1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth virtual HCI driver 5 * 6 * Copyright (C) 2000-2001 Qualcomm Incorporated 7 * Copyright (C) 2002-2003 Maxim Krasnyansky <maxk@qualcomm.com> 8 * Copyright (C) 2004-2006 Marcel Holtmann <marcel@holtmann.org> 9 */ 10 11 #include <linux/module.h> 12 #include <asm/unaligned.h> 13 14 #include <linux/atomic.h> 15 #include <linux/kernel.h> 16 #include <linux/init.h> 17 #include <linux/slab.h> 18 #include <linux/types.h> 19 #include <linux/errno.h> 20 #include <linux/sched.h> 21 #include <linux/poll.h> 22 23 #include <linux/skbuff.h> 24 #include <linux/miscdevice.h> 25 #include <linux/debugfs.h> 26 27 #include <net/bluetooth/bluetooth.h> 28 #include <net/bluetooth/hci_core.h> 29 30 #define VERSION "1.5" 31 32 static bool amp; 33 34 struct vhci_data { 35 struct hci_dev *hdev; 36 37 wait_queue_head_t read_wait; 38 struct sk_buff_head readq; 39 40 struct mutex open_mutex; 41 struct delayed_work open_timeout; 42 struct work_struct suspend_work; 43 44 bool suspended; 45 bool wakeup; 46 __u16 msft_opcode; 47 bool aosp_capable; 48 atomic_t initialized; 49 }; 50 51 static int vhci_open_dev(struct hci_dev *hdev) 52 { 53 return 0; 54 } 55 56 static int vhci_close_dev(struct hci_dev *hdev) 57 { 58 struct vhci_data *data = hci_get_drvdata(hdev); 59 60 skb_queue_purge(&data->readq); 61 62 return 0; 63 } 64 65 static int vhci_flush(struct hci_dev *hdev) 66 { 67 struct vhci_data *data = hci_get_drvdata(hdev); 68 69 skb_queue_purge(&data->readq); 70 71 return 0; 72 } 73 74 static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 75 { 76 struct vhci_data *data = hci_get_drvdata(hdev); 77 78 memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1); 79 80 skb_queue_tail(&data->readq, skb); 81 82 if (atomic_read(&data->initialized)) 83 wake_up_interruptible(&data->read_wait); 84 return 0; 85 } 86 87 static int vhci_get_data_path_id(struct hci_dev *hdev, u8 *data_path_id) 88 { 89 *data_path_id = 0; 90 return 0; 91 } 92 93 static int vhci_get_codec_config_data(struct hci_dev *hdev, __u8 type, 94 struct bt_codec *codec, __u8 *vnd_len, 95 __u8 **vnd_data) 96 { 97 if (type != ESCO_LINK) 98 return -EINVAL; 99 100 *vnd_len = 0; 101 *vnd_data = NULL; 102 return 0; 103 } 104 105 static bool vhci_wakeup(struct hci_dev *hdev) 106 { 107 struct vhci_data *data = hci_get_drvdata(hdev); 108 109 return data->wakeup; 110 } 111 112 static ssize_t force_suspend_read(struct file *file, char __user *user_buf, 113 size_t count, loff_t *ppos) 114 { 115 struct vhci_data *data = file->private_data; 116 char buf[3]; 117 118 buf[0] = data->suspended ? 'Y' : 'N'; 119 buf[1] = '\n'; 120 buf[2] = '\0'; 121 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 122 } 123 124 static void vhci_suspend_work(struct work_struct *work) 125 { 126 struct vhci_data *data = container_of(work, struct vhci_data, 127 suspend_work); 128 129 if (data->suspended) 130 hci_suspend_dev(data->hdev); 131 else 132 hci_resume_dev(data->hdev); 133 } 134 135 static ssize_t force_suspend_write(struct file *file, 136 const char __user *user_buf, 137 size_t count, loff_t *ppos) 138 { 139 struct vhci_data *data = file->private_data; 140 bool enable; 141 int err; 142 143 err = kstrtobool_from_user(user_buf, count, &enable); 144 if (err) 145 return err; 146 147 if (data->suspended == enable) 148 return -EALREADY; 149 150 data->suspended = enable; 151 152 schedule_work(&data->suspend_work); 153 154 return count; 155 } 156 157 static const struct file_operations force_suspend_fops = { 158 .open = simple_open, 159 .read = force_suspend_read, 160 .write = force_suspend_write, 161 .llseek = default_llseek, 162 }; 163 164 static ssize_t force_wakeup_read(struct file *file, char __user *user_buf, 165 size_t count, loff_t *ppos) 166 { 167 struct vhci_data *data = file->private_data; 168 char buf[3]; 169 170 buf[0] = data->wakeup ? 'Y' : 'N'; 171 buf[1] = '\n'; 172 buf[2] = '\0'; 173 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 174 } 175 176 static ssize_t force_wakeup_write(struct file *file, 177 const char __user *user_buf, size_t count, 178 loff_t *ppos) 179 { 180 struct vhci_data *data = file->private_data; 181 bool enable; 182 int err; 183 184 err = kstrtobool_from_user(user_buf, count, &enable); 185 if (err) 186 return err; 187 188 if (data->wakeup == enable) 189 return -EALREADY; 190 191 data->wakeup = enable; 192 193 return count; 194 } 195 196 static const struct file_operations force_wakeup_fops = { 197 .open = simple_open, 198 .read = force_wakeup_read, 199 .write = force_wakeup_write, 200 .llseek = default_llseek, 201 }; 202 203 static int msft_opcode_set(void *data, u64 val) 204 { 205 struct vhci_data *vhci = data; 206 207 if (val > 0xffff || hci_opcode_ogf(val) != 0x3f) 208 return -EINVAL; 209 210 if (vhci->msft_opcode) 211 return -EALREADY; 212 213 vhci->msft_opcode = val; 214 215 return 0; 216 } 217 218 static int msft_opcode_get(void *data, u64 *val) 219 { 220 struct vhci_data *vhci = data; 221 222 *val = vhci->msft_opcode; 223 224 return 0; 225 } 226 227 DEFINE_DEBUGFS_ATTRIBUTE(msft_opcode_fops, msft_opcode_get, msft_opcode_set, 228 "%llu\n"); 229 230 static ssize_t aosp_capable_read(struct file *file, char __user *user_buf, 231 size_t count, loff_t *ppos) 232 { 233 struct vhci_data *vhci = file->private_data; 234 char buf[3]; 235 236 buf[0] = vhci->aosp_capable ? 'Y' : 'N'; 237 buf[1] = '\n'; 238 buf[2] = '\0'; 239 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 240 } 241 242 static ssize_t aosp_capable_write(struct file *file, 243 const char __user *user_buf, size_t count, 244 loff_t *ppos) 245 { 246 struct vhci_data *vhci = file->private_data; 247 bool enable; 248 int err; 249 250 err = kstrtobool_from_user(user_buf, count, &enable); 251 if (err) 252 return err; 253 254 if (!enable) 255 return -EINVAL; 256 257 if (vhci->aosp_capable) 258 return -EALREADY; 259 260 vhci->aosp_capable = enable; 261 262 return count; 263 } 264 265 static const struct file_operations aosp_capable_fops = { 266 .open = simple_open, 267 .read = aosp_capable_read, 268 .write = aosp_capable_write, 269 .llseek = default_llseek, 270 }; 271 272 static int vhci_setup(struct hci_dev *hdev) 273 { 274 struct vhci_data *vhci = hci_get_drvdata(hdev); 275 276 if (vhci->msft_opcode) 277 hci_set_msft_opcode(hdev, vhci->msft_opcode); 278 279 if (vhci->aosp_capable) 280 hci_set_aosp_capable(hdev); 281 282 return 0; 283 } 284 285 static void vhci_coredump(struct hci_dev *hdev) 286 { 287 /* No need to do anything */ 288 } 289 290 static void vhci_coredump_hdr(struct hci_dev *hdev, struct sk_buff *skb) 291 { 292 char buf[80]; 293 294 snprintf(buf, sizeof(buf), "Controller Name: vhci_ctrl\n"); 295 skb_put_data(skb, buf, strlen(buf)); 296 297 snprintf(buf, sizeof(buf), "Firmware Version: vhci_fw\n"); 298 skb_put_data(skb, buf, strlen(buf)); 299 300 snprintf(buf, sizeof(buf), "Driver: vhci_drv\n"); 301 skb_put_data(skb, buf, strlen(buf)); 302 303 snprintf(buf, sizeof(buf), "Vendor: vhci\n"); 304 skb_put_data(skb, buf, strlen(buf)); 305 } 306 307 #define MAX_COREDUMP_LINE_LEN 40 308 309 struct devcoredump_test_data { 310 enum devcoredump_state state; 311 unsigned int timeout; 312 char data[MAX_COREDUMP_LINE_LEN]; 313 }; 314 315 static inline void force_devcd_timeout(struct hci_dev *hdev, 316 unsigned int timeout) 317 { 318 #ifdef CONFIG_DEV_COREDUMP 319 hdev->dump.timeout = msecs_to_jiffies(timeout * 1000); 320 #endif 321 } 322 323 static ssize_t force_devcd_write(struct file *file, const char __user *user_buf, 324 size_t count, loff_t *ppos) 325 { 326 struct vhci_data *data = file->private_data; 327 struct hci_dev *hdev = data->hdev; 328 struct sk_buff *skb = NULL; 329 struct devcoredump_test_data dump_data; 330 size_t data_size; 331 int ret; 332 333 if (count < offsetof(struct devcoredump_test_data, data) || 334 count > sizeof(dump_data)) 335 return -EINVAL; 336 337 if (copy_from_user(&dump_data, user_buf, count)) 338 return -EFAULT; 339 340 data_size = count - offsetof(struct devcoredump_test_data, data); 341 skb = alloc_skb(data_size, GFP_ATOMIC); 342 if (!skb) 343 return -ENOMEM; 344 skb_put_data(skb, &dump_data.data, data_size); 345 346 hci_devcd_register(hdev, vhci_coredump, vhci_coredump_hdr, NULL); 347 348 /* Force the devcoredump timeout */ 349 if (dump_data.timeout) 350 force_devcd_timeout(hdev, dump_data.timeout); 351 352 ret = hci_devcd_init(hdev, skb->len); 353 if (ret) { 354 BT_ERR("Failed to generate devcoredump"); 355 kfree_skb(skb); 356 return ret; 357 } 358 359 hci_devcd_append(hdev, skb); 360 361 switch (dump_data.state) { 362 case HCI_DEVCOREDUMP_DONE: 363 hci_devcd_complete(hdev); 364 break; 365 case HCI_DEVCOREDUMP_ABORT: 366 hci_devcd_abort(hdev); 367 break; 368 case HCI_DEVCOREDUMP_TIMEOUT: 369 /* Do nothing */ 370 break; 371 default: 372 return -EINVAL; 373 } 374 375 return count; 376 } 377 378 static const struct file_operations force_devcoredump_fops = { 379 .open = simple_open, 380 .write = force_devcd_write, 381 }; 382 383 static int __vhci_create_device(struct vhci_data *data, __u8 opcode) 384 { 385 struct hci_dev *hdev; 386 struct sk_buff *skb; 387 __u8 dev_type; 388 389 if (data->hdev) 390 return -EBADFD; 391 392 /* bits 0-1 are dev_type (Primary or AMP) */ 393 dev_type = opcode & 0x03; 394 395 if (dev_type != HCI_PRIMARY && dev_type != HCI_AMP) 396 return -EINVAL; 397 398 /* bits 2-5 are reserved (must be zero) */ 399 if (opcode & 0x3c) 400 return -EINVAL; 401 402 skb = bt_skb_alloc(4, GFP_KERNEL); 403 if (!skb) 404 return -ENOMEM; 405 406 hdev = hci_alloc_dev(); 407 if (!hdev) { 408 kfree_skb(skb); 409 return -ENOMEM; 410 } 411 412 data->hdev = hdev; 413 414 hdev->bus = HCI_VIRTUAL; 415 hdev->dev_type = dev_type; 416 hci_set_drvdata(hdev, data); 417 418 hdev->open = vhci_open_dev; 419 hdev->close = vhci_close_dev; 420 hdev->flush = vhci_flush; 421 hdev->send = vhci_send_frame; 422 hdev->get_data_path_id = vhci_get_data_path_id; 423 hdev->get_codec_config_data = vhci_get_codec_config_data; 424 hdev->wakeup = vhci_wakeup; 425 hdev->setup = vhci_setup; 426 set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); 427 428 /* bit 6 is for external configuration */ 429 if (opcode & 0x40) 430 set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks); 431 432 /* bit 7 is for raw device */ 433 if (opcode & 0x80) 434 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 435 436 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); 437 438 if (hci_register_dev(hdev) < 0) { 439 BT_ERR("Can't register HCI device"); 440 hci_free_dev(hdev); 441 data->hdev = NULL; 442 kfree_skb(skb); 443 return -EBUSY; 444 } 445 446 debugfs_create_file("force_suspend", 0644, hdev->debugfs, data, 447 &force_suspend_fops); 448 449 debugfs_create_file("force_wakeup", 0644, hdev->debugfs, data, 450 &force_wakeup_fops); 451 452 if (IS_ENABLED(CONFIG_BT_MSFTEXT)) 453 debugfs_create_file("msft_opcode", 0644, hdev->debugfs, data, 454 &msft_opcode_fops); 455 456 if (IS_ENABLED(CONFIG_BT_AOSPEXT)) 457 debugfs_create_file("aosp_capable", 0644, hdev->debugfs, data, 458 &aosp_capable_fops); 459 460 debugfs_create_file("force_devcoredump", 0644, hdev->debugfs, data, 461 &force_devcoredump_fops); 462 463 hci_skb_pkt_type(skb) = HCI_VENDOR_PKT; 464 465 skb_put_u8(skb, 0xff); 466 skb_put_u8(skb, opcode); 467 put_unaligned_le16(hdev->id, skb_put(skb, 2)); 468 skb_queue_head(&data->readq, skb); 469 atomic_inc(&data->initialized); 470 471 wake_up_interruptible(&data->read_wait); 472 return 0; 473 } 474 475 static int vhci_create_device(struct vhci_data *data, __u8 opcode) 476 { 477 int err; 478 479 mutex_lock(&data->open_mutex); 480 err = __vhci_create_device(data, opcode); 481 mutex_unlock(&data->open_mutex); 482 483 return err; 484 } 485 486 static inline ssize_t vhci_get_user(struct vhci_data *data, 487 struct iov_iter *from) 488 { 489 size_t len = iov_iter_count(from); 490 struct sk_buff *skb; 491 __u8 pkt_type, opcode; 492 int ret; 493 494 if (len < 2 || len > HCI_MAX_FRAME_SIZE) 495 return -EINVAL; 496 497 skb = bt_skb_alloc(len, GFP_KERNEL); 498 if (!skb) 499 return -ENOMEM; 500 501 if (!copy_from_iter_full(skb_put(skb, len), len, from)) { 502 kfree_skb(skb); 503 return -EFAULT; 504 } 505 506 pkt_type = *((__u8 *) skb->data); 507 skb_pull(skb, 1); 508 509 switch (pkt_type) { 510 case HCI_EVENT_PKT: 511 case HCI_ACLDATA_PKT: 512 case HCI_SCODATA_PKT: 513 case HCI_ISODATA_PKT: 514 if (!data->hdev) { 515 kfree_skb(skb); 516 return -ENODEV; 517 } 518 519 hci_skb_pkt_type(skb) = pkt_type; 520 521 ret = hci_recv_frame(data->hdev, skb); 522 break; 523 524 case HCI_VENDOR_PKT: 525 cancel_delayed_work_sync(&data->open_timeout); 526 527 opcode = *((__u8 *) skb->data); 528 skb_pull(skb, 1); 529 530 if (skb->len > 0) { 531 kfree_skb(skb); 532 return -EINVAL; 533 } 534 535 kfree_skb(skb); 536 537 ret = vhci_create_device(data, opcode); 538 break; 539 540 default: 541 kfree_skb(skb); 542 return -EINVAL; 543 } 544 545 return (ret < 0) ? ret : len; 546 } 547 548 static inline ssize_t vhci_put_user(struct vhci_data *data, 549 struct sk_buff *skb, 550 char __user *buf, int count) 551 { 552 char __user *ptr = buf; 553 int len; 554 555 len = min_t(unsigned int, skb->len, count); 556 557 if (copy_to_user(ptr, skb->data, len)) 558 return -EFAULT; 559 560 if (!data->hdev) 561 return len; 562 563 data->hdev->stat.byte_tx += len; 564 565 switch (hci_skb_pkt_type(skb)) { 566 case HCI_COMMAND_PKT: 567 data->hdev->stat.cmd_tx++; 568 break; 569 case HCI_ACLDATA_PKT: 570 data->hdev->stat.acl_tx++; 571 break; 572 case HCI_SCODATA_PKT: 573 data->hdev->stat.sco_tx++; 574 break; 575 } 576 577 return len; 578 } 579 580 static ssize_t vhci_read(struct file *file, 581 char __user *buf, size_t count, loff_t *pos) 582 { 583 struct vhci_data *data = file->private_data; 584 struct sk_buff *skb; 585 ssize_t ret = 0; 586 587 while (count) { 588 skb = skb_dequeue(&data->readq); 589 if (skb) { 590 ret = vhci_put_user(data, skb, buf, count); 591 if (ret < 0) 592 skb_queue_head(&data->readq, skb); 593 else 594 kfree_skb(skb); 595 break; 596 } 597 598 if (file->f_flags & O_NONBLOCK) { 599 ret = -EAGAIN; 600 break; 601 } 602 603 ret = wait_event_interruptible(data->read_wait, 604 !skb_queue_empty(&data->readq)); 605 if (ret < 0) 606 break; 607 } 608 609 return ret; 610 } 611 612 static ssize_t vhci_write(struct kiocb *iocb, struct iov_iter *from) 613 { 614 struct file *file = iocb->ki_filp; 615 struct vhci_data *data = file->private_data; 616 617 return vhci_get_user(data, from); 618 } 619 620 static __poll_t vhci_poll(struct file *file, poll_table *wait) 621 { 622 struct vhci_data *data = file->private_data; 623 624 poll_wait(file, &data->read_wait, wait); 625 626 if (!skb_queue_empty(&data->readq)) 627 return EPOLLIN | EPOLLRDNORM; 628 629 return EPOLLOUT | EPOLLWRNORM; 630 } 631 632 static void vhci_open_timeout(struct work_struct *work) 633 { 634 struct vhci_data *data = container_of(work, struct vhci_data, 635 open_timeout.work); 636 637 vhci_create_device(data, amp ? HCI_AMP : HCI_PRIMARY); 638 } 639 640 static int vhci_open(struct inode *inode, struct file *file) 641 { 642 struct vhci_data *data; 643 644 data = kzalloc(sizeof(struct vhci_data), GFP_KERNEL); 645 if (!data) 646 return -ENOMEM; 647 648 skb_queue_head_init(&data->readq); 649 init_waitqueue_head(&data->read_wait); 650 651 mutex_init(&data->open_mutex); 652 INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout); 653 INIT_WORK(&data->suspend_work, vhci_suspend_work); 654 655 file->private_data = data; 656 nonseekable_open(inode, file); 657 658 schedule_delayed_work(&data->open_timeout, msecs_to_jiffies(1000)); 659 660 return 0; 661 } 662 663 static int vhci_release(struct inode *inode, struct file *file) 664 { 665 struct vhci_data *data = file->private_data; 666 struct hci_dev *hdev; 667 668 cancel_delayed_work_sync(&data->open_timeout); 669 flush_work(&data->suspend_work); 670 671 hdev = data->hdev; 672 673 if (hdev) { 674 hci_unregister_dev(hdev); 675 hci_free_dev(hdev); 676 } 677 678 skb_queue_purge(&data->readq); 679 file->private_data = NULL; 680 kfree(data); 681 682 return 0; 683 } 684 685 static const struct file_operations vhci_fops = { 686 .owner = THIS_MODULE, 687 .read = vhci_read, 688 .write_iter = vhci_write, 689 .poll = vhci_poll, 690 .open = vhci_open, 691 .release = vhci_release, 692 .llseek = no_llseek, 693 }; 694 695 static struct miscdevice vhci_miscdev = { 696 .name = "vhci", 697 .fops = &vhci_fops, 698 .minor = VHCI_MINOR, 699 }; 700 module_misc_device(vhci_miscdev); 701 702 module_param(amp, bool, 0644); 703 MODULE_PARM_DESC(amp, "Create AMP controller device"); 704 705 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 706 MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION); 707 MODULE_VERSION(VERSION); 708 MODULE_LICENSE("GPL"); 709 MODULE_ALIAS("devname:vhci"); 710 MODULE_ALIAS_MISCDEV(VHCI_MINOR); 711