1 /* 2 * 3 * Bluetooth virtual HCI driver 4 * 5 * Copyright (C) 2000-2001 Qualcomm Incorporated 6 * Copyright (C) 2002-2003 Maxim Krasnyansky <maxk@qualcomm.com> 7 * Copyright (C) 2004-2006 Marcel Holtmann <marcel@holtmann.org> 8 * 9 * 10 * This program is free software; you can redistribute it and/or modify 11 * it under the terms of the GNU General Public License as published by 12 * the Free Software Foundation; either version 2 of the License, or 13 * (at your option) any later version. 14 * 15 * This program is distributed in the hope that it will be useful, 16 * but WITHOUT ANY WARRANTY; without even the implied warranty of 17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18 * GNU General Public License for more details. 19 * 20 * You should have received a copy of the GNU General Public License 21 * along with this program; if not, write to the Free Software 22 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 23 * 24 */ 25 26 #include <linux/module.h> 27 #include <asm/unaligned.h> 28 29 #include <linux/kernel.h> 30 #include <linux/init.h> 31 #include <linux/slab.h> 32 #include <linux/types.h> 33 #include <linux/errno.h> 34 #include <linux/sched.h> 35 #include <linux/poll.h> 36 37 #include <linux/skbuff.h> 38 #include <linux/miscdevice.h> 39 40 #include <net/bluetooth/bluetooth.h> 41 #include <net/bluetooth/hci_core.h> 42 43 #define VERSION "1.5" 44 45 static bool amp; 46 47 struct vhci_data { 48 struct hci_dev *hdev; 49 50 wait_queue_head_t read_wait; 51 struct sk_buff_head readq; 52 53 struct mutex open_mutex; 54 struct delayed_work open_timeout; 55 }; 56 57 static int vhci_open_dev(struct hci_dev *hdev) 58 { 59 return 0; 60 } 61 62 static int vhci_close_dev(struct hci_dev *hdev) 63 { 64 struct vhci_data *data = hci_get_drvdata(hdev); 65 66 skb_queue_purge(&data->readq); 67 68 return 0; 69 } 70 71 static int vhci_flush(struct hci_dev *hdev) 72 { 73 struct vhci_data *data = hci_get_drvdata(hdev); 74 75 skb_queue_purge(&data->readq); 76 77 return 0; 78 } 79 80 static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 81 { 82 struct vhci_data *data = hci_get_drvdata(hdev); 83 84 memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1); 85 skb_queue_tail(&data->readq, skb); 86 87 wake_up_interruptible(&data->read_wait); 88 return 0; 89 } 90 91 static int __vhci_create_device(struct vhci_data *data, __u8 opcode) 92 { 93 struct hci_dev *hdev; 94 struct sk_buff *skb; 95 __u8 dev_type; 96 97 if (data->hdev) 98 return -EBADFD; 99 100 /* bits 0-1 are dev_type (Primary or AMP) */ 101 dev_type = opcode & 0x03; 102 103 if (dev_type != HCI_PRIMARY && dev_type != HCI_AMP) 104 return -EINVAL; 105 106 /* bits 2-5 are reserved (must be zero) */ 107 if (opcode & 0x3c) 108 return -EINVAL; 109 110 skb = bt_skb_alloc(4, GFP_KERNEL); 111 if (!skb) 112 return -ENOMEM; 113 114 hdev = hci_alloc_dev(); 115 if (!hdev) { 116 kfree_skb(skb); 117 return -ENOMEM; 118 } 119 120 data->hdev = hdev; 121 122 hdev->bus = HCI_VIRTUAL; 123 hdev->dev_type = dev_type; 124 hci_set_drvdata(hdev, data); 125 126 hdev->open = vhci_open_dev; 127 hdev->close = vhci_close_dev; 128 hdev->flush = vhci_flush; 129 hdev->send = vhci_send_frame; 130 131 /* bit 6 is for external configuration */ 132 if (opcode & 0x40) 133 set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks); 134 135 /* bit 7 is for raw device */ 136 if (opcode & 0x80) 137 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 138 139 if (hci_register_dev(hdev) < 0) { 140 BT_ERR("Can't register HCI device"); 141 hci_free_dev(hdev); 142 data->hdev = NULL; 143 kfree_skb(skb); 144 return -EBUSY; 145 } 146 147 hci_skb_pkt_type(skb) = HCI_VENDOR_PKT; 148 149 skb_put_u8(skb, 0xff); 150 skb_put_u8(skb, opcode); 151 put_unaligned_le16(hdev->id, skb_put(skb, 2)); 152 skb_queue_tail(&data->readq, skb); 153 154 wake_up_interruptible(&data->read_wait); 155 return 0; 156 } 157 158 static int vhci_create_device(struct vhci_data *data, __u8 opcode) 159 { 160 int err; 161 162 mutex_lock(&data->open_mutex); 163 err = __vhci_create_device(data, opcode); 164 mutex_unlock(&data->open_mutex); 165 166 return err; 167 } 168 169 static inline ssize_t vhci_get_user(struct vhci_data *data, 170 struct iov_iter *from) 171 { 172 size_t len = iov_iter_count(from); 173 struct sk_buff *skb; 174 __u8 pkt_type, opcode; 175 int ret; 176 177 if (len < 2 || len > HCI_MAX_FRAME_SIZE) 178 return -EINVAL; 179 180 skb = bt_skb_alloc(len, GFP_KERNEL); 181 if (!skb) 182 return -ENOMEM; 183 184 if (!copy_from_iter_full(skb_put(skb, len), len, from)) { 185 kfree_skb(skb); 186 return -EFAULT; 187 } 188 189 pkt_type = *((__u8 *) skb->data); 190 skb_pull(skb, 1); 191 192 switch (pkt_type) { 193 case HCI_EVENT_PKT: 194 case HCI_ACLDATA_PKT: 195 case HCI_SCODATA_PKT: 196 if (!data->hdev) { 197 kfree_skb(skb); 198 return -ENODEV; 199 } 200 201 hci_skb_pkt_type(skb) = pkt_type; 202 203 ret = hci_recv_frame(data->hdev, skb); 204 break; 205 206 case HCI_VENDOR_PKT: 207 cancel_delayed_work_sync(&data->open_timeout); 208 209 opcode = *((__u8 *) skb->data); 210 skb_pull(skb, 1); 211 212 if (skb->len > 0) { 213 kfree_skb(skb); 214 return -EINVAL; 215 } 216 217 kfree_skb(skb); 218 219 ret = vhci_create_device(data, opcode); 220 break; 221 222 default: 223 kfree_skb(skb); 224 return -EINVAL; 225 } 226 227 return (ret < 0) ? ret : len; 228 } 229 230 static inline ssize_t vhci_put_user(struct vhci_data *data, 231 struct sk_buff *skb, 232 char __user *buf, int count) 233 { 234 char __user *ptr = buf; 235 int len; 236 237 len = min_t(unsigned int, skb->len, count); 238 239 if (copy_to_user(ptr, skb->data, len)) 240 return -EFAULT; 241 242 if (!data->hdev) 243 return len; 244 245 data->hdev->stat.byte_tx += len; 246 247 switch (hci_skb_pkt_type(skb)) { 248 case HCI_COMMAND_PKT: 249 data->hdev->stat.cmd_tx++; 250 break; 251 case HCI_ACLDATA_PKT: 252 data->hdev->stat.acl_tx++; 253 break; 254 case HCI_SCODATA_PKT: 255 data->hdev->stat.sco_tx++; 256 break; 257 } 258 259 return len; 260 } 261 262 static ssize_t vhci_read(struct file *file, 263 char __user *buf, size_t count, loff_t *pos) 264 { 265 struct vhci_data *data = file->private_data; 266 struct sk_buff *skb; 267 ssize_t ret = 0; 268 269 while (count) { 270 skb = skb_dequeue(&data->readq); 271 if (skb) { 272 ret = vhci_put_user(data, skb, buf, count); 273 if (ret < 0) 274 skb_queue_head(&data->readq, skb); 275 else 276 kfree_skb(skb); 277 break; 278 } 279 280 if (file->f_flags & O_NONBLOCK) { 281 ret = -EAGAIN; 282 break; 283 } 284 285 ret = wait_event_interruptible(data->read_wait, 286 !skb_queue_empty(&data->readq)); 287 if (ret < 0) 288 break; 289 } 290 291 return ret; 292 } 293 294 static ssize_t vhci_write(struct kiocb *iocb, struct iov_iter *from) 295 { 296 struct file *file = iocb->ki_filp; 297 struct vhci_data *data = file->private_data; 298 299 return vhci_get_user(data, from); 300 } 301 302 static __poll_t vhci_poll(struct file *file, poll_table *wait) 303 { 304 struct vhci_data *data = file->private_data; 305 306 poll_wait(file, &data->read_wait, wait); 307 308 if (!skb_queue_empty(&data->readq)) 309 return EPOLLIN | EPOLLRDNORM; 310 311 return EPOLLOUT | EPOLLWRNORM; 312 } 313 314 static void vhci_open_timeout(struct work_struct *work) 315 { 316 struct vhci_data *data = container_of(work, struct vhci_data, 317 open_timeout.work); 318 319 vhci_create_device(data, amp ? HCI_AMP : HCI_PRIMARY); 320 } 321 322 static int vhci_open(struct inode *inode, struct file *file) 323 { 324 struct vhci_data *data; 325 326 data = kzalloc(sizeof(struct vhci_data), GFP_KERNEL); 327 if (!data) 328 return -ENOMEM; 329 330 skb_queue_head_init(&data->readq); 331 init_waitqueue_head(&data->read_wait); 332 333 mutex_init(&data->open_mutex); 334 INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout); 335 336 file->private_data = data; 337 nonseekable_open(inode, file); 338 339 schedule_delayed_work(&data->open_timeout, msecs_to_jiffies(1000)); 340 341 return 0; 342 } 343 344 static int vhci_release(struct inode *inode, struct file *file) 345 { 346 struct vhci_data *data = file->private_data; 347 struct hci_dev *hdev; 348 349 cancel_delayed_work_sync(&data->open_timeout); 350 351 hdev = data->hdev; 352 353 if (hdev) { 354 hci_unregister_dev(hdev); 355 hci_free_dev(hdev); 356 } 357 358 skb_queue_purge(&data->readq); 359 file->private_data = NULL; 360 kfree(data); 361 362 return 0; 363 } 364 365 static const struct file_operations vhci_fops = { 366 .owner = THIS_MODULE, 367 .read = vhci_read, 368 .write_iter = vhci_write, 369 .poll = vhci_poll, 370 .open = vhci_open, 371 .release = vhci_release, 372 .llseek = no_llseek, 373 }; 374 375 static struct miscdevice vhci_miscdev = { 376 .name = "vhci", 377 .fops = &vhci_fops, 378 .minor = VHCI_MINOR, 379 }; 380 module_misc_device(vhci_miscdev); 381 382 module_param(amp, bool, 0644); 383 MODULE_PARM_DESC(amp, "Create AMP controller device"); 384 385 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 386 MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION); 387 MODULE_VERSION(VERSION); 388 MODULE_LICENSE("GPL"); 389 MODULE_ALIAS("devname:vhci"); 390 MODULE_ALIAS_MISCDEV(VHCI_MINOR); 391