Bluetooth: sco: fix information leak to userspace
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / net / bluetooth / sco.c
blobe52443ce4f9c2cc9a1fe3f60eef59be98b9eb2ea
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
25 /* Bluetooth SCO sockets. */
27 #include <linux/module.h>
29 #include <linux/types.h>
30 #include <linux/errno.h>
31 #include <linux/kernel.h>
32 #include <linux/sched.h>
33 #include <linux/slab.h>
34 #include <linux/poll.h>
35 #include <linux/fcntl.h>
36 #include <linux/init.h>
37 #include <linux/interrupt.h>
38 #include <linux/socket.h>
39 #include <linux/skbuff.h>
40 #include <linux/device.h>
41 #include <linux/list.h>
42 #include <net/sock.h>
44 #include <asm/system.h>
45 #include <asm/uaccess.h>
47 #include <net/bluetooth/bluetooth.h>
48 #include <net/bluetooth/hci_core.h>
49 #include <net/bluetooth/sco.h>
51 #define VERSION "0.6"
53 static int disable_esco = 0;
55 static const struct proto_ops sco_sock_ops;
57 static struct bt_sock_list sco_sk_list = {
58 .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
61 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent);
62 static void sco_chan_del(struct sock *sk, int err);
64 static int sco_conn_del(struct hci_conn *conn, int err);
66 static void sco_sock_close(struct sock *sk);
67 static void sco_sock_kill(struct sock *sk);
69 /* ---- SCO timers ---- */
70 static void sco_sock_timeout(unsigned long arg)
72 struct sock *sk = (struct sock *) arg;
74 BT_DBG("sock %p state %d", sk, sk->sk_state);
76 bh_lock_sock(sk);
77 sk->sk_err = ETIMEDOUT;
78 sk->sk_state_change(sk);
79 bh_unlock_sock(sk);
81 sco_sock_kill(sk);
82 sock_put(sk);
85 static void sco_sock_set_timer(struct sock *sk, long timeout)
87 BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
88 sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
91 static void sco_sock_clear_timer(struct sock *sk)
93 BT_DBG("sock %p state %d", sk, sk->sk_state);
94 sk_stop_timer(sk, &sk->sk_timer);
97 /* ---- SCO connections ---- */
98 static struct sco_conn *sco_conn_add(struct hci_conn *hcon, __u8 status)
100 struct hci_dev *hdev = hcon->hdev;
101 struct sco_conn *conn = hcon->sco_data;
103 if (conn || status)
104 return conn;
106 conn = kzalloc(sizeof(struct sco_conn), GFP_ATOMIC);
107 if (!conn)
108 return NULL;
110 spin_lock_init(&conn->lock);
112 hcon->sco_data = conn;
113 conn->hcon = hcon;
115 conn->src = &hdev->bdaddr;
116 conn->dst = &hcon->dst;
118 if (hdev->sco_mtu > 0)
119 conn->mtu = hdev->sco_mtu;
120 else
121 conn->mtu = 60;
123 BT_DBG("hcon %p conn %p", hcon, conn);
125 return conn;
128 static inline struct sock *sco_chan_get(struct sco_conn *conn)
130 struct sock *sk = NULL;
131 sco_conn_lock(conn);
132 sk = conn->sk;
133 sco_conn_unlock(conn);
134 return sk;
137 static int sco_conn_del(struct hci_conn *hcon, int err)
139 struct sco_conn *conn;
140 struct sock *sk;
142 if (!(conn = hcon->sco_data))
143 return 0;
145 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
147 /* Kill socket */
148 if ((sk = sco_chan_get(conn))) {
149 bh_lock_sock(sk);
150 sco_sock_clear_timer(sk);
151 sco_chan_del(sk, err);
152 bh_unlock_sock(sk);
153 sco_sock_kill(sk);
156 hcon->sco_data = NULL;
157 kfree(conn);
158 return 0;
161 static inline int sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
163 int err = 0;
165 sco_conn_lock(conn);
166 if (conn->sk) {
167 err = -EBUSY;
168 } else {
169 __sco_chan_add(conn, sk, parent);
171 sco_conn_unlock(conn);
172 return err;
175 static int sco_connect(struct sock *sk)
177 bdaddr_t *src = &bt_sk(sk)->src;
178 bdaddr_t *dst = &bt_sk(sk)->dst;
179 struct sco_conn *conn;
180 struct hci_conn *hcon;
181 struct hci_dev *hdev;
182 int err, type;
184 BT_DBG("%s -> %s", batostr(src), batostr(dst));
186 if (!(hdev = hci_get_route(dst, src)))
187 return -EHOSTUNREACH;
189 hci_dev_lock_bh(hdev);
191 err = -ENOMEM;
193 if (lmp_esco_capable(hdev) && !disable_esco)
194 type = ESCO_LINK;
195 else
196 type = SCO_LINK;
198 hcon = hci_connect(hdev, type, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
199 if (!hcon)
200 goto done;
202 conn = sco_conn_add(hcon, 0);
203 if (!conn) {
204 hci_conn_put(hcon);
205 goto done;
208 /* Update source addr of the socket */
209 bacpy(src, conn->src);
211 err = sco_chan_add(conn, sk, NULL);
212 if (err)
213 goto done;
215 if (hcon->state == BT_CONNECTED) {
216 sco_sock_clear_timer(sk);
217 sk->sk_state = BT_CONNECTED;
218 } else {
219 sk->sk_state = BT_CONNECT;
220 sco_sock_set_timer(sk, sk->sk_sndtimeo);
223 done:
224 hci_dev_unlock_bh(hdev);
225 hci_dev_put(hdev);
226 return err;
229 static inline int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
231 struct sco_conn *conn = sco_pi(sk)->conn;
232 struct sk_buff *skb;
233 int err, count;
235 /* Check outgoing MTU */
236 if (len > conn->mtu)
237 return -EINVAL;
239 BT_DBG("sk %p len %d", sk, len);
241 count = min_t(unsigned int, conn->mtu, len);
242 if (!(skb = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err)))
243 return err;
245 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
246 err = -EFAULT;
247 goto fail;
250 if ((err = hci_send_sco(conn->hcon, skb)) < 0)
251 return err;
253 return count;
255 fail:
256 kfree_skb(skb);
257 return err;
260 static inline void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
262 struct sock *sk = sco_chan_get(conn);
264 if (!sk)
265 goto drop;
267 BT_DBG("sk %p len %d", sk, skb->len);
269 if (sk->sk_state != BT_CONNECTED)
270 goto drop;
272 if (!sock_queue_rcv_skb(sk, skb))
273 return;
275 drop:
276 kfree_skb(skb);
277 return;
280 /* -------- Socket interface ---------- */
281 static struct sock *__sco_get_sock_by_addr(bdaddr_t *ba)
283 struct sock *sk;
284 struct hlist_node *node;
286 sk_for_each(sk, node, &sco_sk_list.head)
287 if (!bacmp(&bt_sk(sk)->src, ba))
288 goto found;
289 sk = NULL;
290 found:
291 return sk;
294 /* Find socket listening on source bdaddr.
295 * Returns closest match.
297 static struct sock *sco_get_sock_listen(bdaddr_t *src)
299 struct sock *sk = NULL, *sk1 = NULL;
300 struct hlist_node *node;
302 read_lock(&sco_sk_list.lock);
304 sk_for_each(sk, node, &sco_sk_list.head) {
305 if (sk->sk_state != BT_LISTEN)
306 continue;
308 /* Exact match. */
309 if (!bacmp(&bt_sk(sk)->src, src))
310 break;
312 /* Closest match */
313 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
314 sk1 = sk;
317 read_unlock(&sco_sk_list.lock);
319 return node ? sk : sk1;
322 static void sco_sock_destruct(struct sock *sk)
324 BT_DBG("sk %p", sk);
326 skb_queue_purge(&sk->sk_receive_queue);
327 skb_queue_purge(&sk->sk_write_queue);
330 static void sco_sock_cleanup_listen(struct sock *parent)
332 struct sock *sk;
334 BT_DBG("parent %p", parent);
336 /* Close not yet accepted channels */
337 while ((sk = bt_accept_dequeue(parent, NULL))) {
338 sco_sock_close(sk);
339 sco_sock_kill(sk);
342 parent->sk_state = BT_CLOSED;
343 sock_set_flag(parent, SOCK_ZAPPED);
346 /* Kill socket (only if zapped and orphan)
347 * Must be called on unlocked socket.
349 static void sco_sock_kill(struct sock *sk)
351 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
352 return;
354 BT_DBG("sk %p state %d", sk, sk->sk_state);
356 /* Kill poor orphan */
357 bt_sock_unlink(&sco_sk_list, sk);
358 sock_set_flag(sk, SOCK_DEAD);
359 sock_put(sk);
362 static void __sco_sock_close(struct sock *sk)
364 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
366 switch (sk->sk_state) {
367 case BT_LISTEN:
368 sco_sock_cleanup_listen(sk);
369 break;
371 case BT_CONNECTED:
372 case BT_CONFIG:
373 case BT_CONNECT:
374 case BT_DISCONN:
375 sco_chan_del(sk, ECONNRESET);
376 break;
378 default:
379 sock_set_flag(sk, SOCK_ZAPPED);
380 break;
384 /* Must be called on unlocked socket. */
385 static void sco_sock_close(struct sock *sk)
387 sco_sock_clear_timer(sk);
388 lock_sock(sk);
389 __sco_sock_close(sk);
390 release_sock(sk);
391 sco_sock_kill(sk);
394 static void sco_sock_init(struct sock *sk, struct sock *parent)
396 BT_DBG("sk %p", sk);
398 if (parent)
399 sk->sk_type = parent->sk_type;
402 static struct proto sco_proto = {
403 .name = "SCO",
404 .owner = THIS_MODULE,
405 .obj_size = sizeof(struct sco_pinfo)
408 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
410 struct sock *sk;
412 sk = sk_alloc(net, PF_BLUETOOTH, prio, &sco_proto);
413 if (!sk)
414 return NULL;
416 sock_init_data(sock, sk);
417 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
419 sk->sk_destruct = sco_sock_destruct;
420 sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
422 sock_reset_flag(sk, SOCK_ZAPPED);
424 sk->sk_protocol = proto;
425 sk->sk_state = BT_OPEN;
427 setup_timer(&sk->sk_timer, sco_sock_timeout, (unsigned long)sk);
429 bt_sock_link(&sco_sk_list, sk);
430 return sk;
433 static int sco_sock_create(struct net *net, struct socket *sock, int protocol)
435 struct sock *sk;
437 BT_DBG("sock %p", sock);
439 sock->state = SS_UNCONNECTED;
441 if (sock->type != SOCK_SEQPACKET)
442 return -ESOCKTNOSUPPORT;
444 sock->ops = &sco_sock_ops;
446 sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC);
447 if (!sk)
448 return -ENOMEM;
450 sco_sock_init(sk, NULL);
451 return 0;
454 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
456 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
457 struct sock *sk = sock->sk;
458 bdaddr_t *src = &sa->sco_bdaddr;
459 int err = 0;
461 BT_DBG("sk %p %s", sk, batostr(&sa->sco_bdaddr));
463 if (!addr || addr->sa_family != AF_BLUETOOTH)
464 return -EINVAL;
466 lock_sock(sk);
468 if (sk->sk_state != BT_OPEN) {
469 err = -EBADFD;
470 goto done;
473 write_lock_bh(&sco_sk_list.lock);
475 if (bacmp(src, BDADDR_ANY) && __sco_get_sock_by_addr(src)) {
476 err = -EADDRINUSE;
477 } else {
478 /* Save source address */
479 bacpy(&bt_sk(sk)->src, &sa->sco_bdaddr);
480 sk->sk_state = BT_BOUND;
483 write_unlock_bh(&sco_sk_list.lock);
485 done:
486 release_sock(sk);
487 return err;
490 static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
492 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
493 struct sock *sk = sock->sk;
494 int err = 0;
497 BT_DBG("sk %p", sk);
499 if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_sco))
500 return -EINVAL;
502 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
503 return -EBADFD;
505 if (sk->sk_type != SOCK_SEQPACKET)
506 return -EINVAL;
508 lock_sock(sk);
510 /* Set destination address and psm */
511 bacpy(&bt_sk(sk)->dst, &sa->sco_bdaddr);
513 if ((err = sco_connect(sk)))
514 goto done;
516 err = bt_sock_wait_state(sk, BT_CONNECTED,
517 sock_sndtimeo(sk, flags & O_NONBLOCK));
519 done:
520 release_sock(sk);
521 return err;
524 static int sco_sock_listen(struct socket *sock, int backlog)
526 struct sock *sk = sock->sk;
527 int err = 0;
529 BT_DBG("sk %p backlog %d", sk, backlog);
531 lock_sock(sk);
533 if (sk->sk_state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
534 err = -EBADFD;
535 goto done;
538 sk->sk_max_ack_backlog = backlog;
539 sk->sk_ack_backlog = 0;
540 sk->sk_state = BT_LISTEN;
542 done:
543 release_sock(sk);
544 return err;
547 static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flags)
549 DECLARE_WAITQUEUE(wait, current);
550 struct sock *sk = sock->sk, *ch;
551 long timeo;
552 int err = 0;
554 lock_sock(sk);
556 if (sk->sk_state != BT_LISTEN) {
557 err = -EBADFD;
558 goto done;
561 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
563 BT_DBG("sk %p timeo %ld", sk, timeo);
565 /* Wait for an incoming connection. (wake-one). */
566 add_wait_queue_exclusive(sk->sk_sleep, &wait);
567 while (!(ch = bt_accept_dequeue(sk, newsock))) {
568 set_current_state(TASK_INTERRUPTIBLE);
569 if (!timeo) {
570 err = -EAGAIN;
571 break;
574 release_sock(sk);
575 timeo = schedule_timeout(timeo);
576 lock_sock(sk);
578 if (sk->sk_state != BT_LISTEN) {
579 err = -EBADFD;
580 break;
583 if (signal_pending(current)) {
584 err = sock_intr_errno(timeo);
585 break;
588 set_current_state(TASK_RUNNING);
589 remove_wait_queue(sk->sk_sleep, &wait);
591 if (err)
592 goto done;
594 newsock->state = SS_CONNECTED;
596 BT_DBG("new socket %p", ch);
598 done:
599 release_sock(sk);
600 return err;
603 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
605 struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
606 struct sock *sk = sock->sk;
608 BT_DBG("sock %p, sk %p", sock, sk);
610 addr->sa_family = AF_BLUETOOTH;
611 *len = sizeof(struct sockaddr_sco);
613 if (peer)
614 bacpy(&sa->sco_bdaddr, &bt_sk(sk)->dst);
615 else
616 bacpy(&sa->sco_bdaddr, &bt_sk(sk)->src);
618 return 0;
621 static int sco_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
622 struct msghdr *msg, size_t len)
624 struct sock *sk = sock->sk;
625 int err = 0;
627 BT_DBG("sock %p, sk %p", sock, sk);
629 err = sock_error(sk);
630 if (err)
631 return err;
633 if (msg->msg_flags & MSG_OOB)
634 return -EOPNOTSUPP;
636 lock_sock(sk);
638 if (sk->sk_state == BT_CONNECTED)
639 err = sco_send_frame(sk, msg, len);
640 else
641 err = -ENOTCONN;
643 release_sock(sk);
644 return err;
647 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
649 struct sock *sk = sock->sk;
650 int err = 0;
652 BT_DBG("sk %p", sk);
654 lock_sock(sk);
656 switch (optname) {
657 default:
658 err = -ENOPROTOOPT;
659 break;
662 release_sock(sk);
663 return err;
666 static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
668 struct sock *sk = sock->sk;
669 struct sco_options opts;
670 struct sco_conninfo cinfo;
671 int len, err = 0;
673 BT_DBG("sk %p", sk);
675 if (get_user(len, optlen))
676 return -EFAULT;
678 lock_sock(sk);
680 switch (optname) {
681 case SCO_OPTIONS:
682 if (sk->sk_state != BT_CONNECTED) {
683 err = -ENOTCONN;
684 break;
687 opts.mtu = sco_pi(sk)->conn->mtu;
689 BT_DBG("mtu %d", opts.mtu);
691 len = min_t(unsigned int, len, sizeof(opts));
692 if (copy_to_user(optval, (char *)&opts, len))
693 err = -EFAULT;
695 break;
697 case SCO_CONNINFO:
698 if (sk->sk_state != BT_CONNECTED) {
699 err = -ENOTCONN;
700 break;
703 memset(&cinfo, 0, sizeof(cinfo));
704 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
705 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
707 len = min_t(unsigned int, len, sizeof(cinfo));
708 if (copy_to_user(optval, (char *)&cinfo, len))
709 err = -EFAULT;
711 break;
713 default:
714 err = -ENOPROTOOPT;
715 break;
718 release_sock(sk);
719 return err;
722 static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
724 struct sock *sk = sock->sk;
725 int len, err = 0;
727 BT_DBG("sk %p", sk);
729 if (level == SOL_SCO)
730 return sco_sock_getsockopt_old(sock, optname, optval, optlen);
732 if (get_user(len, optlen))
733 return -EFAULT;
735 lock_sock(sk);
737 switch (optname) {
738 default:
739 err = -ENOPROTOOPT;
740 break;
743 release_sock(sk);
744 return err;
747 static int sco_sock_shutdown(struct socket *sock, int how)
749 struct sock *sk = sock->sk;
750 int err = 0;
752 BT_DBG("sock %p, sk %p", sock, sk);
754 if (!sk)
755 return 0;
757 lock_sock(sk);
758 if (!sk->sk_shutdown) {
759 sk->sk_shutdown = SHUTDOWN_MASK;
760 sco_sock_clear_timer(sk);
761 __sco_sock_close(sk);
763 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
764 err = bt_sock_wait_state(sk, BT_CLOSED,
765 sk->sk_lingertime);
767 release_sock(sk);
768 return err;
771 static int sco_sock_release(struct socket *sock)
773 struct sock *sk = sock->sk;
774 int err = 0;
776 BT_DBG("sock %p, sk %p", sock, sk);
778 if (!sk)
779 return 0;
781 sco_sock_close(sk);
783 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) {
784 lock_sock(sk);
785 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
786 release_sock(sk);
789 sock_orphan(sk);
790 sco_sock_kill(sk);
791 return err;
794 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
796 BT_DBG("conn %p", conn);
798 sco_pi(sk)->conn = conn;
799 conn->sk = sk;
801 if (parent)
802 bt_accept_enqueue(parent, sk);
805 /* Delete channel.
806 * Must be called on the locked socket. */
807 static void sco_chan_del(struct sock *sk, int err)
809 struct sco_conn *conn;
811 conn = sco_pi(sk)->conn;
813 BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
815 if (conn) {
816 sco_conn_lock(conn);
817 conn->sk = NULL;
818 sco_pi(sk)->conn = NULL;
819 sco_conn_unlock(conn);
820 hci_conn_put(conn->hcon);
823 sk->sk_state = BT_CLOSED;
824 sk->sk_err = err;
825 sk->sk_state_change(sk);
827 sock_set_flag(sk, SOCK_ZAPPED);
830 static void sco_conn_ready(struct sco_conn *conn)
832 struct sock *parent, *sk;
834 BT_DBG("conn %p", conn);
836 sco_conn_lock(conn);
838 if ((sk = conn->sk)) {
839 sco_sock_clear_timer(sk);
840 bh_lock_sock(sk);
841 sk->sk_state = BT_CONNECTED;
842 sk->sk_state_change(sk);
843 bh_unlock_sock(sk);
844 } else {
845 parent = sco_get_sock_listen(conn->src);
846 if (!parent)
847 goto done;
849 bh_lock_sock(parent);
851 sk = sco_sock_alloc(sock_net(parent), NULL, BTPROTO_SCO, GFP_ATOMIC);
852 if (!sk) {
853 bh_unlock_sock(parent);
854 goto done;
857 sco_sock_init(sk, parent);
859 bacpy(&bt_sk(sk)->src, conn->src);
860 bacpy(&bt_sk(sk)->dst, conn->dst);
862 hci_conn_hold(conn->hcon);
863 __sco_chan_add(conn, sk, parent);
865 sk->sk_state = BT_CONNECTED;
867 /* Wake up parent */
868 parent->sk_data_ready(parent, 1);
870 bh_unlock_sock(parent);
873 done:
874 sco_conn_unlock(conn);
877 /* ----- SCO interface with lower layer (HCI) ----- */
878 static int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type)
880 register struct sock *sk;
881 struct hlist_node *node;
882 int lm = 0;
884 if (type != SCO_LINK && type != ESCO_LINK)
885 return 0;
887 BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
889 /* Find listening sockets */
890 read_lock(&sco_sk_list.lock);
891 sk_for_each(sk, node, &sco_sk_list.head) {
892 if (sk->sk_state != BT_LISTEN)
893 continue;
895 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr) ||
896 !bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
897 lm |= HCI_LM_ACCEPT;
898 break;
901 read_unlock(&sco_sk_list.lock);
903 return lm;
906 static int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
908 BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
910 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
911 return 0;
913 if (!status) {
914 struct sco_conn *conn;
916 conn = sco_conn_add(hcon, status);
917 if (conn)
918 sco_conn_ready(conn);
919 } else
920 sco_conn_del(hcon, bt_err(status));
922 return 0;
925 static int sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
927 BT_DBG("hcon %p reason %d", hcon, reason);
929 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
930 return 0;
932 sco_conn_del(hcon, bt_err(reason));
934 return 0;
937 static int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
939 struct sco_conn *conn = hcon->sco_data;
941 if (!conn)
942 goto drop;
944 BT_DBG("conn %p len %d", conn, skb->len);
946 if (skb->len) {
947 sco_recv_frame(conn, skb);
948 return 0;
951 drop:
952 kfree_skb(skb);
953 return 0;
956 static ssize_t sco_sysfs_show(struct class *dev, char *buf)
958 struct sock *sk;
959 struct hlist_node *node;
960 char *str = buf;
961 int size = PAGE_SIZE;
963 read_lock_bh(&sco_sk_list.lock);
965 sk_for_each(sk, node, &sco_sk_list.head) {
966 int len;
968 len = snprintf(str, size, "%s %s %d\n",
969 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
970 sk->sk_state);
972 size -= len;
973 if (size <= 0)
974 break;
976 str += len;
979 read_unlock_bh(&sco_sk_list.lock);
981 return (str - buf);
984 static CLASS_ATTR(sco, S_IRUGO, sco_sysfs_show, NULL);
986 static const struct proto_ops sco_sock_ops = {
987 .family = PF_BLUETOOTH,
988 .owner = THIS_MODULE,
989 .release = sco_sock_release,
990 .bind = sco_sock_bind,
991 .connect = sco_sock_connect,
992 .listen = sco_sock_listen,
993 .accept = sco_sock_accept,
994 .getname = sco_sock_getname,
995 .sendmsg = sco_sock_sendmsg,
996 .recvmsg = bt_sock_recvmsg,
997 .poll = bt_sock_poll,
998 .ioctl = bt_sock_ioctl,
999 .mmap = sock_no_mmap,
1000 .socketpair = sock_no_socketpair,
1001 .shutdown = sco_sock_shutdown,
1002 .setsockopt = sco_sock_setsockopt,
1003 .getsockopt = sco_sock_getsockopt
1006 static struct net_proto_family sco_sock_family_ops = {
1007 .family = PF_BLUETOOTH,
1008 .owner = THIS_MODULE,
1009 .create = sco_sock_create,
1012 static struct hci_proto sco_hci_proto = {
1013 .name = "SCO",
1014 .id = HCI_PROTO_SCO,
1015 .connect_ind = sco_connect_ind,
1016 .connect_cfm = sco_connect_cfm,
1017 .disconn_cfm = sco_disconn_cfm,
1018 .recv_scodata = sco_recv_scodata
1021 static int __init sco_init(void)
1023 int err;
1025 err = proto_register(&sco_proto, 0);
1026 if (err < 0)
1027 return err;
1029 err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
1030 if (err < 0) {
1031 BT_ERR("SCO socket registration failed");
1032 goto error;
1035 err = hci_register_proto(&sco_hci_proto);
1036 if (err < 0) {
1037 BT_ERR("SCO protocol registration failed");
1038 bt_sock_unregister(BTPROTO_SCO);
1039 goto error;
1042 if (class_create_file(bt_class, &class_attr_sco) < 0)
1043 BT_ERR("Failed to create SCO info file");
1045 BT_INFO("SCO (Voice Link) ver %s", VERSION);
1046 BT_INFO("SCO socket layer initialized");
1048 return 0;
1050 error:
1051 proto_unregister(&sco_proto);
1052 return err;
1055 static void __exit sco_exit(void)
1057 class_remove_file(bt_class, &class_attr_sco);
1059 if (bt_sock_unregister(BTPROTO_SCO) < 0)
1060 BT_ERR("SCO socket unregistration failed");
1062 if (hci_unregister_proto(&sco_hci_proto) < 0)
1063 BT_ERR("SCO protocol unregistration failed");
1065 proto_unregister(&sco_proto);
1068 module_init(sco_init);
1069 module_exit(sco_exit);
1071 module_param(disable_esco, bool, 0644);
1072 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");
1074 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1075 MODULE_DESCRIPTION("Bluetooth SCO ver " VERSION);
1076 MODULE_VERSION(VERSION);
1077 MODULE_LICENSE("GPL");
1078 MODULE_ALIAS("bt-proto-2");