1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4 
5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6 
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License version 2 as
9    published by the Free Software Foundation;
10 
11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 
20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22    SOFTWARE IS DISCLAIMED.
23 */
24 
25 /* Bluetooth SCO sockets. */
26 
27 #include <linux/module.h>
28 #include <linux/debugfs.h>
29 #include <linux/seq_file.h>
30 #include <linux/sched/signal.h>
31 
32 #include <net/bluetooth/bluetooth.h>
33 #include <net/bluetooth/hci_core.h>
34 #include <net/bluetooth/sco.h>
35 
36 static bool disable_esco;
37 
38 static const struct proto_ops sco_sock_ops;
39 
40 static struct bt_sock_list sco_sk_list = {
41 	.lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
42 };
43 
44 /* ---- SCO connections ---- */
45 struct sco_conn {
46 	struct hci_conn	*hcon;
47 
48 	spinlock_t	lock;
49 	struct sock	*sk;
50 
51 	struct delayed_work	timeout_work;
52 
53 	unsigned int    mtu;
54 	struct kref	ref;
55 };
56 
57 #define sco_conn_lock(c)	spin_lock(&c->lock)
58 #define sco_conn_unlock(c)	spin_unlock(&c->lock)
59 
60 static void sco_sock_close(struct sock *sk);
61 static void sco_sock_kill(struct sock *sk);
62 
63 /* ----- SCO socket info ----- */
64 #define sco_pi(sk) ((struct sco_pinfo *) sk)
65 
66 struct sco_pinfo {
67 	struct bt_sock	bt;
68 	bdaddr_t	src;
69 	bdaddr_t	dst;
70 	__u32		flags;
71 	__u16		setting;
72 	struct bt_codec codec;
73 	struct sco_conn	*conn;
74 };
75 
76 /* ---- SCO timers ---- */
77 #define SCO_CONN_TIMEOUT	(HZ * 40)
78 #define SCO_DISCONN_TIMEOUT	(HZ * 2)
79 
80 static void sco_conn_free(struct kref *ref)
81 {
82 	struct sco_conn *conn = container_of(ref, struct sco_conn, ref);
83 
84 	BT_DBG("conn %p", conn);
85 
86 	if (conn->sk)
87 		sco_pi(conn->sk)->conn = NULL;
88 
89 	if (conn->hcon) {
90 		conn->hcon->sco_data = NULL;
91 		hci_conn_drop(conn->hcon);
92 	}
93 
94 	/* Ensure no more work items will run since hci_conn has been dropped */
95 	disable_delayed_work_sync(&conn->timeout_work);
96 
97 	kfree(conn);
98 }
99 
100 static void sco_conn_put(struct sco_conn *conn)
101 {
102 	if (!conn)
103 		return;
104 
105 	BT_DBG("conn %p refcnt %d", conn, kref_read(&conn->ref));
106 
107 	kref_put(&conn->ref, sco_conn_free);
108 }
109 
110 static struct sco_conn *sco_conn_hold(struct sco_conn *conn)
111 {
112 	BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref));
113 
114 	kref_get(&conn->ref);
115 	return conn;
116 }
117 
118 static struct sco_conn *sco_conn_hold_unless_zero(struct sco_conn *conn)
119 {
120 	if (!conn)
121 		return NULL;
122 
123 	BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref));
124 
125 	if (!kref_get_unless_zero(&conn->ref))
126 		return NULL;
127 
128 	return conn;
129 }
130 
131 static struct sock *sco_sock_hold(struct sco_conn *conn)
132 {
133 	if (!conn || !bt_sock_linked(&sco_sk_list, conn->sk))
134 		return NULL;
135 
136 	sock_hold(conn->sk);
137 
138 	return conn->sk;
139 }
140 
141 static void sco_sock_timeout(struct work_struct *work)
142 {
143 	struct sco_conn *conn = container_of(work, struct sco_conn,
144 					     timeout_work.work);
145 	struct sock *sk;
146 
147 	conn = sco_conn_hold_unless_zero(conn);
148 	if (!conn)
149 		return;
150 
151 	sco_conn_lock(conn);
152 	if (!conn->hcon) {
153 		sco_conn_unlock(conn);
154 		sco_conn_put(conn);
155 		return;
156 	}
157 	sk = sco_sock_hold(conn);
158 	sco_conn_unlock(conn);
159 	sco_conn_put(conn);
160 
161 	if (!sk)
162 		return;
163 
164 	BT_DBG("sock %p state %d", sk, sk->sk_state);
165 
166 	lock_sock(sk);
167 	sk->sk_err = ETIMEDOUT;
168 	sk->sk_state_change(sk);
169 	release_sock(sk);
170 	sock_put(sk);
171 }
172 
173 static void sco_sock_set_timer(struct sock *sk, long timeout)
174 {
175 	if (!sco_pi(sk)->conn)
176 		return;
177 
178 	BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
179 	cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
180 	schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout);
181 }
182 
183 static void sco_sock_clear_timer(struct sock *sk)
184 {
185 	if (!sco_pi(sk)->conn)
186 		return;
187 
188 	BT_DBG("sock %p state %d", sk, sk->sk_state);
189 	cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
190 }
191 
192 /* ---- SCO connections ---- */
193 static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
194 {
195 	struct sco_conn *conn = hcon->sco_data;
196 
197 	conn = sco_conn_hold_unless_zero(conn);
198 	if (conn) {
199 		if (!conn->hcon) {
200 			sco_conn_lock(conn);
201 			conn->hcon = hcon;
202 			sco_conn_unlock(conn);
203 		}
204 		return conn;
205 	}
206 
207 	conn = kzalloc(sizeof(struct sco_conn), GFP_KERNEL);
208 	if (!conn)
209 		return NULL;
210 
211 	kref_init(&conn->ref);
212 	spin_lock_init(&conn->lock);
213 	INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
214 
215 	hcon->sco_data = conn;
216 	conn->hcon = hcon;
217 	conn->mtu = hcon->mtu;
218 
219 	if (hcon->mtu > 0)
220 		conn->mtu = hcon->mtu;
221 	else
222 		conn->mtu = 60;
223 
224 	BT_DBG("hcon %p conn %p", hcon, conn);
225 
226 	return conn;
227 }
228 
229 /* Delete channel.
230  * Must be called on the locked socket. */
231 static void sco_chan_del(struct sock *sk, int err)
232 {
233 	struct sco_conn *conn;
234 
235 	conn = sco_pi(sk)->conn;
236 	sco_pi(sk)->conn = NULL;
237 
238 	BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
239 
240 	if (conn) {
241 		sco_conn_lock(conn);
242 		conn->sk = NULL;
243 		sco_conn_unlock(conn);
244 		sco_conn_put(conn);
245 	}
246 
247 	sk->sk_state = BT_CLOSED;
248 	sk->sk_err   = err;
249 	sk->sk_state_change(sk);
250 
251 	sock_set_flag(sk, SOCK_ZAPPED);
252 }
253 
254 static void sco_conn_del(struct hci_conn *hcon, int err)
255 {
256 	struct sco_conn *conn = hcon->sco_data;
257 	struct sock *sk;
258 
259 	conn = sco_conn_hold_unless_zero(conn);
260 	if (!conn)
261 		return;
262 
263 	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
264 
265 	sco_conn_lock(conn);
266 	sk = sco_sock_hold(conn);
267 	sco_conn_unlock(conn);
268 	sco_conn_put(conn);
269 
270 	if (!sk) {
271 		sco_conn_put(conn);
272 		return;
273 	}
274 
275 	/* Kill socket */
276 	lock_sock(sk);
277 	sco_sock_clear_timer(sk);
278 	sco_chan_del(sk, err);
279 	release_sock(sk);
280 	sock_put(sk);
281 }
282 
283 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
284 			   struct sock *parent)
285 {
286 	BT_DBG("conn %p", conn);
287 
288 	sco_pi(sk)->conn = conn;
289 	conn->sk = sk;
290 
291 	if (parent)
292 		bt_accept_enqueue(parent, sk, true);
293 }
294 
295 static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
296 			struct sock *parent)
297 {
298 	int err = 0;
299 
300 	sco_conn_lock(conn);
301 	if (conn->sk)
302 		err = -EBUSY;
303 	else
304 		__sco_chan_add(conn, sk, parent);
305 
306 	sco_conn_unlock(conn);
307 	return err;
308 }
309 
310 static int sco_connect(struct sock *sk)
311 {
312 	struct sco_conn *conn;
313 	struct hci_conn *hcon;
314 	struct hci_dev  *hdev;
315 	int err, type;
316 
317 	BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst);
318 
319 	hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
320 	if (!hdev)
321 		return -EHOSTUNREACH;
322 
323 	hci_dev_lock(hdev);
324 
325 	if (lmp_esco_capable(hdev) && !disable_esco)
326 		type = ESCO_LINK;
327 	else
328 		type = SCO_LINK;
329 
330 	switch (sco_pi(sk)->setting & SCO_AIRMODE_MASK) {
331 	case SCO_AIRMODE_TRANSP:
332 		if (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev)) {
333 			err = -EOPNOTSUPP;
334 			goto unlock;
335 		}
336 		break;
337 	}
338 
339 	hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst,
340 			       sco_pi(sk)->setting, &sco_pi(sk)->codec,
341 			       sk->sk_sndtimeo);
342 	if (IS_ERR(hcon)) {
343 		err = PTR_ERR(hcon);
344 		goto unlock;
345 	}
346 
347 	conn = sco_conn_add(hcon);
348 	if (!conn) {
349 		hci_conn_drop(hcon);
350 		err = -ENOMEM;
351 		goto unlock;
352 	}
353 
354 	lock_sock(sk);
355 
356 	err = sco_chan_add(conn, sk, NULL);
357 	if (err) {
358 		release_sock(sk);
359 		goto unlock;
360 	}
361 
362 	/* Update source addr of the socket */
363 	bacpy(&sco_pi(sk)->src, &hcon->src);
364 
365 	if (hcon->state == BT_CONNECTED) {
366 		sco_sock_clear_timer(sk);
367 		sk->sk_state = BT_CONNECTED;
368 	} else {
369 		sk->sk_state = BT_CONNECT;
370 		sco_sock_set_timer(sk, sk->sk_sndtimeo);
371 	}
372 
373 	release_sock(sk);
374 
375 unlock:
376 	hci_dev_unlock(hdev);
377 	hci_dev_put(hdev);
378 	return err;
379 }
380 
381 static int sco_send_frame(struct sock *sk, struct sk_buff *skb,
382 			  const struct sockcm_cookie *sockc)
383 {
384 	struct sco_conn *conn = sco_pi(sk)->conn;
385 	int len = skb->len;
386 
387 	/* Check outgoing MTU */
388 	if (len > conn->mtu)
389 		return -EINVAL;
390 
391 	BT_DBG("sk %p len %d", sk, len);
392 
393 	hci_setup_tx_timestamp(skb, 1, sockc);
394 	hci_send_sco(conn->hcon, skb);
395 
396 	return len;
397 }
398 
399 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
400 {
401 	struct sock *sk;
402 
403 	sco_conn_lock(conn);
404 	sk = conn->sk;
405 	sco_conn_unlock(conn);
406 
407 	if (!sk)
408 		goto drop;
409 
410 	BT_DBG("sk %p len %u", sk, skb->len);
411 
412 	if (sk->sk_state != BT_CONNECTED)
413 		goto drop;
414 
415 	if (!sock_queue_rcv_skb(sk, skb))
416 		return;
417 
418 drop:
419 	kfree_skb(skb);
420 }
421 
422 /* -------- Socket interface ---------- */
423 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
424 {
425 	struct sock *sk;
426 
427 	sk_for_each(sk, &sco_sk_list.head) {
428 		if (sk->sk_state != BT_LISTEN)
429 			continue;
430 
431 		if (!bacmp(&sco_pi(sk)->src, ba))
432 			return sk;
433 	}
434 
435 	return NULL;
436 }
437 
438 /* Find socket listening on source bdaddr.
439  * Returns closest match.
440  */
441 static struct sock *sco_get_sock_listen(bdaddr_t *src)
442 {
443 	struct sock *sk = NULL, *sk1 = NULL;
444 
445 	read_lock(&sco_sk_list.lock);
446 
447 	sk_for_each(sk, &sco_sk_list.head) {
448 		if (sk->sk_state != BT_LISTEN)
449 			continue;
450 
451 		/* Exact match. */
452 		if (!bacmp(&sco_pi(sk)->src, src))
453 			break;
454 
455 		/* Closest match */
456 		if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY))
457 			sk1 = sk;
458 	}
459 
460 	read_unlock(&sco_sk_list.lock);
461 
462 	return sk ? sk : sk1;
463 }
464 
465 static void sco_sock_destruct(struct sock *sk)
466 {
467 	BT_DBG("sk %p", sk);
468 
469 	sco_conn_put(sco_pi(sk)->conn);
470 
471 	skb_queue_purge(&sk->sk_receive_queue);
472 	skb_queue_purge(&sk->sk_write_queue);
473 }
474 
475 static void sco_sock_cleanup_listen(struct sock *parent)
476 {
477 	struct sock *sk;
478 
479 	BT_DBG("parent %p", parent);
480 
481 	/* Close not yet accepted channels */
482 	while ((sk = bt_accept_dequeue(parent, NULL))) {
483 		sco_sock_close(sk);
484 		sco_sock_kill(sk);
485 	}
486 
487 	parent->sk_state  = BT_CLOSED;
488 	sock_set_flag(parent, SOCK_ZAPPED);
489 }
490 
491 /* Kill socket (only if zapped and orphan)
492  * Must be called on unlocked socket.
493  */
494 static void sco_sock_kill(struct sock *sk)
495 {
496 	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
497 		return;
498 
499 	BT_DBG("sk %p state %d", sk, sk->sk_state);
500 
501 	/* Kill poor orphan */
502 	bt_sock_unlink(&sco_sk_list, sk);
503 	sock_set_flag(sk, SOCK_DEAD);
504 	sock_put(sk);
505 }
506 
507 static void __sco_sock_close(struct sock *sk)
508 {
509 	BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
510 
511 	switch (sk->sk_state) {
512 	case BT_LISTEN:
513 		sco_sock_cleanup_listen(sk);
514 		break;
515 
516 	case BT_CONNECTED:
517 	case BT_CONFIG:
518 	case BT_CONNECT2:
519 	case BT_CONNECT:
520 	case BT_DISCONN:
521 		sco_chan_del(sk, ECONNRESET);
522 		break;
523 
524 	default:
525 		sock_set_flag(sk, SOCK_ZAPPED);
526 		break;
527 	}
528 
529 }
530 
531 /* Must be called on unlocked socket. */
532 static void sco_sock_close(struct sock *sk)
533 {
534 	lock_sock(sk);
535 	sco_sock_clear_timer(sk);
536 	__sco_sock_close(sk);
537 	release_sock(sk);
538 }
539 
540 static void sco_sock_init(struct sock *sk, struct sock *parent)
541 {
542 	BT_DBG("sk %p", sk);
543 
544 	if (parent) {
545 		sk->sk_type = parent->sk_type;
546 		bt_sk(sk)->flags = bt_sk(parent)->flags;
547 		security_sk_clone(parent, sk);
548 	}
549 }
550 
551 static struct proto sco_proto = {
552 	.name		= "SCO",
553 	.owner		= THIS_MODULE,
554 	.obj_size	= sizeof(struct sco_pinfo)
555 };
556 
557 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock,
558 				   int proto, gfp_t prio, int kern)
559 {
560 	struct sock *sk;
561 
562 	sk = bt_sock_alloc(net, sock, &sco_proto, proto, prio, kern);
563 	if (!sk)
564 		return NULL;
565 
566 	sk->sk_destruct = sco_sock_destruct;
567 	sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
568 
569 	sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
570 	sco_pi(sk)->codec.id = BT_CODEC_CVSD;
571 	sco_pi(sk)->codec.cid = 0xffff;
572 	sco_pi(sk)->codec.vid = 0xffff;
573 	sco_pi(sk)->codec.data_path = 0x00;
574 
575 	bt_sock_link(&sco_sk_list, sk);
576 	return sk;
577 }
578 
579 static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
580 			   int kern)
581 {
582 	struct sock *sk;
583 
584 	BT_DBG("sock %p", sock);
585 
586 	sock->state = SS_UNCONNECTED;
587 
588 	if (sock->type != SOCK_SEQPACKET)
589 		return -ESOCKTNOSUPPORT;
590 
591 	sock->ops = &sco_sock_ops;
592 
593 	sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
594 	if (!sk)
595 		return -ENOMEM;
596 
597 	sco_sock_init(sk, NULL);
598 	return 0;
599 }
600 
601 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr,
602 			 int addr_len)
603 {
604 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
605 	struct sock *sk = sock->sk;
606 	int err = 0;
607 
608 	if (!addr || addr_len < sizeof(struct sockaddr_sco) ||
609 	    addr->sa_family != AF_BLUETOOTH)
610 		return -EINVAL;
611 
612 	BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
613 
614 	lock_sock(sk);
615 
616 	if (sk->sk_state != BT_OPEN) {
617 		err = -EBADFD;
618 		goto done;
619 	}
620 
621 	if (sk->sk_type != SOCK_SEQPACKET) {
622 		err = -EINVAL;
623 		goto done;
624 	}
625 
626 	bacpy(&sco_pi(sk)->src, &sa->sco_bdaddr);
627 
628 	sk->sk_state = BT_BOUND;
629 
630 done:
631 	release_sock(sk);
632 	return err;
633 }
634 
635 static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
636 {
637 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
638 	struct sock *sk = sock->sk;
639 	int err;
640 
641 	BT_DBG("sk %p", sk);
642 
643 	if (alen < sizeof(struct sockaddr_sco) ||
644 	    addr->sa_family != AF_BLUETOOTH)
645 		return -EINVAL;
646 
647 	if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
648 		return -EBADFD;
649 
650 	if (sk->sk_type != SOCK_SEQPACKET)
651 		err = -EINVAL;
652 
653 	lock_sock(sk);
654 	/* Set destination address and psm */
655 	bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr);
656 	release_sock(sk);
657 
658 	err = sco_connect(sk);
659 	if (err)
660 		return err;
661 
662 	lock_sock(sk);
663 
664 	err = bt_sock_wait_state(sk, BT_CONNECTED,
665 				 sock_sndtimeo(sk, flags & O_NONBLOCK));
666 
667 	release_sock(sk);
668 	return err;
669 }
670 
671 static int sco_sock_listen(struct socket *sock, int backlog)
672 {
673 	struct sock *sk = sock->sk;
674 	bdaddr_t *src = &sco_pi(sk)->src;
675 	int err = 0;
676 
677 	BT_DBG("sk %p backlog %d", sk, backlog);
678 
679 	lock_sock(sk);
680 
681 	if (sk->sk_state != BT_BOUND) {
682 		err = -EBADFD;
683 		goto done;
684 	}
685 
686 	if (sk->sk_type != SOCK_SEQPACKET) {
687 		err = -EINVAL;
688 		goto done;
689 	}
690 
691 	write_lock(&sco_sk_list.lock);
692 
693 	if (__sco_get_sock_listen_by_addr(src)) {
694 		err = -EADDRINUSE;
695 		goto unlock;
696 	}
697 
698 	sk->sk_max_ack_backlog = backlog;
699 	sk->sk_ack_backlog = 0;
700 
701 	sk->sk_state = BT_LISTEN;
702 
703 unlock:
704 	write_unlock(&sco_sk_list.lock);
705 
706 done:
707 	release_sock(sk);
708 	return err;
709 }
710 
711 static int sco_sock_accept(struct socket *sock, struct socket *newsock,
712 			   struct proto_accept_arg *arg)
713 {
714 	DEFINE_WAIT_FUNC(wait, woken_wake_function);
715 	struct sock *sk = sock->sk, *ch;
716 	long timeo;
717 	int err = 0;
718 
719 	lock_sock(sk);
720 
721 	timeo = sock_rcvtimeo(sk, arg->flags & O_NONBLOCK);
722 
723 	BT_DBG("sk %p timeo %ld", sk, timeo);
724 
725 	/* Wait for an incoming connection. (wake-one). */
726 	add_wait_queue_exclusive(sk_sleep(sk), &wait);
727 	while (1) {
728 		if (sk->sk_state != BT_LISTEN) {
729 			err = -EBADFD;
730 			break;
731 		}
732 
733 		ch = bt_accept_dequeue(sk, newsock);
734 		if (ch)
735 			break;
736 
737 		if (!timeo) {
738 			err = -EAGAIN;
739 			break;
740 		}
741 
742 		if (signal_pending(current)) {
743 			err = sock_intr_errno(timeo);
744 			break;
745 		}
746 
747 		release_sock(sk);
748 
749 		timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
750 		lock_sock(sk);
751 	}
752 	remove_wait_queue(sk_sleep(sk), &wait);
753 
754 	if (err)
755 		goto done;
756 
757 	newsock->state = SS_CONNECTED;
758 
759 	BT_DBG("new socket %p", ch);
760 
761 done:
762 	release_sock(sk);
763 	return err;
764 }
765 
766 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr,
767 			    int peer)
768 {
769 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
770 	struct sock *sk = sock->sk;
771 
772 	BT_DBG("sock %p, sk %p", sock, sk);
773 
774 	addr->sa_family = AF_BLUETOOTH;
775 
776 	if (peer)
777 		bacpy(&sa->sco_bdaddr, &sco_pi(sk)->dst);
778 	else
779 		bacpy(&sa->sco_bdaddr, &sco_pi(sk)->src);
780 
781 	return sizeof(struct sockaddr_sco);
782 }
783 
784 static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
785 			    size_t len)
786 {
787 	struct sock *sk = sock->sk;
788 	struct sk_buff *skb;
789 	struct sockcm_cookie sockc;
790 	int err;
791 
792 	BT_DBG("sock %p, sk %p", sock, sk);
793 
794 	err = sock_error(sk);
795 	if (err)
796 		return err;
797 
798 	if (msg->msg_flags & MSG_OOB)
799 		return -EOPNOTSUPP;
800 
801 	hci_sockcm_init(&sockc, sk);
802 
803 	if (msg->msg_controllen) {
804 		err = sock_cmsg_send(sk, msg, &sockc);
805 		if (err)
806 			return err;
807 	}
808 
809 	skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0);
810 	if (IS_ERR(skb))
811 		return PTR_ERR(skb);
812 
813 	lock_sock(sk);
814 
815 	if (sk->sk_state == BT_CONNECTED)
816 		err = sco_send_frame(sk, skb, &sockc);
817 	else
818 		err = -ENOTCONN;
819 
820 	release_sock(sk);
821 
822 	if (err < 0)
823 		kfree_skb(skb);
824 	return err;
825 }
826 
827 static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
828 {
829 	struct hci_dev *hdev = conn->hdev;
830 
831 	BT_DBG("conn %p", conn);
832 
833 	conn->state = BT_CONFIG;
834 
835 	if (!lmp_esco_capable(hdev)) {
836 		struct hci_cp_accept_conn_req cp;
837 
838 		bacpy(&cp.bdaddr, &conn->dst);
839 		cp.role = 0x00; /* Ignored */
840 
841 		hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
842 	} else {
843 		struct hci_cp_accept_sync_conn_req cp;
844 
845 		bacpy(&cp.bdaddr, &conn->dst);
846 		cp.pkt_type = cpu_to_le16(conn->pkt_type);
847 
848 		cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
849 		cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
850 		cp.content_format = cpu_to_le16(setting);
851 
852 		switch (setting & SCO_AIRMODE_MASK) {
853 		case SCO_AIRMODE_TRANSP:
854 			if (conn->pkt_type & ESCO_2EV3)
855 				cp.max_latency = cpu_to_le16(0x0008);
856 			else
857 				cp.max_latency = cpu_to_le16(0x000D);
858 			cp.retrans_effort = 0x02;
859 			break;
860 		case SCO_AIRMODE_CVSD:
861 			cp.max_latency = cpu_to_le16(0xffff);
862 			cp.retrans_effort = 0xff;
863 			break;
864 		default:
865 			/* use CVSD settings as fallback */
866 			cp.max_latency = cpu_to_le16(0xffff);
867 			cp.retrans_effort = 0xff;
868 			break;
869 		}
870 
871 		hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
872 			     sizeof(cp), &cp);
873 	}
874 }
875 
876 static int sco_sock_recvmsg(struct socket *sock, struct msghdr *msg,
877 			    size_t len, int flags)
878 {
879 	struct sock *sk = sock->sk;
880 	struct sco_pinfo *pi = sco_pi(sk);
881 
882 	if (unlikely(flags & MSG_ERRQUEUE))
883 		return sock_recv_errqueue(sk, msg, len, SOL_BLUETOOTH,
884 					  BT_SCM_ERROR);
885 
886 	lock_sock(sk);
887 
888 	if (sk->sk_state == BT_CONNECT2 &&
889 	    test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
890 		sco_conn_defer_accept(pi->conn->hcon, pi->setting);
891 		sk->sk_state = BT_CONFIG;
892 
893 		release_sock(sk);
894 		return 0;
895 	}
896 
897 	release_sock(sk);
898 
899 	return bt_sock_recvmsg(sock, msg, len, flags);
900 }
901 
902 static int sco_sock_setsockopt(struct socket *sock, int level, int optname,
903 			       sockptr_t optval, unsigned int optlen)
904 {
905 	struct sock *sk = sock->sk;
906 	int err = 0;
907 	struct bt_voice voice;
908 	u32 opt;
909 	struct bt_codecs *codecs;
910 	struct hci_dev *hdev;
911 	__u8 buffer[255];
912 
913 	BT_DBG("sk %p", sk);
914 
915 	lock_sock(sk);
916 
917 	switch (optname) {
918 
919 	case BT_DEFER_SETUP:
920 		if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
921 			err = -EINVAL;
922 			break;
923 		}
924 
925 		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
926 		if (err)
927 			break;
928 
929 		if (opt)
930 			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
931 		else
932 			clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
933 		break;
934 
935 	case BT_VOICE:
936 		if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
937 		    sk->sk_state != BT_CONNECT2) {
938 			err = -EINVAL;
939 			break;
940 		}
941 
942 		voice.setting = sco_pi(sk)->setting;
943 
944 		err = copy_safe_from_sockptr(&voice, sizeof(voice), optval,
945 					     optlen);
946 		if (err)
947 			break;
948 
949 		sco_pi(sk)->setting = voice.setting;
950 		hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src,
951 				     BDADDR_BREDR);
952 		if (!hdev) {
953 			err = -EBADFD;
954 			break;
955 		}
956 
957 		switch (sco_pi(sk)->setting & SCO_AIRMODE_MASK) {
958 		case SCO_AIRMODE_TRANSP:
959 			if (enhanced_sync_conn_capable(hdev))
960 				sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT;
961 			break;
962 		}
963 
964 		hci_dev_put(hdev);
965 		break;
966 
967 	case BT_PKT_STATUS:
968 		err = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
969 		if (err)
970 			break;
971 
972 		if (opt)
973 			set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
974 		else
975 			clear_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
976 		break;
977 
978 	case BT_CODEC:
979 		if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
980 		    sk->sk_state != BT_CONNECT2) {
981 			err = -EINVAL;
982 			break;
983 		}
984 
985 		hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src,
986 				     BDADDR_BREDR);
987 		if (!hdev) {
988 			err = -EBADFD;
989 			break;
990 		}
991 
992 		if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) {
993 			hci_dev_put(hdev);
994 			err = -EOPNOTSUPP;
995 			break;
996 		}
997 
998 		if (!hdev->get_data_path_id) {
999 			hci_dev_put(hdev);
1000 			err = -EOPNOTSUPP;
1001 			break;
1002 		}
1003 
1004 		if (optlen < sizeof(struct bt_codecs) ||
1005 		    optlen > sizeof(buffer)) {
1006 			hci_dev_put(hdev);
1007 			err = -EINVAL;
1008 			break;
1009 		}
1010 
1011 		err = copy_struct_from_sockptr(buffer, sizeof(buffer), optval,
1012 					       optlen);
1013 		if (err) {
1014 			hci_dev_put(hdev);
1015 			break;
1016 		}
1017 
1018 		codecs = (void *)buffer;
1019 
1020 		if (codecs->num_codecs > 1) {
1021 			hci_dev_put(hdev);
1022 			err = -EINVAL;
1023 			break;
1024 		}
1025 
1026 		sco_pi(sk)->codec = codecs->codecs[0];
1027 		hci_dev_put(hdev);
1028 		break;
1029 
1030 	default:
1031 		err = -ENOPROTOOPT;
1032 		break;
1033 	}
1034 
1035 	release_sock(sk);
1036 	return err;
1037 }
1038 
1039 static int sco_sock_getsockopt_old(struct socket *sock, int optname,
1040 				   char __user *optval, int __user *optlen)
1041 {
1042 	struct sock *sk = sock->sk;
1043 	struct sco_options opts;
1044 	struct sco_conninfo cinfo;
1045 	int err = 0;
1046 	size_t len;
1047 
1048 	BT_DBG("sk %p", sk);
1049 
1050 	if (get_user(len, optlen))
1051 		return -EFAULT;
1052 
1053 	lock_sock(sk);
1054 
1055 	switch (optname) {
1056 	case SCO_OPTIONS:
1057 		if (sk->sk_state != BT_CONNECTED &&
1058 		    !(sk->sk_state == BT_CONNECT2 &&
1059 		      test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
1060 			err = -ENOTCONN;
1061 			break;
1062 		}
1063 
1064 		opts.mtu = sco_pi(sk)->conn->mtu;
1065 
1066 		BT_DBG("mtu %u", opts.mtu);
1067 
1068 		len = min(len, sizeof(opts));
1069 		if (copy_to_user(optval, (char *)&opts, len))
1070 			err = -EFAULT;
1071 
1072 		break;
1073 
1074 	case SCO_CONNINFO:
1075 		if (sk->sk_state != BT_CONNECTED &&
1076 		    !(sk->sk_state == BT_CONNECT2 &&
1077 		      test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
1078 			err = -ENOTCONN;
1079 			break;
1080 		}
1081 
1082 		memset(&cinfo, 0, sizeof(cinfo));
1083 		cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
1084 		memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
1085 
1086 		len = min(len, sizeof(cinfo));
1087 		if (copy_to_user(optval, (char *)&cinfo, len))
1088 			err = -EFAULT;
1089 
1090 		break;
1091 
1092 	default:
1093 		err = -ENOPROTOOPT;
1094 		break;
1095 	}
1096 
1097 	release_sock(sk);
1098 	return err;
1099 }
1100 
1101 static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
1102 			       char __user *optval, int __user *optlen)
1103 {
1104 	struct sock *sk = sock->sk;
1105 	int len, err = 0;
1106 	struct bt_voice voice;
1107 	u32 phys;
1108 	int buf_len;
1109 	struct codec_list *c;
1110 	u8 num_codecs, i, __user *ptr;
1111 	struct hci_dev *hdev;
1112 	struct hci_codec_caps *caps;
1113 	struct bt_codec codec;
1114 
1115 	BT_DBG("sk %p", sk);
1116 
1117 	if (level == SOL_SCO)
1118 		return sco_sock_getsockopt_old(sock, optname, optval, optlen);
1119 
1120 	if (get_user(len, optlen))
1121 		return -EFAULT;
1122 
1123 	lock_sock(sk);
1124 
1125 	switch (optname) {
1126 
1127 	case BT_DEFER_SETUP:
1128 		if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1129 			err = -EINVAL;
1130 			break;
1131 		}
1132 
1133 		if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
1134 			     (u32 __user *)optval))
1135 			err = -EFAULT;
1136 
1137 		break;
1138 
1139 	case BT_VOICE:
1140 		voice.setting = sco_pi(sk)->setting;
1141 
1142 		len = min_t(unsigned int, len, sizeof(voice));
1143 		if (copy_to_user(optval, (char *)&voice, len))
1144 			err = -EFAULT;
1145 
1146 		break;
1147 
1148 	case BT_PHY:
1149 		if (sk->sk_state != BT_CONNECTED) {
1150 			err = -ENOTCONN;
1151 			break;
1152 		}
1153 
1154 		phys = hci_conn_get_phy(sco_pi(sk)->conn->hcon);
1155 
1156 		if (put_user(phys, (u32 __user *) optval))
1157 			err = -EFAULT;
1158 		break;
1159 
1160 	case BT_PKT_STATUS:
1161 		if (put_user(test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags),
1162 			     (int __user *)optval))
1163 			err = -EFAULT;
1164 		break;
1165 
1166 	case BT_SNDMTU:
1167 	case BT_RCVMTU:
1168 		if (sk->sk_state != BT_CONNECTED) {
1169 			err = -ENOTCONN;
1170 			break;
1171 		}
1172 
1173 		if (put_user(sco_pi(sk)->conn->mtu, (u32 __user *)optval))
1174 			err = -EFAULT;
1175 		break;
1176 
1177 	case BT_CODEC:
1178 		num_codecs = 0;
1179 		buf_len = 0;
1180 
1181 		hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
1182 		if (!hdev) {
1183 			err = -EBADFD;
1184 			break;
1185 		}
1186 
1187 		if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) {
1188 			hci_dev_put(hdev);
1189 			err = -EOPNOTSUPP;
1190 			break;
1191 		}
1192 
1193 		if (!hdev->get_data_path_id) {
1194 			hci_dev_put(hdev);
1195 			err = -EOPNOTSUPP;
1196 			break;
1197 		}
1198 
1199 		release_sock(sk);
1200 
1201 		/* find total buffer size required to copy codec + caps */
1202 		hci_dev_lock(hdev);
1203 		list_for_each_entry(c, &hdev->local_codecs, list) {
1204 			if (c->transport != HCI_TRANSPORT_SCO_ESCO)
1205 				continue;
1206 			num_codecs++;
1207 			for (i = 0, caps = c->caps; i < c->num_caps; i++) {
1208 				buf_len += 1 + caps->len;
1209 				caps = (void *)&caps->data[caps->len];
1210 			}
1211 			buf_len += sizeof(struct bt_codec);
1212 		}
1213 		hci_dev_unlock(hdev);
1214 
1215 		buf_len += sizeof(struct bt_codecs);
1216 		if (buf_len > len) {
1217 			hci_dev_put(hdev);
1218 			return -ENOBUFS;
1219 		}
1220 		ptr = optval;
1221 
1222 		if (put_user(num_codecs, ptr)) {
1223 			hci_dev_put(hdev);
1224 			return -EFAULT;
1225 		}
1226 		ptr += sizeof(num_codecs);
1227 
1228 		/* Iterate all the codecs supported over SCO and populate
1229 		 * codec data
1230 		 */
1231 		hci_dev_lock(hdev);
1232 		list_for_each_entry(c, &hdev->local_codecs, list) {
1233 			if (c->transport != HCI_TRANSPORT_SCO_ESCO)
1234 				continue;
1235 
1236 			codec.id = c->id;
1237 			codec.cid = c->cid;
1238 			codec.vid = c->vid;
1239 			err = hdev->get_data_path_id(hdev, &codec.data_path);
1240 			if (err < 0)
1241 				break;
1242 			codec.num_caps = c->num_caps;
1243 			if (copy_to_user(ptr, &codec, sizeof(codec))) {
1244 				err = -EFAULT;
1245 				break;
1246 			}
1247 			ptr += sizeof(codec);
1248 
1249 			/* find codec capabilities data length */
1250 			len = 0;
1251 			for (i = 0, caps = c->caps; i < c->num_caps; i++) {
1252 				len += 1 + caps->len;
1253 				caps = (void *)&caps->data[caps->len];
1254 			}
1255 
1256 			/* copy codec capabilities data */
1257 			if (len && copy_to_user(ptr, c->caps, len)) {
1258 				err = -EFAULT;
1259 				break;
1260 			}
1261 			ptr += len;
1262 		}
1263 
1264 		hci_dev_unlock(hdev);
1265 		hci_dev_put(hdev);
1266 
1267 		lock_sock(sk);
1268 
1269 		if (!err && put_user(buf_len, optlen))
1270 			err = -EFAULT;
1271 
1272 		break;
1273 
1274 	default:
1275 		err = -ENOPROTOOPT;
1276 		break;
1277 	}
1278 
1279 	release_sock(sk);
1280 	return err;
1281 }
1282 
1283 static int sco_sock_shutdown(struct socket *sock, int how)
1284 {
1285 	struct sock *sk = sock->sk;
1286 	int err = 0;
1287 
1288 	BT_DBG("sock %p, sk %p", sock, sk);
1289 
1290 	if (!sk)
1291 		return 0;
1292 
1293 	sock_hold(sk);
1294 	lock_sock(sk);
1295 
1296 	if (!sk->sk_shutdown) {
1297 		sk->sk_shutdown = SHUTDOWN_MASK;
1298 		sco_sock_clear_timer(sk);
1299 		__sco_sock_close(sk);
1300 
1301 		if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1302 		    !(current->flags & PF_EXITING))
1303 			err = bt_sock_wait_state(sk, BT_CLOSED,
1304 						 sk->sk_lingertime);
1305 	}
1306 
1307 	release_sock(sk);
1308 	sock_put(sk);
1309 
1310 	return err;
1311 }
1312 
1313 static int sco_sock_release(struct socket *sock)
1314 {
1315 	struct sock *sk = sock->sk;
1316 	int err = 0;
1317 
1318 	BT_DBG("sock %p, sk %p", sock, sk);
1319 
1320 	if (!sk)
1321 		return 0;
1322 
1323 	sco_sock_close(sk);
1324 
1325 	if (sock_flag(sk, SOCK_LINGER) && READ_ONCE(sk->sk_lingertime) &&
1326 	    !(current->flags & PF_EXITING)) {
1327 		lock_sock(sk);
1328 		err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
1329 		release_sock(sk);
1330 	}
1331 
1332 	sock_orphan(sk);
1333 	sco_sock_kill(sk);
1334 	return err;
1335 }
1336 
1337 static void sco_conn_ready(struct sco_conn *conn)
1338 {
1339 	struct sock *parent;
1340 	struct sock *sk = conn->sk;
1341 
1342 	BT_DBG("conn %p", conn);
1343 
1344 	if (sk) {
1345 		lock_sock(sk);
1346 		sco_sock_clear_timer(sk);
1347 		sk->sk_state = BT_CONNECTED;
1348 		sk->sk_state_change(sk);
1349 		release_sock(sk);
1350 	} else {
1351 		sco_conn_lock(conn);
1352 
1353 		if (!conn->hcon) {
1354 			sco_conn_unlock(conn);
1355 			return;
1356 		}
1357 
1358 		parent = sco_get_sock_listen(&conn->hcon->src);
1359 		if (!parent) {
1360 			sco_conn_unlock(conn);
1361 			return;
1362 		}
1363 
1364 		lock_sock(parent);
1365 
1366 		sk = sco_sock_alloc(sock_net(parent), NULL,
1367 				    BTPROTO_SCO, GFP_ATOMIC, 0);
1368 		if (!sk) {
1369 			release_sock(parent);
1370 			sco_conn_unlock(conn);
1371 			return;
1372 		}
1373 
1374 		sco_sock_init(sk, parent);
1375 
1376 		bacpy(&sco_pi(sk)->src, &conn->hcon->src);
1377 		bacpy(&sco_pi(sk)->dst, &conn->hcon->dst);
1378 
1379 		sco_conn_hold(conn);
1380 		hci_conn_hold(conn->hcon);
1381 		__sco_chan_add(conn, sk, parent);
1382 
1383 		if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
1384 			sk->sk_state = BT_CONNECT2;
1385 		else
1386 			sk->sk_state = BT_CONNECTED;
1387 
1388 		/* Wake up parent */
1389 		parent->sk_data_ready(parent);
1390 
1391 		release_sock(parent);
1392 
1393 		sco_conn_unlock(conn);
1394 	}
1395 }
1396 
1397 /* ----- SCO interface with lower layer (HCI) ----- */
1398 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
1399 {
1400 	struct sock *sk;
1401 	int lm = 0;
1402 
1403 	BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1404 
1405 	/* Find listening sockets */
1406 	read_lock(&sco_sk_list.lock);
1407 	sk_for_each(sk, &sco_sk_list.head) {
1408 		if (sk->sk_state != BT_LISTEN)
1409 			continue;
1410 
1411 		if (!bacmp(&sco_pi(sk)->src, &hdev->bdaddr) ||
1412 		    !bacmp(&sco_pi(sk)->src, BDADDR_ANY)) {
1413 			lm |= HCI_LM_ACCEPT;
1414 
1415 			if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
1416 				*flags |= HCI_PROTO_DEFER;
1417 			break;
1418 		}
1419 	}
1420 	read_unlock(&sco_sk_list.lock);
1421 
1422 	return lm;
1423 }
1424 
1425 static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
1426 {
1427 	if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
1428 		return;
1429 
1430 	BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status);
1431 
1432 	if (!status) {
1433 		struct sco_conn *conn;
1434 
1435 		conn = sco_conn_add(hcon);
1436 		if (conn) {
1437 			sco_conn_ready(conn);
1438 			sco_conn_put(conn);
1439 		}
1440 	} else
1441 		sco_conn_del(hcon, bt_to_errno(status));
1442 }
1443 
1444 static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
1445 {
1446 	if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
1447 		return;
1448 
1449 	BT_DBG("hcon %p reason %d", hcon, reason);
1450 
1451 	sco_conn_del(hcon, bt_to_errno(reason));
1452 }
1453 
1454 void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
1455 {
1456 	struct sco_conn *conn = hcon->sco_data;
1457 
1458 	if (!conn)
1459 		goto drop;
1460 
1461 	BT_DBG("conn %p len %u", conn, skb->len);
1462 
1463 	if (skb->len) {
1464 		sco_recv_frame(conn, skb);
1465 		return;
1466 	}
1467 
1468 drop:
1469 	kfree_skb(skb);
1470 }
1471 
1472 static struct hci_cb sco_cb = {
1473 	.name		= "SCO",
1474 	.connect_cfm	= sco_connect_cfm,
1475 	.disconn_cfm	= sco_disconn_cfm,
1476 };
1477 
1478 static int sco_debugfs_show(struct seq_file *f, void *p)
1479 {
1480 	struct sock *sk;
1481 
1482 	read_lock(&sco_sk_list.lock);
1483 
1484 	sk_for_each(sk, &sco_sk_list.head) {
1485 		seq_printf(f, "%pMR %pMR %d\n", &sco_pi(sk)->src,
1486 			   &sco_pi(sk)->dst, sk->sk_state);
1487 	}
1488 
1489 	read_unlock(&sco_sk_list.lock);
1490 
1491 	return 0;
1492 }
1493 
1494 DEFINE_SHOW_ATTRIBUTE(sco_debugfs);
1495 
1496 static struct dentry *sco_debugfs;
1497 
1498 static const struct proto_ops sco_sock_ops = {
1499 	.family		= PF_BLUETOOTH,
1500 	.owner		= THIS_MODULE,
1501 	.release	= sco_sock_release,
1502 	.bind		= sco_sock_bind,
1503 	.connect	= sco_sock_connect,
1504 	.listen		= sco_sock_listen,
1505 	.accept		= sco_sock_accept,
1506 	.getname	= sco_sock_getname,
1507 	.sendmsg	= sco_sock_sendmsg,
1508 	.recvmsg	= sco_sock_recvmsg,
1509 	.poll		= bt_sock_poll,
1510 	.ioctl		= bt_sock_ioctl,
1511 	.gettstamp	= sock_gettstamp,
1512 	.mmap		= sock_no_mmap,
1513 	.socketpair	= sock_no_socketpair,
1514 	.shutdown	= sco_sock_shutdown,
1515 	.setsockopt	= sco_sock_setsockopt,
1516 	.getsockopt	= sco_sock_getsockopt
1517 };
1518 
1519 static const struct net_proto_family sco_sock_family_ops = {
1520 	.family	= PF_BLUETOOTH,
1521 	.owner	= THIS_MODULE,
1522 	.create	= sco_sock_create,
1523 };
1524 
1525 int __init sco_init(void)
1526 {
1527 	int err;
1528 
1529 	BUILD_BUG_ON(sizeof(struct sockaddr_sco) > sizeof(struct sockaddr));
1530 
1531 	err = proto_register(&sco_proto, 0);
1532 	if (err < 0)
1533 		return err;
1534 
1535 	err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
1536 	if (err < 0) {
1537 		BT_ERR("SCO socket registration failed");
1538 		goto error;
1539 	}
1540 
1541 	err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL);
1542 	if (err < 0) {
1543 		BT_ERR("Failed to create SCO proc file");
1544 		bt_sock_unregister(BTPROTO_SCO);
1545 		goto error;
1546 	}
1547 
1548 	BT_INFO("SCO socket layer initialized");
1549 
1550 	hci_register_cb(&sco_cb);
1551 
1552 	if (IS_ERR_OR_NULL(bt_debugfs))
1553 		return 0;
1554 
1555 	sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs,
1556 					  NULL, &sco_debugfs_fops);
1557 
1558 	return 0;
1559 
1560 error:
1561 	proto_unregister(&sco_proto);
1562 	return err;
1563 }
1564 
1565 void sco_exit(void)
1566 {
1567 	bt_procfs_cleanup(&init_net, "sco");
1568 
1569 	debugfs_remove(sco_debugfs);
1570 
1571 	hci_unregister_cb(&sco_cb);
1572 
1573 	bt_sock_unregister(BTPROTO_SCO);
1574 
1575 	proto_unregister(&sco_proto);
1576 }
1577 
1578 module_param(disable_esco, bool, 0644);
1579 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");
1580