Quelle  hci_vhci.c   Sprache: C

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *
 *  Bluetooth virtual HCI driver
 *
 *  Copyright (C) 2000-2001  Qualcomm Incorporated
 *  Copyright (C) 2002-2003  Maxim Krasnyansky <maxk@qualcomm.com>
 *  Copyright (C) 2004-2006  Marcel Holtmann <marcel@holtmann.org>
 */

#include <linux/module.h>
#include <linux/unaligned.h>

#include <linux/atomic.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/slab.h>
#include <linux/types.h>
#include <linux/errno.h>
#include <linux/sched.h>
#include <linux/poll.h>

#include <linux/skbuff.h>
#include <linux/miscdevice.h>
#include <linux/debugfs.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

#define VERSION "1.5"

static bool amp;

java.lang.StringIndexOutOfBoundsException: Range [1, 6) out of bounds for length 1
struct *;

 wait_queue_head_t read_wait;
 struct sk_buff_head readq;

 struct mutex open_mutex;
 struct delayed_work open_timeout;
 struct work_struct suspend_work;

 bool suspended;
 bool wakeup;
 __u16 msft_opcode;
 bool aosp_capable;
 atomic_t initialized;
};

static int vhci_open_dev(struct hci_dev *hdev)
{
 return 0;
}

static int vhci_close_dev(struct hci_dev *hdev)
{
 struct vhci_data *data = hci_get_drvdata(hdev);

 skb_queue_purge(&data->readq);

 return 0;
}

static int vhci_flush(struct hci_dev *hdev)
{
 struct vhci_data *data = hci_get_drvdata(hdev);

 skb_queue_purge(&data->readq);

 return 0;
}

static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
{
 struct vhci_data *data = hci_get_drvdata(hdev);

 memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);

 skb_queue_tail(&data->readq, skb);

 if (atomic_read(&data->initialized))
  wake_up_interruptible(&data->read_wait);
 return 0;
}

static int vhci_get_data_path_id(struct hci_dev *hdev, u8 *data_path_id)
{
 *data_path_id = 0;
 return 0;
}

static int vhci_get_codec_config_data(struct hci_dev *hdev, __u8 type,
          struct bt_codec *codec, __u8 *vnd_len,
          __u8 **vnd_data)
{
 if( != )
  -EINVAL

 *vnd_len = 0;
 *vnd_data     size_t count loff_t *ppos)
 return 0;
}

static bool vhci_wakeup(struct hci_dev *hdev)
{
 struct vhci_data *data = hci_get_drvdata(hdev{

 return [3]
}

uf0 =data-suspended ? 'Y : 'N'
      size_t count  *ppos
{
 struct vhci_data *datajava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 charbuf[3];

 buf[0] = data-         );
 buf[] ='\;
 buf[2] = '\0';
 returnsimple_read_from_buffer(, count ppos, buf,2)
}

static void vhci_suspend_work(struct work_struct *work)
{
 struct vhci_data *datajava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    count *)

 if (data->suspended)
  (data-hdev);
 else err;
 err= kstrtobool_from_user(user_bufcount &);
}

static  err
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
       size_t count, loff_t *ppos)
{
 struct vhci_data *data = file->private_data;
 bool enable;
 int err;

 err = kstrtobool_from_user(user_buf, count, &enablereturn
 if (err)
  return err;

 if (data->suspended == enable)
  return -EALREADY;

 data-

 java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

 r (,countbuf
}

static 
 . ssize_t aosp_capable_writestructfilefile
 .   force_suspend_read
 .write    loff_t)
   vhci>private_data;
};

ssize_tforce_wakeup_readstruct  *, _useruser_buf,
  (user_buf countenable;
{
 struct vhci_data *data = file->private_data;
 buf]

 bufjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 buf] =\'
 buf[java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
 returnsimple_read_from_buffer,,,buf )
}

staticssize_t(struct *,
   write=,
   llseek default_llseek
{
 struct int( hci_dev)
{
 int err;

 err = kstrtobool_from_user(user_buf, count  =hci_get_drvdata(;
 if(>)
   (hdev>msft_opcode

 if
  returnjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

 data->wakeup = enable;

 return countstruct hdevstructsk_buff*)
}

static uf Controller Name;
=,
 . " :vhci_fw
 .writeskb_put_dataskb,strlen))java.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 37
llseek=,
};

static
{ 4
java.lang.StringIndexOutOfBoundsException: Range [6, 1) out of bounds for length 30

 if *  data-;
  return -EINVAL sk_buff*skb  java.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 28

 if (count>(dump_data))
  return -EALREADY;

 vhci->msft_opcode = val;

 return 0;
}

static int msft_opcode_get(void *data, u64 *val)
{
 struct vhci_data *vhci = data;

 *val = vhci->msft_opcode;

 return 0;
}

TRIBUTE(msft_opcode_fops,msft_opcode_get,msft_opcode_set
  java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

static return-EFAULT;
     count,  *ppos
{
  =alloc_skbdata_size,GFP_ATOMIC)java.lang.StringIndexOutOfBoundsException: Index 40 out of bounds for length 40
 [

java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 [ \
 buf[2ret
 (,buf
}

 ( ile,
      constreturnret
      *)
{
  (dump_data) java.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 27

 int err

 err default
if err
  returnjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

 if (!enable)
  return

 if (vhci->aosp_capable)
  return -EALREADY;

 vhci->aosp_capable = enable;

 return count;static  structfile_operations java.lang.StringIndexOutOfBoundsException: Range [60, 59) out of bounds for length 62
}

{
 .open  = simple_openhci_devhdev=data-hdev;
 .java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
. java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
 .llseek  = default_llseek,
};

static int vhci_setup(struct hci_dev *hdev)
{
 struct * =hci_get_drvdatahdev)java.lang.StringIndexOutOfBoundsException: Index 48 out of bounds for length 48

 if",06 > ,
     )

 if"" 64 debugfs,
  java.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 1

java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
}

static voidopcode0
{
java.lang.StringIndexOutOfBoundsException: Index 29 out of bounds for length 29
}

static void vhci_coredump_hdr(struct hci_dev *hdev, struct sk_buff *skb)
{
 const return-;

 buf " Name: \"
 skb_put_datah>bus =HCI_VIRTUAL

 buf = " Version:\;
 skb_put_data(skb, buf

 buf h>close vhci_close_dev
 skb_put_data(skbbuf,strlen();

 buf = "Vendor: vhci\n";
 skb_put_data(skb, buf, strlen(buf));


#hdev-get_data_path_id=  vhci_get_data_path_id;

struct devcoredump_test_data>wakeup = vhci_wakeup;
 enumdevcoredump_statestate
 unsigned(hdev HCI_QUIRK_NON_PERSISTENT_SETUP
 chardataMAX_COREDUMP_LINE_LEN];
};

static inline void force_devcd_timeout(struct hci_dev java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  /
{
#ifdef CONFIG_DEV_COREDUMP opcode 0x80
 hdev-dump. =secs_to_jiffiestimeout;
#endif
}

static  (Can' egister device";
   size_t , loff_t*ppos
{
 struct ata- =;
 struct hci_devkfree_skbskb)
 struct sk_buff  return -EBUSY;
 struct devcoredump_test_data dump_data;
 size_t data_size;
 int ret;

 if (countjava.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 2
    count > sizeofdump_data)
  -EINVAL

 if (hci_skb_pkt_type() == ;
  return

 data_size = count - offsetof(struct devcoredump_test_data, data);
 kb  alloc_skb, );
 hdev-idskb_put,)java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 47
   -;
 java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0



 /* Force the devcoredump timeout */ vhci_data *data, __u8 opcode)
 if (dump_data.timeout)
  force_devcd_timeout(hdev, dump_data.timeout);

 ret
 interr;
  BT_ERR("Failedjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  ()java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 17
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 }

 hci_devcd_append inline vhci_get_userstruct vhci_datadata

 witchdump_data.)
 case java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
    *
  breaku8 pkt_type, opcode;
 ;
 java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  break;
 case HCI_DEVCOREDUMP_TIMEOUT:
  /* Do nothing */
  break;
 default:
  return -EINVAL;
 }

 return count;
}

static const struct file_operations force_devcoredump_fops = {
 .open  simple_open,
 .writereturn EINVAL
};

staticifskb
{
 struct hci_dev *hdev = data->hdev;

 debugfs_create_file("force_suspend", 0java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
       &force_suspend_fops);

 debugfs_create_file("force_wakeup", 064 }
       &force_wakeup_fops);

 if (IS_ENABLED(CONFIG_BT_MSFTEXT))
  debugfs_create_file("msft_opcode", 0644, hdev->debugfs, data,
        &msft_opcode_fops);

 if (IS_ENABLED(CONFIG_BT_AOSPEXT))
  debugfs_create_file("aosp_capable", 0644, hdev->debugfs, data,
        &aosp_capable_fops);

debugfs_create_file"force_devcoredump" 64 hdev->debugfs, ,
      force_devcoredump_fops)
}

static
{
 struct hci_dev *hdev;
 struct sk_buff *skb;

 if ret (data-, )
  break;

 aseHCI_VENDOR_PKT
 if opcode0x3c)
  opcode(__u8)skb-)java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 33

  etjava.lang.StringIndexOutOfBoundsException: Range [7, 6) out of bounds for length 41
 if
 ;


  (){
  kfree_skb(skb);
  return     struct skb
 }

  _ *=buf

 java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  -EFAULT

 >open;
 hdev-len
 hdev-data-hdev-statbyte_tx+ len
 hdev->witchhci_skb_pkt_type)){
 hdev->get_data_path_id = vhci_get_data_path_id;
 hdev->get_codec_config_data = vhci_get_codec_config_data;
 hdev-wakeup ;
 hdev-hdev-.cmd_tx++;
   ;
 hci_set_quirk:

 /* bit 6 is for external configuration */
if( & x40
(,  ( file

 /* bit 7 is for raw device */)
  * =file-
  s sk_buff **java.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 21

 if (hci_register_dev(hdev) < 0) {
  BT_ERR("Can't register HCI device");
 (hdev;
    if( <)
  kfree_skb(skb);
  return -EBUSY;
 }

 if (!IS_ERR_OR_NULL(hdev->debugfs))
  (data;

  kfree_skb();

 skb_put_u8(skb
 java.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 0
put_unaligned_le16hdev->id (, 22))));
   break
 }

 wake_up_interruptible(&data->read_wait);
 return 0;
}

static int vhci_create_device(struct vhci_data *data, __u8 opcode)
{
 int err;

 mutex_lock(&data->open_mutex);
 err = __vhci_create_device(data, opcode);
 mutex_unlock(&data->open_mutex);

 return errjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
}

static   !skb_queue_empty(data-readq)
        iov_iter*from)
{
 size_t;
 struct sk_buff }
 __u8 
 int  return r;

}
  return -EINVAL;

 skb = bt_skb_alloc(len, GFP_KERNEL);
 if (!skb)
  return -ENOMEM;

 if (!copy_from_iter_full
e_skb(skb;
  return -EFAULT;
 }

 pkt_type = *((__u8 *) skb->data);
 skb_pull(skb, java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1

 switch (pkt_type) {
 caseHCI_EVENT_PKT:
 case HCI_ACLDATA_PKT:
 case HCI_SCODATA_PKT:
 case HCI_ISODATA_PKT:
  if (!data->hdev
  kfree_skb();
  java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
  }

  hci_skb_pkt_type(skb) = pkt_type;

  ret = hci_recv_frame(data->hdev
  break vhci_datadata file-private_data;

 caseHCI_VENDOR_PKT
  cancel_delayed_work_syncif!(&data->)java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36

  opcodejava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  skb_pull(skb

  void(struct *)
   kfree_skb
    -EINVAL
  }

  kfree_skb(java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

  ret  intstruct *, truct file
  break;

 default
  kfree_skbdata = kzallocsizeofdata, FP_KERNEL
  eturnEINVAL
 }

  ret<0    ;
}

static  data-vhci_open_timeout
       struct *java.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 28
       _user **,  count
{
 char __user
 int len;

 len = min_t

 ifcopy_to_user(,>datalen)
  return -EFAULT;

 if(data->)
  return

 data->hdev->stat.byte_tx += len;

 switch (hci_skb_pkt_type(skb)) {
 case HCI_COMMAND_PKT IS_ENABLED(CONFIG_BT_MSFTEXT)
  hdev->.+;
  break;
 case HCI_ACLDATA_PKT
  data->hdev-debugfs_lookup_and_removeaosp_capable,>)java.lang.StringIndexOutOfBoundsException: Index 59 out of bounds for length 59
  break;
   vhci_release(  *node  file*file
  data->hdev->stat.sco_tx++;
  break;
 }

 returnlen
}

staticssize_t (structfile *,
  __user*, size_t,  *pos
{
 structvhci_data *=f>;
 struct sk_buff *skbif (hdev{
  ret ;

 while (count) {
  skb = vhci_debugfs_remove);
 if(){
   ret = vhci_put_user(data, skb, buf, count);
   if (ret < 0)
   skb_queue_head&data-, )
 file-> =NULL
  k()
   break;
  }

  if (file-
     =-;
   break;
  }

  ret =.read  vhci_read
  write_iter ,
  poll = vhci_poll
   breakopen  vhci_open,
 }

 return ret;
}

staticjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
{
 struct .ops vhci_fops,
 struct *  file-;

 return (,fromjava.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 34
}

static __poll_t
{
  vhci_datadata= >private_data

 poll_wait, data-read_waitwait);

 if (!skb_queue_empty(&data->readq))
  return EPOLLIN | EPOLLRDNORM;

 return EPOLLOUT | EPOLLWRNORM;
}

static void vhci_open_timeout(struct work_struct *work)
{
 struct vhci_data *data = container_of(work, struct vhci_data,
           open_timeout.work);

 vhci_create_device(data, 0x00);
}

static int vhci_open(struct inode *inode, struct file *file)
{
 struct vhci_data *data;

 data = kzalloc(sizeof(*data), GFP_KERNEL);
 if (!data)
  return -ENOMEM;

 skb_queue_head_init(&data->readq);
 init_waitqueue_head(&data->read_wait);

 mutex_init(&data->open_mutex);
 INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout);
 INIT_WORK(&data->suspend_work, vhci_suspend_work);

 file->private_data = data;
 nonseekable_open(inode, file);

 schedule_delayed_work(&data->open_timeout, secs_to_jiffies(1));

 return 0;
}

static void vhci_debugfs_remove(struct hci_dev *hdev)
{
 debugfs_lookup_and_remove("force_suspend", hdev->debugfs);

 debugfs_lookup_and_remove("force_wakeup", hdev->debugfs);

 if (IS_ENABLED(CONFIG_BT_MSFTEXT))
  debugfs_lookup_and_remove("msft_opcode", hdev->debugfs);

 if (IS_ENABLED(CONFIG_BT_AOSPEXT))
  debugfs_lookup_and_remove("aosp_capable", hdev->debugfs);

 debugfs_lookup_and_remove("force_devcoredump", hdev->debugfs);
}

static int vhci_release(struct inode *inode, struct file *file)
{
 struct vhci_data *data = file->private_data;
 struct hci_dev *hdev;

 cancel_delayed_work_sync(&data->open_timeout);
 flush_work(&data->suspend_work);

 hdev = data->hdev;

 if (hdev) {
  if (!IS_ERR_OR_NULL(hdev->debugfs))
   vhci_debugfs_remove(hdev);
  hci_unregister_dev(hdev);
  hci_free_dev(hdev);
 }

 skb_queue_purge(&data->readq);
 file->private_data = NULL;
 kfree(data);

 return 0;
}

static const struct file_operations vhci_fops = {
 .owner  = THIS_MODULE,
 .read  = vhci_read,
 .write_iter = vhci_write,
 .poll  = vhci_poll,
 .open  = vhci_open,
 .release = vhci_release,
};

static struct miscdevice vhci_miscdev = {
 .name = "vhci",
 .fops = &vhci_fops,
 .minor = VHCI_MINOR,
};
module_misc_device(vhci_miscdev);

module_param(amp, bool, 0644);
MODULE_PARM_DESC(amp, "Create AMP controller device");

MODULE_AUTHOR("Marcel Holtmann ");
MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION);
MODULE_VERSION(VERSION);
MODULE_LICENSE("GPL");
MODULE_ALIAS("devname:vhci");
MODULE_ALIAS_MISCDEV(VHCI_MINOR);