drivers/bluetooth/hci_vhci.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Bluetooth virtual HCI driver
   5  *
   6  *  Copyright (C) 2000-2001  Qualcomm Incorporated
   7  *  Copyright (C) 2002-2003  Maxim Krasnyansky <[email protected]>
   8  *  Copyright (C) 2004-2006  Marcel Holtmann <[email protected]>
   9  */
  10
  11 #include <linux/module.h>
  12 #include <asm/unaligned.h>
  13
  14 #include <linux/kernel.h>
  15 #include <linux/init.h>
  16 #include <linux/slab.h>
  17 #include <linux/types.h>
  18 #include <linux/errno.h>
  19 #include <linux/sched.h>
  20 #include <linux/poll.h>
  21
  22 #include <linux/skbuff.h>
  23 #include <linux/miscdevice.h>
  24 #include <linux/debugfs.h>
  25
  26 #include <net/bluetooth/bluetooth.h>
  27 #include <net/bluetooth/hci_core.h>
  28
  29 #define VERSION "1.5"
  30
  31 static bool amp;
  32
  33 struct vhci_data {
  34         struct hci_dev *hdev;
  35
  36         wait_queue_head_t read_wait;
  37         struct sk_buff_head readq;
  38
  39         struct mutex open_mutex;
  40         struct delayed_work open_timeout;
  41         struct work_struct suspend_work;
  42
  43         bool suspended;
  44         bool wakeup;
  45         __u16 msft_opcode;
  46         bool aosp_capable;
  47 };
  48
  49 static int vhci_open_dev(struct hci_dev *hdev)
  50 {
  51         return 0;
  52 }
  53
  54 static int vhci_close_dev(struct hci_dev *hdev)
  55 {
  56         struct vhci_data *data = hci_get_drvdata(hdev);
  57
  58         skb_queue_purge(&data->readq);
  59
  60         return 0;
  61 }
  62
  63 static int vhci_flush(struct hci_dev *hdev)
  64 {
  65         struct vhci_data *data = hci_get_drvdata(hdev);
  66
  67         skb_queue_purge(&data->readq);
  68
  69         return 0;
  70 }
  71
  72 static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
  73 {
  74         struct vhci_data *data = hci_get_drvdata(hdev);
  75
  76         memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
  77
  78         mutex_lock(&data->open_mutex);
  79         skb_queue_tail(&data->readq, skb);
  80         mutex_unlock(&data->open_mutex);
  81
  82         wake_up_interruptible(&data->read_wait);
  83         return 0;
  84 }
  85
  86 static int vhci_get_data_path_id(struct hci_dev *hdev, u8 *data_path_id)
  87 {
  88         *data_path_id = 0;
  89         return 0;
  90 }
  91
  92 static int vhci_get_codec_config_data(struct hci_dev *hdev, __u8 type,
  93                                       struct bt_codec *codec, __u8 *vnd_len,
  94                                       __u8 **vnd_data)
  95 {
  96         if (type != ESCO_LINK)
  97                 return -EINVAL;
  98
  99         *vnd_len = 0;
 100         *vnd_data = NULL;
 101         return 0;
 102 }
 103
 104 static bool vhci_wakeup(struct hci_dev *hdev)
 105 {
 106         struct vhci_data *data = hci_get_drvdata(hdev);
 107
 108         return data->wakeup;
 109 }
 110
 111 static ssize_t force_suspend_read(struct file *file, char __user *user_buf,
 112                                   size_t count, loff_t *ppos)
 113 {
 114         struct vhci_data *data = file->private_data;
 115         char buf[3];
 116
 117         buf[0] = data->suspended ? 'Y' : 'N';
 118         buf[1] = '\n';
 119         buf[2] = '\0';
 120         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 121 }
 122
 123 static void vhci_suspend_work(struct work_struct *work)
 124 {
 125         struct vhci_data *data = container_of(work, struct vhci_data,
 126                                               suspend_work);
 127
 128         if (data->suspended)
 129                 hci_suspend_dev(data->hdev);
 130         else
 131                 hci_resume_dev(data->hdev);
 132 }
 133
 134 static ssize_t force_suspend_write(struct file *file,
 135                                    const char __user *user_buf,
 136                                    size_t count, loff_t *ppos)
 137 {
 138         struct vhci_data *data = file->private_data;
 139         bool enable;
 140         int err;
 141
 142         err = kstrtobool_from_user(user_buf, count, &enable);
 143         if (err)
 144                 return err;
 145
 146         if (data->suspended == enable)
 147                 return -EALREADY;
 148
 149         data->suspended = enable;
 150
 151         schedule_work(&data->suspend_work);
 152
 153         return count;
 154 }
 155
 156 static const struct file_operations force_suspend_fops = {
 157         .open           = simple_open,
 158         .read           = force_suspend_read,
 159         .write          = force_suspend_write,
 160         .llseek         = default_llseek,
 161 };
 162
 163 static ssize_t force_wakeup_read(struct file *file, char __user *user_buf,
 164                                  size_t count, loff_t *ppos)
 165 {
 166         struct vhci_data *data = file->private_data;
 167         char buf[3];
 168
 169         buf[0] = data->wakeup ? 'Y' : 'N';
 170         buf[1] = '\n';
 171         buf[2] = '\0';
 172         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 173 }
 174
 175 static ssize_t force_wakeup_write(struct file *file,
 176                                   const char __user *user_buf, size_t count,
 177                                   loff_t *ppos)
 178 {
 179         struct vhci_data *data = file->private_data;
 180         bool enable;
 181         int err;
 182
 183         err = kstrtobool_from_user(user_buf, count, &enable);
 184         if (err)
 185                 return err;
 186
 187         if (data->wakeup == enable)
 188                 return -EALREADY;
 189
 190         data->wakeup = enable;
 191
 192         return count;
 193 }
 194
 195 static const struct file_operations force_wakeup_fops = {
 196         .open           = simple_open,
 197         .read           = force_wakeup_read,
 198         .write          = force_wakeup_write,
 199         .llseek         = default_llseek,
 200 };
 201
 202 static int msft_opcode_set(void *data, u64 val)
 203 {
 204         struct vhci_data *vhci = data;
 205
 206         if (val > 0xffff || hci_opcode_ogf(val) != 0x3f)
 207                 return -EINVAL;
 208
 209         if (vhci->msft_opcode)
 210                 return -EALREADY;
 211
 212         vhci->msft_opcode = val;
 213
 214         return 0;
 215 }
 216
 217 static int msft_opcode_get(void *data, u64 *val)
 218 {
 219         struct vhci_data *vhci = data;
 220
 221         *val = vhci->msft_opcode;
 222
 223         return 0;
 224 }
 225
 226 DEFINE_DEBUGFS_ATTRIBUTE(msft_opcode_fops, msft_opcode_get, msft_opcode_set,
 227                          "%llu\n");
 228
 229 static ssize_t aosp_capable_read(struct file *file, char __user *user_buf,
 230                                  size_t count, loff_t *ppos)
 231 {
 232         struct vhci_data *vhci = file->private_data;
 233         char buf[3];
 234
 235         buf[0] = vhci->aosp_capable ? 'Y' : 'N';
 236         buf[1] = '\n';
 237         buf[2] = '\0';
 238         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 239 }
 240
 241 static ssize_t aosp_capable_write(struct file *file,
 242                                   const char __user *user_buf, size_t count,
 243                                   loff_t *ppos)
 244 {
 245         struct vhci_data *vhci = file->private_data;
 246         bool enable;
 247         int err;
 248
 249         err = kstrtobool_from_user(user_buf, count, &enable);
 250         if (err)
 251                 return err;
 252
 253         if (!enable)
 254                 return -EINVAL;
 255
 256         if (vhci->aosp_capable)
 257                 return -EALREADY;
 258
 259         vhci->aosp_capable = enable;
 260
 261         return count;
 262 }
 263
 264 static const struct file_operations aosp_capable_fops = {
 265         .open           = simple_open,
 266         .read           = aosp_capable_read,
 267         .write          = aosp_capable_write,
 268         .llseek         = default_llseek,
 269 };
 270
 271 static int vhci_setup(struct hci_dev *hdev)
 272 {
 273         struct vhci_data *vhci = hci_get_drvdata(hdev);
 274
 275         if (vhci->msft_opcode)
 276                 hci_set_msft_opcode(hdev, vhci->msft_opcode);
 277
 278         if (vhci->aosp_capable)
 279                 hci_set_aosp_capable(hdev);
 280
 281         return 0;
 282 }
 283
 284 static void vhci_coredump(struct hci_dev *hdev)
 285 {
 286         /* No need to do anything */
 287 }
 288
 289 static void vhci_coredump_hdr(struct hci_dev *hdev, struct sk_buff *skb)
 290 {
 291         char buf[80];
 292
 293         snprintf(buf, sizeof(buf), "Controller Name: vhci_ctrl\n");
 294         skb_put_data(skb, buf, strlen(buf));
 295
 296         snprintf(buf, sizeof(buf), "Firmware Version: vhci_fw\n");
 297         skb_put_data(skb, buf, strlen(buf));
 298
 299         snprintf(buf, sizeof(buf), "Driver: vhci_drv\n");
 300         skb_put_data(skb, buf, strlen(buf));
 301
 302         snprintf(buf, sizeof(buf), "Vendor: vhci\n");
 303         skb_put_data(skb, buf, strlen(buf));
 304 }
 305
 306 #define MAX_COREDUMP_LINE_LEN   40
 307
 308 struct devcoredump_test_data {
 309         enum devcoredump_state state;
 310         unsigned int timeout;
 311         char data[MAX_COREDUMP_LINE_LEN];
 312 };
 313
 314 static inline void force_devcd_timeout(struct hci_dev *hdev,
 315                                        unsigned int timeout)
 316 {
 317 #ifdef CONFIG_DEV_COREDUMP
 318         hdev->dump.timeout = msecs_to_jiffies(timeout * 1000);
 319 #endif
 320 }
 321
 322 static ssize_t force_devcd_write(struct file *file, const char __user *user_buf,
 323                                  size_t count, loff_t *ppos)
 324 {
 325         struct vhci_data *data = file->private_data;
 326         struct hci_dev *hdev = data->hdev;
 327         struct sk_buff *skb = NULL;
 328         struct devcoredump_test_data dump_data;
 329         size_t data_size;
 330         int ret;
 331
 332         if (count < offsetof(struct devcoredump_test_data, data) ||
 333             count > sizeof(dump_data))
 334                 return -EINVAL;
 335
 336         if (copy_from_user(&dump_data, user_buf, count))
 337                 return -EFAULT;
 338
 339         data_size = count - offsetof(struct devcoredump_test_data, data);
 340         skb = alloc_skb(data_size, GFP_ATOMIC);
 341         if (!skb)
 342                 return -ENOMEM;
 343         skb_put_data(skb, &dump_data.data, data_size);
 344
 345         hci_devcd_register(hdev, vhci_coredump, vhci_coredump_hdr, NULL);
 346
 347         /* Force the devcoredump timeout */
 348         if (dump_data.timeout)
 349                 force_devcd_timeout(hdev, dump_data.timeout);
 350
 351         ret = hci_devcd_init(hdev, skb->len);
 352         if (ret) {
 353                 BT_ERR("Failed to generate devcoredump");
 354                 kfree_skb(skb);
 355                 return ret;
 356         }
 357
 358         hci_devcd_append(hdev, skb);
 359
 360         switch (dump_data.state) {
 361         case HCI_DEVCOREDUMP_DONE:
 362                 hci_devcd_complete(hdev);
 363                 break;
 364         case HCI_DEVCOREDUMP_ABORT:
 365                 hci_devcd_abort(hdev);
 366                 break;
 367         case HCI_DEVCOREDUMP_TIMEOUT:
 368                 /* Do nothing */
 369                 break;
 370         default:
 371                 return -EINVAL;
 372         }
 373
 374         return count;
 375 }
 376
 377 static const struct file_operations force_devcoredump_fops = {
 378         .open           = simple_open,
 379         .write          = force_devcd_write,
 380 };
 381
 382 static int __vhci_create_device(struct vhci_data *data, __u8 opcode)
 383 {
 384         struct hci_dev *hdev;
 385         struct sk_buff *skb;
 386         __u8 dev_type;
 387
 388         if (data->hdev)
 389                 return -EBADFD;
 390
 391         /* bits 0-1 are dev_type (Primary or AMP) */
 392         dev_type = opcode & 0x03;
 393
 394         if (dev_type != HCI_PRIMARY && dev_type != HCI_AMP)
 395                 return -EINVAL;
 396
 397         /* bits 2-5 are reserved (must be zero) */
 398         if (opcode & 0x3c)
 399                 return -EINVAL;
 400
 401         skb = bt_skb_alloc(4, GFP_KERNEL);
 402         if (!skb)
 403                 return -ENOMEM;
 404
 405         hdev = hci_alloc_dev();
 406         if (!hdev) {
 407                 kfree_skb(skb);
 408                 return -ENOMEM;
 409         }
 410
 411         data->hdev = hdev;
 412
 413         hdev->bus = HCI_VIRTUAL;
 414         hdev->dev_type = dev_type;
 415         hci_set_drvdata(hdev, data);
 416
 417         hdev->open  = vhci_open_dev;
 418         hdev->close = vhci_close_dev;
 419         hdev->flush = vhci_flush;
 420         hdev->send  = vhci_send_frame;
 421         hdev->get_data_path_id = vhci_get_data_path_id;
 422         hdev->get_codec_config_data = vhci_get_codec_config_data;
 423         hdev->wakeup = vhci_wakeup;
 424         hdev->setup = vhci_setup;
 425         set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
 426
 427         /* bit 6 is for external configuration */
 428         if (opcode & 0x40)
 429                 set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks);
 430
 431         /* bit 7 is for raw device */
 432         if (opcode & 0x80)
 433                 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
 434
 435         set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
 436
 437         if (hci_register_dev(hdev) < 0) {
 438                 BT_ERR("Can't register HCI device");
 439                 hci_free_dev(hdev);
 440                 data->hdev = NULL;
 441                 kfree_skb(skb);
 442                 return -EBUSY;
 443         }
 444
 445         debugfs_create_file("force_suspend", 0644, hdev->debugfs, data,
 446                             &force_suspend_fops);
 447
 448         debugfs_create_file("force_wakeup", 0644, hdev->debugfs, data,
 449                             &force_wakeup_fops);
 450
 451         if (IS_ENABLED(CONFIG_BT_MSFTEXT))
 452                 debugfs_create_file("msft_opcode", 0644, hdev->debugfs, data,
 453                                     &msft_opcode_fops);
 454
 455         if (IS_ENABLED(CONFIG_BT_AOSPEXT))
 456                 debugfs_create_file("aosp_capable", 0644, hdev->debugfs, data,
 457                                     &aosp_capable_fops);
 458
 459         debugfs_create_file("force_devcoredump", 0644, hdev->debugfs, data,
 460                             &force_devcoredump_fops);
 461
 462         hci_skb_pkt_type(skb) = HCI_VENDOR_PKT;
 463
 464         skb_put_u8(skb, 0xff);
 465         skb_put_u8(skb, opcode);
 466         put_unaligned_le16(hdev->id, skb_put(skb, 2));
 467         skb_queue_tail(&data->readq, skb);
 468
 469         wake_up_interruptible(&data->read_wait);
 470         return 0;
 471 }
 472
 473 static int vhci_create_device(struct vhci_data *data, __u8 opcode)
 474 {
 475         int err;
 476
 477         mutex_lock(&data->open_mutex);
 478         err = __vhci_create_device(data, opcode);
 479         mutex_unlock(&data->open_mutex);
 480
 481         return err;
 482 }
 483
 484 static inline ssize_t vhci_get_user(struct vhci_data *data,
 485                                     struct iov_iter *from)
 486 {
 487         size_t len = iov_iter_count(from);
 488         struct sk_buff *skb;
 489         __u8 pkt_type, opcode;
 490         int ret;
 491
 492         if (len < 2 || len > HCI_MAX_FRAME_SIZE)
 493                 return -EINVAL;
 494
 495         skb = bt_skb_alloc(len, GFP_KERNEL);
 496         if (!skb)
 497                 return -ENOMEM;
 498
 499         if (!copy_from_iter_full(skb_put(skb, len), len, from)) {
 500                 kfree_skb(skb);
 501                 return -EFAULT;
 502         }
 503
 504         pkt_type = *((__u8 *) skb->data);
 505         skb_pull(skb, 1);
 506
 507         switch (pkt_type) {
 508         case HCI_EVENT_PKT:
 509         case HCI_ACLDATA_PKT:
 510         case HCI_SCODATA_PKT:
 511         case HCI_ISODATA_PKT:
 512                 if (!data->hdev) {
 513                         kfree_skb(skb);
 514                         return -ENODEV;
 515                 }
 516
 517                 hci_skb_pkt_type(skb) = pkt_type;
 518
 519                 ret = hci_recv_frame(data->hdev, skb);
 520                 break;
 521
 522         case HCI_VENDOR_PKT:
 523                 cancel_delayed_work_sync(&data->open_timeout);
 524
 525                 opcode = *((__u8 *) skb->data);
 526                 skb_pull(skb, 1);
 527
 528                 if (skb->len > 0) {
 529                         kfree_skb(skb);
 530                         return -EINVAL;
 531                 }
 532
 533                 kfree_skb(skb);
 534
 535                 ret = vhci_create_device(data, opcode);
 536                 break;
 537
 538         default:
 539                 kfree_skb(skb);
 540                 return -EINVAL;
 541         }
 542
 543         return (ret < 0) ? ret : len;
 544 }
 545
 546 static inline ssize_t vhci_put_user(struct vhci_data *data,
 547                                     struct sk_buff *skb,
 548                                     char __user *buf, int count)
 549 {
 550         char __user *ptr = buf;
 551         int len;
 552
 553         len = min_t(unsigned int, skb->len, count);
 554
 555         if (copy_to_user(ptr, skb->data, len))
 556                 return -EFAULT;
 557
 558         if (!data->hdev)
 559                 return len;
 560
 561         data->hdev->stat.byte_tx += len;
 562
 563         switch (hci_skb_pkt_type(skb)) {
 564         case HCI_COMMAND_PKT:
 565                 data->hdev->stat.cmd_tx++;
 566                 break;
 567         case HCI_ACLDATA_PKT:
 568                 data->hdev->stat.acl_tx++;
 569                 break;
 570         case HCI_SCODATA_PKT:
 571                 data->hdev->stat.sco_tx++;
 572                 break;
 573         }
 574
 575         return len;
 576 }
 577
 578 static ssize_t vhci_read(struct file *file,
 579                          char __user *buf, size_t count, loff_t *pos)
 580 {
 581         struct vhci_data *data = file->private_data;
 582         struct sk_buff *skb;
 583         ssize_t ret = 0;
 584
 585         while (count) {
 586                 skb = skb_dequeue(&data->readq);
 587                 if (skb) {
 588                         ret = vhci_put_user(data, skb, buf, count);
 589                         if (ret < 0)
 590                                 skb_queue_head(&data->readq, skb);
 591                         else
 592                                 kfree_skb(skb);
 593                         break;
 594                 }
 595
 596                 if (file->f_flags & O_NONBLOCK) {
 597                         ret = -EAGAIN;
 598                         break;
 599                 }
 600
 601                 ret = wait_event_interruptible(data->read_wait,
 602                                                !skb_queue_empty(&data->readq));
 603                 if (ret < 0)
 604                         break;
 605         }
 606
 607         return ret;
 608 }
 609
 610 static ssize_t vhci_write(struct kiocb *iocb, struct iov_iter *from)
 611 {
 612         struct file *file = iocb->ki_filp;
 613         struct vhci_data *data = file->private_data;
 614
 615         return vhci_get_user(data, from);
 616 }
 617
 618 static __poll_t vhci_poll(struct file *file, poll_table *wait)
 619 {
 620         struct vhci_data *data = file->private_data;
 621
 622         poll_wait(file, &data->read_wait, wait);
 623
 624         if (!skb_queue_empty(&data->readq))
 625                 return EPOLLIN | EPOLLRDNORM;
 626
 627         return EPOLLOUT | EPOLLWRNORM;
 628 }
 629
 630 static void vhci_open_timeout(struct work_struct *work)
 631 {
 632         struct vhci_data *data = container_of(work, struct vhci_data,
 633                                               open_timeout.work);
 634
 635         vhci_create_device(data, amp ? HCI_AMP : HCI_PRIMARY);
 636 }
 637
 638 static int vhci_open(struct inode *inode, struct file *file)
 639 {
 640         struct vhci_data *data;
 641
 642         data = kzalloc(sizeof(struct vhci_data), GFP_KERNEL);
 643         if (!data)
 644                 return -ENOMEM;
 645
 646         skb_queue_head_init(&data->readq);
 647         init_waitqueue_head(&data->read_wait);
 648
 649         mutex_init(&data->open_mutex);
 650         INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout);
 651         INIT_WORK(&data->suspend_work, vhci_suspend_work);
 652
 653         file->private_data = data;
 654         nonseekable_open(inode, file);
 655
 656         schedule_delayed_work(&data->open_timeout, msecs_to_jiffies(1000));
 657
 658         return 0;
 659 }
 660
 661 static int vhci_release(struct inode *inode, struct file *file)
 662 {
 663         struct vhci_data *data = file->private_data;
 664         struct hci_dev *hdev;
 665
 666         cancel_delayed_work_sync(&data->open_timeout);
 667         flush_work(&data->suspend_work);
 668
 669         hdev = data->hdev;
 670
 671         if (hdev) {
 672                 hci_unregister_dev(hdev);
 673                 hci_free_dev(hdev);
 674         }
 675
 676         skb_queue_purge(&data->readq);
 677         file->private_data = NULL;
 678         kfree(data);
 679
 680         return 0;
 681 }
 682
 683 static const struct file_operations vhci_fops = {
 684         .owner          = THIS_MODULE,
 685         .read           = vhci_read,
 686         .write_iter     = vhci_write,
 687         .poll           = vhci_poll,
 688         .open           = vhci_open,
 689         .release        = vhci_release,
 690         .llseek         = no_llseek,
 691 };
 692
 693 static struct miscdevice vhci_miscdev = {
 694         .name   = "vhci",
 695         .fops   = &vhci_fops,
 696         .minor  = VHCI_MINOR,
 697 };
 698 module_misc_device(vhci_miscdev);
 699
 700 module_param(amp, bool, 0644);
 701 MODULE_PARM_DESC(amp, "Create AMP controller device");
 702
 703 MODULE_AUTHOR("Marcel Holtmann <[email protected]>");
 704 MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION);
 705 MODULE_VERSION(VERSION);
 706 MODULE_LICENSE("GPL");
 707 MODULE_ALIAS("devname:vhci");
 708 MODULE_ALIAS_MISCDEV(VHCI_MINOR);