1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth virtual HCI driver 5 * 6 * Copyright (C) 2000-2001 Qualcomm Incorporated 7 * Copyright (C) 2002-2003 Maxim Krasnyansky <maxk@qualcomm.com> 8 * Copyright (C) 2004-2006 Marcel Holtmann <marcel@holtmann.org> 9 */ 10 11 #include <linux/module.h> 12 #include <asm/unaligned.h> 13 14 #include <linux/kernel.h> 15 #include <linux/init.h> 16 #include <linux/slab.h> 17 #include <linux/types.h> 18 #include <linux/errno.h> 19 #include <linux/sched.h> 20 #include <linux/poll.h> 21 22 #include <linux/skbuff.h> 23 #include <linux/miscdevice.h> 24 #include <linux/debugfs.h> 25 26 #include <net/bluetooth/bluetooth.h> 27 #include <net/bluetooth/hci_core.h> 28 29 #define VERSION "1.5" 30 31 static bool amp; 32 33 struct vhci_data { 34 struct hci_dev *hdev; 35 36 wait_queue_head_t read_wait; 37 struct sk_buff_head readq; 38 39 struct mutex open_mutex; 40 struct delayed_work open_timeout; 41 struct work_struct suspend_work; 42 43 bool suspended; 44 bool wakeup; 45 __u16 msft_opcode; 46 bool aosp_capable; 47 }; 48 49 static int vhci_open_dev(struct hci_dev *hdev) 50 { 51 return 0; 52 } 53 54 static int vhci_close_dev(struct hci_dev *hdev) 55 { 56 struct vhci_data *data = hci_get_drvdata(hdev); 57 58 skb_queue_purge(&data->readq); 59 60 return 0; 61 } 62 63 static int vhci_flush(struct hci_dev *hdev) 64 { 65 struct vhci_data *data = hci_get_drvdata(hdev); 66 67 skb_queue_purge(&data->readq); 68 69 return 0; 70 } 71 72 static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 73 { 74 struct vhci_data *data = hci_get_drvdata(hdev); 75 76 memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1); 77 skb_queue_tail(&data->readq, skb); 78 79 wake_up_interruptible(&data->read_wait); 80 return 0; 81 } 82 83 static int vhci_get_data_path_id(struct hci_dev *hdev, u8 *data_path_id) 84 { 85 *data_path_id = 0; 86 return 0; 87 } 88 89 static int vhci_get_codec_config_data(struct hci_dev *hdev, __u8 type, 90 struct bt_codec *codec, __u8 *vnd_len, 91 __u8 **vnd_data) 92 { 93 if (type != ESCO_LINK) 94 return -EINVAL; 95 96 *vnd_len = 0; 97 *vnd_data = NULL; 98 return 0; 99 } 100 101 static bool vhci_wakeup(struct hci_dev *hdev) 102 { 103 struct vhci_data *data = hci_get_drvdata(hdev); 104 105 return data->wakeup; 106 } 107 108 static ssize_t force_suspend_read(struct file *file, char __user *user_buf, 109 size_t count, loff_t *ppos) 110 { 111 struct vhci_data *data = file->private_data; 112 char buf[3]; 113 114 buf[0] = data->suspended ? 'Y' : 'N'; 115 buf[1] = '\n'; 116 buf[2] = '\0'; 117 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 118 } 119 120 static void vhci_suspend_work(struct work_struct *work) 121 { 122 struct vhci_data *data = container_of(work, struct vhci_data, 123 suspend_work); 124 125 if (data->suspended) 126 hci_suspend_dev(data->hdev); 127 else 128 hci_resume_dev(data->hdev); 129 } 130 131 static ssize_t force_suspend_write(struct file *file, 132 const char __user *user_buf, 133 size_t count, loff_t *ppos) 134 { 135 struct vhci_data *data = file->private_data; 136 bool enable; 137 int err; 138 139 err = kstrtobool_from_user(user_buf, count, &enable); 140 if (err) 141 return err; 142 143 if (data->suspended == enable) 144 return -EALREADY; 145 146 data->suspended = enable; 147 148 schedule_work(&data->suspend_work); 149 150 return count; 151 } 152 153 static const struct file_operations force_suspend_fops = { 154 .open = simple_open, 155 .read = force_suspend_read, 156 .write = force_suspend_write, 157 .llseek = default_llseek, 158 }; 159 160 static ssize_t force_wakeup_read(struct file *file, char __user *user_buf, 161 size_t count, loff_t *ppos) 162 { 163 struct vhci_data *data = file->private_data; 164 char buf[3]; 165 166 buf[0] = data->wakeup ? 'Y' : 'N'; 167 buf[1] = '\n'; 168 buf[2] = '\0'; 169 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 170 } 171 172 static ssize_t force_wakeup_write(struct file *file, 173 const char __user *user_buf, size_t count, 174 loff_t *ppos) 175 { 176 struct vhci_data *data = file->private_data; 177 bool enable; 178 int err; 179 180 err = kstrtobool_from_user(user_buf, count, &enable); 181 if (err) 182 return err; 183 184 if (data->wakeup == enable) 185 return -EALREADY; 186 187 data->wakeup = enable; 188 189 return count; 190 } 191 192 static const struct file_operations force_wakeup_fops = { 193 .open = simple_open, 194 .read = force_wakeup_read, 195 .write = force_wakeup_write, 196 .llseek = default_llseek, 197 }; 198 199 static int msft_opcode_set(void *data, u64 val) 200 { 201 struct vhci_data *vhci = data; 202 203 if (val > 0xffff || hci_opcode_ogf(val) != 0x3f) 204 return -EINVAL; 205 206 if (vhci->msft_opcode) 207 return -EALREADY; 208 209 vhci->msft_opcode = val; 210 211 return 0; 212 } 213 214 static int msft_opcode_get(void *data, u64 *val) 215 { 216 struct vhci_data *vhci = data; 217 218 *val = vhci->msft_opcode; 219 220 return 0; 221 } 222 223 DEFINE_DEBUGFS_ATTRIBUTE(msft_opcode_fops, msft_opcode_get, msft_opcode_set, 224 "%llu\n"); 225 226 static ssize_t aosp_capable_read(struct file *file, char __user *user_buf, 227 size_t count, loff_t *ppos) 228 { 229 struct vhci_data *vhci = file->private_data; 230 char buf[3]; 231 232 buf[0] = vhci->aosp_capable ? 'Y' : 'N'; 233 buf[1] = '\n'; 234 buf[2] = '\0'; 235 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 236 } 237 238 static ssize_t aosp_capable_write(struct file *file, 239 const char __user *user_buf, size_t count, 240 loff_t *ppos) 241 { 242 struct vhci_data *vhci = file->private_data; 243 bool enable; 244 int err; 245 246 err = kstrtobool_from_user(user_buf, count, &enable); 247 if (err) 248 return err; 249 250 if (!enable) 251 return -EINVAL; 252 253 if (vhci->aosp_capable) 254 return -EALREADY; 255 256 vhci->aosp_capable = enable; 257 258 return count; 259 } 260 261 static const struct file_operations aosp_capable_fops = { 262 .open = simple_open, 263 .read = aosp_capable_read, 264 .write = aosp_capable_write, 265 .llseek = default_llseek, 266 }; 267 268 static int vhci_setup(struct hci_dev *hdev) 269 { 270 struct vhci_data *vhci = hci_get_drvdata(hdev); 271 272 if (vhci->msft_opcode) 273 hci_set_msft_opcode(hdev, vhci->msft_opcode); 274 275 if (vhci->aosp_capable) 276 hci_set_aosp_capable(hdev); 277 278 return 0; 279 } 280 281 static void vhci_coredump(struct hci_dev *hdev) 282 { 283 /* No need to do anything */ 284 } 285 286 static void vhci_coredump_hdr(struct hci_dev *hdev, struct sk_buff *skb) 287 { 288 char buf[80]; 289 290 snprintf(buf, sizeof(buf), "Controller Name: vhci_ctrl\n"); 291 skb_put_data(skb, buf, strlen(buf)); 292 293 snprintf(buf, sizeof(buf), "Firmware Version: vhci_fw\n"); 294 skb_put_data(skb, buf, strlen(buf)); 295 296 snprintf(buf, sizeof(buf), "Driver: vhci_drv\n"); 297 skb_put_data(skb, buf, strlen(buf)); 298 299 snprintf(buf, sizeof(buf), "Vendor: vhci\n"); 300 skb_put_data(skb, buf, strlen(buf)); 301 } 302 303 #define MAX_COREDUMP_LINE_LEN 40 304 305 struct devcoredump_test_data { 306 enum devcoredump_state state; 307 unsigned int timeout; 308 char data[MAX_COREDUMP_LINE_LEN]; 309 }; 310 311 static inline void force_devcd_timeout(struct hci_dev *hdev, 312 unsigned int timeout) 313 { 314 #ifdef CONFIG_DEV_COREDUMP 315 hdev->dump.timeout = msecs_to_jiffies(timeout * 1000); 316 #endif 317 } 318 319 static ssize_t force_devcd_write(struct file *file, const char __user *user_buf, 320 size_t count, loff_t *ppos) 321 { 322 struct vhci_data *data = file->private_data; 323 struct hci_dev *hdev = data->hdev; 324 struct sk_buff *skb = NULL; 325 struct devcoredump_test_data dump_data; 326 size_t data_size; 327 int ret; 328 329 if (count < offsetof(struct devcoredump_test_data, data) || 330 count > sizeof(dump_data)) 331 return -EINVAL; 332 333 if (copy_from_user(&dump_data, user_buf, count)) 334 return -EFAULT; 335 336 data_size = count - offsetof(struct devcoredump_test_data, data); 337 skb = alloc_skb(data_size, GFP_ATOMIC); 338 if (!skb) 339 return -ENOMEM; 340 skb_put_data(skb, &dump_data.data, data_size); 341 342 hci_devcd_register(hdev, vhci_coredump, vhci_coredump_hdr, NULL); 343 344 /* Force the devcoredump timeout */ 345 if (dump_data.timeout) 346 force_devcd_timeout(hdev, dump_data.timeout); 347 348 ret = hci_devcd_init(hdev, skb->len); 349 if (ret) { 350 BT_ERR("Failed to generate devcoredump"); 351 kfree_skb(skb); 352 return ret; 353 } 354 355 hci_devcd_append(hdev, skb); 356 357 switch (dump_data.state) { 358 case HCI_DEVCOREDUMP_DONE: 359 hci_devcd_complete(hdev); 360 break; 361 case HCI_DEVCOREDUMP_ABORT: 362 hci_devcd_abort(hdev); 363 break; 364 case HCI_DEVCOREDUMP_TIMEOUT: 365 /* Do nothing */ 366 break; 367 default: 368 return -EINVAL; 369 } 370 371 return count; 372 } 373 374 static const struct file_operations force_devcoredump_fops = { 375 .open = simple_open, 376 .write = force_devcd_write, 377 }; 378 379 static int __vhci_create_device(struct vhci_data *data, __u8 opcode) 380 { 381 struct hci_dev *hdev; 382 struct sk_buff *skb; 383 __u8 dev_type; 384 385 if (data->hdev) 386 return -EBADFD; 387 388 /* bits 0-1 are dev_type (Primary or AMP) */ 389 dev_type = opcode & 0x03; 390 391 if (dev_type != HCI_PRIMARY && dev_type != HCI_AMP) 392 return -EINVAL; 393 394 /* bits 2-5 are reserved (must be zero) */ 395 if (opcode & 0x3c) 396 return -EINVAL; 397 398 skb = bt_skb_alloc(4, GFP_KERNEL); 399 if (!skb) 400 return -ENOMEM; 401 402 hdev = hci_alloc_dev(); 403 if (!hdev) { 404 kfree_skb(skb); 405 return -ENOMEM; 406 } 407 408 data->hdev = hdev; 409 410 hdev->bus = HCI_VIRTUAL; 411 hdev->dev_type = dev_type; 412 hci_set_drvdata(hdev, data); 413 414 hdev->open = vhci_open_dev; 415 hdev->close = vhci_close_dev; 416 hdev->flush = vhci_flush; 417 hdev->send = vhci_send_frame; 418 hdev->get_data_path_id = vhci_get_data_path_id; 419 hdev->get_codec_config_data = vhci_get_codec_config_data; 420 hdev->wakeup = vhci_wakeup; 421 hdev->setup = vhci_setup; 422 set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); 423 424 /* bit 6 is for external configuration */ 425 if (opcode & 0x40) 426 set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks); 427 428 /* bit 7 is for raw device */ 429 if (opcode & 0x80) 430 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 431 432 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); 433 434 if (hci_register_dev(hdev) < 0) { 435 BT_ERR("Can't register HCI device"); 436 hci_free_dev(hdev); 437 data->hdev = NULL; 438 kfree_skb(skb); 439 return -EBUSY; 440 } 441 442 debugfs_create_file("force_suspend", 0644, hdev->debugfs, data, 443 &force_suspend_fops); 444 445 debugfs_create_file("force_wakeup", 0644, hdev->debugfs, data, 446 &force_wakeup_fops); 447 448 if (IS_ENABLED(CONFIG_BT_MSFTEXT)) 449 debugfs_create_file("msft_opcode", 0644, hdev->debugfs, data, 450 &msft_opcode_fops); 451 452 if (IS_ENABLED(CONFIG_BT_AOSPEXT)) 453 debugfs_create_file("aosp_capable", 0644, hdev->debugfs, data, 454 &aosp_capable_fops); 455 456 debugfs_create_file("force_devcoredump", 0644, hdev->debugfs, data, 457 &force_devcoredump_fops); 458 459 hci_skb_pkt_type(skb) = HCI_VENDOR_PKT; 460 461 skb_put_u8(skb, 0xff); 462 skb_put_u8(skb, opcode); 463 put_unaligned_le16(hdev->id, skb_put(skb, 2)); 464 skb_queue_tail(&data->readq, skb); 465 466 wake_up_interruptible(&data->read_wait); 467 return 0; 468 } 469 470 static int vhci_create_device(struct vhci_data *data, __u8 opcode) 471 { 472 int err; 473 474 mutex_lock(&data->open_mutex); 475 err = __vhci_create_device(data, opcode); 476 mutex_unlock(&data->open_mutex); 477 478 return err; 479 } 480 481 static inline ssize_t vhci_get_user(struct vhci_data *data, 482 struct iov_iter *from) 483 { 484 size_t len = iov_iter_count(from); 485 struct sk_buff *skb; 486 __u8 pkt_type, opcode; 487 int ret; 488 489 if (len < 2 || len > HCI_MAX_FRAME_SIZE) 490 return -EINVAL; 491 492 skb = bt_skb_alloc(len, GFP_KERNEL); 493 if (!skb) 494 return -ENOMEM; 495 496 if (!copy_from_iter_full(skb_put(skb, len), len, from)) { 497 kfree_skb(skb); 498 return -EFAULT; 499 } 500 501 pkt_type = *((__u8 *) skb->data); 502 skb_pull(skb, 1); 503 504 switch (pkt_type) { 505 case HCI_EVENT_PKT: 506 case HCI_ACLDATA_PKT: 507 case HCI_SCODATA_PKT: 508 case HCI_ISODATA_PKT: 509 if (!data->hdev) { 510 kfree_skb(skb); 511 return -ENODEV; 512 } 513 514 hci_skb_pkt_type(skb) = pkt_type; 515 516 ret = hci_recv_frame(data->hdev, skb); 517 break; 518 519 case HCI_VENDOR_PKT: 520 cancel_delayed_work_sync(&data->open_timeout); 521 522 opcode = *((__u8 *) skb->data); 523 skb_pull(skb, 1); 524 525 if (skb->len > 0) { 526 kfree_skb(skb); 527 return -EINVAL; 528 } 529 530 kfree_skb(skb); 531 532 ret = vhci_create_device(data, opcode); 533 break; 534 535 default: 536 kfree_skb(skb); 537 return -EINVAL; 538 } 539 540 return (ret < 0) ? ret : len; 541 } 542 543 static inline ssize_t vhci_put_user(struct vhci_data *data, 544 struct sk_buff *skb, 545 char __user *buf, int count) 546 { 547 char __user *ptr = buf; 548 int len; 549 550 len = min_t(unsigned int, skb->len, count); 551 552 if (copy_to_user(ptr, skb->data, len)) 553 return -EFAULT; 554 555 if (!data->hdev) 556 return len; 557 558 data->hdev->stat.byte_tx += len; 559 560 switch (hci_skb_pkt_type(skb)) { 561 case HCI_COMMAND_PKT: 562 data->hdev->stat.cmd_tx++; 563 break; 564 case HCI_ACLDATA_PKT: 565 data->hdev->stat.acl_tx++; 566 break; 567 case HCI_SCODATA_PKT: 568 data->hdev->stat.sco_tx++; 569 break; 570 } 571 572 return len; 573 } 574 575 static ssize_t vhci_read(struct file *file, 576 char __user *buf, size_t count, loff_t *pos) 577 { 578 struct vhci_data *data = file->private_data; 579 struct sk_buff *skb; 580 ssize_t ret = 0; 581 582 while (count) { 583 skb = skb_dequeue(&data->readq); 584 if (skb) { 585 ret = vhci_put_user(data, skb, buf, count); 586 if (ret < 0) 587 skb_queue_head(&data->readq, skb); 588 else 589 kfree_skb(skb); 590 break; 591 } 592 593 if (file->f_flags & O_NONBLOCK) { 594 ret = -EAGAIN; 595 break; 596 } 597 598 ret = wait_event_interruptible(data->read_wait, 599 !skb_queue_empty(&data->readq)); 600 if (ret < 0) 601 break; 602 } 603 604 return ret; 605 } 606 607 static ssize_t vhci_write(struct kiocb *iocb, struct iov_iter *from) 608 { 609 struct file *file = iocb->ki_filp; 610 struct vhci_data *data = file->private_data; 611 612 return vhci_get_user(data, from); 613 } 614 615 static __poll_t vhci_poll(struct file *file, poll_table *wait) 616 { 617 struct vhci_data *data = file->private_data; 618 619 poll_wait(file, &data->read_wait, wait); 620 621 if (!skb_queue_empty(&data->readq)) 622 return EPOLLIN | EPOLLRDNORM; 623 624 return EPOLLOUT | EPOLLWRNORM; 625 } 626 627 static void vhci_open_timeout(struct work_struct *work) 628 { 629 struct vhci_data *data = container_of(work, struct vhci_data, 630 open_timeout.work); 631 632 vhci_create_device(data, amp ? HCI_AMP : HCI_PRIMARY); 633 } 634 635 static int vhci_open(struct inode *inode, struct file *file) 636 { 637 struct vhci_data *data; 638 639 data = kzalloc(sizeof(struct vhci_data), GFP_KERNEL); 640 if (!data) 641 return -ENOMEM; 642 643 skb_queue_head_init(&data->readq); 644 init_waitqueue_head(&data->read_wait); 645 646 mutex_init(&data->open_mutex); 647 INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout); 648 INIT_WORK(&data->suspend_work, vhci_suspend_work); 649 650 file->private_data = data; 651 nonseekable_open(inode, file); 652 653 schedule_delayed_work(&data->open_timeout, msecs_to_jiffies(1000)); 654 655 return 0; 656 } 657 658 static int vhci_release(struct inode *inode, struct file *file) 659 { 660 struct vhci_data *data = file->private_data; 661 struct hci_dev *hdev; 662 663 cancel_delayed_work_sync(&data->open_timeout); 664 flush_work(&data->suspend_work); 665 666 hdev = data->hdev; 667 668 if (hdev) { 669 hci_unregister_dev(hdev); 670 hci_free_dev(hdev); 671 } 672 673 skb_queue_purge(&data->readq); 674 file->private_data = NULL; 675 kfree(data); 676 677 return 0; 678 } 679 680 static const struct file_operations vhci_fops = { 681 .owner = THIS_MODULE, 682 .read = vhci_read, 683 .write_iter = vhci_write, 684 .poll = vhci_poll, 685 .open = vhci_open, 686 .release = vhci_release, 687 .llseek = no_llseek, 688 }; 689 690 static struct miscdevice vhci_miscdev = { 691 .name = "vhci", 692 .fops = &vhci_fops, 693 .minor = VHCI_MINOR, 694 }; 695 module_misc_device(vhci_miscdev); 696 697 module_param(amp, bool, 0644); 698 MODULE_PARM_DESC(amp, "Create AMP controller device"); 699 700 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 701 MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION); 702 MODULE_VERSION(VERSION); 703 MODULE_LICENSE("GPL"); 704 MODULE_ALIAS("devname:vhci"); 705 MODULE_ALIAS_MISCDEV(VHCI_MINOR); 706