GNU Linux-libre 6.8.7-gnu
[releases.git] / net / bluetooth / sco.c
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4
5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License version 2 as
9    published by the Free Software Foundation;
10
11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22    SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth SCO sockets. */
26
27 #include <linux/module.h>
28 #include <linux/debugfs.h>
29 #include <linux/seq_file.h>
30 #include <linux/sched/signal.h>
31
32 #include <net/bluetooth/bluetooth.h>
33 #include <net/bluetooth/hci_core.h>
34 #include <net/bluetooth/sco.h>
35
36 static bool disable_esco;
37
38 static const struct proto_ops sco_sock_ops;
39
40 static struct bt_sock_list sco_sk_list = {
41         .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
42 };
43
44 /* ---- SCO connections ---- */
45 struct sco_conn {
46         struct hci_conn *hcon;
47
48         spinlock_t      lock;
49         struct sock     *sk;
50
51         struct delayed_work     timeout_work;
52
53         unsigned int    mtu;
54 };
55
56 #define sco_conn_lock(c)        spin_lock(&c->lock)
57 #define sco_conn_unlock(c)      spin_unlock(&c->lock)
58
59 static void sco_sock_close(struct sock *sk);
60 static void sco_sock_kill(struct sock *sk);
61
62 /* ----- SCO socket info ----- */
63 #define sco_pi(sk) ((struct sco_pinfo *) sk)
64
65 struct sco_pinfo {
66         struct bt_sock  bt;
67         bdaddr_t        src;
68         bdaddr_t        dst;
69         __u32           flags;
70         __u16           setting;
71         struct bt_codec codec;
72         struct sco_conn *conn;
73 };
74
75 /* ---- SCO timers ---- */
76 #define SCO_CONN_TIMEOUT        (HZ * 40)
77 #define SCO_DISCONN_TIMEOUT     (HZ * 2)
78
79 static void sco_sock_timeout(struct work_struct *work)
80 {
81         struct sco_conn *conn = container_of(work, struct sco_conn,
82                                              timeout_work.work);
83         struct sock *sk;
84
85         sco_conn_lock(conn);
86         sk = conn->sk;
87         if (sk)
88                 sock_hold(sk);
89         sco_conn_unlock(conn);
90
91         if (!sk)
92                 return;
93
94         BT_DBG("sock %p state %d", sk, sk->sk_state);
95
96         lock_sock(sk);
97         sk->sk_err = ETIMEDOUT;
98         sk->sk_state_change(sk);
99         release_sock(sk);
100         sock_put(sk);
101 }
102
103 static void sco_sock_set_timer(struct sock *sk, long timeout)
104 {
105         if (!sco_pi(sk)->conn)
106                 return;
107
108         BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
109         cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
110         schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout);
111 }
112
113 static void sco_sock_clear_timer(struct sock *sk)
114 {
115         if (!sco_pi(sk)->conn)
116                 return;
117
118         BT_DBG("sock %p state %d", sk, sk->sk_state);
119         cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
120 }
121
122 /* ---- SCO connections ---- */
123 static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
124 {
125         struct hci_dev *hdev = hcon->hdev;
126         struct sco_conn *conn = hcon->sco_data;
127
128         if (conn) {
129                 if (!conn->hcon)
130                         conn->hcon = hcon;
131                 return conn;
132         }
133
134         conn = kzalloc(sizeof(struct sco_conn), GFP_KERNEL);
135         if (!conn)
136                 return NULL;
137
138         spin_lock_init(&conn->lock);
139         INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
140
141         hcon->sco_data = conn;
142         conn->hcon = hcon;
143
144         if (hdev->sco_mtu > 0)
145                 conn->mtu = hdev->sco_mtu;
146         else
147                 conn->mtu = 60;
148
149         BT_DBG("hcon %p conn %p", hcon, conn);
150
151         return conn;
152 }
153
154 /* Delete channel.
155  * Must be called on the locked socket. */
156 static void sco_chan_del(struct sock *sk, int err)
157 {
158         struct sco_conn *conn;
159
160         conn = sco_pi(sk)->conn;
161
162         BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
163
164         if (conn) {
165                 sco_conn_lock(conn);
166                 conn->sk = NULL;
167                 sco_pi(sk)->conn = NULL;
168                 sco_conn_unlock(conn);
169
170                 if (conn->hcon)
171                         hci_conn_drop(conn->hcon);
172         }
173
174         sk->sk_state = BT_CLOSED;
175         sk->sk_err   = err;
176         sk->sk_state_change(sk);
177
178         sock_set_flag(sk, SOCK_ZAPPED);
179 }
180
181 static void sco_conn_del(struct hci_conn *hcon, int err)
182 {
183         struct sco_conn *conn = hcon->sco_data;
184         struct sock *sk;
185
186         if (!conn)
187                 return;
188
189         BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
190
191         /* Kill socket */
192         sco_conn_lock(conn);
193         sk = conn->sk;
194         if (sk)
195                 sock_hold(sk);
196         sco_conn_unlock(conn);
197
198         if (sk) {
199                 lock_sock(sk);
200                 sco_sock_clear_timer(sk);
201                 sco_chan_del(sk, err);
202                 release_sock(sk);
203                 sock_put(sk);
204         }
205
206         /* Ensure no more work items will run before freeing conn. */
207         cancel_delayed_work_sync(&conn->timeout_work);
208
209         hcon->sco_data = NULL;
210         kfree(conn);
211 }
212
213 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
214                            struct sock *parent)
215 {
216         BT_DBG("conn %p", conn);
217
218         sco_pi(sk)->conn = conn;
219         conn->sk = sk;
220
221         if (parent)
222                 bt_accept_enqueue(parent, sk, true);
223 }
224
225 static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
226                         struct sock *parent)
227 {
228         int err = 0;
229
230         sco_conn_lock(conn);
231         if (conn->sk)
232                 err = -EBUSY;
233         else
234                 __sco_chan_add(conn, sk, parent);
235
236         sco_conn_unlock(conn);
237         return err;
238 }
239
240 static int sco_connect(struct sock *sk)
241 {
242         struct sco_conn *conn;
243         struct hci_conn *hcon;
244         struct hci_dev  *hdev;
245         int err, type;
246
247         BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst);
248
249         hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
250         if (!hdev)
251                 return -EHOSTUNREACH;
252
253         hci_dev_lock(hdev);
254
255         if (lmp_esco_capable(hdev) && !disable_esco)
256                 type = ESCO_LINK;
257         else
258                 type = SCO_LINK;
259
260         if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT &&
261             (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) {
262                 err = -EOPNOTSUPP;
263                 goto unlock;
264         }
265
266         hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst,
267                                sco_pi(sk)->setting, &sco_pi(sk)->codec);
268         if (IS_ERR(hcon)) {
269                 err = PTR_ERR(hcon);
270                 goto unlock;
271         }
272
273         conn = sco_conn_add(hcon);
274         if (!conn) {
275                 hci_conn_drop(hcon);
276                 err = -ENOMEM;
277                 goto unlock;
278         }
279
280         lock_sock(sk);
281
282         err = sco_chan_add(conn, sk, NULL);
283         if (err) {
284                 release_sock(sk);
285                 goto unlock;
286         }
287
288         /* Update source addr of the socket */
289         bacpy(&sco_pi(sk)->src, &hcon->src);
290
291         if (hcon->state == BT_CONNECTED) {
292                 sco_sock_clear_timer(sk);
293                 sk->sk_state = BT_CONNECTED;
294         } else {
295                 sk->sk_state = BT_CONNECT;
296                 sco_sock_set_timer(sk, sk->sk_sndtimeo);
297         }
298
299         release_sock(sk);
300
301 unlock:
302         hci_dev_unlock(hdev);
303         hci_dev_put(hdev);
304         return err;
305 }
306
307 static int sco_send_frame(struct sock *sk, struct sk_buff *skb)
308 {
309         struct sco_conn *conn = sco_pi(sk)->conn;
310         int len = skb->len;
311
312         /* Check outgoing MTU */
313         if (len > conn->mtu)
314                 return -EINVAL;
315
316         BT_DBG("sk %p len %d", sk, len);
317
318         hci_send_sco(conn->hcon, skb);
319
320         return len;
321 }
322
323 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
324 {
325         struct sock *sk;
326
327         sco_conn_lock(conn);
328         sk = conn->sk;
329         sco_conn_unlock(conn);
330
331         if (!sk)
332                 goto drop;
333
334         BT_DBG("sk %p len %u", sk, skb->len);
335
336         if (sk->sk_state != BT_CONNECTED)
337                 goto drop;
338
339         if (!sock_queue_rcv_skb(sk, skb))
340                 return;
341
342 drop:
343         kfree_skb(skb);
344 }
345
346 /* -------- Socket interface ---------- */
347 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
348 {
349         struct sock *sk;
350
351         sk_for_each(sk, &sco_sk_list.head) {
352                 if (sk->sk_state != BT_LISTEN)
353                         continue;
354
355                 if (!bacmp(&sco_pi(sk)->src, ba))
356                         return sk;
357         }
358
359         return NULL;
360 }
361
362 /* Find socket listening on source bdaddr.
363  * Returns closest match.
364  */
365 static struct sock *sco_get_sock_listen(bdaddr_t *src)
366 {
367         struct sock *sk = NULL, *sk1 = NULL;
368
369         read_lock(&sco_sk_list.lock);
370
371         sk_for_each(sk, &sco_sk_list.head) {
372                 if (sk->sk_state != BT_LISTEN)
373                         continue;
374
375                 /* Exact match. */
376                 if (!bacmp(&sco_pi(sk)->src, src))
377                         break;
378
379                 /* Closest match */
380                 if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY))
381                         sk1 = sk;
382         }
383
384         read_unlock(&sco_sk_list.lock);
385
386         return sk ? sk : sk1;
387 }
388
389 static void sco_sock_destruct(struct sock *sk)
390 {
391         BT_DBG("sk %p", sk);
392
393         skb_queue_purge(&sk->sk_receive_queue);
394         skb_queue_purge(&sk->sk_write_queue);
395 }
396
397 static void sco_sock_cleanup_listen(struct sock *parent)
398 {
399         struct sock *sk;
400
401         BT_DBG("parent %p", parent);
402
403         /* Close not yet accepted channels */
404         while ((sk = bt_accept_dequeue(parent, NULL))) {
405                 sco_sock_close(sk);
406                 sco_sock_kill(sk);
407         }
408
409         parent->sk_state  = BT_CLOSED;
410         sock_set_flag(parent, SOCK_ZAPPED);
411 }
412
413 /* Kill socket (only if zapped and orphan)
414  * Must be called on unlocked socket.
415  */
416 static void sco_sock_kill(struct sock *sk)
417 {
418         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
419                 return;
420
421         BT_DBG("sk %p state %d", sk, sk->sk_state);
422
423         /* Kill poor orphan */
424         bt_sock_unlink(&sco_sk_list, sk);
425         sock_set_flag(sk, SOCK_DEAD);
426         sock_put(sk);
427 }
428
429 static void __sco_sock_close(struct sock *sk)
430 {
431         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
432
433         switch (sk->sk_state) {
434         case BT_LISTEN:
435                 sco_sock_cleanup_listen(sk);
436                 break;
437
438         case BT_CONNECTED:
439         case BT_CONFIG:
440                 if (sco_pi(sk)->conn->hcon) {
441                         sk->sk_state = BT_DISCONN;
442                         sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
443                         sco_conn_lock(sco_pi(sk)->conn);
444                         hci_conn_drop(sco_pi(sk)->conn->hcon);
445                         sco_pi(sk)->conn->hcon = NULL;
446                         sco_conn_unlock(sco_pi(sk)->conn);
447                 } else
448                         sco_chan_del(sk, ECONNRESET);
449                 break;
450
451         case BT_CONNECT2:
452         case BT_CONNECT:
453         case BT_DISCONN:
454                 sco_chan_del(sk, ECONNRESET);
455                 break;
456
457         default:
458                 sock_set_flag(sk, SOCK_ZAPPED);
459                 break;
460         }
461
462 }
463
464 /* Must be called on unlocked socket. */
465 static void sco_sock_close(struct sock *sk)
466 {
467         lock_sock(sk);
468         sco_sock_clear_timer(sk);
469         __sco_sock_close(sk);
470         release_sock(sk);
471 }
472
473 static void sco_sock_init(struct sock *sk, struct sock *parent)
474 {
475         BT_DBG("sk %p", sk);
476
477         if (parent) {
478                 sk->sk_type = parent->sk_type;
479                 bt_sk(sk)->flags = bt_sk(parent)->flags;
480                 security_sk_clone(parent, sk);
481         }
482 }
483
484 static struct proto sco_proto = {
485         .name           = "SCO",
486         .owner          = THIS_MODULE,
487         .obj_size       = sizeof(struct sco_pinfo)
488 };
489
490 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock,
491                                    int proto, gfp_t prio, int kern)
492 {
493         struct sock *sk;
494
495         sk = bt_sock_alloc(net, sock, &sco_proto, proto, prio, kern);
496         if (!sk)
497                 return NULL;
498
499         sk->sk_destruct = sco_sock_destruct;
500         sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
501
502         sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
503         sco_pi(sk)->codec.id = BT_CODEC_CVSD;
504         sco_pi(sk)->codec.cid = 0xffff;
505         sco_pi(sk)->codec.vid = 0xffff;
506         sco_pi(sk)->codec.data_path = 0x00;
507
508         bt_sock_link(&sco_sk_list, sk);
509         return sk;
510 }
511
512 static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
513                            int kern)
514 {
515         struct sock *sk;
516
517         BT_DBG("sock %p", sock);
518
519         sock->state = SS_UNCONNECTED;
520
521         if (sock->type != SOCK_SEQPACKET)
522                 return -ESOCKTNOSUPPORT;
523
524         sock->ops = &sco_sock_ops;
525
526         sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
527         if (!sk)
528                 return -ENOMEM;
529
530         sco_sock_init(sk, NULL);
531         return 0;
532 }
533
534 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr,
535                          int addr_len)
536 {
537         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
538         struct sock *sk = sock->sk;
539         int err = 0;
540
541         if (!addr || addr_len < sizeof(struct sockaddr_sco) ||
542             addr->sa_family != AF_BLUETOOTH)
543                 return -EINVAL;
544
545         BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
546
547         lock_sock(sk);
548
549         if (sk->sk_state != BT_OPEN) {
550                 err = -EBADFD;
551                 goto done;
552         }
553
554         if (sk->sk_type != SOCK_SEQPACKET) {
555                 err = -EINVAL;
556                 goto done;
557         }
558
559         bacpy(&sco_pi(sk)->src, &sa->sco_bdaddr);
560
561         sk->sk_state = BT_BOUND;
562
563 done:
564         release_sock(sk);
565         return err;
566 }
567
568 static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
569 {
570         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
571         struct sock *sk = sock->sk;
572         int err;
573
574         BT_DBG("sk %p", sk);
575
576         if (alen < sizeof(struct sockaddr_sco) ||
577             addr->sa_family != AF_BLUETOOTH)
578                 return -EINVAL;
579
580         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
581                 return -EBADFD;
582
583         if (sk->sk_type != SOCK_SEQPACKET)
584                 err = -EINVAL;
585
586         lock_sock(sk);
587         /* Set destination address and psm */
588         bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr);
589         release_sock(sk);
590
591         err = sco_connect(sk);
592         if (err)
593                 return err;
594
595         lock_sock(sk);
596
597         err = bt_sock_wait_state(sk, BT_CONNECTED,
598                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
599
600         release_sock(sk);
601         return err;
602 }
603
604 static int sco_sock_listen(struct socket *sock, int backlog)
605 {
606         struct sock *sk = sock->sk;
607         bdaddr_t *src = &sco_pi(sk)->src;
608         int err = 0;
609
610         BT_DBG("sk %p backlog %d", sk, backlog);
611
612         lock_sock(sk);
613
614         if (sk->sk_state != BT_BOUND) {
615                 err = -EBADFD;
616                 goto done;
617         }
618
619         if (sk->sk_type != SOCK_SEQPACKET) {
620                 err = -EINVAL;
621                 goto done;
622         }
623
624         write_lock(&sco_sk_list.lock);
625
626         if (__sco_get_sock_listen_by_addr(src)) {
627                 err = -EADDRINUSE;
628                 goto unlock;
629         }
630
631         sk->sk_max_ack_backlog = backlog;
632         sk->sk_ack_backlog = 0;
633
634         sk->sk_state = BT_LISTEN;
635
636 unlock:
637         write_unlock(&sco_sk_list.lock);
638
639 done:
640         release_sock(sk);
641         return err;
642 }
643
644 static int sco_sock_accept(struct socket *sock, struct socket *newsock,
645                            int flags, bool kern)
646 {
647         DEFINE_WAIT_FUNC(wait, woken_wake_function);
648         struct sock *sk = sock->sk, *ch;
649         long timeo;
650         int err = 0;
651
652         lock_sock(sk);
653
654         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
655
656         BT_DBG("sk %p timeo %ld", sk, timeo);
657
658         /* Wait for an incoming connection. (wake-one). */
659         add_wait_queue_exclusive(sk_sleep(sk), &wait);
660         while (1) {
661                 if (sk->sk_state != BT_LISTEN) {
662                         err = -EBADFD;
663                         break;
664                 }
665
666                 ch = bt_accept_dequeue(sk, newsock);
667                 if (ch)
668                         break;
669
670                 if (!timeo) {
671                         err = -EAGAIN;
672                         break;
673                 }
674
675                 if (signal_pending(current)) {
676                         err = sock_intr_errno(timeo);
677                         break;
678                 }
679
680                 release_sock(sk);
681
682                 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
683                 lock_sock(sk);
684         }
685         remove_wait_queue(sk_sleep(sk), &wait);
686
687         if (err)
688                 goto done;
689
690         newsock->state = SS_CONNECTED;
691
692         BT_DBG("new socket %p", ch);
693
694 done:
695         release_sock(sk);
696         return err;
697 }
698
699 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr,
700                             int peer)
701 {
702         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
703         struct sock *sk = sock->sk;
704
705         BT_DBG("sock %p, sk %p", sock, sk);
706
707         addr->sa_family = AF_BLUETOOTH;
708
709         if (peer)
710                 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->dst);
711         else
712                 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->src);
713
714         return sizeof(struct sockaddr_sco);
715 }
716
717 static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
718                             size_t len)
719 {
720         struct sock *sk = sock->sk;
721         struct sk_buff *skb;
722         int err;
723
724         BT_DBG("sock %p, sk %p", sock, sk);
725
726         err = sock_error(sk);
727         if (err)
728                 return err;
729
730         if (msg->msg_flags & MSG_OOB)
731                 return -EOPNOTSUPP;
732
733         skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0);
734         if (IS_ERR(skb))
735                 return PTR_ERR(skb);
736
737         lock_sock(sk);
738
739         if (sk->sk_state == BT_CONNECTED)
740                 err = sco_send_frame(sk, skb);
741         else
742                 err = -ENOTCONN;
743
744         release_sock(sk);
745
746         if (err < 0)
747                 kfree_skb(skb);
748         return err;
749 }
750
751 static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
752 {
753         struct hci_dev *hdev = conn->hdev;
754
755         BT_DBG("conn %p", conn);
756
757         conn->state = BT_CONFIG;
758
759         if (!lmp_esco_capable(hdev)) {
760                 struct hci_cp_accept_conn_req cp;
761
762                 bacpy(&cp.bdaddr, &conn->dst);
763                 cp.role = 0x00; /* Ignored */
764
765                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
766         } else {
767                 struct hci_cp_accept_sync_conn_req cp;
768
769                 bacpy(&cp.bdaddr, &conn->dst);
770                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
771
772                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
773                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
774                 cp.content_format = cpu_to_le16(setting);
775
776                 switch (setting & SCO_AIRMODE_MASK) {
777                 case SCO_AIRMODE_TRANSP:
778                         if (conn->pkt_type & ESCO_2EV3)
779                                 cp.max_latency = cpu_to_le16(0x0008);
780                         else
781                                 cp.max_latency = cpu_to_le16(0x000D);
782                         cp.retrans_effort = 0x02;
783                         break;
784                 case SCO_AIRMODE_CVSD:
785                         cp.max_latency = cpu_to_le16(0xffff);
786                         cp.retrans_effort = 0xff;
787                         break;
788                 default:
789                         /* use CVSD settings as fallback */
790                         cp.max_latency = cpu_to_le16(0xffff);
791                         cp.retrans_effort = 0xff;
792                         break;
793                 }
794
795                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
796                              sizeof(cp), &cp);
797         }
798 }
799
800 static int sco_sock_recvmsg(struct socket *sock, struct msghdr *msg,
801                             size_t len, int flags)
802 {
803         struct sock *sk = sock->sk;
804         struct sco_pinfo *pi = sco_pi(sk);
805
806         lock_sock(sk);
807
808         if (sk->sk_state == BT_CONNECT2 &&
809             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
810                 sco_conn_defer_accept(pi->conn->hcon, pi->setting);
811                 sk->sk_state = BT_CONFIG;
812
813                 release_sock(sk);
814                 return 0;
815         }
816
817         release_sock(sk);
818
819         return bt_sock_recvmsg(sock, msg, len, flags);
820 }
821
822 static int sco_sock_setsockopt(struct socket *sock, int level, int optname,
823                                sockptr_t optval, unsigned int optlen)
824 {
825         struct sock *sk = sock->sk;
826         int err = 0;
827         struct bt_voice voice;
828         u32 opt;
829         struct bt_codecs *codecs;
830         struct hci_dev *hdev;
831         __u8 buffer[255];
832
833         BT_DBG("sk %p", sk);
834
835         lock_sock(sk);
836
837         switch (optname) {
838
839         case BT_DEFER_SETUP:
840                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
841                         err = -EINVAL;
842                         break;
843                 }
844
845                 err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
846                 if (err)
847                         break;
848
849                 if (opt)
850                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
851                 else
852                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
853                 break;
854
855         case BT_VOICE:
856                 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
857                     sk->sk_state != BT_CONNECT2) {
858                         err = -EINVAL;
859                         break;
860                 }
861
862                 voice.setting = sco_pi(sk)->setting;
863
864                 err = bt_copy_from_sockptr(&voice, sizeof(voice), optval,
865                                            optlen);
866                 if (err)
867                         break;
868
869                 /* Explicitly check for these values */
870                 if (voice.setting != BT_VOICE_TRANSPARENT &&
871                     voice.setting != BT_VOICE_CVSD_16BIT) {
872                         err = -EINVAL;
873                         break;
874                 }
875
876                 sco_pi(sk)->setting = voice.setting;
877                 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src,
878                                      BDADDR_BREDR);
879                 if (!hdev) {
880                         err = -EBADFD;
881                         break;
882                 }
883                 if (enhanced_sync_conn_capable(hdev) &&
884                     voice.setting == BT_VOICE_TRANSPARENT)
885                         sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT;
886                 hci_dev_put(hdev);
887                 break;
888
889         case BT_PKT_STATUS:
890                 err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
891                 if (err)
892                         break;
893
894                 if (opt)
895                         set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
896                 else
897                         clear_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
898                 break;
899
900         case BT_CODEC:
901                 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
902                     sk->sk_state != BT_CONNECT2) {
903                         err = -EINVAL;
904                         break;
905                 }
906
907                 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src,
908                                      BDADDR_BREDR);
909                 if (!hdev) {
910                         err = -EBADFD;
911                         break;
912                 }
913
914                 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) {
915                         hci_dev_put(hdev);
916                         err = -EOPNOTSUPP;
917                         break;
918                 }
919
920                 if (!hdev->get_data_path_id) {
921                         hci_dev_put(hdev);
922                         err = -EOPNOTSUPP;
923                         break;
924                 }
925
926                 if (optlen < sizeof(struct bt_codecs) ||
927                     optlen > sizeof(buffer)) {
928                         hci_dev_put(hdev);
929                         err = -EINVAL;
930                         break;
931                 }
932
933                 err = bt_copy_from_sockptr(buffer, optlen, optval, optlen);
934                 if (err) {
935                         hci_dev_put(hdev);
936                         break;
937                 }
938
939                 codecs = (void *)buffer;
940
941                 if (codecs->num_codecs > 1) {
942                         hci_dev_put(hdev);
943                         err = -EINVAL;
944                         break;
945                 }
946
947                 sco_pi(sk)->codec = codecs->codecs[0];
948                 hci_dev_put(hdev);
949                 break;
950
951         default:
952                 err = -ENOPROTOOPT;
953                 break;
954         }
955
956         release_sock(sk);
957         return err;
958 }
959
960 static int sco_sock_getsockopt_old(struct socket *sock, int optname,
961                                    char __user *optval, int __user *optlen)
962 {
963         struct sock *sk = sock->sk;
964         struct sco_options opts;
965         struct sco_conninfo cinfo;
966         int len, err = 0;
967
968         BT_DBG("sk %p", sk);
969
970         if (get_user(len, optlen))
971                 return -EFAULT;
972
973         lock_sock(sk);
974
975         switch (optname) {
976         case SCO_OPTIONS:
977                 if (sk->sk_state != BT_CONNECTED &&
978                     !(sk->sk_state == BT_CONNECT2 &&
979                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
980                         err = -ENOTCONN;
981                         break;
982                 }
983
984                 opts.mtu = sco_pi(sk)->conn->mtu;
985
986                 BT_DBG("mtu %u", opts.mtu);
987
988                 len = min_t(unsigned int, len, sizeof(opts));
989                 if (copy_to_user(optval, (char *)&opts, len))
990                         err = -EFAULT;
991
992                 break;
993
994         case SCO_CONNINFO:
995                 if (sk->sk_state != BT_CONNECTED &&
996                     !(sk->sk_state == BT_CONNECT2 &&
997                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
998                         err = -ENOTCONN;
999                         break;
1000                 }
1001
1002                 memset(&cinfo, 0, sizeof(cinfo));
1003                 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
1004                 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
1005
1006                 len = min_t(unsigned int, len, sizeof(cinfo));
1007                 if (copy_to_user(optval, (char *)&cinfo, len))
1008                         err = -EFAULT;
1009
1010                 break;
1011
1012         default:
1013                 err = -ENOPROTOOPT;
1014                 break;
1015         }
1016
1017         release_sock(sk);
1018         return err;
1019 }
1020
1021 static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
1022                                char __user *optval, int __user *optlen)
1023 {
1024         struct sock *sk = sock->sk;
1025         int len, err = 0;
1026         struct bt_voice voice;
1027         u32 phys;
1028         int buf_len;
1029         struct codec_list *c;
1030         u8 num_codecs, i, __user *ptr;
1031         struct hci_dev *hdev;
1032         struct hci_codec_caps *caps;
1033         struct bt_codec codec;
1034
1035         BT_DBG("sk %p", sk);
1036
1037         if (level == SOL_SCO)
1038                 return sco_sock_getsockopt_old(sock, optname, optval, optlen);
1039
1040         if (get_user(len, optlen))
1041                 return -EFAULT;
1042
1043         lock_sock(sk);
1044
1045         switch (optname) {
1046
1047         case BT_DEFER_SETUP:
1048                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1049                         err = -EINVAL;
1050                         break;
1051                 }
1052
1053                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
1054                              (u32 __user *)optval))
1055                         err = -EFAULT;
1056
1057                 break;
1058
1059         case BT_VOICE:
1060                 voice.setting = sco_pi(sk)->setting;
1061
1062                 len = min_t(unsigned int, len, sizeof(voice));
1063                 if (copy_to_user(optval, (char *)&voice, len))
1064                         err = -EFAULT;
1065
1066                 break;
1067
1068         case BT_PHY:
1069                 if (sk->sk_state != BT_CONNECTED) {
1070                         err = -ENOTCONN;
1071                         break;
1072                 }
1073
1074                 phys = hci_conn_get_phy(sco_pi(sk)->conn->hcon);
1075
1076                 if (put_user(phys, (u32 __user *) optval))
1077                         err = -EFAULT;
1078                 break;
1079
1080         case BT_PKT_STATUS:
1081                 if (put_user(test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags),
1082                              (int __user *)optval))
1083                         err = -EFAULT;
1084                 break;
1085
1086         case BT_SNDMTU:
1087         case BT_RCVMTU:
1088                 if (sk->sk_state != BT_CONNECTED) {
1089                         err = -ENOTCONN;
1090                         break;
1091                 }
1092
1093                 if (put_user(sco_pi(sk)->conn->mtu, (u32 __user *)optval))
1094                         err = -EFAULT;
1095                 break;
1096
1097         case BT_CODEC:
1098                 num_codecs = 0;
1099                 buf_len = 0;
1100
1101                 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
1102                 if (!hdev) {
1103                         err = -EBADFD;
1104                         break;
1105                 }
1106
1107                 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) {
1108                         hci_dev_put(hdev);
1109                         err = -EOPNOTSUPP;
1110                         break;
1111                 }
1112
1113                 if (!hdev->get_data_path_id) {
1114                         hci_dev_put(hdev);
1115                         err = -EOPNOTSUPP;
1116                         break;
1117                 }
1118
1119                 release_sock(sk);
1120
1121                 /* find total buffer size required to copy codec + caps */
1122                 hci_dev_lock(hdev);
1123                 list_for_each_entry(c, &hdev->local_codecs, list) {
1124                         if (c->transport != HCI_TRANSPORT_SCO_ESCO)
1125                                 continue;
1126                         num_codecs++;
1127                         for (i = 0, caps = c->caps; i < c->num_caps; i++) {
1128                                 buf_len += 1 + caps->len;
1129                                 caps = (void *)&caps->data[caps->len];
1130                         }
1131                         buf_len += sizeof(struct bt_codec);
1132                 }
1133                 hci_dev_unlock(hdev);
1134
1135                 buf_len += sizeof(struct bt_codecs);
1136                 if (buf_len > len) {
1137                         hci_dev_put(hdev);
1138                         return -ENOBUFS;
1139                 }
1140                 ptr = optval;
1141
1142                 if (put_user(num_codecs, ptr)) {
1143                         hci_dev_put(hdev);
1144                         return -EFAULT;
1145                 }
1146                 ptr += sizeof(num_codecs);
1147
1148                 /* Iterate all the codecs supported over SCO and populate
1149                  * codec data
1150                  */
1151                 hci_dev_lock(hdev);
1152                 list_for_each_entry(c, &hdev->local_codecs, list) {
1153                         if (c->transport != HCI_TRANSPORT_SCO_ESCO)
1154                                 continue;
1155
1156                         codec.id = c->id;
1157                         codec.cid = c->cid;
1158                         codec.vid = c->vid;
1159                         err = hdev->get_data_path_id(hdev, &codec.data_path);
1160                         if (err < 0)
1161                                 break;
1162                         codec.num_caps = c->num_caps;
1163                         if (copy_to_user(ptr, &codec, sizeof(codec))) {
1164                                 err = -EFAULT;
1165                                 break;
1166                         }
1167                         ptr += sizeof(codec);
1168
1169                         /* find codec capabilities data length */
1170                         len = 0;
1171                         for (i = 0, caps = c->caps; i < c->num_caps; i++) {
1172                                 len += 1 + caps->len;
1173                                 caps = (void *)&caps->data[caps->len];
1174                         }
1175
1176                         /* copy codec capabilities data */
1177                         if (len && copy_to_user(ptr, c->caps, len)) {
1178                                 err = -EFAULT;
1179                                 break;
1180                         }
1181                         ptr += len;
1182                 }
1183
1184                 hci_dev_unlock(hdev);
1185                 hci_dev_put(hdev);
1186
1187                 lock_sock(sk);
1188
1189                 if (!err && put_user(buf_len, optlen))
1190                         err = -EFAULT;
1191
1192                 break;
1193
1194         default:
1195                 err = -ENOPROTOOPT;
1196                 break;
1197         }
1198
1199         release_sock(sk);
1200         return err;
1201 }
1202
1203 static int sco_sock_shutdown(struct socket *sock, int how)
1204 {
1205         struct sock *sk = sock->sk;
1206         int err = 0;
1207
1208         BT_DBG("sock %p, sk %p", sock, sk);
1209
1210         if (!sk)
1211                 return 0;
1212
1213         sock_hold(sk);
1214         lock_sock(sk);
1215
1216         if (!sk->sk_shutdown) {
1217                 sk->sk_shutdown = SHUTDOWN_MASK;
1218                 sco_sock_clear_timer(sk);
1219                 __sco_sock_close(sk);
1220
1221                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1222                     !(current->flags & PF_EXITING))
1223                         err = bt_sock_wait_state(sk, BT_CLOSED,
1224                                                  sk->sk_lingertime);
1225         }
1226
1227         release_sock(sk);
1228         sock_put(sk);
1229
1230         return err;
1231 }
1232
1233 static int sco_sock_release(struct socket *sock)
1234 {
1235         struct sock *sk = sock->sk;
1236         int err = 0;
1237
1238         BT_DBG("sock %p, sk %p", sock, sk);
1239
1240         if (!sk)
1241                 return 0;
1242
1243         sco_sock_close(sk);
1244
1245         if (sock_flag(sk, SOCK_LINGER) && READ_ONCE(sk->sk_lingertime) &&
1246             !(current->flags & PF_EXITING)) {
1247                 lock_sock(sk);
1248                 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
1249                 release_sock(sk);
1250         }
1251
1252         sock_orphan(sk);
1253         sco_sock_kill(sk);
1254         return err;
1255 }
1256
1257 static void sco_conn_ready(struct sco_conn *conn)
1258 {
1259         struct sock *parent;
1260         struct sock *sk = conn->sk;
1261
1262         BT_DBG("conn %p", conn);
1263
1264         if (sk) {
1265                 lock_sock(sk);
1266                 sco_sock_clear_timer(sk);
1267                 sk->sk_state = BT_CONNECTED;
1268                 sk->sk_state_change(sk);
1269                 release_sock(sk);
1270         } else {
1271                 sco_conn_lock(conn);
1272
1273                 if (!conn->hcon) {
1274                         sco_conn_unlock(conn);
1275                         return;
1276                 }
1277
1278                 parent = sco_get_sock_listen(&conn->hcon->src);
1279                 if (!parent) {
1280                         sco_conn_unlock(conn);
1281                         return;
1282                 }
1283
1284                 lock_sock(parent);
1285
1286                 sk = sco_sock_alloc(sock_net(parent), NULL,
1287                                     BTPROTO_SCO, GFP_ATOMIC, 0);
1288                 if (!sk) {
1289                         release_sock(parent);
1290                         sco_conn_unlock(conn);
1291                         return;
1292                 }
1293
1294                 sco_sock_init(sk, parent);
1295
1296                 bacpy(&sco_pi(sk)->src, &conn->hcon->src);
1297                 bacpy(&sco_pi(sk)->dst, &conn->hcon->dst);
1298
1299                 hci_conn_hold(conn->hcon);
1300                 __sco_chan_add(conn, sk, parent);
1301
1302                 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
1303                         sk->sk_state = BT_CONNECT2;
1304                 else
1305                         sk->sk_state = BT_CONNECTED;
1306
1307                 /* Wake up parent */
1308                 parent->sk_data_ready(parent);
1309
1310                 release_sock(parent);
1311
1312                 sco_conn_unlock(conn);
1313         }
1314 }
1315
1316 /* ----- SCO interface with lower layer (HCI) ----- */
1317 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
1318 {
1319         struct sock *sk;
1320         int lm = 0;
1321
1322         BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1323
1324         /* Find listening sockets */
1325         read_lock(&sco_sk_list.lock);
1326         sk_for_each(sk, &sco_sk_list.head) {
1327                 if (sk->sk_state != BT_LISTEN)
1328                         continue;
1329
1330                 if (!bacmp(&sco_pi(sk)->src, &hdev->bdaddr) ||
1331                     !bacmp(&sco_pi(sk)->src, BDADDR_ANY)) {
1332                         lm |= HCI_LM_ACCEPT;
1333
1334                         if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
1335                                 *flags |= HCI_PROTO_DEFER;
1336                         break;
1337                 }
1338         }
1339         read_unlock(&sco_sk_list.lock);
1340
1341         return lm;
1342 }
1343
1344 static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
1345 {
1346         if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
1347                 return;
1348
1349         BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status);
1350
1351         if (!status) {
1352                 struct sco_conn *conn;
1353
1354                 conn = sco_conn_add(hcon);
1355                 if (conn)
1356                         sco_conn_ready(conn);
1357         } else
1358                 sco_conn_del(hcon, bt_to_errno(status));
1359 }
1360
1361 static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
1362 {
1363         if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
1364                 return;
1365
1366         BT_DBG("hcon %p reason %d", hcon, reason);
1367
1368         sco_conn_del(hcon, bt_to_errno(reason));
1369 }
1370
1371 void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
1372 {
1373         struct sco_conn *conn = hcon->sco_data;
1374
1375         if (!conn)
1376                 goto drop;
1377
1378         BT_DBG("conn %p len %u", conn, skb->len);
1379
1380         if (skb->len) {
1381                 sco_recv_frame(conn, skb);
1382                 return;
1383         }
1384
1385 drop:
1386         kfree_skb(skb);
1387 }
1388
1389 static struct hci_cb sco_cb = {
1390         .name           = "SCO",
1391         .connect_cfm    = sco_connect_cfm,
1392         .disconn_cfm    = sco_disconn_cfm,
1393 };
1394
1395 static int sco_debugfs_show(struct seq_file *f, void *p)
1396 {
1397         struct sock *sk;
1398
1399         read_lock(&sco_sk_list.lock);
1400
1401         sk_for_each(sk, &sco_sk_list.head) {
1402                 seq_printf(f, "%pMR %pMR %d\n", &sco_pi(sk)->src,
1403                            &sco_pi(sk)->dst, sk->sk_state);
1404         }
1405
1406         read_unlock(&sco_sk_list.lock);
1407
1408         return 0;
1409 }
1410
1411 DEFINE_SHOW_ATTRIBUTE(sco_debugfs);
1412
1413 static struct dentry *sco_debugfs;
1414
1415 static const struct proto_ops sco_sock_ops = {
1416         .family         = PF_BLUETOOTH,
1417         .owner          = THIS_MODULE,
1418         .release        = sco_sock_release,
1419         .bind           = sco_sock_bind,
1420         .connect        = sco_sock_connect,
1421         .listen         = sco_sock_listen,
1422         .accept         = sco_sock_accept,
1423         .getname        = sco_sock_getname,
1424         .sendmsg        = sco_sock_sendmsg,
1425         .recvmsg        = sco_sock_recvmsg,
1426         .poll           = bt_sock_poll,
1427         .ioctl          = bt_sock_ioctl,
1428         .gettstamp      = sock_gettstamp,
1429         .mmap           = sock_no_mmap,
1430         .socketpair     = sock_no_socketpair,
1431         .shutdown       = sco_sock_shutdown,
1432         .setsockopt     = sco_sock_setsockopt,
1433         .getsockopt     = sco_sock_getsockopt
1434 };
1435
1436 static const struct net_proto_family sco_sock_family_ops = {
1437         .family = PF_BLUETOOTH,
1438         .owner  = THIS_MODULE,
1439         .create = sco_sock_create,
1440 };
1441
1442 int __init sco_init(void)
1443 {
1444         int err;
1445
1446         BUILD_BUG_ON(sizeof(struct sockaddr_sco) > sizeof(struct sockaddr));
1447
1448         err = proto_register(&sco_proto, 0);
1449         if (err < 0)
1450                 return err;
1451
1452         err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
1453         if (err < 0) {
1454                 BT_ERR("SCO socket registration failed");
1455                 goto error;
1456         }
1457
1458         err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL);
1459         if (err < 0) {
1460                 BT_ERR("Failed to create SCO proc file");
1461                 bt_sock_unregister(BTPROTO_SCO);
1462                 goto error;
1463         }
1464
1465         BT_INFO("SCO socket layer initialized");
1466
1467         hci_register_cb(&sco_cb);
1468
1469         if (IS_ERR_OR_NULL(bt_debugfs))
1470                 return 0;
1471
1472         sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs,
1473                                           NULL, &sco_debugfs_fops);
1474
1475         return 0;
1476
1477 error:
1478         proto_unregister(&sco_proto);
1479         return err;
1480 }
1481
1482 void sco_exit(void)
1483 {
1484         bt_procfs_cleanup(&init_net, "sco");
1485
1486         debugfs_remove(sco_debugfs);
1487
1488         hci_unregister_cb(&sco_cb);
1489
1490         bt_sock_unregister(BTPROTO_SCO);
1491
1492         proto_unregister(&sco_proto);
1493 }
1494
1495 module_param(disable_esco, bool, 0644);
1496 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");