Direct Control of Hci Device (Bypass Bluetooth Drivers) on Linux

Direct Control of HCI Device (Bypass Bluetooth Drivers) on Linux

I was able to achieve option #1.

Digging in the Linux kernel code for bluetooth drivers, I found an option for binding an HCI socket with hci_channel=1. 1 is the enum for HCI_USER_CHANNEL which causes the driver not to add its own commands to the HCI device.

To achieve this in C:

struct sockaddr_hci {
    sa_family_t     hci_family;
    unsigned short  hci_dev;
    unsigned short  hci_channel;
};

struct sockaddr_hci a;

memset(&a, 0, sizeof(a));
a.hci_family = AF_BLUETOOTH;
a.hci_dev = 0; //0 for hci0
a.hci_channel = 1; //1 for HCI_CHANNEL_USER

bind(sock, (struct sockaddr *) &a, sizeof(a));

To achieve this in Python:

Python's socket module does not support this option. A workaround for the missing support in Python was implemented in Scapy:
https://github.com/secdev/scapy/blob/d2f2b0c7b46b607fcdf79860f8f866446bb625fb/scapy/layers/bluetooth.py#L808

Example for C++:
https://github.com/sandeepmistry/node-bluetooth-hci-socket/blob/560a956c3e1421e31366115444ca9027d45b0e71/src/BluetoothHciSocket.cpp#L184

If you are interested in the relevant part of the Linux kernel: https://github.com/torvalds/linux/blob/86292b33d4b79ee03e2f43ea0381ef85f077c760/net/bluetooth/hci_sock.c#L1693

Prevent bluetooth driver actions?

sudo hciconfig hci0 down before creating user channel socket is needed. Other than that, see my edits. Marking this as done.

Bluetooth interface control in C code ( Linux OS )

You can use the c code for hciconfig itself. Just download the BlueZ source and open tools/hciconfig.c and use the following functions:-

static void cmd_up(int ctl, int hdev, char *opt)
{
    ...
}

and

static void cmd_down(int ctl, int hdev, char *opt) 
{
    ... 
}

L2CAP connection over an HCI socket?

In BLE, whenever you establish a connection, the L2CAP is ready to be used.

You don't need to connect or anything else. Once you receive the LE Connection Complete Event, you are ready to go and you may start communicating through L2CAP.

The other commands and data you mention are not LE, they are only for BR/EDR.

---

Related Topics