xref: /openbmc/linux/net/bluetooth/sco.c (revision de2fe5e0)
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4 
5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6 
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License version 2 as
9    published by the Free Software Foundation;
10 
11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 
20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22    SOFTWARE IS DISCLAIMED.
23 */
24 
25 /* Bluetooth SCO sockets. */
26 
27 #include <linux/config.h>
28 #include <linux/module.h>
29 
30 #include <linux/types.h>
31 #include <linux/errno.h>
32 #include <linux/kernel.h>
33 #include <linux/sched.h>
34 #include <linux/slab.h>
35 #include <linux/poll.h>
36 #include <linux/fcntl.h>
37 #include <linux/init.h>
38 #include <linux/interrupt.h>
39 #include <linux/socket.h>
40 #include <linux/skbuff.h>
41 #include <linux/device.h>
42 #include <linux/list.h>
43 #include <net/sock.h>
44 
45 #include <asm/system.h>
46 #include <asm/uaccess.h>
47 
48 #include <net/bluetooth/bluetooth.h>
49 #include <net/bluetooth/hci_core.h>
50 #include <net/bluetooth/sco.h>
51 
52 #ifndef CONFIG_BT_SCO_DEBUG
53 #undef  BT_DBG
54 #define BT_DBG(D...)
55 #endif
56 
57 #define VERSION "0.5"
58 
59 static const struct proto_ops sco_sock_ops;
60 
61 static struct bt_sock_list sco_sk_list = {
62 	.lock = RW_LOCK_UNLOCKED
63 };
64 
65 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent);
66 static void sco_chan_del(struct sock *sk, int err);
67 
68 static int  sco_conn_del(struct hci_conn *conn, int err);
69 
70 static void sco_sock_close(struct sock *sk);
71 static void sco_sock_kill(struct sock *sk);
72 
73 /* ---- SCO timers ---- */
74 static void sco_sock_timeout(unsigned long arg)
75 {
76 	struct sock *sk = (struct sock *) arg;
77 
78 	BT_DBG("sock %p state %d", sk, sk->sk_state);
79 
80 	bh_lock_sock(sk);
81 	sk->sk_err = ETIMEDOUT;
82 	sk->sk_state_change(sk);
83 	bh_unlock_sock(sk);
84 
85 	sco_sock_kill(sk);
86 	sock_put(sk);
87 }
88 
89 static void sco_sock_set_timer(struct sock *sk, long timeout)
90 {
91 	BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
92 	sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
93 }
94 
95 static void sco_sock_clear_timer(struct sock *sk)
96 {
97 	BT_DBG("sock %p state %d", sk, sk->sk_state);
98 	sk_stop_timer(sk, &sk->sk_timer);
99 }
100 
101 static void sco_sock_init_timer(struct sock *sk)
102 {
103 	init_timer(&sk->sk_timer);
104 	sk->sk_timer.function = sco_sock_timeout;
105 	sk->sk_timer.data = (unsigned long)sk;
106 }
107 
108 /* ---- SCO connections ---- */
109 static struct sco_conn *sco_conn_add(struct hci_conn *hcon, __u8 status)
110 {
111 	struct hci_dev *hdev = hcon->hdev;
112 	struct sco_conn *conn;
113 
114 	if ((conn = hcon->sco_data))
115 		return conn;
116 
117 	if (status)
118 		return conn;
119 
120 	if (!(conn = kmalloc(sizeof(struct sco_conn), GFP_ATOMIC)))
121 		return NULL;
122 	memset(conn, 0, sizeof(struct sco_conn));
123 
124 	spin_lock_init(&conn->lock);
125 
126 	hcon->sco_data = conn;
127 	conn->hcon = hcon;
128 
129 	conn->src = &hdev->bdaddr;
130 	conn->dst = &hcon->dst;
131 
132 	if (hdev->sco_mtu > 0)
133 		conn->mtu = hdev->sco_mtu;
134 	else
135 		conn->mtu = 60;
136 
137 	BT_DBG("hcon %p conn %p", hcon, conn);
138 	return conn;
139 }
140 
141 static inline struct sock *sco_chan_get(struct sco_conn *conn)
142 {
143 	struct sock *sk = NULL;
144 	sco_conn_lock(conn);
145 	sk = conn->sk;
146 	sco_conn_unlock(conn);
147 	return sk;
148 }
149 
150 static int sco_conn_del(struct hci_conn *hcon, int err)
151 {
152 	struct sco_conn *conn;
153 	struct sock *sk;
154 
155 	if (!(conn = hcon->sco_data))
156 		return 0;
157 
158 	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
159 
160 	/* Kill socket */
161 	if ((sk = sco_chan_get(conn))) {
162 		bh_lock_sock(sk);
163 		sco_sock_clear_timer(sk);
164 		sco_chan_del(sk, err);
165 		bh_unlock_sock(sk);
166 		sco_sock_kill(sk);
167 	}
168 
169 	hcon->sco_data = NULL;
170 	kfree(conn);
171 	return 0;
172 }
173 
174 static inline int sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
175 {
176 	int err = 0;
177 
178 	sco_conn_lock(conn);
179 	if (conn->sk) {
180 		err = -EBUSY;
181 	} else {
182 		__sco_chan_add(conn, sk, parent);
183 	}
184 	sco_conn_unlock(conn);
185 	return err;
186 }
187 
188 static int sco_connect(struct sock *sk)
189 {
190 	bdaddr_t *src = &bt_sk(sk)->src;
191 	bdaddr_t *dst = &bt_sk(sk)->dst;
192 	struct sco_conn *conn;
193 	struct hci_conn *hcon;
194 	struct hci_dev  *hdev;
195 	int err = 0;
196 
197 	BT_DBG("%s -> %s", batostr(src), batostr(dst));
198 
199 	if (!(hdev = hci_get_route(dst, src)))
200 		return -EHOSTUNREACH;
201 
202 	hci_dev_lock_bh(hdev);
203 
204 	err = -ENOMEM;
205 
206 	hcon = hci_connect(hdev, SCO_LINK, dst);
207 	if (!hcon)
208 		goto done;
209 
210 	conn = sco_conn_add(hcon, 0);
211 	if (!conn) {
212 		hci_conn_put(hcon);
213 		goto done;
214 	}
215 
216 	/* Update source addr of the socket */
217 	bacpy(src, conn->src);
218 
219 	err = sco_chan_add(conn, sk, NULL);
220 	if (err)
221 		goto done;
222 
223 	if (hcon->state == BT_CONNECTED) {
224 		sco_sock_clear_timer(sk);
225 		sk->sk_state = BT_CONNECTED;
226 	} else {
227 		sk->sk_state = BT_CONNECT;
228 		sco_sock_set_timer(sk, sk->sk_sndtimeo);
229 	}
230 done:
231 	hci_dev_unlock_bh(hdev);
232 	hci_dev_put(hdev);
233 	return err;
234 }
235 
236 static inline int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
237 {
238 	struct sco_conn *conn = sco_pi(sk)->conn;
239 	struct sk_buff *skb;
240 	int err, count;
241 
242 	/* Check outgoing MTU */
243 	if (len > conn->mtu)
244 		return -EINVAL;
245 
246 	BT_DBG("sk %p len %d", sk, len);
247 
248 	count = min_t(unsigned int, conn->mtu, len);
249 	if (!(skb = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err)))
250 		return err;
251 
252 	if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
253 		err = -EFAULT;
254 		goto fail;
255 	}
256 
257 	if ((err = hci_send_sco(conn->hcon, skb)) < 0)
258 		goto fail;
259 
260 	return count;
261 
262 fail:
263 	kfree_skb(skb);
264 	return err;
265 }
266 
267 static inline void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
268 {
269 	struct sock *sk = sco_chan_get(conn);
270 
271 	if (!sk)
272 		goto drop;
273 
274 	BT_DBG("sk %p len %d", sk, skb->len);
275 
276 	if (sk->sk_state != BT_CONNECTED)
277 		goto drop;
278 
279 	if (!sock_queue_rcv_skb(sk, skb))
280 		return;
281 
282 drop:
283 	kfree_skb(skb);
284 	return;
285 }
286 
287 /* -------- Socket interface ---------- */
288 static struct sock *__sco_get_sock_by_addr(bdaddr_t *ba)
289 {
290 	struct sock *sk;
291 	struct hlist_node *node;
292 
293 	sk_for_each(sk, node, &sco_sk_list.head)
294 		if (!bacmp(&bt_sk(sk)->src, ba))
295 			goto found;
296 	sk = NULL;
297 found:
298 	return sk;
299 }
300 
301 /* Find socket listening on source bdaddr.
302  * Returns closest match.
303  */
304 static struct sock *sco_get_sock_listen(bdaddr_t *src)
305 {
306 	struct sock *sk = NULL, *sk1 = NULL;
307 	struct hlist_node *node;
308 
309 	read_lock(&sco_sk_list.lock);
310 
311 	sk_for_each(sk, node, &sco_sk_list.head) {
312 		if (sk->sk_state != BT_LISTEN)
313 			continue;
314 
315 		/* Exact match. */
316 		if (!bacmp(&bt_sk(sk)->src, src))
317 			break;
318 
319 		/* Closest match */
320 		if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
321 			sk1 = sk;
322 	}
323 
324 	read_unlock(&sco_sk_list.lock);
325 
326 	return node ? sk : sk1;
327 }
328 
329 static void sco_sock_destruct(struct sock *sk)
330 {
331 	BT_DBG("sk %p", sk);
332 
333 	skb_queue_purge(&sk->sk_receive_queue);
334 	skb_queue_purge(&sk->sk_write_queue);
335 }
336 
337 static void sco_sock_cleanup_listen(struct sock *parent)
338 {
339 	struct sock *sk;
340 
341 	BT_DBG("parent %p", parent);
342 
343 	/* Close not yet accepted channels */
344 	while ((sk = bt_accept_dequeue(parent, NULL))) {
345 		sco_sock_close(sk);
346 		sco_sock_kill(sk);
347 	}
348 
349 	parent->sk_state  = BT_CLOSED;
350 	sock_set_flag(parent, SOCK_ZAPPED);
351 }
352 
353 /* Kill socket (only if zapped and orphan)
354  * Must be called on unlocked socket.
355  */
356 static void sco_sock_kill(struct sock *sk)
357 {
358 	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
359 		return;
360 
361 	BT_DBG("sk %p state %d", sk, sk->sk_state);
362 
363 	/* Kill poor orphan */
364 	bt_sock_unlink(&sco_sk_list, sk);
365 	sock_set_flag(sk, SOCK_DEAD);
366 	sock_put(sk);
367 }
368 
369 /* Close socket.
370  * Must be called on unlocked socket.
371  */
372 static void sco_sock_close(struct sock *sk)
373 {
374 	struct sco_conn *conn;
375 
376 	sco_sock_clear_timer(sk);
377 
378 	lock_sock(sk);
379 
380 	conn = sco_pi(sk)->conn;
381 
382 	BT_DBG("sk %p state %d conn %p socket %p", sk, sk->sk_state, conn, sk->sk_socket);
383 
384 	switch (sk->sk_state) {
385 	case BT_LISTEN:
386 		sco_sock_cleanup_listen(sk);
387 		break;
388 
389 	case BT_CONNECTED:
390 	case BT_CONFIG:
391 	case BT_CONNECT:
392 	case BT_DISCONN:
393 		sco_chan_del(sk, ECONNRESET);
394 		break;
395 
396 	default:
397 		sock_set_flag(sk, SOCK_ZAPPED);
398 		break;
399 	};
400 
401 	release_sock(sk);
402 
403 	sco_sock_kill(sk);
404 }
405 
406 static void sco_sock_init(struct sock *sk, struct sock *parent)
407 {
408 	BT_DBG("sk %p", sk);
409 
410 	if (parent)
411 		sk->sk_type = parent->sk_type;
412 }
413 
414 static struct proto sco_proto = {
415 	.name		= "SCO",
416 	.owner		= THIS_MODULE,
417 	.obj_size	= sizeof(struct sco_pinfo)
418 };
419 
420 static struct sock *sco_sock_alloc(struct socket *sock, int proto, gfp_t prio)
421 {
422 	struct sock *sk;
423 
424 	sk = sk_alloc(PF_BLUETOOTH, prio, &sco_proto, 1);
425 	if (!sk)
426 		return NULL;
427 
428 	sock_init_data(sock, sk);
429 	INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
430 
431 	sk->sk_destruct = sco_sock_destruct;
432 	sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
433 
434 	sock_reset_flag(sk, SOCK_ZAPPED);
435 
436 	sk->sk_protocol = proto;
437 	sk->sk_state    = BT_OPEN;
438 
439 	sco_sock_init_timer(sk);
440 
441 	bt_sock_link(&sco_sk_list, sk);
442 	return sk;
443 }
444 
445 static int sco_sock_create(struct socket *sock, int protocol)
446 {
447 	struct sock *sk;
448 
449 	BT_DBG("sock %p", sock);
450 
451 	sock->state = SS_UNCONNECTED;
452 
453 	if (sock->type != SOCK_SEQPACKET)
454 		return -ESOCKTNOSUPPORT;
455 
456 	sock->ops = &sco_sock_ops;
457 
458 	if (!(sk = sco_sock_alloc(sock, protocol, GFP_KERNEL)))
459 		return -ENOMEM;
460 
461 	sco_sock_init(sk, NULL);
462 	return 0;
463 }
464 
465 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
466 {
467 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
468 	struct sock *sk = sock->sk;
469 	bdaddr_t *src = &sa->sco_bdaddr;
470 	int err = 0;
471 
472 	BT_DBG("sk %p %s", sk, batostr(&sa->sco_bdaddr));
473 
474 	if (!addr || addr->sa_family != AF_BLUETOOTH)
475 		return -EINVAL;
476 
477 	lock_sock(sk);
478 
479 	if (sk->sk_state != BT_OPEN) {
480 		err = -EBADFD;
481 		goto done;
482 	}
483 
484 	write_lock_bh(&sco_sk_list.lock);
485 
486 	if (bacmp(src, BDADDR_ANY) && __sco_get_sock_by_addr(src)) {
487 		err = -EADDRINUSE;
488 	} else {
489 		/* Save source address */
490 		bacpy(&bt_sk(sk)->src, &sa->sco_bdaddr);
491 		sk->sk_state = BT_BOUND;
492 	}
493 
494 	write_unlock_bh(&sco_sk_list.lock);
495 
496 done:
497 	release_sock(sk);
498 	return err;
499 }
500 
501 static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
502 {
503 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
504 	struct sock *sk = sock->sk;
505 	int err = 0;
506 
507 
508 	BT_DBG("sk %p", sk);
509 
510 	if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_sco))
511 		return -EINVAL;
512 
513 	if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
514 		return -EBADFD;
515 
516 	if (sk->sk_type != SOCK_SEQPACKET)
517 		return -EINVAL;
518 
519 	lock_sock(sk);
520 
521 	/* Set destination address and psm */
522 	bacpy(&bt_sk(sk)->dst, &sa->sco_bdaddr);
523 
524 	if ((err = sco_connect(sk)))
525 		goto done;
526 
527 	err = bt_sock_wait_state(sk, BT_CONNECTED,
528 			sock_sndtimeo(sk, flags & O_NONBLOCK));
529 
530 done:
531 	release_sock(sk);
532 	return err;
533 }
534 
535 static int sco_sock_listen(struct socket *sock, int backlog)
536 {
537 	struct sock *sk = sock->sk;
538 	int err = 0;
539 
540 	BT_DBG("sk %p backlog %d", sk, backlog);
541 
542 	lock_sock(sk);
543 
544 	if (sk->sk_state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
545 		err = -EBADFD;
546 		goto done;
547 	}
548 
549 	sk->sk_max_ack_backlog = backlog;
550 	sk->sk_ack_backlog = 0;
551 	sk->sk_state = BT_LISTEN;
552 
553 done:
554 	release_sock(sk);
555 	return err;
556 }
557 
558 static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flags)
559 {
560 	DECLARE_WAITQUEUE(wait, current);
561 	struct sock *sk = sock->sk, *ch;
562 	long timeo;
563 	int err = 0;
564 
565 	lock_sock(sk);
566 
567 	if (sk->sk_state != BT_LISTEN) {
568 		err = -EBADFD;
569 		goto done;
570 	}
571 
572 	timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
573 
574 	BT_DBG("sk %p timeo %ld", sk, timeo);
575 
576 	/* Wait for an incoming connection. (wake-one). */
577 	add_wait_queue_exclusive(sk->sk_sleep, &wait);
578 	while (!(ch = bt_accept_dequeue(sk, newsock))) {
579 		set_current_state(TASK_INTERRUPTIBLE);
580 		if (!timeo) {
581 			err = -EAGAIN;
582 			break;
583 		}
584 
585 		release_sock(sk);
586 		timeo = schedule_timeout(timeo);
587 		lock_sock(sk);
588 
589 		if (sk->sk_state != BT_LISTEN) {
590 			err = -EBADFD;
591 			break;
592 		}
593 
594 		if (signal_pending(current)) {
595 			err = sock_intr_errno(timeo);
596 			break;
597 		}
598 	}
599 	set_current_state(TASK_RUNNING);
600 	remove_wait_queue(sk->sk_sleep, &wait);
601 
602 	if (err)
603 		goto done;
604 
605 	newsock->state = SS_CONNECTED;
606 
607 	BT_DBG("new socket %p", ch);
608 
609 done:
610 	release_sock(sk);
611 	return err;
612 }
613 
614 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
615 {
616 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
617 	struct sock *sk = sock->sk;
618 
619 	BT_DBG("sock %p, sk %p", sock, sk);
620 
621 	addr->sa_family = AF_BLUETOOTH;
622 	*len = sizeof(struct sockaddr_sco);
623 
624 	if (peer)
625 		bacpy(&sa->sco_bdaddr, &bt_sk(sk)->dst);
626 	else
627 		bacpy(&sa->sco_bdaddr, &bt_sk(sk)->src);
628 
629 	return 0;
630 }
631 
632 static int sco_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
633 			    struct msghdr *msg, size_t len)
634 {
635 	struct sock *sk = sock->sk;
636 	int err = 0;
637 
638 	BT_DBG("sock %p, sk %p", sock, sk);
639 
640 	err = sock_error(sk);
641 	if (err)
642 		return err;
643 
644 	if (msg->msg_flags & MSG_OOB)
645 		return -EOPNOTSUPP;
646 
647 	lock_sock(sk);
648 
649 	if (sk->sk_state == BT_CONNECTED)
650 		err = sco_send_frame(sk, msg, len);
651 	else
652 		err = -ENOTCONN;
653 
654 	release_sock(sk);
655 	return err;
656 }
657 
658 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
659 {
660 	struct sock *sk = sock->sk;
661 	int err = 0;
662 
663 	BT_DBG("sk %p", sk);
664 
665 	lock_sock(sk);
666 
667 	switch (optname) {
668 	default:
669 		err = -ENOPROTOOPT;
670 		break;
671 	}
672 
673 	release_sock(sk);
674 	return err;
675 }
676 
677 static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
678 {
679 	struct sock *sk = sock->sk;
680 	struct sco_options opts;
681 	struct sco_conninfo cinfo;
682 	int len, err = 0;
683 
684 	BT_DBG("sk %p", sk);
685 
686 	if (get_user(len, optlen))
687 		return -EFAULT;
688 
689 	lock_sock(sk);
690 
691 	switch (optname) {
692 	case SCO_OPTIONS:
693 		if (sk->sk_state != BT_CONNECTED) {
694 			err = -ENOTCONN;
695 			break;
696 		}
697 
698 		opts.mtu = sco_pi(sk)->conn->mtu;
699 
700 		BT_DBG("mtu %d", opts.mtu);
701 
702 		len = min_t(unsigned int, len, sizeof(opts));
703 		if (copy_to_user(optval, (char *)&opts, len))
704 			err = -EFAULT;
705 
706 		break;
707 
708 	case SCO_CONNINFO:
709 		if (sk->sk_state != BT_CONNECTED) {
710 			err = -ENOTCONN;
711 			break;
712 		}
713 
714 		cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
715 		memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
716 
717 		len = min_t(unsigned int, len, sizeof(cinfo));
718 		if (copy_to_user(optval, (char *)&cinfo, len))
719 			err = -EFAULT;
720 
721 		break;
722 
723 	default:
724 		err = -ENOPROTOOPT;
725 		break;
726 	}
727 
728 	release_sock(sk);
729 	return err;
730 }
731 
732 static int sco_sock_release(struct socket *sock)
733 {
734 	struct sock *sk = sock->sk;
735 	int err = 0;
736 
737 	BT_DBG("sock %p, sk %p", sock, sk);
738 
739 	if (!sk)
740 		return 0;
741 
742 	sco_sock_close(sk);
743 
744 	if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) {
745 		lock_sock(sk);
746 		err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
747 		release_sock(sk);
748 	}
749 
750 	sock_orphan(sk);
751 	sco_sock_kill(sk);
752 	return err;
753 }
754 
755 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
756 {
757 	BT_DBG("conn %p", conn);
758 
759 	sco_pi(sk)->conn = conn;
760 	conn->sk = sk;
761 
762 	if (parent)
763 		bt_accept_enqueue(parent, sk);
764 }
765 
766 /* Delete channel.
767  * Must be called on the locked socket. */
768 static void sco_chan_del(struct sock *sk, int err)
769 {
770 	struct sco_conn *conn;
771 
772 	conn = sco_pi(sk)->conn;
773 
774 	BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
775 
776 	if (conn) {
777 		sco_conn_lock(conn);
778 		conn->sk = NULL;
779 		sco_pi(sk)->conn = NULL;
780 		sco_conn_unlock(conn);
781 		hci_conn_put(conn->hcon);
782 	}
783 
784 	sk->sk_state = BT_CLOSED;
785 	sk->sk_err   = err;
786 	sk->sk_state_change(sk);
787 
788 	sock_set_flag(sk, SOCK_ZAPPED);
789 }
790 
791 static void sco_conn_ready(struct sco_conn *conn)
792 {
793 	struct sock *parent, *sk;
794 
795 	BT_DBG("conn %p", conn);
796 
797 	sco_conn_lock(conn);
798 
799 	if ((sk = conn->sk)) {
800 		sco_sock_clear_timer(sk);
801 		bh_lock_sock(sk);
802 		sk->sk_state = BT_CONNECTED;
803 		sk->sk_state_change(sk);
804 		bh_unlock_sock(sk);
805 	} else {
806 		parent = sco_get_sock_listen(conn->src);
807 		if (!parent)
808 			goto done;
809 
810 		bh_lock_sock(parent);
811 
812 		sk = sco_sock_alloc(NULL, BTPROTO_SCO, GFP_ATOMIC);
813 		if (!sk) {
814 			bh_unlock_sock(parent);
815 			goto done;
816 		}
817 
818 		sco_sock_init(sk, parent);
819 
820 		bacpy(&bt_sk(sk)->src, conn->src);
821 		bacpy(&bt_sk(sk)->dst, conn->dst);
822 
823 		hci_conn_hold(conn->hcon);
824 		__sco_chan_add(conn, sk, parent);
825 
826 		sk->sk_state = BT_CONNECTED;
827 
828 		/* Wake up parent */
829 		parent->sk_data_ready(parent, 1);
830 
831 		bh_unlock_sock(parent);
832 	}
833 
834 done:
835 	sco_conn_unlock(conn);
836 }
837 
838 /* ----- SCO interface with lower layer (HCI) ----- */
839 static int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type)
840 {
841 	BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
842 
843 	/* Always accept connection */
844 	return HCI_LM_ACCEPT;
845 }
846 
847 static int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
848 {
849 	BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
850 
851 	if (hcon->type != SCO_LINK)
852 		return 0;
853 
854 	if (!status) {
855 		struct sco_conn *conn;
856 
857 		conn = sco_conn_add(hcon, status);
858 		if (conn)
859 			sco_conn_ready(conn);
860 	} else
861 		sco_conn_del(hcon, bt_err(status));
862 
863 	return 0;
864 }
865 
866 static int sco_disconn_ind(struct hci_conn *hcon, __u8 reason)
867 {
868 	BT_DBG("hcon %p reason %d", hcon, reason);
869 
870 	if (hcon->type != SCO_LINK)
871 		return 0;
872 
873 	sco_conn_del(hcon, bt_err(reason));
874 	return 0;
875 }
876 
877 static int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
878 {
879 	struct sco_conn *conn = hcon->sco_data;
880 
881 	if (!conn)
882 		goto drop;
883 
884 	BT_DBG("conn %p len %d", conn, skb->len);
885 
886 	if (skb->len) {
887 		sco_recv_frame(conn, skb);
888 		return 0;
889 	}
890 
891 drop:
892 	kfree_skb(skb);
893 	return 0;
894 }
895 
896 static ssize_t sco_sysfs_show(struct class *dev, char *buf)
897 {
898 	struct sock *sk;
899 	struct hlist_node *node;
900 	char *str = buf;
901 
902 	read_lock_bh(&sco_sk_list.lock);
903 
904 	sk_for_each(sk, node, &sco_sk_list.head) {
905 		str += sprintf(str, "%s %s %d\n",
906 				batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
907 				sk->sk_state);
908 	}
909 
910 	read_unlock_bh(&sco_sk_list.lock);
911 
912 	return (str - buf);
913 }
914 
915 static CLASS_ATTR(sco, S_IRUGO, sco_sysfs_show, NULL);
916 
917 static const struct proto_ops sco_sock_ops = {
918 	.family		= PF_BLUETOOTH,
919 	.owner		= THIS_MODULE,
920 	.release	= sco_sock_release,
921 	.bind		= sco_sock_bind,
922 	.connect	= sco_sock_connect,
923 	.listen		= sco_sock_listen,
924 	.accept		= sco_sock_accept,
925 	.getname	= sco_sock_getname,
926 	.sendmsg	= sco_sock_sendmsg,
927 	.recvmsg	= bt_sock_recvmsg,
928 	.poll		= bt_sock_poll,
929 	.ioctl		= sock_no_ioctl,
930 	.mmap		= sock_no_mmap,
931 	.socketpair	= sock_no_socketpair,
932 	.shutdown	= sock_no_shutdown,
933 	.setsockopt	= sco_sock_setsockopt,
934 	.getsockopt	= sco_sock_getsockopt
935 };
936 
937 static struct net_proto_family sco_sock_family_ops = {
938 	.family	= PF_BLUETOOTH,
939 	.owner	= THIS_MODULE,
940 	.create	= sco_sock_create,
941 };
942 
943 static struct hci_proto sco_hci_proto = {
944 	.name		= "SCO",
945 	.id		= HCI_PROTO_SCO,
946 	.connect_ind	= sco_connect_ind,
947 	.connect_cfm	= sco_connect_cfm,
948 	.disconn_ind	= sco_disconn_ind,
949 	.recv_scodata	= sco_recv_scodata
950 };
951 
952 static int __init sco_init(void)
953 {
954 	int err;
955 
956 	err = proto_register(&sco_proto, 0);
957 	if (err < 0)
958 		return err;
959 
960 	err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
961 	if (err < 0) {
962 		BT_ERR("SCO socket registration failed");
963 		goto error;
964 	}
965 
966 	err = hci_register_proto(&sco_hci_proto);
967 	if (err < 0) {
968 		BT_ERR("SCO protocol registration failed");
969 		bt_sock_unregister(BTPROTO_SCO);
970 		goto error;
971 	}
972 
973 	class_create_file(&bt_class, &class_attr_sco);
974 
975 	BT_INFO("SCO (Voice Link) ver %s", VERSION);
976 	BT_INFO("SCO socket layer initialized");
977 
978 	return 0;
979 
980 error:
981 	proto_unregister(&sco_proto);
982 	return err;
983 }
984 
985 static void __exit sco_exit(void)
986 {
987 	class_remove_file(&bt_class, &class_attr_sco);
988 
989 	if (bt_sock_unregister(BTPROTO_SCO) < 0)
990 		BT_ERR("SCO socket unregistration failed");
991 
992 	if (hci_unregister_proto(&sco_hci_proto) < 0)
993 		BT_ERR("SCO protocol unregistration failed");
994 
995 	proto_unregister(&sco_proto);
996 }
997 
998 module_init(sco_init);
999 module_exit(sco_exit);
1000 
1001 MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
1002 MODULE_DESCRIPTION("Bluetooth SCO ver " VERSION);
1003 MODULE_VERSION(VERSION);
1004 MODULE_LICENSE("GPL");
1005 MODULE_ALIAS("bt-proto-2");
1006