1 /* 2 * 3 * Bluetooth virtual HCI driver 4 * 5 * Copyright (C) 2000-2001 Qualcomm Incorporated 6 * Copyright (C) 2002-2003 Maxim Krasnyansky <maxk@qualcomm.com> 7 * Copyright (C) 2004-2006 Marcel Holtmann <marcel@holtmann.org> 8 * 9 * 10 * This program is free software; you can redistribute it and/or modify 11 * it under the terms of the GNU General Public License as published by 12 * the Free Software Foundation; either version 2 of the License, or 13 * (at your option) any later version. 14 * 15 * This program is distributed in the hope that it will be useful, 16 * but WITHOUT ANY WARRANTY; without even the implied warranty of 17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18 * GNU General Public License for more details. 19 * 20 * You should have received a copy of the GNU General Public License 21 * along with this program; if not, write to the Free Software 22 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 23 * 24 */ 25 26 #include <linux/module.h> 27 #include <asm/unaligned.h> 28 29 #include <linux/kernel.h> 30 #include <linux/init.h> 31 #include <linux/slab.h> 32 #include <linux/types.h> 33 #include <linux/errno.h> 34 #include <linux/sched.h> 35 #include <linux/poll.h> 36 37 #include <linux/skbuff.h> 38 #include <linux/miscdevice.h> 39 40 #include <net/bluetooth/bluetooth.h> 41 #include <net/bluetooth/hci_core.h> 42 43 #define VERSION "1.5" 44 45 static bool amp; 46 47 struct vhci_data { 48 struct hci_dev *hdev; 49 50 wait_queue_head_t read_wait; 51 struct sk_buff_head readq; 52 53 struct delayed_work open_timeout; 54 }; 55 56 static int vhci_open_dev(struct hci_dev *hdev) 57 { 58 return 0; 59 } 60 61 static int vhci_close_dev(struct hci_dev *hdev) 62 { 63 struct vhci_data *data = hci_get_drvdata(hdev); 64 65 skb_queue_purge(&data->readq); 66 67 return 0; 68 } 69 70 static int vhci_flush(struct hci_dev *hdev) 71 { 72 struct vhci_data *data = hci_get_drvdata(hdev); 73 74 skb_queue_purge(&data->readq); 75 76 return 0; 77 } 78 79 static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 80 { 81 struct vhci_data *data = hci_get_drvdata(hdev); 82 83 memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1); 84 skb_queue_tail(&data->readq, skb); 85 86 wake_up_interruptible(&data->read_wait); 87 return 0; 88 } 89 90 static int vhci_create_device(struct vhci_data *data, __u8 opcode) 91 { 92 struct hci_dev *hdev; 93 struct sk_buff *skb; 94 __u8 dev_type; 95 96 /* bits 0-1 are dev_type (BR/EDR or AMP) */ 97 dev_type = opcode & 0x03; 98 99 if (dev_type != HCI_BREDR && dev_type != HCI_AMP) 100 return -EINVAL; 101 102 /* bits 2-5 are reserved (must be zero) */ 103 if (opcode & 0x3c) 104 return -EINVAL; 105 106 skb = bt_skb_alloc(4, GFP_KERNEL); 107 if (!skb) 108 return -ENOMEM; 109 110 hdev = hci_alloc_dev(); 111 if (!hdev) { 112 kfree_skb(skb); 113 return -ENOMEM; 114 } 115 116 data->hdev = hdev; 117 118 hdev->bus = HCI_VIRTUAL; 119 hdev->dev_type = dev_type; 120 hci_set_drvdata(hdev, data); 121 122 hdev->open = vhci_open_dev; 123 hdev->close = vhci_close_dev; 124 hdev->flush = vhci_flush; 125 hdev->send = vhci_send_frame; 126 127 /* bit 6 is for external configuration */ 128 if (opcode & 0x40) 129 set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks); 130 131 /* bit 7 is for raw device */ 132 if (opcode & 0x80) 133 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 134 135 if (hci_register_dev(hdev) < 0) { 136 BT_ERR("Can't register HCI device"); 137 hci_free_dev(hdev); 138 data->hdev = NULL; 139 kfree_skb(skb); 140 return -EBUSY; 141 } 142 143 bt_cb(skb)->pkt_type = HCI_VENDOR_PKT; 144 145 *skb_put(skb, 1) = 0xff; 146 *skb_put(skb, 1) = opcode; 147 put_unaligned_le16(hdev->id, skb_put(skb, 2)); 148 skb_queue_tail(&data->readq, skb); 149 150 wake_up_interruptible(&data->read_wait); 151 return 0; 152 } 153 154 static inline ssize_t vhci_get_user(struct vhci_data *data, 155 struct iov_iter *from) 156 { 157 size_t len = iov_iter_count(from); 158 struct sk_buff *skb; 159 __u8 pkt_type, opcode; 160 int ret; 161 162 if (len < 2 || len > HCI_MAX_FRAME_SIZE) 163 return -EINVAL; 164 165 skb = bt_skb_alloc(len, GFP_KERNEL); 166 if (!skb) 167 return -ENOMEM; 168 169 if (copy_from_iter(skb_put(skb, len), len, from) != len) { 170 kfree_skb(skb); 171 return -EFAULT; 172 } 173 174 pkt_type = *((__u8 *) skb->data); 175 skb_pull(skb, 1); 176 177 switch (pkt_type) { 178 case HCI_EVENT_PKT: 179 case HCI_ACLDATA_PKT: 180 case HCI_SCODATA_PKT: 181 if (!data->hdev) { 182 kfree_skb(skb); 183 return -ENODEV; 184 } 185 186 bt_cb(skb)->pkt_type = pkt_type; 187 188 ret = hci_recv_frame(data->hdev, skb); 189 break; 190 191 case HCI_VENDOR_PKT: 192 if (data->hdev) { 193 kfree_skb(skb); 194 return -EBADFD; 195 } 196 197 cancel_delayed_work_sync(&data->open_timeout); 198 199 opcode = *((__u8 *) skb->data); 200 skb_pull(skb, 1); 201 202 if (skb->len > 0) { 203 kfree_skb(skb); 204 return -EINVAL; 205 } 206 207 kfree_skb(skb); 208 209 ret = vhci_create_device(data, opcode); 210 break; 211 212 default: 213 kfree_skb(skb); 214 return -EINVAL; 215 } 216 217 return (ret < 0) ? ret : len; 218 } 219 220 static inline ssize_t vhci_put_user(struct vhci_data *data, 221 struct sk_buff *skb, 222 char __user *buf, int count) 223 { 224 char __user *ptr = buf; 225 int len; 226 227 len = min_t(unsigned int, skb->len, count); 228 229 if (copy_to_user(ptr, skb->data, len)) 230 return -EFAULT; 231 232 if (!data->hdev) 233 return len; 234 235 data->hdev->stat.byte_tx += len; 236 237 switch (bt_cb(skb)->pkt_type) { 238 case HCI_COMMAND_PKT: 239 data->hdev->stat.cmd_tx++; 240 break; 241 case HCI_ACLDATA_PKT: 242 data->hdev->stat.acl_tx++; 243 break; 244 case HCI_SCODATA_PKT: 245 data->hdev->stat.sco_tx++; 246 break; 247 } 248 249 return len; 250 } 251 252 static ssize_t vhci_read(struct file *file, 253 char __user *buf, size_t count, loff_t *pos) 254 { 255 struct vhci_data *data = file->private_data; 256 struct sk_buff *skb; 257 ssize_t ret = 0; 258 259 while (count) { 260 skb = skb_dequeue(&data->readq); 261 if (skb) { 262 ret = vhci_put_user(data, skb, buf, count); 263 if (ret < 0) 264 skb_queue_head(&data->readq, skb); 265 else 266 kfree_skb(skb); 267 break; 268 } 269 270 if (file->f_flags & O_NONBLOCK) { 271 ret = -EAGAIN; 272 break; 273 } 274 275 ret = wait_event_interruptible(data->read_wait, 276 !skb_queue_empty(&data->readq)); 277 if (ret < 0) 278 break; 279 } 280 281 return ret; 282 } 283 284 static ssize_t vhci_write(struct kiocb *iocb, struct iov_iter *from) 285 { 286 struct file *file = iocb->ki_filp; 287 struct vhci_data *data = file->private_data; 288 289 return vhci_get_user(data, from); 290 } 291 292 static unsigned int vhci_poll(struct file *file, poll_table *wait) 293 { 294 struct vhci_data *data = file->private_data; 295 296 poll_wait(file, &data->read_wait, wait); 297 298 if (!skb_queue_empty(&data->readq)) 299 return POLLIN | POLLRDNORM; 300 301 return POLLOUT | POLLWRNORM; 302 } 303 304 static void vhci_open_timeout(struct work_struct *work) 305 { 306 struct vhci_data *data = container_of(work, struct vhci_data, 307 open_timeout.work); 308 309 vhci_create_device(data, amp ? HCI_AMP : HCI_BREDR); 310 } 311 312 static int vhci_open(struct inode *inode, struct file *file) 313 { 314 struct vhci_data *data; 315 316 data = kzalloc(sizeof(struct vhci_data), GFP_KERNEL); 317 if (!data) 318 return -ENOMEM; 319 320 skb_queue_head_init(&data->readq); 321 init_waitqueue_head(&data->read_wait); 322 323 INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout); 324 325 file->private_data = data; 326 nonseekable_open(inode, file); 327 328 schedule_delayed_work(&data->open_timeout, msecs_to_jiffies(1000)); 329 330 return 0; 331 } 332 333 static int vhci_release(struct inode *inode, struct file *file) 334 { 335 struct vhci_data *data = file->private_data; 336 struct hci_dev *hdev = data->hdev; 337 338 cancel_delayed_work_sync(&data->open_timeout); 339 340 if (hdev) { 341 hci_unregister_dev(hdev); 342 hci_free_dev(hdev); 343 } 344 345 file->private_data = NULL; 346 kfree(data); 347 348 return 0; 349 } 350 351 static const struct file_operations vhci_fops = { 352 .owner = THIS_MODULE, 353 .read = vhci_read, 354 .write_iter = vhci_write, 355 .poll = vhci_poll, 356 .open = vhci_open, 357 .release = vhci_release, 358 .llseek = no_llseek, 359 }; 360 361 static struct miscdevice vhci_miscdev = { 362 .name = "vhci", 363 .fops = &vhci_fops, 364 .minor = VHCI_MINOR, 365 }; 366 367 static int __init vhci_init(void) 368 { 369 BT_INFO("Virtual HCI driver ver %s", VERSION); 370 371 return misc_register(&vhci_miscdev); 372 } 373 374 static void __exit vhci_exit(void) 375 { 376 misc_deregister(&vhci_miscdev); 377 } 378 379 module_init(vhci_init); 380 module_exit(vhci_exit); 381 382 module_param(amp, bool, 0644); 383 MODULE_PARM_DESC(amp, "Create AMP controller device"); 384 385 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 386 MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION); 387 MODULE_VERSION(VERSION); 388 MODULE_LICENSE("GPL"); 389 MODULE_ALIAS("devname:vhci"); 390 MODULE_ALIAS_MISCDEV(VHCI_MINOR); 391