drivers/bluetooth/hci_vhci.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Bluetooth virtual HCI driver
   5  *
   6  *  Copyright (C) 2000-2001  Qualcomm Incorporated
   7  *  Copyright (C) 2002-2003  Maxim Krasnyansky <maxk@qualcomm.com>
   8  *  Copyright (C) 2004-2006  Marcel Holtmann <marcel@holtmann.org>
   9  */
  10
  11 #include <linux/module.h>
  12 #include <asm/unaligned.h>
  13
  14 #include <linux/kernel.h>
  15 #include <linux/init.h>
  16 #include <linux/slab.h>
  17 #include <linux/types.h>
  18 #include <linux/errno.h>
  19 #include <linux/sched.h>
  20 #include <linux/poll.h>
  21
  22 #include <linux/skbuff.h>
  23 #include <linux/miscdevice.h>
  24 #include <linux/debugfs.h>
  25
  26 #include <net/bluetooth/bluetooth.h>
  27 #include <net/bluetooth/hci_core.h>
  28
  29 #define VERSION "1.5"
  30
  31 static bool amp;
  32
  33 struct vhci_data {
  34         struct hci_dev *hdev;
  35
  36         wait_queue_head_t read_wait;
  37         struct sk_buff_head readq;
  38
  39         struct mutex open_mutex;
  40         struct delayed_work open_timeout;
  41         struct work_struct suspend_work;
  42
  43         bool suspended;
  44         bool wakeup;
  45         __u16 msft_opcode;
  46         bool aosp_capable;
  47 };
  48
  49 static int vhci_open_dev(struct hci_dev *hdev)
  50 {
  51         return 0;
  52 }
  53
  54 static int vhci_close_dev(struct hci_dev *hdev)
  55 {
  56         struct vhci_data *data = hci_get_drvdata(hdev);
  57
  58         skb_queue_purge(&data->readq);
  59
  60         return 0;
  61 }
  62
  63 static int vhci_flush(struct hci_dev *hdev)
  64 {
  65         struct vhci_data *data = hci_get_drvdata(hdev);
  66
  67         skb_queue_purge(&data->readq);
  68
  69         return 0;
  70 }
  71
  72 static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
  73 {
  74         struct vhci_data *data = hci_get_drvdata(hdev);
  75
  76         memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
  77         skb_queue_tail(&data->readq, skb);
  78
  79         wake_up_interruptible(&data->read_wait);
  80         return 0;
  81 }
  82
  83 static int vhci_get_data_path_id(struct hci_dev *hdev, u8 *data_path_id)
  84 {
  85         *data_path_id = 0;
  86         return 0;
  87 }
  88
  89 static int vhci_get_codec_config_data(struct hci_dev *hdev, __u8 type,
  90                                       struct bt_codec *codec, __u8 *vnd_len,
  91                                       __u8 **vnd_data)
  92 {
  93         if (type != ESCO_LINK)
  94                 return -EINVAL;
  95
  96         *vnd_len = 0;
  97         *vnd_data = NULL;
  98         return 0;
  99 }
 100
 101 static bool vhci_wakeup(struct hci_dev *hdev)
 102 {
 103         struct vhci_data *data = hci_get_drvdata(hdev);
 104
 105         return data->wakeup;
 106 }
 107
 108 static ssize_t force_suspend_read(struct file *file, char __user *user_buf,
 109                                   size_t count, loff_t *ppos)
 110 {
 111         struct vhci_data *data = file->private_data;
 112         char buf[3];
 113
 114         buf[0] = data->suspended ? 'Y' : 'N';
 115         buf[1] = '\n';
 116         buf[2] = '\0';
 117         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 118 }
 119
 120 static void vhci_suspend_work(struct work_struct *work)
 121 {
 122         struct vhci_data *data = container_of(work, struct vhci_data,
 123                                               suspend_work);
 124
 125         if (data->suspended)
 126                 hci_suspend_dev(data->hdev);
 127         else
 128                 hci_resume_dev(data->hdev);
 129 }
 130
 131 static ssize_t force_suspend_write(struct file *file,
 132                                    const char __user *user_buf,
 133                                    size_t count, loff_t *ppos)
 134 {
 135         struct vhci_data *data = file->private_data;
 136         bool enable;
 137         int err;
 138
 139         err = kstrtobool_from_user(user_buf, count, &enable);
 140         if (err)
 141                 return err;
 142
 143         if (data->suspended == enable)
 144                 return -EALREADY;
 145
 146         data->suspended = enable;
 147
 148         schedule_work(&data->suspend_work);
 149
 150         return count;
 151 }
 152
 153 static const struct file_operations force_suspend_fops = {
 154         .open           = simple_open,
 155         .read           = force_suspend_read,
 156         .write          = force_suspend_write,
 157         .llseek         = default_llseek,
 158 };
 159
 160 static ssize_t force_wakeup_read(struct file *file, char __user *user_buf,
 161                                  size_t count, loff_t *ppos)
 162 {
 163         struct vhci_data *data = file->private_data;
 164         char buf[3];
 165
 166         buf[0] = data->wakeup ? 'Y' : 'N';
 167         buf[1] = '\n';
 168         buf[2] = '\0';
 169         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 170 }
 171
 172 static ssize_t force_wakeup_write(struct file *file,
 173                                   const char __user *user_buf, size_t count,
 174                                   loff_t *ppos)
 175 {
 176         struct vhci_data *data = file->private_data;
 177         bool enable;
 178         int err;
 179
 180         err = kstrtobool_from_user(user_buf, count, &enable);
 181         if (err)
 182                 return err;
 183
 184         if (data->wakeup == enable)
 185                 return -EALREADY;
 186
 187         data->wakeup = enable;
 188
 189         return count;
 190 }
 191
 192 static const struct file_operations force_wakeup_fops = {
 193         .open           = simple_open,
 194         .read           = force_wakeup_read,
 195         .write          = force_wakeup_write,
 196         .llseek         = default_llseek,
 197 };
 198
 199 static int msft_opcode_set(void *data, u64 val)
 200 {
 201         struct vhci_data *vhci = data;
 202
 203         if (val > 0xffff || hci_opcode_ogf(val) != 0x3f)
 204                 return -EINVAL;
 205
 206         if (vhci->msft_opcode)
 207                 return -EALREADY;
 208
 209         vhci->msft_opcode = val;
 210
 211         return 0;
 212 }
 213
 214 static int msft_opcode_get(void *data, u64 *val)
 215 {
 216         struct vhci_data *vhci = data;
 217
 218         *val = vhci->msft_opcode;
 219
 220         return 0;
 221 }
 222
 223 DEFINE_DEBUGFS_ATTRIBUTE(msft_opcode_fops, msft_opcode_get, msft_opcode_set,
 224                          "%llu\n");
 225
 226 static ssize_t aosp_capable_read(struct file *file, char __user *user_buf,
 227                                  size_t count, loff_t *ppos)
 228 {
 229         struct vhci_data *vhci = file->private_data;
 230         char buf[3];
 231
 232         buf[0] = vhci->aosp_capable ? 'Y' : 'N';
 233         buf[1] = '\n';
 234         buf[2] = '\0';
 235         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 236 }
 237
 238 static ssize_t aosp_capable_write(struct file *file,
 239                                   const char __user *user_buf, size_t count,
 240                                   loff_t *ppos)
 241 {
 242         struct vhci_data *vhci = file->private_data;
 243         bool enable;
 244         int err;
 245
 246         err = kstrtobool_from_user(user_buf, count, &enable);
 247         if (err)
 248                 return err;
 249
 250         if (!enable)
 251                 return -EINVAL;
 252
 253         if (vhci->aosp_capable)
 254                 return -EALREADY;
 255
 256         vhci->aosp_capable = enable;
 257
 258         return count;
 259 }
 260
 261 static const struct file_operations aosp_capable_fops = {
 262         .open           = simple_open,
 263         .read           = aosp_capable_read,
 264         .write          = aosp_capable_write,
 265         .llseek         = default_llseek,
 266 };
 267
 268 static int vhci_setup(struct hci_dev *hdev)
 269 {
 270         struct vhci_data *vhci = hci_get_drvdata(hdev);
 271
 272         if (vhci->msft_opcode)
 273                 hci_set_msft_opcode(hdev, vhci->msft_opcode);
 274
 275         if (vhci->aosp_capable)
 276                 hci_set_aosp_capable(hdev);
 277
 278         return 0;
 279 }
 280
 281 static void vhci_coredump(struct hci_dev *hdev)
 282 {
 283         /* No need to do anything */
 284 }
 285
 286 static void vhci_coredump_hdr(struct hci_dev *hdev, struct sk_buff *skb)
 287 {
 288         char buf[80];
 289
 290         snprintf(buf, sizeof(buf), "Controller Name: vhci_ctrl\n");
 291         skb_put_data(skb, buf, strlen(buf));
 292
 293         snprintf(buf, sizeof(buf), "Firmware Version: vhci_fw\n");
 294         skb_put_data(skb, buf, strlen(buf));
 295
 296         snprintf(buf, sizeof(buf), "Driver: vhci_drv\n");
 297         skb_put_data(skb, buf, strlen(buf));
 298
 299         snprintf(buf, sizeof(buf), "Vendor: vhci\n");
 300         skb_put_data(skb, buf, strlen(buf));
 301 }
 302
 303 #define MAX_COREDUMP_LINE_LEN   40
 304
 305 struct devcoredump_test_data {
 306         enum devcoredump_state state;
 307         unsigned int timeout;
 308         char data[MAX_COREDUMP_LINE_LEN];
 309 };
 310
 311 static inline void force_devcd_timeout(struct hci_dev *hdev,
 312                                        unsigned int timeout)
 313 {
 314 #ifdef CONFIG_DEV_COREDUMP
 315         hdev->dump.timeout = msecs_to_jiffies(timeout * 1000);
 316 #endif
 317 }
 318
 319 static ssize_t force_devcd_write(struct file *file, const char __user *user_buf,
 320                                  size_t count, loff_t *ppos)
 321 {
 322         struct vhci_data *data = file->private_data;
 323         struct hci_dev *hdev = data->hdev;
 324         struct sk_buff *skb = NULL;
 325         struct devcoredump_test_data dump_data;
 326         size_t data_size;
 327         int ret;
 328
 329         if (count < offsetof(struct devcoredump_test_data, data) ||
 330             count > sizeof(dump_data))
 331                 return -EINVAL;
 332
 333         if (copy_from_user(&dump_data, user_buf, count))
 334                 return -EFAULT;
 335
 336         data_size = count - offsetof(struct devcoredump_test_data, data);
 337         skb = alloc_skb(data_size, GFP_ATOMIC);
 338         if (!skb)
 339                 return -ENOMEM;
 340         skb_put_data(skb, &dump_data.data, data_size);
 341
 342         hci_devcd_register(hdev, vhci_coredump, vhci_coredump_hdr, NULL);
 343
 344         /* Force the devcoredump timeout */
 345         if (dump_data.timeout)
 346                 force_devcd_timeout(hdev, dump_data.timeout);
 347
 348         ret = hci_devcd_init(hdev, skb->len);
 349         if (ret) {
 350                 BT_ERR("Failed to generate devcoredump");
 351                 kfree_skb(skb);
 352                 return ret;
 353         }
 354
 355         hci_devcd_append(hdev, skb);
 356
 357         switch (dump_data.state) {
 358         case HCI_DEVCOREDUMP_DONE:
 359                 hci_devcd_complete(hdev);
 360                 break;
 361         case HCI_DEVCOREDUMP_ABORT:
 362                 hci_devcd_abort(hdev);
 363                 break;
 364         case HCI_DEVCOREDUMP_TIMEOUT:
 365                 /* Do nothing */
 366                 break;
 367         default:
 368                 return -EINVAL;
 369         }
 370
 371         return count;
 372 }
 373
 374 static const struct file_operations force_devcoredump_fops = {
 375         .open           = simple_open,
 376         .write          = force_devcd_write,
 377 };
 378
 379 static int __vhci_create_device(struct vhci_data *data, __u8 opcode)
 380 {
 381         struct hci_dev *hdev;
 382         struct sk_buff *skb;
 383         __u8 dev_type;
 384
 385         if (data->hdev)
 386                 return -EBADFD;
 387
 388         /* bits 0-1 are dev_type (Primary or AMP) */
 389         dev_type = opcode & 0x03;
 390
 391         if (dev_type != HCI_PRIMARY && dev_type != HCI_AMP)
 392                 return -EINVAL;
 393
 394         /* bits 2-5 are reserved (must be zero) */
 395         if (opcode & 0x3c)
 396                 return -EINVAL;
 397
 398         skb = bt_skb_alloc(4, GFP_KERNEL);
 399         if (!skb)
 400                 return -ENOMEM;
 401
 402         hdev = hci_alloc_dev();
 403         if (!hdev) {
 404                 kfree_skb(skb);
 405                 return -ENOMEM;
 406         }
 407
 408         data->hdev = hdev;
 409
 410         hdev->bus = HCI_VIRTUAL;
 411         hdev->dev_type = dev_type;
 412         hci_set_drvdata(hdev, data);
 413
 414         hdev->open  = vhci_open_dev;
 415         hdev->close = vhci_close_dev;
 416         hdev->flush = vhci_flush;
 417         hdev->send  = vhci_send_frame;
 418         hdev->get_data_path_id = vhci_get_data_path_id;
 419         hdev->get_codec_config_data = vhci_get_codec_config_data;
 420         hdev->wakeup = vhci_wakeup;
 421         hdev->setup = vhci_setup;
 422         set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
 423
 424         /* bit 6 is for external configuration */
 425         if (opcode & 0x40)
 426                 set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks);
 427
 428         /* bit 7 is for raw device */
 429         if (opcode & 0x80)
 430                 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
 431
 432         set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
 433
 434         if (hci_register_dev(hdev) < 0) {
 435                 BT_ERR("Can't register HCI device");
 436                 hci_free_dev(hdev);
 437                 data->hdev = NULL;
 438                 kfree_skb(skb);
 439                 return -EBUSY;
 440         }
 441
 442         debugfs_create_file("force_suspend", 0644, hdev->debugfs, data,
 443                             &force_suspend_fops);
 444
 445         debugfs_create_file("force_wakeup", 0644, hdev->debugfs, data,
 446                             &force_wakeup_fops);
 447
 448         if (IS_ENABLED(CONFIG_BT_MSFTEXT))
 449                 debugfs_create_file("msft_opcode", 0644, hdev->debugfs, data,
 450                                     &msft_opcode_fops);
 451
 452         if (IS_ENABLED(CONFIG_BT_AOSPEXT))
 453                 debugfs_create_file("aosp_capable", 0644, hdev->debugfs, data,
 454                                     &aosp_capable_fops);
 455
 456         debugfs_create_file("force_devcoredump", 0644, hdev->debugfs, data,
 457                             &force_devcoredump_fops);
 458
 459         hci_skb_pkt_type(skb) = HCI_VENDOR_PKT;
 460
 461         skb_put_u8(skb, 0xff);
 462         skb_put_u8(skb, opcode);
 463         put_unaligned_le16(hdev->id, skb_put(skb, 2));
 464         skb_queue_tail(&data->readq, skb);
 465
 466         wake_up_interruptible(&data->read_wait);
 467         return 0;
 468 }
 469
 470 static int vhci_create_device(struct vhci_data *data, __u8 opcode)
 471 {
 472         int err;
 473
 474         mutex_lock(&data->open_mutex);
 475         err = __vhci_create_device(data, opcode);
 476         mutex_unlock(&data->open_mutex);
 477
 478         return err;
 479 }
 480
 481 static inline ssize_t vhci_get_user(struct vhci_data *data,
 482                                     struct iov_iter *from)
 483 {
 484         size_t len = iov_iter_count(from);
 485         struct sk_buff *skb;
 486         __u8 pkt_type, opcode;
 487         int ret;
 488
 489         if (len < 2 || len > HCI_MAX_FRAME_SIZE)
 490                 return -EINVAL;
 491
 492         skb = bt_skb_alloc(len, GFP_KERNEL);
 493         if (!skb)
 494                 return -ENOMEM;
 495
 496         if (!copy_from_iter_full(skb_put(skb, len), len, from)) {
 497                 kfree_skb(skb);
 498                 return -EFAULT;
 499         }
 500
 501         pkt_type = *((__u8 *) skb->data);
 502         skb_pull(skb, 1);
 503
 504         switch (pkt_type) {
 505         case HCI_EVENT_PKT:
 506         case HCI_ACLDATA_PKT:
 507         case HCI_SCODATA_PKT:
 508         case HCI_ISODATA_PKT:
 509                 if (!data->hdev) {
 510                         kfree_skb(skb);
 511                         return -ENODEV;
 512                 }
 513
 514                 hci_skb_pkt_type(skb) = pkt_type;
 515
 516                 ret = hci_recv_frame(data->hdev, skb);
 517                 break;
 518
 519         case HCI_VENDOR_PKT:
 520                 cancel_delayed_work_sync(&data->open_timeout);
 521
 522                 opcode = *((__u8 *) skb->data);
 523                 skb_pull(skb, 1);
 524
 525                 if (skb->len > 0) {
 526                         kfree_skb(skb);
 527                         return -EINVAL;
 528                 }
 529
 530                 kfree_skb(skb);
 531
 532                 ret = vhci_create_device(data, opcode);
 533                 break;
 534
 535         default:
 536                 kfree_skb(skb);
 537                 return -EINVAL;
 538         }
 539
 540         return (ret < 0) ? ret : len;
 541 }
 542
 543 static inline ssize_t vhci_put_user(struct vhci_data *data,
 544                                     struct sk_buff *skb,
 545                                     char __user *buf, int count)
 546 {
 547         char __user *ptr = buf;
 548         int len;
 549
 550         len = min_t(unsigned int, skb->len, count);
 551
 552         if (copy_to_user(ptr, skb->data, len))
 553                 return -EFAULT;
 554
 555         if (!data->hdev)
 556                 return len;
 557
 558         data->hdev->stat.byte_tx += len;
 559
 560         switch (hci_skb_pkt_type(skb)) {
 561         case HCI_COMMAND_PKT:
 562                 data->hdev->stat.cmd_tx++;
 563                 break;
 564         case HCI_ACLDATA_PKT:
 565                 data->hdev->stat.acl_tx++;
 566                 break;
 567         case HCI_SCODATA_PKT:
 568                 data->hdev->stat.sco_tx++;
 569                 break;
 570         }
 571
 572         return len;
 573 }
 574
 575 static ssize_t vhci_read(struct file *file,
 576                          char __user *buf, size_t count, loff_t *pos)
 577 {
 578         struct vhci_data *data = file->private_data;
 579         struct sk_buff *skb;
 580         ssize_t ret = 0;
 581
 582         while (count) {
 583                 skb = skb_dequeue(&data->readq);
 584                 if (skb) {
 585                         ret = vhci_put_user(data, skb, buf, count);
 586                         if (ret < 0)
 587                                 skb_queue_head(&data->readq, skb);
 588                         else
 589                                 kfree_skb(skb);
 590                         break;
 591                 }
 592
 593                 if (file->f_flags & O_NONBLOCK) {
 594                         ret = -EAGAIN;
 595                         break;
 596                 }
 597
 598                 ret = wait_event_interruptible(data->read_wait,
 599                                                !skb_queue_empty(&data->readq));
 600                 if (ret < 0)
 601                         break;
 602         }
 603
 604         return ret;
 605 }
 606
 607 static ssize_t vhci_write(struct kiocb *iocb, struct iov_iter *from)
 608 {
 609         struct file *file = iocb->ki_filp;
 610         struct vhci_data *data = file->private_data;
 611
 612         return vhci_get_user(data, from);
 613 }
 614
 615 static __poll_t vhci_poll(struct file *file, poll_table *wait)
 616 {
 617         struct vhci_data *data = file->private_data;
 618
 619         poll_wait(file, &data->read_wait, wait);
 620
 621         if (!skb_queue_empty(&data->readq))
 622                 return EPOLLIN | EPOLLRDNORM;
 623
 624         return EPOLLOUT | EPOLLWRNORM;
 625 }
 626
 627 static void vhci_open_timeout(struct work_struct *work)
 628 {
 629         struct vhci_data *data = container_of(work, struct vhci_data,
 630                                               open_timeout.work);
 631
 632         vhci_create_device(data, amp ? HCI_AMP : HCI_PRIMARY);
 633 }
 634
 635 static int vhci_open(struct inode *inode, struct file *file)
 636 {
 637         struct vhci_data *data;
 638
 639         data = kzalloc(sizeof(struct vhci_data), GFP_KERNEL);
 640         if (!data)
 641                 return -ENOMEM;
 642
 643         skb_queue_head_init(&data->readq);
 644         init_waitqueue_head(&data->read_wait);
 645
 646         mutex_init(&data->open_mutex);
 647         INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout);
 648         INIT_WORK(&data->suspend_work, vhci_suspend_work);
 649
 650         file->private_data = data;
 651         nonseekable_open(inode, file);
 652
 653         schedule_delayed_work(&data->open_timeout, msecs_to_jiffies(1000));
 654
 655         return 0;
 656 }
 657
 658 static int vhci_release(struct inode *inode, struct file *file)
 659 {
 660         struct vhci_data *data = file->private_data;
 661         struct hci_dev *hdev;
 662
 663         cancel_delayed_work_sync(&data->open_timeout);
 664         flush_work(&data->suspend_work);
 665
 666         hdev = data->hdev;
 667
 668         if (hdev) {
 669                 hci_unregister_dev(hdev);
 670                 hci_free_dev(hdev);
 671         }
 672
 673         skb_queue_purge(&data->readq);
 674         file->private_data = NULL;
 675         kfree(data);
 676
 677         return 0;
 678 }
 679
 680 static const struct file_operations vhci_fops = {
 681         .owner          = THIS_MODULE,
 682         .read           = vhci_read,
 683         .write_iter     = vhci_write,
 684         .poll           = vhci_poll,
 685         .open           = vhci_open,
 686         .release        = vhci_release,
 687         .llseek         = no_llseek,
 688 };
 689
 690 static struct miscdevice vhci_miscdev = {
 691         .name   = "vhci",
 692         .fops   = &vhci_fops,
 693         .minor  = VHCI_MINOR,
 694 };
 695 module_misc_device(vhci_miscdev);
 696
 697 module_param(amp, bool, 0644);
 698 MODULE_PARM_DESC(amp, "Create AMP controller device");
 699
 700 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 701 MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION);
 702 MODULE_VERSION(VERSION);
 703 MODULE_LICENSE("GPL");
 704 MODULE_ALIAS("devname:vhci");
 705 MODULE_ALIAS_MISCDEV(VHCI_MINOR);