net/bluetooth/sco.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth SCO sockets. */
  26
  27 #include <linux/module.h>
  28 #include <linux/debugfs.h>
  29 #include <linux/seq_file.h>
  30 #include <linux/sched/signal.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34 #include <net/bluetooth/sco.h>
  35
  36 #ifdef TIZEN_BT
  37 #include <net/bluetooth/mgmt.h>
  38 #include <net/bluetooth/mgmt_tizen.h>
  39 #endif
  40
  41 static bool disable_esco;
  42
  43 static const struct proto_ops sco_sock_ops;
  44
  45 static struct bt_sock_list sco_sk_list = {
  46         .lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
  47 };
  48
  49 /* ---- SCO connections ---- */
  50 struct sco_conn {
  51         struct hci_conn *hcon;
  52
  53         spinlock_t      lock;
  54         struct sock     *sk;
  55
  56         struct delayed_work     timeout_work;
  57
  58         unsigned int    mtu;
  59 };
  60
  61 #define sco_conn_lock(c)        spin_lock(&c->lock)
  62 #define sco_conn_unlock(c)      spin_unlock(&c->lock)
  63
  64 static void sco_sock_close(struct sock *sk);
  65 static void sco_sock_kill(struct sock *sk);
  66
  67 /* ----- SCO socket info ----- */
  68 #define sco_pi(sk) ((struct sco_pinfo *) sk)
  69
  70 struct sco_pinfo {
  71         struct bt_sock  bt;
  72         bdaddr_t        src;
  73         bdaddr_t        dst;
  74         __u32           flags;
  75         __u16           setting;
  76         struct bt_codec codec;
  77         struct sco_conn *conn;
  78 };
  79
  80 /* ---- SCO timers ---- */
  81 #define SCO_CONN_TIMEOUT        (HZ * 40)
  82 #define SCO_DISCONN_TIMEOUT     (HZ * 2)
  83
  84 static void sco_sock_timeout(struct work_struct *work)
  85 {
  86         struct sco_conn *conn = container_of(work, struct sco_conn,
  87                                              timeout_work.work);
  88         struct sock *sk;
  89
  90         sco_conn_lock(conn);
  91         sk = conn->sk;
  92         if (sk)
  93                 sock_hold(sk);
  94         sco_conn_unlock(conn);
  95
  96         if (!sk)
  97                 return;
  98
  99         BT_DBG("sock %p state %d", sk, sk->sk_state);
 100
 101         lock_sock(sk);
 102         sk->sk_err = ETIMEDOUT;
 103         sk->sk_state_change(sk);
 104         release_sock(sk);
 105         sock_put(sk);
 106 }
 107
 108 static void sco_sock_set_timer(struct sock *sk, long timeout)
 109 {
 110         if (!sco_pi(sk)->conn)
 111                 return;
 112
 113         BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
 114         cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
 115         schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout);
 116 }
 117
 118 static void sco_sock_clear_timer(struct sock *sk)
 119 {
 120         if (!sco_pi(sk)->conn)
 121                 return;
 122
 123         BT_DBG("sock %p state %d", sk, sk->sk_state);
 124         cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
 125 }
 126
 127 /* ---- SCO connections ---- */
 128 static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
 129 {
 130         struct hci_dev *hdev = hcon->hdev;
 131         struct sco_conn *conn = hcon->sco_data;
 132
 133         if (conn) {
 134                 if (!conn->hcon)
 135                         conn->hcon = hcon;
 136                 return conn;
 137         }
 138
 139         conn = kzalloc(sizeof(struct sco_conn), GFP_KERNEL);
 140         if (!conn)
 141                 return NULL;
 142
 143         spin_lock_init(&conn->lock);
 144         INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
 145
 146         hcon->sco_data = conn;
 147         conn->hcon = hcon;
 148
 149         if (hdev->sco_mtu > 0)
 150                 conn->mtu = hdev->sco_mtu;
 151         else
 152                 conn->mtu = 60;
 153
 154         BT_DBG("hcon %p conn %p", hcon, conn);
 155
 156         return conn;
 157 }
 158
 159 /* Delete channel.
 160  * Must be called on the locked socket. */
 161 static void sco_chan_del(struct sock *sk, int err)
 162 {
 163         struct sco_conn *conn;
 164
 165         conn = sco_pi(sk)->conn;
 166
 167         BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
 168
 169         if (conn) {
 170                 sco_conn_lock(conn);
 171                 conn->sk = NULL;
 172                 sco_pi(sk)->conn = NULL;
 173                 sco_conn_unlock(conn);
 174
 175                 if (conn->hcon)
 176                         hci_conn_drop(conn->hcon);
 177         }
 178
 179         sk->sk_state = BT_CLOSED;
 180         sk->sk_err   = err;
 181         sk->sk_state_change(sk);
 182
 183         sock_set_flag(sk, SOCK_ZAPPED);
 184 }
 185
 186 static void sco_conn_del(struct hci_conn *hcon, int err)
 187 {
 188         struct sco_conn *conn = hcon->sco_data;
 189         struct sock *sk;
 190
 191         if (!conn)
 192                 return;
 193
 194         BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 195
 196         /* Kill socket */
 197         sco_conn_lock(conn);
 198         sk = conn->sk;
 199         if (sk)
 200                 sock_hold(sk);
 201         sco_conn_unlock(conn);
 202
 203         if (sk) {
 204                 lock_sock(sk);
 205                 sco_sock_clear_timer(sk);
 206                 sco_chan_del(sk, err);
 207                 release_sock(sk);
 208                 sock_put(sk);
 209         }
 210
 211         /* Ensure no more work items will run before freeing conn. */
 212         cancel_delayed_work_sync(&conn->timeout_work);
 213
 214         hcon->sco_data = NULL;
 215         kfree(conn);
 216 }
 217
 218 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
 219                            struct sock *parent)
 220 {
 221         BT_DBG("conn %p", conn);
 222
 223         sco_pi(sk)->conn = conn;
 224         conn->sk = sk;
 225
 226         if (parent)
 227                 bt_accept_enqueue(parent, sk, true);
 228 }
 229
 230 static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
 231                         struct sock *parent)
 232 {
 233         int err = 0;
 234
 235         sco_conn_lock(conn);
 236         if (conn->sk)
 237                 err = -EBUSY;
 238         else
 239                 __sco_chan_add(conn, sk, parent);
 240
 241         sco_conn_unlock(conn);
 242         return err;
 243 }
 244
 245 static int sco_connect(struct sock *sk)
 246 {
 247         struct sco_conn *conn;
 248         struct hci_conn *hcon;
 249         struct hci_dev  *hdev;
 250         int err, type;
 251
 252         BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst);
 253
 254         hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
 255         if (!hdev)
 256                 return -EHOSTUNREACH;
 257
 258         hci_dev_lock(hdev);
 259
 260         if (lmp_esco_capable(hdev) && !disable_esco)
 261                 type = ESCO_LINK;
 262         else
 263                 type = SCO_LINK;
 264
 265         if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT &&
 266             (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) {
 267                 err = -EOPNOTSUPP;
 268                 goto unlock;
 269         }
 270
 271         hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst,
 272                                sco_pi(sk)->setting, &sco_pi(sk)->codec);
 273         if (IS_ERR(hcon)) {
 274                 err = PTR_ERR(hcon);
 275                 goto unlock;
 276         }
 277
 278         conn = sco_conn_add(hcon);
 279         if (!conn) {
 280                 hci_conn_drop(hcon);
 281                 err = -ENOMEM;
 282                 goto unlock;
 283         }
 284
 285         lock_sock(sk);
 286
 287         err = sco_chan_add(conn, sk, NULL);
 288         if (err) {
 289                 release_sock(sk);
 290                 goto unlock;
 291         }
 292
 293         /* Update source addr of the socket */
 294         bacpy(&sco_pi(sk)->src, &hcon->src);
 295
 296         if (hcon->state == BT_CONNECTED) {
 297                 sco_sock_clear_timer(sk);
 298                 sk->sk_state = BT_CONNECTED;
 299         } else {
 300                 sk->sk_state = BT_CONNECT;
 301                 sco_sock_set_timer(sk, sk->sk_sndtimeo);
 302         }
 303
 304         release_sock(sk);
 305
 306 unlock:
 307         hci_dev_unlock(hdev);
 308         hci_dev_put(hdev);
 309         return err;
 310 }
 311
 312 static int sco_send_frame(struct sock *sk, struct sk_buff *skb)
 313 {
 314         struct sco_conn *conn = sco_pi(sk)->conn;
 315         int len = skb->len;
 316
 317         /* Check outgoing MTU */
 318         if (len > conn->mtu)
 319                 return -EINVAL;
 320
 321         BT_DBG("sk %p len %d", sk, len);
 322
 323         hci_send_sco(conn->hcon, skb);
 324
 325         return len;
 326 }
 327
 328 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
 329 {
 330         struct sock *sk;
 331
 332         sco_conn_lock(conn);
 333         sk = conn->sk;
 334         sco_conn_unlock(conn);
 335
 336         if (!sk)
 337                 goto drop;
 338
 339         BT_DBG("sk %p len %u", sk, skb->len);
 340
 341         if (sk->sk_state != BT_CONNECTED)
 342                 goto drop;
 343
 344         if (!sock_queue_rcv_skb(sk, skb))
 345                 return;
 346
 347 drop:
 348         kfree_skb(skb);
 349 }
 350
 351 /* -------- Socket interface ---------- */
 352 static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
 353 {
 354         struct sock *sk;
 355
 356         sk_for_each(sk, &sco_sk_list.head) {
 357                 if (sk->sk_state != BT_LISTEN)
 358                         continue;
 359
 360                 if (!bacmp(&sco_pi(sk)->src, ba))
 361                         return sk;
 362         }
 363
 364         return NULL;
 365 }
 366
 367 /* Find socket listening on source bdaddr.
 368  * Returns closest match.
 369  */
 370 static struct sock *sco_get_sock_listen(bdaddr_t *src)
 371 {
 372         struct sock *sk = NULL, *sk1 = NULL;
 373
 374         read_lock(&sco_sk_list.lock);
 375
 376         sk_for_each(sk, &sco_sk_list.head) {
 377                 if (sk->sk_state != BT_LISTEN)
 378                         continue;
 379
 380                 /* Exact match. */
 381                 if (!bacmp(&sco_pi(sk)->src, src))
 382                         break;
 383
 384                 /* Closest match */
 385                 if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY))
 386                         sk1 = sk;
 387         }
 388
 389         read_unlock(&sco_sk_list.lock);
 390
 391         return sk ? sk : sk1;
 392 }
 393
 394 static void sco_sock_destruct(struct sock *sk)
 395 {
 396         BT_DBG("sk %p", sk);
 397
 398         skb_queue_purge(&sk->sk_receive_queue);
 399         skb_queue_purge(&sk->sk_write_queue);
 400 }
 401
 402 static void sco_sock_cleanup_listen(struct sock *parent)
 403 {
 404         struct sock *sk;
 405
 406         BT_DBG("parent %p", parent);
 407
 408         /* Close not yet accepted channels */
 409         while ((sk = bt_accept_dequeue(parent, NULL))) {
 410                 sco_sock_close(sk);
 411                 sco_sock_kill(sk);
 412         }
 413
 414         parent->sk_state  = BT_CLOSED;
 415         sock_set_flag(parent, SOCK_ZAPPED);
 416 }
 417
 418 /* Kill socket (only if zapped and orphan)
 419  * Must be called on unlocked socket.
 420  */
 421 static void sco_sock_kill(struct sock *sk)
 422 {
 423         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 424                 return;
 425
 426         BT_DBG("sk %p state %d", sk, sk->sk_state);
 427
 428         /* Kill poor orphan */
 429         bt_sock_unlink(&sco_sk_list, sk);
 430         sock_set_flag(sk, SOCK_DEAD);
 431         sock_put(sk);
 432 }
 433
 434 static void __sco_sock_close(struct sock *sk)
 435 {
 436         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 437
 438         switch (sk->sk_state) {
 439         case BT_LISTEN:
 440                 sco_sock_cleanup_listen(sk);
 441                 break;
 442
 443         case BT_CONNECTED:
 444         case BT_CONFIG:
 445                 if (sco_pi(sk)->conn->hcon) {
 446                         sk->sk_state = BT_DISCONN;
 447                         sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
 448                         sco_conn_lock(sco_pi(sk)->conn);
 449                         hci_conn_drop(sco_pi(sk)->conn->hcon);
 450                         sco_pi(sk)->conn->hcon = NULL;
 451                         sco_conn_unlock(sco_pi(sk)->conn);
 452                 } else
 453                         sco_chan_del(sk, ECONNRESET);
 454                 break;
 455
 456         case BT_CONNECT2:
 457         case BT_CONNECT:
 458         case BT_DISCONN:
 459                 sco_chan_del(sk, ECONNRESET);
 460                 break;
 461
 462         default:
 463                 sock_set_flag(sk, SOCK_ZAPPED);
 464                 break;
 465         }
 466
 467 }
 468
 469 /* Must be called on unlocked socket. */
 470 static void sco_sock_close(struct sock *sk)
 471 {
 472         lock_sock(sk);
 473         sco_sock_clear_timer(sk);
 474         __sco_sock_close(sk);
 475         release_sock(sk);
 476 }
 477
 478 static void sco_sock_init(struct sock *sk, struct sock *parent)
 479 {
 480         BT_DBG("sk %p", sk);
 481
 482         if (parent) {
 483                 sk->sk_type = parent->sk_type;
 484                 bt_sk(sk)->flags = bt_sk(parent)->flags;
 485                 security_sk_clone(parent, sk);
 486         }
 487 }
 488
 489 static struct proto sco_proto = {
 490         .name           = "SCO",
 491         .owner          = THIS_MODULE,
 492         .obj_size       = sizeof(struct sco_pinfo)
 493 };
 494
 495 static struct sock *sco_sock_alloc(struct net *net, struct socket *sock,
 496                                    int proto, gfp_t prio, int kern)
 497 {
 498         struct sock *sk;
 499
 500         sk = bt_sock_alloc(net, sock, &sco_proto, proto, prio, kern);
 501         if (!sk)
 502                 return NULL;
 503
 504         sk->sk_destruct = sco_sock_destruct;
 505         sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
 506
 507         sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
 508         sco_pi(sk)->codec.id = BT_CODEC_CVSD;
 509         sco_pi(sk)->codec.cid = 0xffff;
 510         sco_pi(sk)->codec.vid = 0xffff;
 511         sco_pi(sk)->codec.data_path = 0x00;
 512
 513         bt_sock_link(&sco_sk_list, sk);
 514         return sk;
 515 }
 516
 517 static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
 518                            int kern)
 519 {
 520         struct sock *sk;
 521
 522         BT_DBG("sock %p", sock);
 523
 524         sock->state = SS_UNCONNECTED;
 525
 526         if (sock->type != SOCK_SEQPACKET)
 527                 return -ESOCKTNOSUPPORT;
 528
 529         sock->ops = &sco_sock_ops;
 530
 531         sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
 532         if (!sk)
 533                 return -ENOMEM;
 534
 535         sco_sock_init(sk, NULL);
 536         return 0;
 537 }
 538
 539 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr,
 540                          int addr_len)
 541 {
 542         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 543         struct sock *sk = sock->sk;
 544         int err = 0;
 545
 546         if (!addr || addr_len < sizeof(struct sockaddr_sco) ||
 547             addr->sa_family != AF_BLUETOOTH)
 548                 return -EINVAL;
 549
 550         BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
 551
 552         lock_sock(sk);
 553
 554         if (sk->sk_state != BT_OPEN) {
 555                 err = -EBADFD;
 556                 goto done;
 557         }
 558
 559         if (sk->sk_type != SOCK_SEQPACKET) {
 560                 err = -EINVAL;
 561                 goto done;
 562         }
 563
 564         bacpy(&sco_pi(sk)->src, &sa->sco_bdaddr);
 565
 566         sk->sk_state = BT_BOUND;
 567
 568 done:
 569         release_sock(sk);
 570         return err;
 571 }
 572
 573 static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 574 {
 575         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 576         struct sock *sk = sock->sk;
 577         int err;
 578
 579         BT_DBG("sk %p", sk);
 580
 581         if (alen < sizeof(struct sockaddr_sco) ||
 582             addr->sa_family != AF_BLUETOOTH)
 583                 return -EINVAL;
 584
 585         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
 586                 return -EBADFD;
 587
 588         if (sk->sk_type != SOCK_SEQPACKET)
 589                 err = -EINVAL;
 590
 591         lock_sock(sk);
 592         /* Set destination address and psm */
 593         bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr);
 594         release_sock(sk);
 595
 596         err = sco_connect(sk);
 597         if (err)
 598                 return err;
 599
 600         lock_sock(sk);
 601
 602         err = bt_sock_wait_state(sk, BT_CONNECTED,
 603                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 604
 605         release_sock(sk);
 606         return err;
 607 }
 608
 609 static int sco_sock_listen(struct socket *sock, int backlog)
 610 {
 611         struct sock *sk = sock->sk;
 612         bdaddr_t *src = &sco_pi(sk)->src;
 613         int err = 0;
 614
 615         BT_DBG("sk %p backlog %d", sk, backlog);
 616
 617         lock_sock(sk);
 618
 619         if (sk->sk_state != BT_BOUND) {
 620                 err = -EBADFD;
 621                 goto done;
 622         }
 623
 624         if (sk->sk_type != SOCK_SEQPACKET) {
 625                 err = -EINVAL;
 626                 goto done;
 627         }
 628
 629         write_lock(&sco_sk_list.lock);
 630
 631         if (__sco_get_sock_listen_by_addr(src)) {
 632                 err = -EADDRINUSE;
 633                 goto unlock;
 634         }
 635
 636         sk->sk_max_ack_backlog = backlog;
 637         sk->sk_ack_backlog = 0;
 638
 639         sk->sk_state = BT_LISTEN;
 640
 641 unlock:
 642         write_unlock(&sco_sk_list.lock);
 643
 644 done:
 645         release_sock(sk);
 646         return err;
 647 }
 648
 649 static int sco_sock_accept(struct socket *sock, struct socket *newsock,
 650                            int flags, bool kern)
 651 {
 652         DEFINE_WAIT_FUNC(wait, woken_wake_function);
 653         struct sock *sk = sock->sk, *ch;
 654         long timeo;
 655         int err = 0;
 656
 657         lock_sock(sk);
 658
 659         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 660
 661         BT_DBG("sk %p timeo %ld", sk, timeo);
 662
 663         /* Wait for an incoming connection. (wake-one). */
 664         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 665         while (1) {
 666                 if (sk->sk_state != BT_LISTEN) {
 667                         err = -EBADFD;
 668                         break;
 669                 }
 670
 671                 ch = bt_accept_dequeue(sk, newsock);
 672                 if (ch)
 673                         break;
 674
 675                 if (!timeo) {
 676                         err = -EAGAIN;
 677                         break;
 678                 }
 679
 680                 if (signal_pending(current)) {
 681                         err = sock_intr_errno(timeo);
 682                         break;
 683                 }
 684
 685                 release_sock(sk);
 686
 687                 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 688                 lock_sock(sk);
 689         }
 690         remove_wait_queue(sk_sleep(sk), &wait);
 691
 692         if (err)
 693                 goto done;
 694
 695         newsock->state = SS_CONNECTED;
 696
 697         BT_DBG("new socket %p", ch);
 698
 699 done:
 700         release_sock(sk);
 701         return err;
 702 }
 703
 704 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr,
 705                             int peer)
 706 {
 707         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 708         struct sock *sk = sock->sk;
 709
 710         BT_DBG("sock %p, sk %p", sock, sk);
 711
 712         addr->sa_family = AF_BLUETOOTH;
 713
 714         if (peer)
 715                 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->dst);
 716         else
 717                 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->src);
 718
 719         return sizeof(struct sockaddr_sco);
 720 }
 721
 722 static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 723                             size_t len)
 724 {
 725         struct sock *sk = sock->sk;
 726         struct sk_buff *skb;
 727         int err;
 728
 729         BT_DBG("sock %p, sk %p", sock, sk);
 730
 731         err = sock_error(sk);
 732         if (err)
 733                 return err;
 734
 735         if (msg->msg_flags & MSG_OOB)
 736                 return -EOPNOTSUPP;
 737
 738         skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0);
 739         if (IS_ERR(skb))
 740                 return PTR_ERR(skb);
 741
 742         lock_sock(sk);
 743
 744         if (sk->sk_state == BT_CONNECTED)
 745                 err = sco_send_frame(sk, skb);
 746         else
 747                 err = -ENOTCONN;
 748
 749         release_sock(sk);
 750
 751         if (err < 0)
 752                 kfree_skb(skb);
 753         return err;
 754 }
 755
 756 static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
 757 {
 758         struct hci_dev *hdev = conn->hdev;
 759
 760         BT_DBG("conn %p", conn);
 761
 762         conn->state = BT_CONFIG;
 763
 764         if (!lmp_esco_capable(hdev)) {
 765                 struct hci_cp_accept_conn_req cp;
 766
 767                 bacpy(&cp.bdaddr, &conn->dst);
 768                 cp.role = 0x00; /* Ignored */
 769
 770                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
 771         } else {
 772                 struct hci_cp_accept_sync_conn_req cp;
 773
 774                 bacpy(&cp.bdaddr, &conn->dst);
 775                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
 776
 777                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
 778                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
 779                 cp.content_format = cpu_to_le16(setting);
 780
 781                 switch (setting & SCO_AIRMODE_MASK) {
 782                 case SCO_AIRMODE_TRANSP:
 783                         if (conn->pkt_type & ESCO_2EV3)
 784                                 cp.max_latency = cpu_to_le16(0x0008);
 785                         else
 786                                 cp.max_latency = cpu_to_le16(0x000D);
 787                         cp.retrans_effort = 0x02;
 788                         break;
 789                 case SCO_AIRMODE_CVSD:
 790                         cp.max_latency = cpu_to_le16(0xffff);
 791                         cp.retrans_effort = 0xff;
 792                         break;
 793                 default:
 794                         /* use CVSD settings as fallback */
 795                         cp.max_latency = cpu_to_le16(0xffff);
 796                         cp.retrans_effort = 0xff;
 797                         break;
 798                 }
 799
 800                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
 801                              sizeof(cp), &cp);
 802         }
 803 }
 804
 805 static int sco_sock_recvmsg(struct socket *sock, struct msghdr *msg,
 806                             size_t len, int flags)
 807 {
 808         struct sock *sk = sock->sk;
 809         struct sco_pinfo *pi = sco_pi(sk);
 810
 811         lock_sock(sk);
 812
 813         if (sk->sk_state == BT_CONNECT2 &&
 814             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
 815                 sco_conn_defer_accept(pi->conn->hcon, pi->setting);
 816                 sk->sk_state = BT_CONFIG;
 817
 818                 release_sock(sk);
 819                 return 0;
 820         }
 821
 822         release_sock(sk);
 823
 824         return bt_sock_recvmsg(sock, msg, len, flags);
 825 }
 826
 827 static int sco_sock_setsockopt(struct socket *sock, int level, int optname,
 828                                sockptr_t optval, unsigned int optlen)
 829 {
 830         struct sock *sk = sock->sk;
 831         int len, err = 0;
 832         struct bt_voice voice;
 833         u32 opt;
 834         struct bt_codecs *codecs;
 835         struct hci_dev *hdev;
 836         __u8 buffer[255];
 837
 838         BT_DBG("sk %p", sk);
 839
 840         lock_sock(sk);
 841
 842         switch (optname) {
 843
 844         case BT_DEFER_SETUP:
 845                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 846                         err = -EINVAL;
 847                         break;
 848                 }
 849
 850                 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
 851                         err = -EFAULT;
 852                         break;
 853                 }
 854
 855                 if (opt)
 856                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 857                 else
 858                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 859                 break;
 860
 861         case BT_VOICE:
 862                 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
 863                     sk->sk_state != BT_CONNECT2) {
 864                         err = -EINVAL;
 865                         break;
 866                 }
 867
 868                 voice.setting = sco_pi(sk)->setting;
 869
 870                 len = min_t(unsigned int, sizeof(voice), optlen);
 871                 if (copy_from_sockptr(&voice, optval, len)) {
 872                         err = -EFAULT;
 873                         break;
 874                 }
 875
 876                 /* Explicitly check for these values */
 877 #ifdef TIZEN_BT
 878                 /* Codec defer accept */
 879                 if (voice.setting != (BT_VOICE_TRANSPARENT |
 880                     BT_VOICE_CVSD_16BIT) &&
 881                     voice.setting != BT_VOICE_CVSD_16BIT) {
 882 #else
 883                 if (voice.setting != BT_VOICE_TRANSPARENT &&
 884                     voice.setting != BT_VOICE_CVSD_16BIT) {
 885 #endif
 886                         err = -EINVAL;
 887                         break;
 888                 }
 889
 890                 sco_pi(sk)->setting = voice.setting;
 891                 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src,
 892                                      BDADDR_BREDR);
 893                 if (!hdev) {
 894                         err = -EBADFD;
 895                         break;
 896                 }
 897                 if (enhanced_sync_conn_capable(hdev) &&
 898                     voice.setting == BT_VOICE_TRANSPARENT)
 899                         sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT;
 900                 hci_dev_put(hdev);
 901                 break;
 902
 903         case BT_PKT_STATUS:
 904                 if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
 905                         err = -EFAULT;
 906                         break;
 907                 }
 908
 909                 if (opt)
 910                         set_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
 911                 else
 912                         clear_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags);
 913                 break;
 914
 915         case BT_CODEC:
 916                 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
 917                     sk->sk_state != BT_CONNECT2) {
 918                         err = -EINVAL;
 919                         break;
 920                 }
 921
 922                 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src,
 923                                      BDADDR_BREDR);
 924                 if (!hdev) {
 925                         err = -EBADFD;
 926                         break;
 927                 }
 928
 929                 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) {
 930                         hci_dev_put(hdev);
 931                         err = -EOPNOTSUPP;
 932                         break;
 933                 }
 934
 935                 if (!hdev->get_data_path_id) {
 936                         hci_dev_put(hdev);
 937                         err = -EOPNOTSUPP;
 938                         break;
 939                 }
 940
 941                 if (optlen < sizeof(struct bt_codecs) ||
 942                     optlen > sizeof(buffer)) {
 943                         hci_dev_put(hdev);
 944                         err = -EINVAL;
 945                         break;
 946                 }
 947
 948                 if (copy_from_sockptr(buffer, optval, optlen)) {
 949                         hci_dev_put(hdev);
 950                         err = -EFAULT;
 951                         break;
 952                 }
 953
 954                 codecs = (void *)buffer;
 955
 956                 if (codecs->num_codecs > 1) {
 957                         hci_dev_put(hdev);
 958                         err = -EINVAL;
 959                         break;
 960                 }
 961
 962                 sco_pi(sk)->codec = codecs->codecs[0];
 963                 hci_dev_put(hdev);
 964                 break;
 965
 966         default:
 967                 err = -ENOPROTOOPT;
 968                 break;
 969         }
 970
 971         release_sock(sk);
 972         return err;
 973 }
 974
 975 static int sco_sock_getsockopt_old(struct socket *sock, int optname,
 976                                    char __user *optval, int __user *optlen)
 977 {
 978         struct sock *sk = sock->sk;
 979         struct sco_options opts;
 980         struct sco_conninfo cinfo;
 981         int len, err = 0;
 982
 983         BT_DBG("sk %p", sk);
 984
 985         if (get_user(len, optlen))
 986                 return -EFAULT;
 987
 988         lock_sock(sk);
 989
 990         switch (optname) {
 991         case SCO_OPTIONS:
 992                 if (sk->sk_state != BT_CONNECTED &&
 993                     !(sk->sk_state == BT_CONNECT2 &&
 994                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 995                         err = -ENOTCONN;
 996                         break;
 997                 }
 998
 999                 opts.mtu = sco_pi(sk)->conn->mtu;
1000
1001                 BT_DBG("mtu %u", opts.mtu);
1002
1003                 len = min_t(unsigned int, len, sizeof(opts));
1004                 if (copy_to_user(optval, (char *)&opts, len))
1005                         err = -EFAULT;
1006
1007                 break;
1008
1009         case SCO_CONNINFO:
1010                 if (sk->sk_state != BT_CONNECTED &&
1011                     !(sk->sk_state == BT_CONNECT2 &&
1012                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
1013                         err = -ENOTCONN;
1014                         break;
1015                 }
1016
1017                 memset(&cinfo, 0, sizeof(cinfo));
1018                 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
1019                 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
1020
1021                 len = min_t(unsigned int, len, sizeof(cinfo));
1022                 if (copy_to_user(optval, (char *)&cinfo, len))
1023                         err = -EFAULT;
1024
1025                 break;
1026
1027         default:
1028                 err = -ENOPROTOOPT;
1029                 break;
1030         }
1031
1032         release_sock(sk);
1033         return err;
1034 }
1035
1036 static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
1037                                char __user *optval, int __user *optlen)
1038 {
1039         struct sock *sk = sock->sk;
1040         int len, err = 0;
1041         struct bt_voice voice;
1042         u32 phys;
1043         int buf_len;
1044         struct codec_list *c;
1045         u8 num_codecs, i, __user *ptr;
1046         struct hci_dev *hdev;
1047         struct hci_codec_caps *caps;
1048         struct bt_codec codec;
1049
1050         BT_DBG("sk %p", sk);
1051
1052         if (level == SOL_SCO)
1053                 return sco_sock_getsockopt_old(sock, optname, optval, optlen);
1054
1055         if (get_user(len, optlen))
1056                 return -EFAULT;
1057
1058         lock_sock(sk);
1059
1060         switch (optname) {
1061
1062         case BT_DEFER_SETUP:
1063                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1064                         err = -EINVAL;
1065                         break;
1066                 }
1067
1068                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
1069                              (u32 __user *)optval))
1070                         err = -EFAULT;
1071
1072                 break;
1073
1074         case BT_VOICE:
1075                 voice.setting = sco_pi(sk)->setting;
1076
1077                 len = min_t(unsigned int, len, sizeof(voice));
1078                 if (copy_to_user(optval, (char *)&voice, len))
1079                         err = -EFAULT;
1080
1081                 break;
1082
1083         case BT_PHY:
1084                 if (sk->sk_state != BT_CONNECTED) {
1085                         err = -ENOTCONN;
1086                         break;
1087                 }
1088
1089                 phys = hci_conn_get_phy(sco_pi(sk)->conn->hcon);
1090
1091                 if (put_user(phys, (u32 __user *) optval))
1092                         err = -EFAULT;
1093                 break;
1094
1095         case BT_PKT_STATUS:
1096                 if (put_user(test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags),
1097                              (int __user *)optval))
1098                         err = -EFAULT;
1099                 break;
1100
1101         case BT_SNDMTU:
1102         case BT_RCVMTU:
1103                 if (sk->sk_state != BT_CONNECTED) {
1104                         err = -ENOTCONN;
1105                         break;
1106                 }
1107
1108                 if (put_user(sco_pi(sk)->conn->mtu, (u32 __user *)optval))
1109                         err = -EFAULT;
1110                 break;
1111
1112         case BT_CODEC:
1113                 num_codecs = 0;
1114                 buf_len = 0;
1115
1116                 hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
1117                 if (!hdev) {
1118                         err = -EBADFD;
1119                         break;
1120                 }
1121
1122                 if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) {
1123                         hci_dev_put(hdev);
1124                         err = -EOPNOTSUPP;
1125                         break;
1126                 }
1127
1128                 if (!hdev->get_data_path_id) {
1129                         hci_dev_put(hdev);
1130                         err = -EOPNOTSUPP;
1131                         break;
1132                 }
1133
1134                 release_sock(sk);
1135
1136                 /* find total buffer size required to copy codec + caps */
1137                 hci_dev_lock(hdev);
1138                 list_for_each_entry(c, &hdev->local_codecs, list) {
1139                         if (c->transport != HCI_TRANSPORT_SCO_ESCO)
1140                                 continue;
1141                         num_codecs++;
1142                         for (i = 0, caps = c->caps; i < c->num_caps; i++) {
1143                                 buf_len += 1 + caps->len;
1144                                 caps = (void *)&caps->data[caps->len];
1145                         }
1146                         buf_len += sizeof(struct bt_codec);
1147                 }
1148                 hci_dev_unlock(hdev);
1149
1150                 buf_len += sizeof(struct bt_codecs);
1151                 if (buf_len > len) {
1152                         hci_dev_put(hdev);
1153                         return -ENOBUFS;
1154                 }
1155                 ptr = optval;
1156
1157                 if (put_user(num_codecs, ptr)) {
1158                         hci_dev_put(hdev);
1159                         return -EFAULT;
1160                 }
1161                 ptr += sizeof(num_codecs);
1162
1163                 /* Iterate all the codecs supported over SCO and populate
1164                  * codec data
1165                  */
1166                 hci_dev_lock(hdev);
1167                 list_for_each_entry(c, &hdev->local_codecs, list) {
1168                         if (c->transport != HCI_TRANSPORT_SCO_ESCO)
1169                                 continue;
1170
1171                         codec.id = c->id;
1172                         codec.cid = c->cid;
1173                         codec.vid = c->vid;
1174                         err = hdev->get_data_path_id(hdev, &codec.data_path);
1175                         if (err < 0)
1176                                 break;
1177                         codec.num_caps = c->num_caps;
1178                         if (copy_to_user(ptr, &codec, sizeof(codec))) {
1179                                 err = -EFAULT;
1180                                 break;
1181                         }
1182                         ptr += sizeof(codec);
1183
1184                         /* find codec capabilities data length */
1185                         len = 0;
1186                         for (i = 0, caps = c->caps; i < c->num_caps; i++) {
1187                                 len += 1 + caps->len;
1188                                 caps = (void *)&caps->data[caps->len];
1189                         }
1190
1191                         /* copy codec capabilities data */
1192                         if (len && copy_to_user(ptr, c->caps, len)) {
1193                                 err = -EFAULT;
1194                                 break;
1195                         }
1196                         ptr += len;
1197                 }
1198
1199                 hci_dev_unlock(hdev);
1200                 hci_dev_put(hdev);
1201
1202                 lock_sock(sk);
1203
1204                 if (!err && put_user(buf_len, optlen))
1205                         err = -EFAULT;
1206
1207                 break;
1208
1209         default:
1210                 err = -ENOPROTOOPT;
1211                 break;
1212         }
1213
1214         release_sock(sk);
1215         return err;
1216 }
1217
1218 static int sco_sock_shutdown(struct socket *sock, int how)
1219 {
1220         struct sock *sk = sock->sk;
1221         int err = 0;
1222
1223         BT_DBG("sock %p, sk %p", sock, sk);
1224
1225         if (!sk)
1226                 return 0;
1227
1228         sock_hold(sk);
1229         lock_sock(sk);
1230
1231         if (!sk->sk_shutdown) {
1232                 sk->sk_shutdown = SHUTDOWN_MASK;
1233                 sco_sock_clear_timer(sk);
1234                 __sco_sock_close(sk);
1235
1236                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1237                     !(current->flags & PF_EXITING))
1238                         err = bt_sock_wait_state(sk, BT_CLOSED,
1239                                                  sk->sk_lingertime);
1240         }
1241
1242         release_sock(sk);
1243         sock_put(sk);
1244
1245         return err;
1246 }
1247
1248 static int sco_sock_release(struct socket *sock)
1249 {
1250         struct sock *sk = sock->sk;
1251         int err = 0;
1252
1253         BT_DBG("sock %p, sk %p", sock, sk);
1254
1255         if (!sk)
1256                 return 0;
1257
1258         sco_sock_close(sk);
1259
1260         if (sock_flag(sk, SOCK_LINGER) && READ_ONCE(sk->sk_lingertime) &&
1261             !(current->flags & PF_EXITING)) {
1262                 lock_sock(sk);
1263                 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
1264                 release_sock(sk);
1265         }
1266
1267 #ifdef TIZEN_BT
1268         /* SCO kernel panic fix */
1269         bt_sock_unlink(&sco_sk_list, sk);
1270 #endif
1271         sock_orphan(sk);
1272         sco_sock_kill(sk);
1273         return err;
1274 }
1275
1276 static void sco_conn_ready(struct sco_conn *conn)
1277 {
1278         struct sock *parent;
1279         struct sock *sk = conn->sk;
1280
1281         BT_DBG("conn %p", conn);
1282
1283         if (sk) {
1284                 lock_sock(sk);
1285                 sco_sock_clear_timer(sk);
1286                 sk->sk_state = BT_CONNECTED;
1287                 sk->sk_state_change(sk);
1288                 release_sock(sk);
1289         } else {
1290                 sco_conn_lock(conn);
1291
1292                 if (!conn->hcon) {
1293                         sco_conn_unlock(conn);
1294                         return;
1295                 }
1296
1297 #ifdef TIZEN_BT
1298                 /* Multiple SCO accept feature */
1299                 parent = sco_get_sock_listen(&conn->hcon->dst);
1300 #else
1301                 parent = sco_get_sock_listen(&conn->hcon->src);
1302 #endif
1303                 if (!parent) {
1304                         sco_conn_unlock(conn);
1305                         return;
1306                 }
1307
1308                 lock_sock(parent);
1309
1310                 sk = sco_sock_alloc(sock_net(parent), NULL,
1311                                     BTPROTO_SCO, GFP_ATOMIC, 0);
1312                 if (!sk) {
1313                         release_sock(parent);
1314                         sco_conn_unlock(conn);
1315                         return;
1316                 }
1317
1318                 sco_sock_init(sk, parent);
1319
1320                 bacpy(&sco_pi(sk)->src, &conn->hcon->src);
1321                 bacpy(&sco_pi(sk)->dst, &conn->hcon->dst);
1322
1323                 hci_conn_hold(conn->hcon);
1324                 __sco_chan_add(conn, sk, parent);
1325
1326                 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
1327                         sk->sk_state = BT_CONNECT2;
1328                 else
1329                         sk->sk_state = BT_CONNECTED;
1330
1331                 /* Wake up parent */
1332                 parent->sk_data_ready(parent);
1333
1334                 release_sock(parent);
1335
1336                 sco_conn_unlock(conn);
1337         }
1338 }
1339
1340 #ifdef TIZEN_BT
1341 /* WBC/NBC feature */
1342 void sco_connect_set_gw_nbc(struct hci_dev *hdev)
1343 {
1344         struct hci_cp_write_voice_setting cp1;
1345         struct hci_cp_bcm_wbs_req cp2;
1346         struct hci_cp_i2c_pcm_req cp3;
1347         struct hci_cp_sco_pcm_req cp4;
1348
1349         BT_DBG("Setting the NBC params, hdev = %p", hdev);
1350
1351         cp1.voice_setting = cpu_to_le16(0x0060);
1352         hci_send_cmd(hdev, HCI_OP_WRITE_VOICE_SETTING, sizeof(cp1), &cp1);
1353         hdev->voice_setting = cpu_to_le16(0x0060);
1354
1355         cp2.role = 0x00;  /* WbDisable */
1356         cp2.pkt_type = cpu_to_le16(0x0002);
1357         hci_send_cmd(hdev, HCI_BCM_ENABLE_WBS_REQ, sizeof(cp2), &cp2);
1358
1359         cp3.i2c_enable = 0x01;
1360         cp3.is_master = 0x00;
1361         cp3.pcm_rate = 0x00;
1362         cp3.clock_rate = 0x01;
1363         hci_send_cmd(hdev, HCI_BCM_I2C_PCM_REQ, sizeof(cp3), &cp3);
1364
1365         cp4.sco_routing = 0x00;
1366         cp4.pcm_rate = 0x01;
1367         cp4.frame_type = 0x00;
1368         cp4.sync_mode = 0x00;
1369         cp4.clock_mode = 0x00;
1370         hci_send_cmd(hdev, HCI_BCM_SCO_PCM_REQ, sizeof(cp4), &cp4);
1371 }
1372
1373 void sco_connect_set_gw_wbc(struct hci_dev *hdev)
1374 {
1375         struct hci_cp_write_voice_setting cp1;
1376         struct hci_cp_bcm_wbs_req cp2;
1377         struct hci_cp_i2c_pcm_req cp3;
1378         struct hci_cp_sco_pcm_req cp4;
1379
1380         BT_DBG("Setting the WBC params, hdev = %p", hdev);
1381         cp1.voice_setting = cpu_to_le16(0x0003 | 0x0060);
1382         hci_send_cmd(hdev, HCI_OP_WRITE_VOICE_SETTING, sizeof(cp1), &cp1);
1383         hdev->voice_setting = cpu_to_le16(0x0003 | 0x0060);
1384
1385         cp2.role = 0x01; /* Enable */
1386         cp2.pkt_type = cpu_to_le16(0x0002);
1387         hci_send_cmd(hdev, HCI_BCM_ENABLE_WBS_REQ, sizeof(cp2), &cp2);
1388
1389         cp3.i2c_enable = 0x00;
1390         cp3.is_master = 0x00;
1391         cp3.pcm_rate = 0x01;
1392         cp3.clock_rate = 0x02;
1393         hci_send_cmd(hdev, HCI_BCM_I2C_PCM_REQ, sizeof(cp3), &cp3);
1394
1395         cp4.sco_routing = 0x00;
1396         cp4.pcm_rate = 0x00;
1397         cp4.frame_type = 0x00;
1398         cp4.sync_mode = 0x00;
1399         cp4.clock_mode = 0x00;
1400         hci_send_cmd(hdev, HCI_BCM_SCO_PCM_REQ, sizeof(cp4), &cp4);
1401 }
1402
1403 void sco_connect_set_nbc(struct hci_dev *hdev)
1404 {
1405         struct hci_cp_write_voice_setting cp1;
1406         struct hci_cp_bcm_wbs_req cp2;
1407         struct hci_cp_i2c_pcm_req cp3;
1408         struct hci_cp_sco_pcm_req cp4;
1409
1410         BT_DBG("Setting the NBC params, hdev = %p", hdev);
1411
1412         cp1.voice_setting = cpu_to_le16(0x0060);
1413         hci_send_cmd(hdev, HCI_OP_WRITE_VOICE_SETTING, sizeof(cp1), &cp1);
1414         hdev->voice_setting = cpu_to_le16(0x0060);
1415
1416         cp2.role = 0x00; /* WbDisable */
1417         cp2.pkt_type = cpu_to_le16(0x0002);
1418         hci_send_cmd(hdev, HCI_BCM_ENABLE_WBS_REQ, sizeof(cp2), &cp2);
1419
1420         cp3.i2c_enable = 0x00;
1421         cp3.is_master = 0x00;
1422         cp3.pcm_rate = 0x00;
1423         cp3.clock_rate = 0x04;
1424         hci_send_cmd(hdev, HCI_BCM_I2C_PCM_REQ, sizeof(cp3), &cp3);
1425
1426         cp4.sco_routing = 0x00;
1427         cp4.pcm_rate = 0x04;
1428         cp4.frame_type = 0x00;
1429         cp4.sync_mode = 0x00;
1430         cp4.clock_mode = 0x00;
1431         hci_send_cmd(hdev, HCI_BCM_SCO_PCM_REQ, sizeof(cp4), &cp4);
1432 }
1433
1434 void sco_connect_set_wbc(struct hci_dev *hdev)
1435 {
1436         struct hci_cp_write_voice_setting cp1;
1437         struct hci_cp_bcm_wbs_req cp2;
1438         struct hci_cp_i2c_pcm_req cp3;
1439         struct hci_cp_sco_pcm_req cp4;
1440
1441         BT_DBG("Setting the WBC params, hdev = %p", hdev);
1442         cp1.voice_setting = cpu_to_le16(0x0003 | 0x0060);
1443         hci_send_cmd(hdev, HCI_OP_WRITE_VOICE_SETTING, sizeof(cp1), &cp1);
1444         hdev->voice_setting = cpu_to_le16(0x0003 | 0x0060);
1445
1446         cp2.role = 0x01; /* Enable */
1447         cp2.pkt_type = cpu_to_le16(0x0002);
1448         hci_send_cmd(hdev, HCI_BCM_ENABLE_WBS_REQ, sizeof(cp2), &cp2);
1449
1450         cp3.i2c_enable = 0x00;
1451         cp3.is_master = 0x00;
1452         cp3.pcm_rate = 0x01;
1453         cp3.clock_rate = 0x04;
1454         hci_send_cmd(hdev, HCI_BCM_I2C_PCM_REQ, sizeof(cp3), &cp3);
1455
1456         cp4.sco_routing = 0x00;
1457         cp4.pcm_rate = 0x04;
1458         cp4.frame_type = 0x00;
1459         cp4.sync_mode = 0x00;
1460         cp4.clock_mode = 0x00;
1461         hci_send_cmd(hdev, HCI_BCM_SCO_PCM_REQ, sizeof(cp4), &cp4);
1462 }
1463 #endif
1464
1465 /* ----- SCO interface with lower layer (HCI) ----- */
1466 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
1467 {
1468         struct sock *sk;
1469         int lm = 0;
1470
1471         BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1472
1473         /* Find listening sockets */
1474         read_lock(&sco_sk_list.lock);
1475         sk_for_each(sk, &sco_sk_list.head) {
1476                 if (sk->sk_state != BT_LISTEN)
1477                         continue;
1478
1479 #ifdef TIZEN_BT
1480                 /* Multiple SCO accept feature */
1481                 if (!bacmp(&sco_pi(sk)->src, bdaddr) ||
1482                     !bacmp(&sco_pi(sk)->src, BDADDR_ANY)) {
1483 #else
1484                 if (!bacmp(&sco_pi(sk)->src, &hdev->bdaddr) ||
1485                     !bacmp(&sco_pi(sk)->src, BDADDR_ANY)) {
1486 #endif
1487                         lm |= HCI_LM_ACCEPT;
1488
1489                         if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
1490                                 *flags |= HCI_PROTO_DEFER;
1491                         break;
1492                 }
1493         }
1494         read_unlock(&sco_sk_list.lock);
1495
1496 #ifdef TIZEN_BT
1497         /* WBC/NBC feature */
1498         if ((lm & HCI_LM_ACCEPT) && !hci_conn_hash_lookup_sco(hdev)) {
1499                 struct hci_conn *hcon_acl;
1500
1501                 hcon_acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
1502                 if (!hcon_acl) {
1503                         BT_ERR("ACL doesn't alive. Use 0x%X",
1504                                hdev->voice_setting);
1505
1506                         if (hdev->voice_setting == 0x0063)
1507                                 sco_connect_set_wbc(hdev);
1508                         else
1509                                 sco_connect_set_nbc(hdev);
1510                 } else if (hcon_acl->sco_role == MGMT_SCO_ROLE_HANDSFREE) {
1511                         BT_DBG("Handsfree SCO 0x%X", hcon_acl->voice_setting);
1512                         if (hcon_acl->voice_setting == 0x0063)
1513                                 sco_connect_set_wbc(hdev);
1514                         else
1515                                 sco_connect_set_nbc(hdev);
1516                 } else {
1517                         BT_DBG("Gateway SCO 0x%X", hcon_acl->voice_setting);
1518                         if (hcon_acl->voice_setting == 0x0063)
1519                                 sco_connect_set_gw_wbc(hdev);
1520                         else
1521                                 sco_connect_set_gw_nbc(hdev);
1522                 }
1523         }
1524 #endif
1525
1526         return lm;
1527 }
1528
1529 static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
1530 {
1531         if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
1532                 return;
1533
1534         BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status);
1535
1536         if (!status) {
1537                 struct sco_conn *conn;
1538
1539                 conn = sco_conn_add(hcon);
1540                 if (conn)
1541                         sco_conn_ready(conn);
1542         } else
1543                 sco_conn_del(hcon, bt_to_errno(status));
1544 }
1545
1546 static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
1547 {
1548         if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
1549                 return;
1550
1551         BT_DBG("hcon %p reason %d", hcon, reason);
1552
1553         sco_conn_del(hcon, bt_to_errno(reason));
1554 }
1555
1556 void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
1557 {
1558         struct sco_conn *conn = hcon->sco_data;
1559
1560         if (!conn)
1561                 goto drop;
1562
1563         BT_DBG("conn %p len %u", conn, skb->len);
1564
1565         if (skb->len) {
1566                 sco_recv_frame(conn, skb);
1567                 return;
1568         }
1569
1570 drop:
1571         kfree_skb(skb);
1572 }
1573
1574 static struct hci_cb sco_cb = {
1575         .name           = "SCO",
1576         .connect_cfm    = sco_connect_cfm,
1577         .disconn_cfm    = sco_disconn_cfm,
1578 };
1579
1580 static int sco_debugfs_show(struct seq_file *f, void *p)
1581 {
1582         struct sock *sk;
1583
1584         read_lock(&sco_sk_list.lock);
1585
1586         sk_for_each(sk, &sco_sk_list.head) {
1587                 seq_printf(f, "%pMR %pMR %d\n", &sco_pi(sk)->src,
1588                            &sco_pi(sk)->dst, sk->sk_state);
1589         }
1590
1591         read_unlock(&sco_sk_list.lock);
1592
1593         return 0;
1594 }
1595
1596 DEFINE_SHOW_ATTRIBUTE(sco_debugfs);
1597
1598 static struct dentry *sco_debugfs;
1599
1600 static const struct proto_ops sco_sock_ops = {
1601         .family         = PF_BLUETOOTH,
1602         .owner          = THIS_MODULE,
1603         .release        = sco_sock_release,
1604         .bind           = sco_sock_bind,
1605         .connect        = sco_sock_connect,
1606         .listen         = sco_sock_listen,
1607         .accept         = sco_sock_accept,
1608         .getname        = sco_sock_getname,
1609         .sendmsg        = sco_sock_sendmsg,
1610         .recvmsg        = sco_sock_recvmsg,
1611         .poll           = bt_sock_poll,
1612         .ioctl          = bt_sock_ioctl,
1613         .gettstamp      = sock_gettstamp,
1614         .mmap           = sock_no_mmap,
1615         .socketpair     = sock_no_socketpair,
1616         .shutdown       = sco_sock_shutdown,
1617         .setsockopt     = sco_sock_setsockopt,
1618         .getsockopt     = sco_sock_getsockopt
1619 };
1620
1621 static const struct net_proto_family sco_sock_family_ops = {
1622         .family = PF_BLUETOOTH,
1623         .owner  = THIS_MODULE,
1624         .create = sco_sock_create,
1625 };
1626
1627 int __init sco_init(void)
1628 {
1629         int err;
1630
1631         BUILD_BUG_ON(sizeof(struct sockaddr_sco) > sizeof(struct sockaddr));
1632
1633         err = proto_register(&sco_proto, 0);
1634         if (err < 0)
1635                 return err;
1636
1637         err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
1638         if (err < 0) {
1639                 BT_ERR("SCO socket registration failed");
1640                 goto error;
1641         }
1642
1643         err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL);
1644         if (err < 0) {
1645                 BT_ERR("Failed to create SCO proc file");
1646                 bt_sock_unregister(BTPROTO_SCO);
1647                 goto error;
1648         }
1649
1650         BT_INFO("SCO socket layer initialized");
1651
1652         hci_register_cb(&sco_cb);
1653
1654         if (IS_ERR_OR_NULL(bt_debugfs))
1655                 return 0;
1656
1657         sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs,
1658                                           NULL, &sco_debugfs_fops);
1659
1660         return 0;
1661
1662 error:
1663         proto_unregister(&sco_proto);
1664         return err;
1665 }
1666
1667 void sco_exit(void)
1668 {
1669         bt_procfs_cleanup(&init_net, "sco");
1670
1671         debugfs_remove(sco_debugfs);
1672
1673         hci_unregister_cb(&sco_cb);
1674
1675         bt_sock_unregister(BTPROTO_SCO);
1676
1677         proto_unregister(&sco_proto);
1678 }
1679
1680 module_param(disable_esco, bool, 0644);
1681 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");