const struct proto_ops sco_sock_ops;
59 
60 static struct bt_sock_list sco_sk_list = {
61 	.lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
62 };
63 
64 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent);
65 static void sco_chan_del(struct sock *sk, int err);
66 
67 static int  sco_conn_del(struct hci_conn *conn, int err);
68 
69 static void sco_sock_close(struct sock *sk);
70 static void sco_sock_kill(struct sock *sk);
71 
72 /* ---- SCO timers ---- */
73 static void sco_sock_timeout(unsigned long arg)
74 {
75 	struct sock *sk = (struct sock *) arg;
76 
77 	BT_DBG("sock %p state %d", sk, sk->sk_state);
78 
79 	bh_lock_sock(sk);
80 	sk->sk_err = ETIMEDOUT;
81 	sk->sk_state_change(sk);
82 	bh_unlock_sock(sk);
83 
84 	sco_sock_kill(sk);
85 	sock_put(sk);
86 }
87 
88 static void sco_sock_set_timer(struct sock *sk, long timeout)
89 {
90 	BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
91 	sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
92 }
93 
94 static void sco_sock_clear_timer(struct sock *sk)
95 {
96 	BT_DBG("sock %p state %d", sk, sk->sk_state);
97 	sk_stop_timer(sk, &sk->sk_timer);
98 }
99 
100 /* ---- SCO connections ---- */
101 static struct sco_conn *sco_conn_add(struct hci_conn *hcon, __u8 status)
102 {
103 	struct hci_dev *hdev = hcon->hdev;
104 	struct sco_conn *conn = hcon->sco_data;
105 
106 	if (conn || status)
107 		return conn;
108 
109 	conn = kzalloc(sizeof(struct sco_conn), GFP_ATOMIC);
110 	if (!conn)
111 		return NULL;
112 
113 	spin_lock_init(&conn->lock);
114 
115 	hcon->sco_data = conn;
116 	conn->hcon = hcon;
117 
118 	conn->src = &hdev->bdaddr;
119 	conn->dst = &hcon->dst;
120 
121 	if (hdev->sco_mtu > 0)
122 		conn->mtu = hdev->sco_mtu;
123 	else
124 		conn->mtu = 60;
125 
126 	BT_DBG("hcon %p conn %p", hcon, conn);
127 
128 	return conn;
129 }
130 
131 static inline struct sock *sco_chan_get(struct sco_conn *conn)
132 {
133 	struct sock *sk = NULL;
134 	sco_conn_lock(conn);
135 	sk = conn->sk;
136 	sco_conn_unlock(conn);
137 	return sk;
138 }
139 
140 static int sco_conn_del(struct hci_conn *hcon, int err)
141 {
142 	struct sco_conn *conn;
143 	struct sock *sk;
144 
145 	if (!(conn = hcon->sco_data))
146 		return 0;
147 
148 	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
149 
150 	/* Kill socket */
151 	if ((sk = sco_chan_get(conn))) {
152 		bh_lock_sock(sk);
153 		sco_sock_clear_timer(sk);
154 		sco_chan_del(sk, err);
155 		bh_unlock_sock(sk);
156 		sco_sock_kill(sk);
157 	}
158 
159 	hcon->sco_data = NULL;
160 	kfree(conn);
161 	return 0;
162 }
163 
164 static inline int sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
165 {
166 	int err = 0;
167 
168 	sco_conn_lock(conn);
169 	if (conn->sk) {
170 		err = -EBUSY;
171 	} else {
172 		__sco_chan_add(conn, sk, parent);
173 	}
174 	sco_conn_unlock(conn);
175 	return err;
176 }
177 
178 static int sco_connect(struct sock *sk)
179 {
180 	bdaddr_t *src = &bt_sk(sk)->src;
181 	bdaddr_t *dst = &bt_sk(sk)->dst;
182 	struct sco_conn *conn;
183 	struct hci_conn *hcon;
184 	struct hci_dev  *hdev;
185 	int err, type;
186 
187 	BT_DBG("%s -> %s", batostr(src), batostr(dst));
188 
189 	if (!(hdev = hci_get_route(dst, src)))
190 		return -EHOSTUNREACH;
191 
192 	hci_dev_lock_bh(hdev);
193 
194 	err = -ENOMEM;
195 
196 	type = lmp_esco_capable(hdev) ? ESCO_LINK : SCO_LINK;
197 
198 	hcon = hci_connect(hdev, type, dst);
199 	if (!hcon)
200 		goto done;
201 
202 	conn = sco_conn_add(hcon, 0);
203 	if (!conn) {
204 		hci_conn_put(hcon);
205 		goto done;
206 	}
207 
208 	/* Update source addr of the socket */
209 	bacpy(src, conn->src);
210 
211 	err = sco_chan_add(conn, sk, NULL);
212 	if (err)
213 		goto done;
214 
215 	if (hcon->state == BT_CONNECTED) {
216 		sco_sock_clear_timer(sk);
217 		sk->sk_state = BT_CONNECTED;
218 	} else {
219 		sk->sk_state = BT_CONNECT;
220 		sco_sock_set_timer(sk, sk->sk_sndtimeo);
221 	}
222 
223 done:
224 	hci_dev_unlock_bh(hdev);
225 	hci_dev_put(hdev);
226 	return err;
227 }
228 
229 static inline int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
230 {
231 	struct sco_conn *conn = sco_pi(sk)->conn;
232 	struct sk_buff *skb;
233 	int err, count;
234 
235 	/* Check outgoing MTU */
236 	if (len > conn->mtu)
237 		return -EINVAL;
238 
239 	BT_DBG("sk %p len %d", sk, len);
240 
241 	count = min_t(unsigned int, conn->mtu, len);
242 	if (!(skb = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err)))
243 		return err;
244 
245 	if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
246 		err = -EFAULT;
247 		goto fail;
248 	}
249 
250 	if ((err = hci_send_sco(conn->hcon, skb)) < 0)
251 		return err;
252 
253 	return count;
254 
255 fail:
256 	kfree_skb(skb);
257 	return err;
258 }
259 
260 static inline void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
261 {
262 	struct sock *sk = sco_chan_get(conn);
263 
264 	if (!sk)
265 		goto drop;
266 
267 	BT_DBG("sk %p len %d", sk, skb->len);
268 
269 	if (sk->sk_state != BT_CONNECTED)
270 		goto drop;
271 
272 	if (!sock_queue_rcv_skb(sk, skb))
273 		return;
274 
275 drop:
276 	kfree_skb(skb);
277 	return;
278 }
279 
280 /* -------- Socket interface ---------- */
281 static struct sock *__sco_get_sock_by_addr(bdaddr_t *ba)
282 {
283 	struct sock *sk;
284 	struct hlist_node *node;
285 
286 	sk_for_each(sk, node, &sco_sk_list.head)
287 		if (!bacmp(&bt_sk(sk)->src, ba))
288 			goto found;
289 	sk = NULL;
290 found:
291 	return sk;
292 }
293 
294 /* Find socket listening on source bdaddr.
295  * Returns closest match.
296  */
297 static struct sock *sco_get_sock_listen(bdaddr_t *src)
298 {
299 	struct sock *sk = NULL, *sk1 = NULL;
300 	struct hlist_node *node;
301 
302 	read_lock(&sco_sk_list.lock);
303 
304 	sk_for_each(sk, node, &sco_sk_list.head) {
305 		if (sk->sk_state != BT_LISTEN)
306 			continue;
307 
308 		/* Exact match. */
309 		if (!bacmp(&bt_sk(sk)->src, src))
310 			break;
311 
312 		/* Closest match */
313 		if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
314 			sk1 = sk;
315 	}
316 
317 	read_unlock(&sco_sk_list.lock);
318 
319 	return node ? sk : sk1;
320 }
321 
322 static void sco_sock_destruct(struct sock *sk)
323 {
324 	BT_DBG("sk %p", sk);
325 
326 	skb_queue_purge(&sk->sk_receive_queue);
327 	skb_queue_purge(&sk->sk_write_queue);
328 }
329 
330 static void sco_sock_cleanup_listen(struct sock *parent)
331 {
332 	struct sock *sk;
333 
334 	BT_DBG("parent %p", parent);
335 
336 	/* Close not yet accepted channels */
337 	while ((sk = bt_accept_dequeue(parent, NULL))) {
338 		sco_sock_close(sk);
339 		sco_sock_kill(sk);
340 	}
341 
342 	parent->sk_state  = BT_CLOSED;
343 	sock_set_flag(parent, SOCK_ZAPPED);
344 }
345 
346 /* Kill socket (only if zapped and orphan)
347  * Must be called on unlocked socket.
348  */
349 static void sco_sock_kill(struct sock *sk)
350 {
351 	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
352 		return;
353 
354 	BT_DBG("sk %p state %d", sk, sk->sk_state);
355 
356 	/* Kill poor orphan */
357 	bt_sock_unlink(&sco_sk_list, sk);
358 	sock_set_flag(sk, SOCK_DEAD);
359 	sock_put(sk);
360 }
361 
362 /* Close socket.
363  * Must be called on unlocked socket.
364  */
365 static void sco_sock_close(struct sock *sk)
366 {
367 	struct sco_conn *conn;
368 
369 	sco_sock_clear_timer(sk);
370 
371 	lock_sock(sk);
372 
373 	conn = sco_pi(sk)->conn;
374 
375 	BT_DBG("sk %p state %d conn %p socket %p", sk, sk->sk_state, conn, sk->sk_socket);
376 
377 	switch (sk->sk_state) {
378 	case BT_LISTEN:
379 		sco_sock_cleanup_listen(sk);
380 		break;
381 
382 	case BT_CONNECTED:
383 	case BT_CONFIG:
384 	case BT_CONNECT:
385 	case BT_DISCONN:
386 		sco_chan_del(sk, ECONNRESET);
387 		break;
388 
389 	default:
390 		sock_set_flag(sk, SOCK_ZAPPED);
391 		break;
392 	}
393 
394 	release_sock(sk);
395 
396 	sco_sock_kill(sk);
397 }
398 
399 static void sco_sock_init(struct sock *sk, struct sock *parent)
400 {
401 	BT_DBG("sk %p", sk);
402 
403 	if (parent)
404 		sk->sk_type = parent->sk_type;
405 }
406 
407 static struct proto sco_proto = {
408 	.name		= "SCO",
409 	.owner		= THIS_MODULE,
410 	.obj_size	= sizeof(struct sco_pinfo)
411 };
412 
413 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
414 {
415 	struct sock *sk;
416 
417 	sk = sk_alloc(net, PF_BLUETOOTH, prio, &sco_proto);
418 	if (!sk)
419 		return NULL;
420 
421 	sock_init_data(sock, sk);
422 	INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
423 
424 	sk->sk_destruct = sco_sock_destruct;
425 	sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
426 
427 	sock_reset_flag(sk, SOCK_ZAPPED);
428 
429 	sk->sk_protocol = proto;
430 	sk->sk_state    = BT_OPEN;
431 
432 	setup_timer(&sk->sk_timer, sco_sock_timeout, (unsigned long)sk);
433 
434 	bt_sock_link(&sco_sk_list, sk);
435 	return sk;
436 }
437 
438 static int sco_sock_create(struct net *net, struct socket *sock, int protocol)
439 {
440 	struct sock *sk;
441 
442 	BT_DBG("sock %p", sock);
443 
444 	sock->state = SS_UNCONNECTED;
445 
446 	if (sock->type != SOCK_SEQPACKET)
447 		return -ESOCKTNOSUPPORT;
448 
449 	sock->ops = &sco_sock_ops;
450 
451 	sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC);
452 	if (!sk)
453 		return -ENOMEM;
454 
455 	sco_sock_init(sk, NULL);
456 	return 0;
457 }
458 
459 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
460 {
461 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
462 	struct sock *sk = sock->sk;
463 	bdaddr_t *src = &sa->sco_bdaddr;
464 	int err = 0;
465 
466 	BT_DBG("sk %p %s", sk, batostr(&sa->sco_bdaddr));
467 
468 	if (!addr || addr->sa_family != AF_BLUETOOTH)
469 		return -EINVAL;
470 
471 	lock_sock(sk);
472 
473 	if (sk->sk_state != BT_OPEN) {
474 		err = -EBADFD;
475 		goto done;
476 	}
477 
478 	write_lock_bh(&sco_sk_list.lock);
479 
480 	if (bacmp(src, BDADDR_ANY) && __sco_get_sock_by_addr(src)) {
481 		err = -EADDRINUSE;
482 	} else {
483 		/* Save source address */
484 		bacpy(&bt_sk(sk)->src, &sa->sco_bdaddr);
485 		sk->sk_state = BT_BOUND;
486 	}
487 
488 	write_unlock_bh(&sco_sk_list.lock);
489 
490 done:
491 	release_sock(sk);
492 	return err;
493 }
494 
495 static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
496 {
497 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
498 	struct sock *sk = sock->sk;
499 	int err = 0;
500 
501 
502 	BT_DBG("sk %p", sk);
503 
504 	if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_sco))
505 		return -EINVAL;
506 
507 	if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
508 		return -EBADFD;
509 
510 	if (sk->sk_type != SOCK_SEQPACKET)
511 		return -EINVAL;
512 
513 	lock_sock(sk);
514 
515 	/* Set destination address and psm */
516 	bacpy(&bt_sk(sk)->dst, &sa->sco_bdaddr);
517 
518 	if ((err = sco_connect(sk)))
519 		goto done;
520 
521 	err = bt_sock_wait_state(sk, BT_CONNECTED,
522 			sock_sndtimeo(sk, flags & O_NONBLOCK));
523 
524 done:
525 	release_sock(sk);
526 	return err;
527 }
528 
529 static int sco_sock_listen(struct socket *sock, int backlog)
530 {
531 	struct sock *sk = sock->sk;
532 	int err = 0;
533 
534 	BT_DBG("sk %p backlog %d", sk, backlog);
535 
536 	lock_sock(sk);
537 
538 	if (sk->sk_state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
539 		err = -EBADFD;
540 		goto done;
541 	}
542 
543 	sk->sk_max_ack_backlog = backlog;
544 	sk->sk_ack_backlog = 0;
545 	sk->sk_state = BT_LISTEN;
546 
547 done:
548 	release_sock(sk);
549 	return err;
550 }
551 
552 static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flags)
553 {
554 	DECLARE_WAITQUEUE(wait, current);
555 	struct sock *sk = sock->sk, *ch;
556 	long timeo;
557 	int err = 0;
558 
559 	lock_sock(sk);
560 
561 	if (sk->sk_state != BT_LISTEN) {
562 		err = -EBADFD;
563 		goto done;
564 	}
565 
566 	timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
567 
568 	BT_DBG("sk %p timeo %ld", sk, timeo);
569 
570 	/* Wait for an incoming connection. (wake-one). */
571 	add_wait_queue_exclusive(sk->sk_sleep, &wait);
572 	while (!(ch = bt_accept_dequeue(sk, newsock))) {
573 		set_current_state(TASK_INTERRUPTIBLE);
574 		if (!timeo) {
575 			err = -EAGAIN;
576 			break;
577 		}
578 
579 		release_sock(sk);
580 		timeo = schedule_timeout(timeo);
581 		lock_sock(sk);
582 
583 		if (sk->sk_state != BT_LISTEN) {
584 			err = -EBADFD;
585 			break;
586 		}
587 
588 		if (signal_pending(current)) {
589 			err = sock_intr_errno(timeo);
590 			break;
591 		}
592 	}
593 	set_current_state(TASK_RUNNING);
594 	remove_wait_queue(sk->sk_sleep, &wait);
595 
596 	if (err)
597 		goto done;
598 
599 	newsock->state = SS_CONNECTED;
600 
601 	BT_DBG("new socket %p", ch);
602 
603 done:
604 	release_sock(sk);
605 	return err;
606 }
607 
608 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
609 {
610 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
611 	struct sock *sk = sock->sk;
612 
613 	BT_DBG("sock %p, sk %p", sock, sk);
614 
615 	addr->sa_family = AF_BLUETOOTH;
616 	*len = sizeof(struct sockaddr_sco);
617 
618 	if (peer)
619 		bacpy(&sa->sco_bdaddr, &bt_sk(sk)->dst);
620 	else
621 		bacpy(&sa->sco_bdaddr, &bt_sk(sk)->src);
622 
623 	return 0;
624 }
625 
626 static int sco_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
627 			    struct msghdr *msg, size_t len)
628 {
629 	struct sock *sk = sock->sk;
630 	int err = 0;
631 
632 	BT_DBG("sock %p, sk %p", sock, sk);
633 
634 	err = sock_error(sk);
635 	if (err)
636 		return err;
637 
638 	if (msg->msg_flags & MSG_OOB)
639 		return -EOPNOTSUPP;
640 
641 	lock_sock(sk);
642 
643 	if (sk->sk_state == BT_CONNECTED)
644 		err = sco_send_frame(sk, msg, len);
645 	else
646 		err = -ENOTCONN;
647 
648 	release_sock(sk);
649 	return err;
650 }
651 
652 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
653 {
654 	struct sock *sk = sock->sk;
655 	int err = 0;
656 
657 	BT_DBG("sk %p", sk);
658 
659 	lock_sock(sk);
660 
661 	switch (optname) {
662 	default:
663 		err = -ENOPROTOOPT;
664 		break;
665 	}
666 
667 	release_sock(sk);
668 	return err;
669 }
670 
671 static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
672 {
673 	struct sock *sk = sock->sk;
674 	struct sco_options opts;
675 	struct sco_conninfo cinfo;
676 	int len, err = 0;
677 
678 	BT_DBG("sk %p", sk);
679 
680 	if (get_user(len, optlen))
681 		return -EFAULT;
682 
683 	lock_sock(sk);
684 
685 	switch (optname) {
686 	case SCO_OPTIONS:
687 		if (sk->sk_state != BT_CONNECTED) {
688 			err = -ENOTCONN;
689 			break;
690 		}
691 
692 		opts.mtu = sco_pi(sk)->conn->mtu;
693 
694 		BT_DBG("mtu %d", opts.mtu);
695 
696 		len = min_t(unsigned int, len, sizeof(opts));
697 		if (copy_to_user(optval, (char *)&opts, len))
698 			err = -EFAULT;
699 
700 		break;
701 
702 	case SCO_CONNINFO:
703 		if (sk->sk_state != BT_CONNECTED) {
704 			err = -ENOTCONN;
705 			break;
706 		}
707 
708 		cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
709 		memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
710 
711 		len = min_t(unsigned int, len, sizeof(cinfo));
712 		if (copy_to_user(optval, (char *)&cinfo, len))
713 			err = -EFAULT;
714 
715 		break;
716 
717 	default:
718 		err = -ENOPROTOOPT;
719 		break;
720 	}
721 
722 	release_sock(sk);
723 	return err;
724 }
725 
726 static int sco_sock_release(struct socket *sock)
727 {
728 	struct sock *sk = sock->sk;
729 	int err = 0;
730 
731 	BT_DBG("sock %p, sk %p", sock, sk);
732 
733 	if (!sk)
734 		return 0;
735 
736 	sco_sock_close(sk);
737 
738 	if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) {
739 		lock_sock(sk);
740 		err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
741 		release_sock(sk);
742 	}
743 
744 	sock_orphan(sk);
745 	sco_sock_kill(sk);
746 	return err;
747 }
748 
749 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
750 {
751 	BT_DBG("conn %p", conn);
752 
753 	sco_pi(sk)->conn = conn;
754 	conn->sk = sk;
755 
756 	if (parent)
757 		bt_accept_enqueue(parent, sk);
758 }
759 
760 /* Delete channel.
761  * Must be called on the locked socket. */
762 static void sco_chan_del(struct sock *sk, int err)
763 {
764 	struct sco_conn *conn;
765 
766 	conn = sco_pi(sk)->conn;
767 
768 	BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
769 
770 	if (conn) {
771 		sco_conn_lock(conn);
772 		conn->sk = NULL;
773 		sco_pi(sk)->conn = NULL;
774 		sco_conn_unlock(conn);
775 		hci_conn_put(conn->hcon);
776 	}
777 
778 	sk->sk_state = BT_CLOSED;
779 	sk->sk_err   = err;
780 	sk->sk_state_change(sk);
781 
782 	sock_set_flag(sk, SOCK_ZAPPED);
783 }
784 
785 static void sco_conn_ready(struct sco_conn *conn)
786 {
787 	struct sock *parent, *sk;
788 
789 	BT_DBG("conn %p", conn);
790 
791 	sco_conn_lock(conn);
792 
793 	if ((sk = conn->sk)) {
794 		sco_sock_clear_timer(sk);
795 		bh_lock_sock(sk);
796 		sk->sk_state = BT_CONNECTED;
797 		sk->sk_state_change(sk);
798 		bh_unlock_sock(sk);
799 	} else {
800 		parent = sco_get_sock_listen(conn->src);
801 		if (!parent)
802 			goto done;
803 
804 		bh_lock_sock(parent);
805 
806 		sk = sco_sock_alloc(parent->sk_net, NULL, BTPROTO_SCO, GFP_ATOMIC);
807 		if (!sk) {
808 			bh_unlock_sock(parent);
809 			goto done;
810 		}
811 
812 		sco_sock_init(sk, parent);
813 
814 		bacpy(&bt_sk(sk)->src, conn->src);
815 		bacpy(&bt_sk(sk)->dst, conn->dst);
816 
817 		hci_conn_hold(conn->hcon);
818 		__sco_chan_add(conn, sk, parent);
819 
820 		sk->sk_state = BT_CONNECTED;
821 
822 		/* Wake up parent */
823 		parent->sk_data_ready(parent, 1);
824 
825 		bh_unlock_sock(parent);
826 	}
827 
828 done:
829 	sco_conn_unlock(conn);
830 }
831 
832 /* ----- SCO interface with lower layer (HCI) ----- */
833 static int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type)
834 {
835 	BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
836 
837 	/* Always accept connection */
838 	return HCI_LM_ACCEPT;
839 }
840 
841 static int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
842 {
843 	BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
844 
845 	if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
846 		return 0;
847 
848 	if (!status) {
849 		struct sco_conn *conn;
850 
851 		conn = sco_conn_add(hcon, status);
852 		if (conn)
853 			sco_conn_ready(conn);
854 	} else
855 		sco_conn_del(hcon, bt_err(status));
856 
857 	return 0;
858 }
859 
860 static int sco_disconn_ind(struct hci_conn *hcon, __u8 reason)
861 {
862 	BT_DBG("hcon %p reason %d", hcon, reason);
863 
864 	if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
865 		return 0;
866 
867 	sco_conn_del(hcon, bt_err(reason));
868 
869 	return 0;
870 }
871 
872 static int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
873 {
874 	struct sco_conn *conn = hcon->sco_data;
875 
876 	if (!conn)
877 		goto drop;
878 
879 	BT_DBG("conn %p len %d", conn, skb->len);
880 
881 	if (skb->len) {
882 		sco_recv_frame(conn, skb);
883 		return 0;
884 	}
885 
886 drop:
887 	kfree_skb(skb);
888 	return 0;
889 }
890 
891 static ssize_t sco_sysfs_show(struct class *dev, char *buf)
892 {
893 	struct sock *sk;
894 	struct hlist_node *node;
895 	char *str = buf;
896 
897 	read_lock_bh(&sco_sk_list.lock);
898 
899 	sk_for_each(sk, node, &sco_sk_list.head) {
900 		str += sprintf(str, "%s %s %d\n",
901 				batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
902 				sk->sk_state);
903 	}
904 
905 	read_unlock_bh(&sco_sk_list.lock);
906 
907 	return (str - buf);
908 }
909 
910 static CLASS_ATTR(sco, S_IRUGO, sco_sysfs_show, NULL);
911 
912 static const struct proto_ops sco_sock_ops = {
913 	.family		= PF_BLUETOOTH,
914 	.owner		= THIS_MODULE,
915 	.release	= sco_sock_release,
916 	.bind		= sco_sock_bind,
917 	.connect	= sco_sock_connect,
918 	.listen		= sco_sock_listen,
919 	.accept		= sco_sock_accept,
920 	.getname	= sco_sock_getname,
921 	.sendmsg	= sco_sock_sendmsg,
922 	.recvmsg	= bt_sock_recvmsg,
923 	.poll		= bt_sock_poll,
924 	.ioctl		= sock_no_ioctl,
925 	.mmap		= sock_no_mmap,
926 	.socketpair	= sock_no_socketpair,
927 	.shutdown	= sock_no_shutdown,
928 	.setsockopt	= sco_sock_setsockopt,
929 	.getsockopt	= sco_sock_getsockopt
930 };
931 
932 static struct net_proto_family sco_sock_family_ops = {
933 	.family	= PF_BLUETOOTH,
934 	.owner	= THIS_MODULE,
935 	.create	= sco_sock_create,
936 };
937 
938 static struct hci_proto sco_hci_proto = {
939 	.name		= "SCO",
940 	.id		= HCI_PROTO_SCO,
941 	.connect_ind	= sco_connect_ind,
942 	.connect_cfm	= sco_connect_cfm,
943 	.disconn_ind	= sco_disconn_ind,
944 	.recv_scodata	= sco_recv_scodata
945 };
946 
947 static int __init sco_init(void)
948 {
949 	int err;
950 
951 	err = proto_register(&sco_proto, 0);
952 	if (err < 0)
953 		return err;
954 
955 	err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
956 	if (err < 0) {
957 		BT_ERR("SCO socket registration failed");
958 		goto error;
959 	}
960 
961 	err = hci_register_proto(&sco_hci_proto);
962 	if (err < 0) {
963 		BT_ERR("SCO protocol registration failed");
964 		bt_sock_unregister(BTPROTO_SCO);
965 		goto error;
966 	}
967 
968 	if (class_create_file(bt_class, &class_attr_sco) < 0)
969 		BT_ERR("Failed to create SCO info file");
970 
971 	BT_INFO("SCO (Voice Link) ver %s", VERSION);
972 	BT_INFO("SCO socket layer initialized");
973 
974 	return 0;
975 
976 error:
977 	proto_unregister(&sco_proto);
978 	return err;
979 }
980 
981 static void __exit sco_exit(void)
982 {
983 	class_remove_file(bt_class, &class_attr_sco);
984 
985 	if (bt_sock_unregister(BTPROTO_SCO) < 0)
986 		BT_ERR("SCO socket unregistration failed");
987 
988 	if (hci_unregister_proto(&sco_hci_proto) < 0)
989 		BT_ERR("SCO protocol unregistration failed");
990 
991 	proto_unregister(&sco_proto);
992 }
993 
994 module_init(sco_init);
995 module_exit(sco_exit);
996 
997 MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
998 MODULE_DESCRIPTION("Bluetooth SCO ver " VERSION);
999 MODULE_VERSION(VERSION);
1000 MODULE_LICENSE("GPL");
1001 MODULE_ALIAS("bt-proto-2");
1002