1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth virtual HCI driver 5 * 6 * Copyright (C) 2000-2001 Qualcomm Incorporated 7 * Copyright (C) 2002-2003 Maxim Krasnyansky <maxk@qualcomm.com> 8 * Copyright (C) 2004-2006 Marcel Holtmann <marcel@holtmann.org> 9 */ 10 11 #include <linux/module.h> 12 #include <asm/unaligned.h> 13 14 #include <linux/kernel.h> 15 #include <linux/init.h> 16 #include <linux/slab.h> 17 #include <linux/types.h> 18 #include <linux/errno.h> 19 #include <linux/sched.h> 20 #include <linux/poll.h> 21 22 #include <linux/skbuff.h> 23 #include <linux/miscdevice.h> 24 #include <linux/debugfs.h> 25 26 #include <net/bluetooth/bluetooth.h> 27 #include <net/bluetooth/hci_core.h> 28 29 #define VERSION "1.5" 30 31 static bool amp; 32 33 struct vhci_data { 34 struct hci_dev *hdev; 35 36 wait_queue_head_t read_wait; 37 struct sk_buff_head readq; 38 39 struct mutex open_mutex; 40 struct delayed_work open_timeout; 41 struct work_struct suspend_work; 42 43 bool suspended; 44 bool wakeup; 45 __u16 msft_opcode; 46 bool aosp_capable; 47 }; 48 49 static int vhci_open_dev(struct hci_dev *hdev) 50 { 51 return 0; 52 } 53 54 static int vhci_close_dev(struct hci_dev *hdev) 55 { 56 struct vhci_data *data = hci_get_drvdata(hdev); 57 58 skb_queue_purge(&data->readq); 59 60 return 0; 61 } 62 63 static int vhci_flush(struct hci_dev *hdev) 64 { 65 struct vhci_data *data = hci_get_drvdata(hdev); 66 67 skb_queue_purge(&data->readq); 68 69 return 0; 70 } 71 72 static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 73 { 74 struct vhci_data *data = hci_get_drvdata(hdev); 75 76 memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1); 77 78 mutex_lock(&data->open_mutex); 79 skb_queue_tail(&data->readq, skb); 80 mutex_unlock(&data->open_mutex); 81 82 wake_up_interruptible(&data->read_wait); 83 return 0; 84 } 85 86 static int vhci_get_data_path_id(struct hci_dev *hdev, u8 *data_path_id) 87 { 88 *data_path_id = 0; 89 return 0; 90 } 91 92 static int vhci_get_codec_config_data(struct hci_dev *hdev, __u8 type, 93 struct bt_codec *codec, __u8 *vnd_len, 94 __u8 **vnd_data) 95 { 96 if (type != ESCO_LINK) 97 return -EINVAL; 98 99 *vnd_len = 0; 100 *vnd_data = NULL; 101 return 0; 102 } 103 104 static bool vhci_wakeup(struct hci_dev *hdev) 105 { 106 struct vhci_data *data = hci_get_drvdata(hdev); 107 108 return data->wakeup; 109 } 110 111 static ssize_t force_suspend_read(struct file *file, char __user *user_buf, 112 size_t count, loff_t *ppos) 113 { 114 struct vhci_data *data = file->private_data; 115 char buf[3]; 116 117 buf[0] = data->suspended ? 'Y' : 'N'; 118 buf[1] = '\n'; 119 buf[2] = '\0'; 120 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 121 } 122 123 static void vhci_suspend_work(struct work_struct *work) 124 { 125 struct vhci_data *data = container_of(work, struct vhci_data, 126 suspend_work); 127 128 if (data->suspended) 129 hci_suspend_dev(data->hdev); 130 else 131 hci_resume_dev(data->hdev); 132 } 133 134 static ssize_t force_suspend_write(struct file *file, 135 const char __user *user_buf, 136 size_t count, loff_t *ppos) 137 { 138 struct vhci_data *data = file->private_data; 139 bool enable; 140 int err; 141 142 err = kstrtobool_from_user(user_buf, count, &enable); 143 if (err) 144 return err; 145 146 if (data->suspended == enable) 147 return -EALREADY; 148 149 data->suspended = enable; 150 151 schedule_work(&data->suspend_work); 152 153 return count; 154 } 155 156 static const struct file_operations force_suspend_fops = { 157 .open = simple_open, 158 .read = force_suspend_read, 159 .write = force_suspend_write, 160 .llseek = default_llseek, 161 }; 162 163 static ssize_t force_wakeup_read(struct file *file, char __user *user_buf, 164 size_t count, loff_t *ppos) 165 { 166 struct vhci_data *data = file->private_data; 167 char buf[3]; 168 169 buf[0] = data->wakeup ? 'Y' : 'N'; 170 buf[1] = '\n'; 171 buf[2] = '\0'; 172 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 173 } 174 175 static ssize_t force_wakeup_write(struct file *file, 176 const char __user *user_buf, size_t count, 177 loff_t *ppos) 178 { 179 struct vhci_data *data = file->private_data; 180 bool enable; 181 int err; 182 183 err = kstrtobool_from_user(user_buf, count, &enable); 184 if (err) 185 return err; 186 187 if (data->wakeup == enable) 188 return -EALREADY; 189 190 data->wakeup = enable; 191 192 return count; 193 } 194 195 static const struct file_operations force_wakeup_fops = { 196 .open = simple_open, 197 .read = force_wakeup_read, 198 .write = force_wakeup_write, 199 .llseek = default_llseek, 200 }; 201 202 static int msft_opcode_set(void *data, u64 val) 203 { 204 struct vhci_data *vhci = data; 205 206 if (val > 0xffff || hci_opcode_ogf(val) != 0x3f) 207 return -EINVAL; 208 209 if (vhci->msft_opcode) 210 return -EALREADY; 211 212 vhci->msft_opcode = val; 213 214 return 0; 215 } 216 217 static int msft_opcode_get(void *data, u64 *val) 218 { 219 struct vhci_data *vhci = data; 220 221 *val = vhci->msft_opcode; 222 223 return 0; 224 } 225 226 DEFINE_DEBUGFS_ATTRIBUTE(msft_opcode_fops, msft_opcode_get, msft_opcode_set, 227 "%llu\n"); 228 229 static ssize_t aosp_capable_read(struct file *file, char __user *user_buf, 230 size_t count, loff_t *ppos) 231 { 232 struct vhci_data *vhci = file->private_data; 233 char buf[3]; 234 235 buf[0] = vhci->aosp_capable ? 'Y' : 'N'; 236 buf[1] = '\n'; 237 buf[2] = '\0'; 238 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 239 } 240 241 static ssize_t aosp_capable_write(struct file *file, 242 const char __user *user_buf, size_t count, 243 loff_t *ppos) 244 { 245 struct vhci_data *vhci = file->private_data; 246 bool enable; 247 int err; 248 249 err = kstrtobool_from_user(user_buf, count, &enable); 250 if (err) 251 return err; 252 253 if (!enable) 254 return -EINVAL; 255 256 if (vhci->aosp_capable) 257 return -EALREADY; 258 259 vhci->aosp_capable = enable; 260 261 return count; 262 } 263 264 static const struct file_operations aosp_capable_fops = { 265 .open = simple_open, 266 .read = aosp_capable_read, 267 .write = aosp_capable_write, 268 .llseek = default_llseek, 269 }; 270 271 static int vhci_setup(struct hci_dev *hdev) 272 { 273 struct vhci_data *vhci = hci_get_drvdata(hdev); 274 275 if (vhci->msft_opcode) 276 hci_set_msft_opcode(hdev, vhci->msft_opcode); 277 278 if (vhci->aosp_capable) 279 hci_set_aosp_capable(hdev); 280 281 return 0; 282 } 283 284 static void vhci_coredump(struct hci_dev *hdev) 285 { 286 /* No need to do anything */ 287 } 288 289 static void vhci_coredump_hdr(struct hci_dev *hdev, struct sk_buff *skb) 290 { 291 char buf[80]; 292 293 snprintf(buf, sizeof(buf), "Controller Name: vhci_ctrl\n"); 294 skb_put_data(skb, buf, strlen(buf)); 295 296 snprintf(buf, sizeof(buf), "Firmware Version: vhci_fw\n"); 297 skb_put_data(skb, buf, strlen(buf)); 298 299 snprintf(buf, sizeof(buf), "Driver: vhci_drv\n"); 300 skb_put_data(skb, buf, strlen(buf)); 301 302 snprintf(buf, sizeof(buf), "Vendor: vhci\n"); 303 skb_put_data(skb, buf, strlen(buf)); 304 } 305 306 #define MAX_COREDUMP_LINE_LEN 40 307 308 struct devcoredump_test_data { 309 enum devcoredump_state state; 310 unsigned int timeout; 311 char data[MAX_COREDUMP_LINE_LEN]; 312 }; 313 314 static inline void force_devcd_timeout(struct hci_dev *hdev, 315 unsigned int timeout) 316 { 317 #ifdef CONFIG_DEV_COREDUMP 318 hdev->dump.timeout = msecs_to_jiffies(timeout * 1000); 319 #endif 320 } 321 322 static ssize_t force_devcd_write(struct file *file, const char __user *user_buf, 323 size_t count, loff_t *ppos) 324 { 325 struct vhci_data *data = file->private_data; 326 struct hci_dev *hdev = data->hdev; 327 struct sk_buff *skb = NULL; 328 struct devcoredump_test_data dump_data; 329 size_t data_size; 330 int ret; 331 332 if (count < offsetof(struct devcoredump_test_data, data) || 333 count > sizeof(dump_data)) 334 return -EINVAL; 335 336 if (copy_from_user(&dump_data, user_buf, count)) 337 return -EFAULT; 338 339 data_size = count - offsetof(struct devcoredump_test_data, data); 340 skb = alloc_skb(data_size, GFP_ATOMIC); 341 if (!skb) 342 return -ENOMEM; 343 skb_put_data(skb, &dump_data.data, data_size); 344 345 hci_devcd_register(hdev, vhci_coredump, vhci_coredump_hdr, NULL); 346 347 /* Force the devcoredump timeout */ 348 if (dump_data.timeout) 349 force_devcd_timeout(hdev, dump_data.timeout); 350 351 ret = hci_devcd_init(hdev, skb->len); 352 if (ret) { 353 BT_ERR("Failed to generate devcoredump"); 354 kfree_skb(skb); 355 return ret; 356 } 357 358 hci_devcd_append(hdev, skb); 359 360 switch (dump_data.state) { 361 case HCI_DEVCOREDUMP_DONE: 362 hci_devcd_complete(hdev); 363 break; 364 case HCI_DEVCOREDUMP_ABORT: 365 hci_devcd_abort(hdev); 366 break; 367 case HCI_DEVCOREDUMP_TIMEOUT: 368 /* Do nothing */ 369 break; 370 default: 371 return -EINVAL; 372 } 373 374 return count; 375 } 376 377 static const struct file_operations force_devcoredump_fops = { 378 .open = simple_open, 379 .write = force_devcd_write, 380 }; 381 382 static int __vhci_create_device(struct vhci_data *data, __u8 opcode) 383 { 384 struct hci_dev *hdev; 385 struct sk_buff *skb; 386 __u8 dev_type; 387 388 if (data->hdev) 389 return -EBADFD; 390 391 /* bits 0-1 are dev_type (Primary or AMP) */ 392 dev_type = opcode & 0x03; 393 394 if (dev_type != HCI_PRIMARY && dev_type != HCI_AMP) 395 return -EINVAL; 396 397 /* bits 2-5 are reserved (must be zero) */ 398 if (opcode & 0x3c) 399 return -EINVAL; 400 401 skb = bt_skb_alloc(4, GFP_KERNEL); 402 if (!skb) 403 return -ENOMEM; 404 405 hdev = hci_alloc_dev(); 406 if (!hdev) { 407 kfree_skb(skb); 408 return -ENOMEM; 409 } 410 411 data->hdev = hdev; 412 413 hdev->bus = HCI_VIRTUAL; 414 hdev->dev_type = dev_type; 415 hci_set_drvdata(hdev, data); 416 417 hdev->open = vhci_open_dev; 418 hdev->close = vhci_close_dev; 419 hdev->flush = vhci_flush; 420 hdev->send = vhci_send_frame; 421 hdev->get_data_path_id = vhci_get_data_path_id; 422 hdev->get_codec_config_data = vhci_get_codec_config_data; 423 hdev->wakeup = vhci_wakeup; 424 hdev->setup = vhci_setup; 425 set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); 426 427 /* bit 6 is for external configuration */ 428 if (opcode & 0x40) 429 set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks); 430 431 /* bit 7 is for raw device */ 432 if (opcode & 0x80) 433 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 434 435 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); 436 437 if (hci_register_dev(hdev) < 0) { 438 BT_ERR("Can't register HCI device"); 439 hci_free_dev(hdev); 440 data->hdev = NULL; 441 kfree_skb(skb); 442 return -EBUSY; 443 } 444 445 debugfs_create_file("force_suspend", 0644, hdev->debugfs, data, 446 &force_suspend_fops); 447 448 debugfs_create_file("force_wakeup", 0644, hdev->debugfs, data, 449 &force_wakeup_fops); 450 451 if (IS_ENABLED(CONFIG_BT_MSFTEXT)) 452 debugfs_create_file("msft_opcode", 0644, hdev->debugfs, data, 453 &msft_opcode_fops); 454 455 if (IS_ENABLED(CONFIG_BT_AOSPEXT)) 456 debugfs_create_file("aosp_capable", 0644, hdev->debugfs, data, 457 &aosp_capable_fops); 458 459 debugfs_create_file("force_devcoredump", 0644, hdev->debugfs, data, 460 &force_devcoredump_fops); 461 462 hci_skb_pkt_type(skb) = HCI_VENDOR_PKT; 463 464 skb_put_u8(skb, 0xff); 465 skb_put_u8(skb, opcode); 466 put_unaligned_le16(hdev->id, skb_put(skb, 2)); 467 skb_queue_tail(&data->readq, skb); 468 469 wake_up_interruptible(&data->read_wait); 470 return 0; 471 } 472 473 static int vhci_create_device(struct vhci_data *data, __u8 opcode) 474 { 475 int err; 476 477 mutex_lock(&data->open_mutex); 478 err = __vhci_create_device(data, opcode); 479 mutex_unlock(&data->open_mutex); 480 481 return err; 482 } 483 484 static inline ssize_t vhci_get_user(struct vhci_data *data, 485 struct iov_iter *from) 486 { 487 size_t len = iov_iter_count(from); 488 struct sk_buff *skb; 489 __u8 pkt_type, opcode; 490 int ret; 491 492 if (len < 2 || len > HCI_MAX_FRAME_SIZE) 493 return -EINVAL; 494 495 skb = bt_skb_alloc(len, GFP_KERNEL); 496 if (!skb) 497 return -ENOMEM; 498 499 if (!copy_from_iter_full(skb_put(skb, len), len, from)) { 500 kfree_skb(skb); 501 return -EFAULT; 502 } 503 504 pkt_type = *((__u8 *) skb->data); 505 skb_pull(skb, 1); 506 507 switch (pkt_type) { 508 case HCI_EVENT_PKT: 509 case HCI_ACLDATA_PKT: 510 case HCI_SCODATA_PKT: 511 case HCI_ISODATA_PKT: 512 if (!data->hdev) { 513 kfree_skb(skb); 514 return -ENODEV; 515 } 516 517 hci_skb_pkt_type(skb) = pkt_type; 518 519 ret = hci_recv_frame(data->hdev, skb); 520 break; 521 522 case HCI_VENDOR_PKT: 523 cancel_delayed_work_sync(&data->open_timeout); 524 525 opcode = *((__u8 *) skb->data); 526 skb_pull(skb, 1); 527 528 if (skb->len > 0) { 529 kfree_skb(skb); 530 return -EINVAL; 531 } 532 533 kfree_skb(skb); 534 535 ret = vhci_create_device(data, opcode); 536 break; 537 538 default: 539 kfree_skb(skb); 540 return -EINVAL; 541 } 542 543 return (ret < 0) ? ret : len; 544 } 545 546 static inline ssize_t vhci_put_user(struct vhci_data *data, 547 struct sk_buff *skb, 548 char __user *buf, int count) 549 { 550 char __user *ptr = buf; 551 int len; 552 553 len = min_t(unsigned int, skb->len, count); 554 555 if (copy_to_user(ptr, skb->data, len)) 556 return -EFAULT; 557 558 if (!data->hdev) 559 return len; 560 561 data->hdev->stat.byte_tx += len; 562 563 switch (hci_skb_pkt_type(skb)) { 564 case HCI_COMMAND_PKT: 565 data->hdev->stat.cmd_tx++; 566 break; 567 case HCI_ACLDATA_PKT: 568 data->hdev->stat.acl_tx++; 569 break; 570 case HCI_SCODATA_PKT: 571 data->hdev->stat.sco_tx++; 572 break; 573 } 574 575 return len; 576 } 577 578 static ssize_t vhci_read(struct file *file, 579 char __user *buf, size_t count, loff_t *pos) 580 { 581 struct vhci_data *data = file->private_data; 582 struct sk_buff *skb; 583 ssize_t ret = 0; 584 585 while (count) { 586 skb = skb_dequeue(&data->readq); 587 if (skb) { 588 ret = vhci_put_user(data, skb, buf, count); 589 if (ret < 0) 590 skb_queue_head(&data->readq, skb); 591 else 592 kfree_skb(skb); 593 break; 594 } 595 596 if (file->f_flags & O_NONBLOCK) { 597 ret = -EAGAIN; 598 break; 599 } 600 601 ret = wait_event_interruptible(data->read_wait, 602 !skb_queue_empty(&data->readq)); 603 if (ret < 0) 604 break; 605 } 606 607 return ret; 608 } 609 610 static ssize_t vhci_write(struct kiocb *iocb, struct iov_iter *from) 611 { 612 struct file *file = iocb->ki_filp; 613 struct vhci_data *data = file->private_data; 614 615 return vhci_get_user(data, from); 616 } 617 618 static __poll_t vhci_poll(struct file *file, poll_table *wait) 619 { 620 struct vhci_data *data = file->private_data; 621 622 poll_wait(file, &data->read_wait, wait); 623 624 if (!skb_queue_empty(&data->readq)) 625 return EPOLLIN | EPOLLRDNORM; 626 627 return EPOLLOUT | EPOLLWRNORM; 628 } 629 630 static void vhci_open_timeout(struct work_struct *work) 631 { 632 struct vhci_data *data = container_of(work, struct vhci_data, 633 open_timeout.work); 634 635 vhci_create_device(data, amp ? HCI_AMP : HCI_PRIMARY); 636 } 637 638 static int vhci_open(struct inode *inode, struct file *file) 639 { 640 struct vhci_data *data; 641 642 data = kzalloc(sizeof(struct vhci_data), GFP_KERNEL); 643 if (!data) 644 return -ENOMEM; 645 646 skb_queue_head_init(&data->readq); 647 init_waitqueue_head(&data->read_wait); 648 649 mutex_init(&data->open_mutex); 650 INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout); 651 INIT_WORK(&data->suspend_work, vhci_suspend_work); 652 653 file->private_data = data; 654 nonseekable_open(inode, file); 655 656 schedule_delayed_work(&data->open_timeout, msecs_to_jiffies(1000)); 657 658 return 0; 659 } 660 661 static int vhci_release(struct inode *inode, struct file *file) 662 { 663 struct vhci_data *data = file->private_data; 664 struct hci_dev *hdev; 665 666 cancel_delayed_work_sync(&data->open_timeout); 667 flush_work(&data->suspend_work); 668 669 hdev = data->hdev; 670 671 if (hdev) { 672 hci_unregister_dev(hdev); 673 hci_free_dev(hdev); 674 } 675 676 skb_queue_purge(&data->readq); 677 file->private_data = NULL; 678 kfree(data); 679 680 return 0; 681 } 682 683 static const struct file_operations vhci_fops = { 684 .owner = THIS_MODULE, 685 .read = vhci_read, 686 .write_iter = vhci_write, 687 .poll = vhci_poll, 688 .open = vhci_open, 689 .release = vhci_release, 690 .llseek = no_llseek, 691 }; 692 693 static struct miscdevice vhci_miscdev = { 694 .name = "vhci", 695 .fops = &vhci_fops, 696 .minor = VHCI_MINOR, 697 }; 698 module_misc_device(vhci_miscdev); 699 700 module_param(amp, bool, 0644); 701 MODULE_PARM_DESC(amp, "Create AMP controller device"); 702 703 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 704 MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION); 705 MODULE_VERSION(VERSION); 706 MODULE_LICENSE("GPL"); 707 MODULE_ALIAS("devname:vhci"); 708 MODULE_ALIAS_MISCDEV(VHCI_MINOR); 709