1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth virtual HCI driver 5 * 6 * Copyright (C) 2000-2001 Qualcomm Incorporated 7 * Copyright (C) 2002-2003 Maxim Krasnyansky <maxk@qualcomm.com> 8 * Copyright (C) 2004-2006 Marcel Holtmann <marcel@holtmann.org> 9 */ 10 11 #include <linux/module.h> 12 #include <asm/unaligned.h> 13 14 #include <linux/atomic.h> 15 #include <linux/kernel.h> 16 #include <linux/init.h> 17 #include <linux/slab.h> 18 #include <linux/types.h> 19 #include <linux/errno.h> 20 #include <linux/sched.h> 21 #include <linux/poll.h> 22 23 #include <linux/skbuff.h> 24 #include <linux/miscdevice.h> 25 #include <linux/debugfs.h> 26 27 #include <net/bluetooth/bluetooth.h> 28 #include <net/bluetooth/hci_core.h> 29 30 #define VERSION "1.5" 31 32 static bool amp; 33 34 struct vhci_data { 35 struct hci_dev *hdev; 36 37 wait_queue_head_t read_wait; 38 struct sk_buff_head readq; 39 40 struct mutex open_mutex; 41 struct delayed_work open_timeout; 42 struct work_struct suspend_work; 43 44 bool suspended; 45 bool wakeup; 46 __u16 msft_opcode; 47 bool aosp_capable; 48 atomic_t initialized; 49 }; 50 51 static int vhci_open_dev(struct hci_dev *hdev) 52 { 53 return 0; 54 } 55 56 static int vhci_close_dev(struct hci_dev *hdev) 57 { 58 struct vhci_data *data = hci_get_drvdata(hdev); 59 60 skb_queue_purge(&data->readq); 61 62 return 0; 63 } 64 65 static int vhci_flush(struct hci_dev *hdev) 66 { 67 struct vhci_data *data = hci_get_drvdata(hdev); 68 69 skb_queue_purge(&data->readq); 70 71 return 0; 72 } 73 74 static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 75 { 76 struct vhci_data *data = hci_get_drvdata(hdev); 77 78 memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1); 79 80 skb_queue_tail(&data->readq, skb); 81 82 if (atomic_read(&data->initialized)) 83 wake_up_interruptible(&data->read_wait); 84 return 0; 85 } 86 87 static int vhci_get_data_path_id(struct hci_dev *hdev, u8 *data_path_id) 88 { 89 *data_path_id = 0; 90 return 0; 91 } 92 93 static int vhci_get_codec_config_data(struct hci_dev *hdev, __u8 type, 94 struct bt_codec *codec, __u8 *vnd_len, 95 __u8 **vnd_data) 96 { 97 if (type != ESCO_LINK) 98 return -EINVAL; 99 100 *vnd_len = 0; 101 *vnd_data = NULL; 102 return 0; 103 } 104 105 static bool vhci_wakeup(struct hci_dev *hdev) 106 { 107 struct vhci_data *data = hci_get_drvdata(hdev); 108 109 return data->wakeup; 110 } 111 112 static ssize_t force_suspend_read(struct file *file, char __user *user_buf, 113 size_t count, loff_t *ppos) 114 { 115 struct vhci_data *data = file->private_data; 116 char buf[3]; 117 118 buf[0] = data->suspended ? 'Y' : 'N'; 119 buf[1] = '\n'; 120 buf[2] = '\0'; 121 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 122 } 123 124 static void vhci_suspend_work(struct work_struct *work) 125 { 126 struct vhci_data *data = container_of(work, struct vhci_data, 127 suspend_work); 128 129 if (data->suspended) 130 hci_suspend_dev(data->hdev); 131 else 132 hci_resume_dev(data->hdev); 133 } 134 135 static ssize_t force_suspend_write(struct file *file, 136 const char __user *user_buf, 137 size_t count, loff_t *ppos) 138 { 139 struct vhci_data *data = file->private_data; 140 bool enable; 141 int err; 142 143 err = kstrtobool_from_user(user_buf, count, &enable); 144 if (err) 145 return err; 146 147 if (data->suspended == enable) 148 return -EALREADY; 149 150 data->suspended = enable; 151 152 schedule_work(&data->suspend_work); 153 154 return count; 155 } 156 157 static const struct file_operations force_suspend_fops = { 158 .open = simple_open, 159 .read = force_suspend_read, 160 .write = force_suspend_write, 161 .llseek = default_llseek, 162 }; 163 164 static ssize_t force_wakeup_read(struct file *file, char __user *user_buf, 165 size_t count, loff_t *ppos) 166 { 167 struct vhci_data *data = file->private_data; 168 char buf[3]; 169 170 buf[0] = data->wakeup ? 'Y' : 'N'; 171 buf[1] = '\n'; 172 buf[2] = '\0'; 173 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 174 } 175 176 static ssize_t force_wakeup_write(struct file *file, 177 const char __user *user_buf, size_t count, 178 loff_t *ppos) 179 { 180 struct vhci_data *data = file->private_data; 181 bool enable; 182 int err; 183 184 err = kstrtobool_from_user(user_buf, count, &enable); 185 if (err) 186 return err; 187 188 if (data->wakeup == enable) 189 return -EALREADY; 190 191 data->wakeup = enable; 192 193 return count; 194 } 195 196 static const struct file_operations force_wakeup_fops = { 197 .open = simple_open, 198 .read = force_wakeup_read, 199 .write = force_wakeup_write, 200 .llseek = default_llseek, 201 }; 202 203 static int msft_opcode_set(void *data, u64 val) 204 { 205 struct vhci_data *vhci = data; 206 207 if (val > 0xffff || hci_opcode_ogf(val) != 0x3f) 208 return -EINVAL; 209 210 if (vhci->msft_opcode) 211 return -EALREADY; 212 213 vhci->msft_opcode = val; 214 215 return 0; 216 } 217 218 static int msft_opcode_get(void *data, u64 *val) 219 { 220 struct vhci_data *vhci = data; 221 222 *val = vhci->msft_opcode; 223 224 return 0; 225 } 226 227 DEFINE_DEBUGFS_ATTRIBUTE(msft_opcode_fops, msft_opcode_get, msft_opcode_set, 228 "%llu\n"); 229 230 static ssize_t aosp_capable_read(struct file *file, char __user *user_buf, 231 size_t count, loff_t *ppos) 232 { 233 struct vhci_data *vhci = file->private_data; 234 char buf[3]; 235 236 buf[0] = vhci->aosp_capable ? 'Y' : 'N'; 237 buf[1] = '\n'; 238 buf[2] = '\0'; 239 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 240 } 241 242 static ssize_t aosp_capable_write(struct file *file, 243 const char __user *user_buf, size_t count, 244 loff_t *ppos) 245 { 246 struct vhci_data *vhci = file->private_data; 247 bool enable; 248 int err; 249 250 err = kstrtobool_from_user(user_buf, count, &enable); 251 if (err) 252 return err; 253 254 if (!enable) 255 return -EINVAL; 256 257 if (vhci->aosp_capable) 258 return -EALREADY; 259 260 vhci->aosp_capable = enable; 261 262 return count; 263 } 264 265 static const struct file_operations aosp_capable_fops = { 266 .open = simple_open, 267 .read = aosp_capable_read, 268 .write = aosp_capable_write, 269 .llseek = default_llseek, 270 }; 271 272 static int vhci_setup(struct hci_dev *hdev) 273 { 274 struct vhci_data *vhci = hci_get_drvdata(hdev); 275 276 if (vhci->msft_opcode) 277 hci_set_msft_opcode(hdev, vhci->msft_opcode); 278 279 if (vhci->aosp_capable) 280 hci_set_aosp_capable(hdev); 281 282 return 0; 283 } 284 285 static void vhci_coredump(struct hci_dev *hdev) 286 { 287 /* No need to do anything */ 288 } 289 290 static void vhci_coredump_hdr(struct hci_dev *hdev, struct sk_buff *skb) 291 { 292 char buf[80]; 293 294 snprintf(buf, sizeof(buf), "Controller Name: vhci_ctrl\n"); 295 skb_put_data(skb, buf, strlen(buf)); 296 297 snprintf(buf, sizeof(buf), "Firmware Version: vhci_fw\n"); 298 skb_put_data(skb, buf, strlen(buf)); 299 300 snprintf(buf, sizeof(buf), "Driver: vhci_drv\n"); 301 skb_put_data(skb, buf, strlen(buf)); 302 303 snprintf(buf, sizeof(buf), "Vendor: vhci\n"); 304 skb_put_data(skb, buf, strlen(buf)); 305 } 306 307 #define MAX_COREDUMP_LINE_LEN 40 308 309 struct devcoredump_test_data { 310 enum devcoredump_state state; 311 unsigned int timeout; 312 char data[MAX_COREDUMP_LINE_LEN]; 313 }; 314 315 static inline void force_devcd_timeout(struct hci_dev *hdev, 316 unsigned int timeout) 317 { 318 #ifdef CONFIG_DEV_COREDUMP 319 hdev->dump.timeout = msecs_to_jiffies(timeout * 1000); 320 #endif 321 } 322 323 static ssize_t force_devcd_write(struct file *file, const char __user *user_buf, 324 size_t count, loff_t *ppos) 325 { 326 struct vhci_data *data = file->private_data; 327 struct hci_dev *hdev = data->hdev; 328 struct sk_buff *skb = NULL; 329 struct devcoredump_test_data dump_data; 330 size_t data_size; 331 int ret; 332 333 if (count < offsetof(struct devcoredump_test_data, data) || 334 count > sizeof(dump_data)) 335 return -EINVAL; 336 337 if (copy_from_user(&dump_data, user_buf, count)) 338 return -EFAULT; 339 340 data_size = count - offsetof(struct devcoredump_test_data, data); 341 skb = alloc_skb(data_size, GFP_ATOMIC); 342 if (!skb) 343 return -ENOMEM; 344 skb_put_data(skb, &dump_data.data, data_size); 345 346 hci_devcd_register(hdev, vhci_coredump, vhci_coredump_hdr, NULL); 347 348 /* Force the devcoredump timeout */ 349 if (dump_data.timeout) 350 force_devcd_timeout(hdev, dump_data.timeout); 351 352 ret = hci_devcd_init(hdev, skb->len); 353 if (ret) { 354 BT_ERR("Failed to generate devcoredump"); 355 kfree_skb(skb); 356 return ret; 357 } 358 359 hci_devcd_append(hdev, skb); 360 361 switch (dump_data.state) { 362 case HCI_DEVCOREDUMP_DONE: 363 hci_devcd_complete(hdev); 364 break; 365 case HCI_DEVCOREDUMP_ABORT: 366 hci_devcd_abort(hdev); 367 break; 368 case HCI_DEVCOREDUMP_TIMEOUT: 369 /* Do nothing */ 370 break; 371 default: 372 return -EINVAL; 373 } 374 375 return count; 376 } 377 378 static const struct file_operations force_devcoredump_fops = { 379 .open = simple_open, 380 .write = force_devcd_write, 381 }; 382 383 static int __vhci_create_device(struct vhci_data *data, __u8 opcode) 384 { 385 struct hci_dev *hdev; 386 struct sk_buff *skb; 387 388 if (data->hdev) 389 return -EBADFD; 390 391 /* bits 2-5 are reserved (must be zero) */ 392 if (opcode & 0x3c) 393 return -EINVAL; 394 395 skb = bt_skb_alloc(4, GFP_KERNEL); 396 if (!skb) 397 return -ENOMEM; 398 399 hdev = hci_alloc_dev(); 400 if (!hdev) { 401 kfree_skb(skb); 402 return -ENOMEM; 403 } 404 405 data->hdev = hdev; 406 407 hdev->bus = HCI_VIRTUAL; 408 hci_set_drvdata(hdev, data); 409 410 hdev->open = vhci_open_dev; 411 hdev->close = vhci_close_dev; 412 hdev->flush = vhci_flush; 413 hdev->send = vhci_send_frame; 414 hdev->get_data_path_id = vhci_get_data_path_id; 415 hdev->get_codec_config_data = vhci_get_codec_config_data; 416 hdev->wakeup = vhci_wakeup; 417 hdev->setup = vhci_setup; 418 set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); 419 420 /* bit 6 is for external configuration */ 421 if (opcode & 0x40) 422 set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks); 423 424 /* bit 7 is for raw device */ 425 if (opcode & 0x80) 426 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 427 428 if (hci_register_dev(hdev) < 0) { 429 BT_ERR("Can't register HCI device"); 430 hci_free_dev(hdev); 431 data->hdev = NULL; 432 kfree_skb(skb); 433 return -EBUSY; 434 } 435 436 debugfs_create_file("force_suspend", 0644, hdev->debugfs, data, 437 &force_suspend_fops); 438 439 debugfs_create_file("force_wakeup", 0644, hdev->debugfs, data, 440 &force_wakeup_fops); 441 442 if (IS_ENABLED(CONFIG_BT_MSFTEXT)) 443 debugfs_create_file("msft_opcode", 0644, hdev->debugfs, data, 444 &msft_opcode_fops); 445 446 if (IS_ENABLED(CONFIG_BT_AOSPEXT)) 447 debugfs_create_file("aosp_capable", 0644, hdev->debugfs, data, 448 &aosp_capable_fops); 449 450 debugfs_create_file("force_devcoredump", 0644, hdev->debugfs, data, 451 &force_devcoredump_fops); 452 453 hci_skb_pkt_type(skb) = HCI_VENDOR_PKT; 454 455 skb_put_u8(skb, 0xff); 456 skb_put_u8(skb, opcode); 457 put_unaligned_le16(hdev->id, skb_put(skb, 2)); 458 skb_queue_head(&data->readq, skb); 459 atomic_inc(&data->initialized); 460 461 wake_up_interruptible(&data->read_wait); 462 return 0; 463 } 464 465 static int vhci_create_device(struct vhci_data *data, __u8 opcode) 466 { 467 int err; 468 469 mutex_lock(&data->open_mutex); 470 err = __vhci_create_device(data, opcode); 471 mutex_unlock(&data->open_mutex); 472 473 return err; 474 } 475 476 static inline ssize_t vhci_get_user(struct vhci_data *data, 477 struct iov_iter *from) 478 { 479 size_t len = iov_iter_count(from); 480 struct sk_buff *skb; 481 __u8 pkt_type, opcode; 482 int ret; 483 484 if (len < 2 || len > HCI_MAX_FRAME_SIZE) 485 return -EINVAL; 486 487 skb = bt_skb_alloc(len, GFP_KERNEL); 488 if (!skb) 489 return -ENOMEM; 490 491 if (!copy_from_iter_full(skb_put(skb, len), len, from)) { 492 kfree_skb(skb); 493 return -EFAULT; 494 } 495 496 pkt_type = *((__u8 *) skb->data); 497 skb_pull(skb, 1); 498 499 switch (pkt_type) { 500 case HCI_EVENT_PKT: 501 case HCI_ACLDATA_PKT: 502 case HCI_SCODATA_PKT: 503 case HCI_ISODATA_PKT: 504 if (!data->hdev) { 505 kfree_skb(skb); 506 return -ENODEV; 507 } 508 509 hci_skb_pkt_type(skb) = pkt_type; 510 511 ret = hci_recv_frame(data->hdev, skb); 512 break; 513 514 case HCI_VENDOR_PKT: 515 cancel_delayed_work_sync(&data->open_timeout); 516 517 opcode = *((__u8 *) skb->data); 518 skb_pull(skb, 1); 519 520 if (skb->len > 0) { 521 kfree_skb(skb); 522 return -EINVAL; 523 } 524 525 kfree_skb(skb); 526 527 ret = vhci_create_device(data, opcode); 528 break; 529 530 default: 531 kfree_skb(skb); 532 return -EINVAL; 533 } 534 535 return (ret < 0) ? ret : len; 536 } 537 538 static inline ssize_t vhci_put_user(struct vhci_data *data, 539 struct sk_buff *skb, 540 char __user *buf, int count) 541 { 542 char __user *ptr = buf; 543 int len; 544 545 len = min_t(unsigned int, skb->len, count); 546 547 if (copy_to_user(ptr, skb->data, len)) 548 return -EFAULT; 549 550 if (!data->hdev) 551 return len; 552 553 data->hdev->stat.byte_tx += len; 554 555 switch (hci_skb_pkt_type(skb)) { 556 case HCI_COMMAND_PKT: 557 data->hdev->stat.cmd_tx++; 558 break; 559 case HCI_ACLDATA_PKT: 560 data->hdev->stat.acl_tx++; 561 break; 562 case HCI_SCODATA_PKT: 563 data->hdev->stat.sco_tx++; 564 break; 565 } 566 567 return len; 568 } 569 570 static ssize_t vhci_read(struct file *file, 571 char __user *buf, size_t count, loff_t *pos) 572 { 573 struct vhci_data *data = file->private_data; 574 struct sk_buff *skb; 575 ssize_t ret = 0; 576 577 while (count) { 578 skb = skb_dequeue(&data->readq); 579 if (skb) { 580 ret = vhci_put_user(data, skb, buf, count); 581 if (ret < 0) 582 skb_queue_head(&data->readq, skb); 583 else 584 kfree_skb(skb); 585 break; 586 } 587 588 if (file->f_flags & O_NONBLOCK) { 589 ret = -EAGAIN; 590 break; 591 } 592 593 ret = wait_event_interruptible(data->read_wait, 594 !skb_queue_empty(&data->readq)); 595 if (ret < 0) 596 break; 597 } 598 599 return ret; 600 } 601 602 static ssize_t vhci_write(struct kiocb *iocb, struct iov_iter *from) 603 { 604 struct file *file = iocb->ki_filp; 605 struct vhci_data *data = file->private_data; 606 607 return vhci_get_user(data, from); 608 } 609 610 static __poll_t vhci_poll(struct file *file, poll_table *wait) 611 { 612 struct vhci_data *data = file->private_data; 613 614 poll_wait(file, &data->read_wait, wait); 615 616 if (!skb_queue_empty(&data->readq)) 617 return EPOLLIN | EPOLLRDNORM; 618 619 return EPOLLOUT | EPOLLWRNORM; 620 } 621 622 static void vhci_open_timeout(struct work_struct *work) 623 { 624 struct vhci_data *data = container_of(work, struct vhci_data, 625 open_timeout.work); 626 627 vhci_create_device(data, 0x00); 628 } 629 630 static int vhci_open(struct inode *inode, struct file *file) 631 { 632 struct vhci_data *data; 633 634 data = kzalloc(sizeof(*data), GFP_KERNEL); 635 if (!data) 636 return -ENOMEM; 637 638 skb_queue_head_init(&data->readq); 639 init_waitqueue_head(&data->read_wait); 640 641 mutex_init(&data->open_mutex); 642 INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout); 643 INIT_WORK(&data->suspend_work, vhci_suspend_work); 644 645 file->private_data = data; 646 nonseekable_open(inode, file); 647 648 schedule_delayed_work(&data->open_timeout, msecs_to_jiffies(1000)); 649 650 return 0; 651 } 652 653 static int vhci_release(struct inode *inode, struct file *file) 654 { 655 struct vhci_data *data = file->private_data; 656 struct hci_dev *hdev; 657 658 cancel_delayed_work_sync(&data->open_timeout); 659 flush_work(&data->suspend_work); 660 661 hdev = data->hdev; 662 663 if (hdev) { 664 hci_unregister_dev(hdev); 665 hci_free_dev(hdev); 666 } 667 668 skb_queue_purge(&data->readq); 669 file->private_data = NULL; 670 kfree(data); 671 672 return 0; 673 } 674 675 static const struct file_operations vhci_fops = { 676 .owner = THIS_MODULE, 677 .read = vhci_read, 678 .write_iter = vhci_write, 679 .poll = vhci_poll, 680 .open = vhci_open, 681 .release = vhci_release, 682 .llseek = no_llseek, 683 }; 684 685 static struct miscdevice vhci_miscdev = { 686 .name = "vhci", 687 .fops = &vhci_fops, 688 .minor = VHCI_MINOR, 689 }; 690 module_misc_device(vhci_miscdev); 691 692 module_param(amp, bool, 0644); 693 MODULE_PARM_DESC(amp, "Create AMP controller device"); 694 695 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 696 MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION); 697 MODULE_VERSION(VERSION); 698 MODULE_LICENSE("GPL"); 699 MODULE_ALIAS("devname:vhci"); 700 MODULE_ALIAS_MISCDEV(VHCI_MINOR); 701