1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26#include <linux/module.h>
27#include <asm/unaligned.h>
28
29#include <linux/kernel.h>
30#include <linux/init.h>
31#include <linux/slab.h>
32#include <linux/types.h>
33#include <linux/errno.h>
34#include <linux/sched.h>
35#include <linux/poll.h>
36
37#include <linux/skbuff.h>
38#include <linux/miscdevice.h>
39
40#include <net/bluetooth/bluetooth.h>
41#include <net/bluetooth/hci_core.h>
42
43#define VERSION "1.5"
44
45static bool amp;
46
47struct vhci_data {
48 struct hci_dev *hdev;
49
50 wait_queue_head_t read_wait;
51 struct sk_buff_head readq;
52
53 struct delayed_work open_timeout;
54};
55
56static int vhci_open_dev(struct hci_dev *hdev)
57{
58 set_bit(HCI_RUNNING, &hdev->flags);
59
60 return 0;
61}
62
63static int vhci_close_dev(struct hci_dev *hdev)
64{
65 struct vhci_data *data = hci_get_drvdata(hdev);
66
67 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
68 return 0;
69
70 skb_queue_purge(&data->readq);
71
72 return 0;
73}
74
75static int vhci_flush(struct hci_dev *hdev)
76{
77 struct vhci_data *data = hci_get_drvdata(hdev);
78
79 skb_queue_purge(&data->readq);
80
81 return 0;
82}
83
84static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
85{
86 struct vhci_data *data = hci_get_drvdata(hdev);
87
88 if (!test_bit(HCI_RUNNING, &hdev->flags))
89 return -EBUSY;
90
91 memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
92 skb_queue_tail(&data->readq, skb);
93
94 wake_up_interruptible(&data->read_wait);
95 return 0;
96}
97
98static int vhci_create_device(struct vhci_data *data, __u8 opcode)
99{
100 struct hci_dev *hdev;
101 struct sk_buff *skb;
102 __u8 dev_type;
103
104
105 dev_type = opcode & 0x03;
106
107 if (dev_type != HCI_BREDR && dev_type != HCI_AMP)
108 return -EINVAL;
109
110
111 if (opcode & 0x3c)
112 return -EINVAL;
113
114 skb = bt_skb_alloc(4, GFP_KERNEL);
115 if (!skb)
116 return -ENOMEM;
117
118 hdev = hci_alloc_dev();
119 if (!hdev) {
120 kfree_skb(skb);
121 return -ENOMEM;
122 }
123
124 data->hdev = hdev;
125
126 hdev->bus = HCI_VIRTUAL;
127 hdev->dev_type = dev_type;
128 hci_set_drvdata(hdev, data);
129
130 hdev->open = vhci_open_dev;
131 hdev->close = vhci_close_dev;
132 hdev->flush = vhci_flush;
133 hdev->send = vhci_send_frame;
134
135
136 if (opcode & 0x40)
137 set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks);
138
139
140 if (opcode & 0x80)
141 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
142
143 if (hci_register_dev(hdev) < 0) {
144 BT_ERR("Can't register HCI device");
145 hci_free_dev(hdev);
146 data->hdev = NULL;
147 kfree_skb(skb);
148 return -EBUSY;
149 }
150
151 bt_cb(skb)->pkt_type = HCI_VENDOR_PKT;
152
153 *skb_put(skb, 1) = 0xff;
154 *skb_put(skb, 1) = opcode;
155 put_unaligned_le16(hdev->id, skb_put(skb, 2));
156 skb_queue_tail(&data->readq, skb);
157
158 wake_up_interruptible(&data->read_wait);
159 return 0;
160}
161
162static inline ssize_t vhci_get_user(struct vhci_data *data,
163 struct iov_iter *from)
164{
165 size_t len = iov_iter_count(from);
166 struct sk_buff *skb;
167 __u8 pkt_type, opcode;
168 int ret;
169
170 if (len < 2 || len > HCI_MAX_FRAME_SIZE)
171 return -EINVAL;
172
173 skb = bt_skb_alloc(len, GFP_KERNEL);
174 if (!skb)
175 return -ENOMEM;
176
177 if (copy_from_iter(skb_put(skb, len), len, from) != len) {
178 kfree_skb(skb);
179 return -EFAULT;
180 }
181
182 pkt_type = *((__u8 *) skb->data);
183 skb_pull(skb, 1);
184
185 switch (pkt_type) {
186 case HCI_EVENT_PKT:
187 case HCI_ACLDATA_PKT:
188 case HCI_SCODATA_PKT:
189 if (!data->hdev) {
190 kfree_skb(skb);
191 return -ENODEV;
192 }
193
194 bt_cb(skb)->pkt_type = pkt_type;
195
196 ret = hci_recv_frame(data->hdev, skb);
197 break;
198
199 case HCI_VENDOR_PKT:
200 if (data->hdev) {
201 kfree_skb(skb);
202 return -EBADFD;
203 }
204
205 cancel_delayed_work_sync(&data->open_timeout);
206
207 opcode = *((__u8 *) skb->data);
208 skb_pull(skb, 1);
209
210 if (skb->len > 0) {
211 kfree_skb(skb);
212 return -EINVAL;
213 }
214
215 kfree_skb(skb);
216
217 ret = vhci_create_device(data, opcode);
218 break;
219
220 default:
221 kfree_skb(skb);
222 return -EINVAL;
223 }
224
225 return (ret < 0) ? ret : len;
226}
227
228static inline ssize_t vhci_put_user(struct vhci_data *data,
229 struct sk_buff *skb,
230 char __user *buf, int count)
231{
232 char __user *ptr = buf;
233 int len;
234
235 len = min_t(unsigned int, skb->len, count);
236
237 if (copy_to_user(ptr, skb->data, len))
238 return -EFAULT;
239
240 if (!data->hdev)
241 return len;
242
243 data->hdev->stat.byte_tx += len;
244
245 switch (bt_cb(skb)->pkt_type) {
246 case HCI_COMMAND_PKT:
247 data->hdev->stat.cmd_tx++;
248 break;
249 case HCI_ACLDATA_PKT:
250 data->hdev->stat.acl_tx++;
251 break;
252 case HCI_SCODATA_PKT:
253 data->hdev->stat.sco_tx++;
254 break;
255 }
256
257 return len;
258}
259
260static ssize_t vhci_read(struct file *file,
261 char __user *buf, size_t count, loff_t *pos)
262{
263 struct vhci_data *data = file->private_data;
264 struct sk_buff *skb;
265 ssize_t ret = 0;
266
267 while (count) {
268 skb = skb_dequeue(&data->readq);
269 if (skb) {
270 ret = vhci_put_user(data, skb, buf, count);
271 if (ret < 0)
272 skb_queue_head(&data->readq, skb);
273 else
274 kfree_skb(skb);
275 break;
276 }
277
278 if (file->f_flags & O_NONBLOCK) {
279 ret = -EAGAIN;
280 break;
281 }
282
283 ret = wait_event_interruptible(data->read_wait,
284 !skb_queue_empty(&data->readq));
285 if (ret < 0)
286 break;
287 }
288
289 return ret;
290}
291
292static ssize_t vhci_write(struct kiocb *iocb, struct iov_iter *from)
293{
294 struct file *file = iocb->ki_filp;
295 struct vhci_data *data = file->private_data;
296
297 return vhci_get_user(data, from);
298}
299
300static unsigned int vhci_poll(struct file *file, poll_table *wait)
301{
302 struct vhci_data *data = file->private_data;
303
304 poll_wait(file, &data->read_wait, wait);
305
306 if (!skb_queue_empty(&data->readq))
307 return POLLIN | POLLRDNORM;
308
309 return POLLOUT | POLLWRNORM;
310}
311
312static void vhci_open_timeout(struct work_struct *work)
313{
314 struct vhci_data *data = container_of(work, struct vhci_data,
315 open_timeout.work);
316
317 vhci_create_device(data, amp ? HCI_AMP : HCI_BREDR);
318}
319
320static int vhci_open(struct inode *inode, struct file *file)
321{
322 struct vhci_data *data;
323
324 data = kzalloc(sizeof(struct vhci_data), GFP_KERNEL);
325 if (!data)
326 return -ENOMEM;
327
328 skb_queue_head_init(&data->readq);
329 init_waitqueue_head(&data->read_wait);
330
331 INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout);
332
333 file->private_data = data;
334 nonseekable_open(inode, file);
335
336 schedule_delayed_work(&data->open_timeout, msecs_to_jiffies(1000));
337
338 return 0;
339}
340
341static int vhci_release(struct inode *inode, struct file *file)
342{
343 struct vhci_data *data = file->private_data;
344 struct hci_dev *hdev = data->hdev;
345
346 cancel_delayed_work_sync(&data->open_timeout);
347
348 if (hdev) {
349 hci_unregister_dev(hdev);
350 hci_free_dev(hdev);
351 }
352
353 file->private_data = NULL;
354 kfree(data);
355
356 return 0;
357}
358
359static const struct file_operations vhci_fops = {
360 .owner = THIS_MODULE,
361 .read = vhci_read,
362 .write_iter = vhci_write,
363 .poll = vhci_poll,
364 .open = vhci_open,
365 .release = vhci_release,
366 .llseek = no_llseek,
367};
368
369static struct miscdevice vhci_miscdev = {
370 .name = "vhci",
371 .fops = &vhci_fops,
372 .minor = VHCI_MINOR,
373};
374
375static int __init vhci_init(void)
376{
377 BT_INFO("Virtual HCI driver ver %s", VERSION);
378
379 return misc_register(&vhci_miscdev);
380}
381
382static void __exit vhci_exit(void)
383{
384 misc_deregister(&vhci_miscdev);
385}
386
387module_init(vhci_init);
388module_exit(vhci_exit);
389
390module_param(amp, bool, 0644);
391MODULE_PARM_DESC(amp, "Create AMP controller device");
392
393MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
394MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION);
395MODULE_VERSION(VERSION);
396MODULE_LICENSE("GPL");
397MODULE_ALIAS("devname:vhci");
398MODULE_ALIAS_MISCDEV(VHCI_MINOR);
399
