drivers/bluetooth/hci_vhci.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Bluetooth virtual HCI driver
   5  *
   6  *  Copyright (C) 2000-2001  Qualcomm Incorporated
   7  *  Copyright (C) 2002-2003  Maxim Krasnyansky <maxk@qualcomm.com>
   8  *  Copyright (C) 2004-2006  Marcel Holtmann <marcel@holtmann.org>
   9  */
  10
  11 #include <linux/module.h>
  12 #include <linux/unaligned.h>
  13
  14 #include <linux/atomic.h>
  15 #include <linux/kernel.h>
  16 #include <linux/init.h>
  17 #include <linux/slab.h>
  18 #include <linux/types.h>
  19 #include <linux/errno.h>
  20 #include <linux/sched.h>
  21 #include <linux/poll.h>
  22
  23 #include <linux/skbuff.h>
  24 #include <linux/miscdevice.h>
  25 #include <linux/debugfs.h>
  26
  27 #include <net/bluetooth/bluetooth.h>
  28 #include <net/bluetooth/hci_core.h>
  29
  30 #define VERSION "1.5"
  31
  32 static bool amp;
  33
  34 struct vhci_data {
  35         struct hci_dev *hdev;
  36
  37         wait_queue_head_t read_wait;
  38         struct sk_buff_head readq;
  39
  40         struct mutex open_mutex;
  41         struct delayed_work open_timeout;
  42         struct work_struct suspend_work;
  43
  44         bool suspended;
  45         bool wakeup;
  46         __u16 msft_opcode;
  47         bool aosp_capable;
  48         atomic_t initialized;
  49 };
  50
  51 static int vhci_open_dev(struct hci_dev *hdev)
  52 {
  53         return 0;
  54 }
  55
  56 static int vhci_close_dev(struct hci_dev *hdev)
  57 {
  58         struct vhci_data *data = hci_get_drvdata(hdev);
  59
  60         skb_queue_purge(&data->readq);
  61
  62         return 0;
  63 }
  64
  65 static int vhci_flush(struct hci_dev *hdev)
  66 {
  67         struct vhci_data *data = hci_get_drvdata(hdev);
  68
  69         skb_queue_purge(&data->readq);
  70
  71         return 0;
  72 }
  73
  74 static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
  75 {
  76         struct vhci_data *data = hci_get_drvdata(hdev);
  77
  78         memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
  79
  80         skb_queue_tail(&data->readq, skb);
  81
  82         if (atomic_read(&data->initialized))
  83                 wake_up_interruptible(&data->read_wait);
  84         return 0;
  85 }
  86
  87 static int vhci_get_data_path_id(struct hci_dev *hdev, u8 *data_path_id)
  88 {
  89         *data_path_id = 0;
  90         return 0;
  91 }
  92
  93 static int vhci_get_codec_config_data(struct hci_dev *hdev, __u8 type,
  94                                       struct bt_codec *codec, __u8 *vnd_len,
  95                                       __u8 **vnd_data)
  96 {
  97         if (type != ESCO_LINK)
  98                 return -EINVAL;
  99
 100         *vnd_len = 0;
 101         *vnd_data = NULL;
 102         return 0;
 103 }
 104
 105 static bool vhci_wakeup(struct hci_dev *hdev)
 106 {
 107         struct vhci_data *data = hci_get_drvdata(hdev);
 108
 109         return data->wakeup;
 110 }
 111
 112 static ssize_t force_suspend_read(struct file *file, char __user *user_buf,
 113                                   size_t count, loff_t *ppos)
 114 {
 115         struct vhci_data *data = file->private_data;
 116         char buf[3];
 117
 118         buf[0] = data->suspended ? 'Y' : 'N';
 119         buf[1] = '\n';
 120         buf[2] = '\0';
 121         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 122 }
 123
 124 static void vhci_suspend_work(struct work_struct *work)
 125 {
 126         struct vhci_data *data = container_of(work, struct vhci_data,
 127                                               suspend_work);
 128
 129         if (data->suspended)
 130                 hci_suspend_dev(data->hdev);
 131         else
 132                 hci_resume_dev(data->hdev);
 133 }
 134
 135 static ssize_t force_suspend_write(struct file *file,
 136                                    const char __user *user_buf,
 137                                    size_t count, loff_t *ppos)
 138 {
 139         struct vhci_data *data = file->private_data;
 140         bool enable;
 141         int err;
 142
 143         err = kstrtobool_from_user(user_buf, count, &enable);
 144         if (err)
 145                 return err;
 146
 147         if (data->suspended == enable)
 148                 return -EALREADY;
 149
 150         data->suspended = enable;
 151
 152         schedule_work(&data->suspend_work);
 153
 154         return count;
 155 }
 156
 157 static const struct file_operations force_suspend_fops = {
 158         .open           = simple_open,
 159         .read           = force_suspend_read,
 160         .write          = force_suspend_write,
 161         .llseek         = default_llseek,
 162 };
 163
 164 static ssize_t force_wakeup_read(struct file *file, char __user *user_buf,
 165                                  size_t count, loff_t *ppos)
 166 {
 167         struct vhci_data *data = file->private_data;
 168         char buf[3];
 169
 170         buf[0] = data->wakeup ? 'Y' : 'N';
 171         buf[1] = '\n';
 172         buf[2] = '\0';
 173         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 174 }
 175
 176 static ssize_t force_wakeup_write(struct file *file,
 177                                   const char __user *user_buf, size_t count,
 178                                   loff_t *ppos)
 179 {
 180         struct vhci_data *data = file->private_data;
 181         bool enable;
 182         int err;
 183
 184         err = kstrtobool_from_user(user_buf, count, &enable);
 185         if (err)
 186                 return err;
 187
 188         if (data->wakeup == enable)
 189                 return -EALREADY;
 190
 191         data->wakeup = enable;
 192
 193         return count;
 194 }
 195
 196 static const struct file_operations force_wakeup_fops = {
 197         .open           = simple_open,
 198         .read           = force_wakeup_read,
 199         .write          = force_wakeup_write,
 200         .llseek         = default_llseek,
 201 };
 202
 203 static int msft_opcode_set(void *data, u64 val)
 204 {
 205         struct vhci_data *vhci = data;
 206
 207         if (val > 0xffff || hci_opcode_ogf(val) != 0x3f)
 208                 return -EINVAL;
 209
 210         if (vhci->msft_opcode)
 211                 return -EALREADY;
 212
 213         vhci->msft_opcode = val;
 214
 215         return 0;
 216 }
 217
 218 static int msft_opcode_get(void *data, u64 *val)
 219 {
 220         struct vhci_data *vhci = data;
 221
 222         *val = vhci->msft_opcode;
 223
 224         return 0;
 225 }
 226
 227 DEFINE_DEBUGFS_ATTRIBUTE(msft_opcode_fops, msft_opcode_get, msft_opcode_set,
 228                          "%llu\n");
 229
 230 static ssize_t aosp_capable_read(struct file *file, char __user *user_buf,
 231                                  size_t count, loff_t *ppos)
 232 {
 233         struct vhci_data *vhci = file->private_data;
 234         char buf[3];
 235
 236         buf[0] = vhci->aosp_capable ? 'Y' : 'N';
 237         buf[1] = '\n';
 238         buf[2] = '\0';
 239         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 240 }
 241
 242 static ssize_t aosp_capable_write(struct file *file,
 243                                   const char __user *user_buf, size_t count,
 244                                   loff_t *ppos)
 245 {
 246         struct vhci_data *vhci = file->private_data;
 247         bool enable;
 248         int err;
 249
 250         err = kstrtobool_from_user(user_buf, count, &enable);
 251         if (err)
 252                 return err;
 253
 254         if (!enable)
 255                 return -EINVAL;
 256
 257         if (vhci->aosp_capable)
 258                 return -EALREADY;
 259
 260         vhci->aosp_capable = enable;
 261
 262         return count;
 263 }
 264
 265 static const struct file_operations aosp_capable_fops = {
 266         .open           = simple_open,
 267         .read           = aosp_capable_read,
 268         .write          = aosp_capable_write,
 269         .llseek         = default_llseek,
 270 };
 271
 272 static int vhci_setup(struct hci_dev *hdev)
 273 {
 274         struct vhci_data *vhci = hci_get_drvdata(hdev);
 275
 276         if (vhci->msft_opcode)
 277                 hci_set_msft_opcode(hdev, vhci->msft_opcode);
 278
 279         if (vhci->aosp_capable)
 280                 hci_set_aosp_capable(hdev);
 281
 282         return 0;
 283 }
 284
 285 static void vhci_coredump(struct hci_dev *hdev)
 286 {
 287         /* No need to do anything */
 288 }
 289
 290 static void vhci_coredump_hdr(struct hci_dev *hdev, struct sk_buff *skb)
 291 {
 292         char buf[80];
 293
 294         snprintf(buf, sizeof(buf), "Controller Name: vhci_ctrl\n");
 295         skb_put_data(skb, buf, strlen(buf));
 296
 297         snprintf(buf, sizeof(buf), "Firmware Version: vhci_fw\n");
 298         skb_put_data(skb, buf, strlen(buf));
 299
 300         snprintf(buf, sizeof(buf), "Driver: vhci_drv\n");
 301         skb_put_data(skb, buf, strlen(buf));
 302
 303         snprintf(buf, sizeof(buf), "Vendor: vhci\n");
 304         skb_put_data(skb, buf, strlen(buf));
 305 }
 306
 307 #define MAX_COREDUMP_LINE_LEN   40
 308
 309 struct devcoredump_test_data {
 310         enum devcoredump_state state;
 311         unsigned int timeout;
 312         char data[MAX_COREDUMP_LINE_LEN];
 313 };
 314
 315 static inline void force_devcd_timeout(struct hci_dev *hdev,
 316                                        unsigned int timeout)
 317 {
 318 #ifdef CONFIG_DEV_COREDUMP
 319         hdev->dump.timeout = msecs_to_jiffies(timeout * 1000);
 320 #endif
 321 }
 322
 323 static ssize_t force_devcd_write(struct file *file, const char __user *user_buf,
 324                                  size_t count, loff_t *ppos)
 325 {
 326         struct vhci_data *data = file->private_data;
 327         struct hci_dev *hdev = data->hdev;
 328         struct sk_buff *skb = NULL;
 329         struct devcoredump_test_data dump_data;
 330         size_t data_size;
 331         int ret;
 332
 333         if (count < offsetof(struct devcoredump_test_data, data) ||
 334             count > sizeof(dump_data))
 335                 return -EINVAL;
 336
 337         if (copy_from_user(&dump_data, user_buf, count))
 338                 return -EFAULT;
 339
 340         data_size = count - offsetof(struct devcoredump_test_data, data);
 341         skb = alloc_skb(data_size, GFP_ATOMIC);
 342         if (!skb)
 343                 return -ENOMEM;
 344         skb_put_data(skb, &dump_data.data, data_size);
 345
 346         hci_devcd_register(hdev, vhci_coredump, vhci_coredump_hdr, NULL);
 347
 348         /* Force the devcoredump timeout */
 349         if (dump_data.timeout)
 350                 force_devcd_timeout(hdev, dump_data.timeout);
 351
 352         ret = hci_devcd_init(hdev, skb->len);
 353         if (ret) {
 354                 BT_ERR("Failed to generate devcoredump");
 355                 kfree_skb(skb);
 356                 return ret;
 357         }
 358
 359         hci_devcd_append(hdev, skb);
 360
 361         switch (dump_data.state) {
 362         case HCI_DEVCOREDUMP_DONE:
 363                 hci_devcd_complete(hdev);
 364                 break;
 365         case HCI_DEVCOREDUMP_ABORT:
 366                 hci_devcd_abort(hdev);
 367                 break;
 368         case HCI_DEVCOREDUMP_TIMEOUT:
 369                 /* Do nothing */
 370                 break;
 371         default:
 372                 return -EINVAL;
 373         }
 374
 375         return count;
 376 }
 377
 378 static const struct file_operations force_devcoredump_fops = {
 379         .open           = simple_open,
 380         .write          = force_devcd_write,
 381 };
 382
 383 static int __vhci_create_device(struct vhci_data *data, __u8 opcode)
 384 {
 385         struct hci_dev *hdev;
 386         struct sk_buff *skb;
 387
 388         if (data->hdev)
 389                 return -EBADFD;
 390
 391         /* bits 2-5 are reserved (must be zero) */
 392         if (opcode & 0x3c)
 393                 return -EINVAL;
 394
 395         skb = bt_skb_alloc(4, GFP_KERNEL);
 396         if (!skb)
 397                 return -ENOMEM;
 398
 399         hdev = hci_alloc_dev();
 400         if (!hdev) {
 401                 kfree_skb(skb);
 402                 return -ENOMEM;
 403         }
 404
 405         data->hdev = hdev;
 406
 407         hdev->bus = HCI_VIRTUAL;
 408         hci_set_drvdata(hdev, data);
 409
 410         hdev->open  = vhci_open_dev;
 411         hdev->close = vhci_close_dev;
 412         hdev->flush = vhci_flush;
 413         hdev->send  = vhci_send_frame;
 414         hdev->get_data_path_id = vhci_get_data_path_id;
 415         hdev->get_codec_config_data = vhci_get_codec_config_data;
 416         hdev->wakeup = vhci_wakeup;
 417         hdev->setup = vhci_setup;
 418         set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
 419
 420         /* bit 6 is for external configuration */
 421         if (opcode & 0x40)
 422                 set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks);
 423
 424         /* bit 7 is for raw device */
 425         if (opcode & 0x80)
 426                 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
 427
 428         if (hci_register_dev(hdev) < 0) {
 429                 BT_ERR("Can't register HCI device");
 430                 hci_free_dev(hdev);
 431                 data->hdev = NULL;
 432                 kfree_skb(skb);
 433                 return -EBUSY;
 434         }
 435
 436         debugfs_create_file("force_suspend", 0644, hdev->debugfs, data,
 437                             &force_suspend_fops);
 438
 439         debugfs_create_file("force_wakeup", 0644, hdev->debugfs, data,
 440                             &force_wakeup_fops);
 441
 442         if (IS_ENABLED(CONFIG_BT_MSFTEXT))
 443                 debugfs_create_file("msft_opcode", 0644, hdev->debugfs, data,
 444                                     &msft_opcode_fops);
 445
 446         if (IS_ENABLED(CONFIG_BT_AOSPEXT))
 447                 debugfs_create_file("aosp_capable", 0644, hdev->debugfs, data,
 448                                     &aosp_capable_fops);
 449
 450         debugfs_create_file("force_devcoredump", 0644, hdev->debugfs, data,
 451                             &force_devcoredump_fops);
 452
 453         hci_skb_pkt_type(skb) = HCI_VENDOR_PKT;
 454
 455         skb_put_u8(skb, 0xff);
 456         skb_put_u8(skb, opcode);
 457         put_unaligned_le16(hdev->id, skb_put(skb, 2));
 458         skb_queue_head(&data->readq, skb);
 459         atomic_inc(&data->initialized);
 460
 461         wake_up_interruptible(&data->read_wait);
 462         return 0;
 463 }
 464
 465 static int vhci_create_device(struct vhci_data *data, __u8 opcode)
 466 {
 467         int err;
 468
 469         mutex_lock(&data->open_mutex);
 470         err = __vhci_create_device(data, opcode);
 471         mutex_unlock(&data->open_mutex);
 472
 473         return err;
 474 }
 475
 476 static inline ssize_t vhci_get_user(struct vhci_data *data,
 477                                     struct iov_iter *from)
 478 {
 479         size_t len = iov_iter_count(from);
 480         struct sk_buff *skb;
 481         __u8 pkt_type, opcode;
 482         int ret;
 483
 484         if (len < 2 || len > HCI_MAX_FRAME_SIZE)
 485                 return -EINVAL;
 486
 487         skb = bt_skb_alloc(len, GFP_KERNEL);
 488         if (!skb)
 489                 return -ENOMEM;
 490
 491         if (!copy_from_iter_full(skb_put(skb, len), len, from)) {
 492                 kfree_skb(skb);
 493                 return -EFAULT;
 494         }
 495
 496         pkt_type = *((__u8 *) skb->data);
 497         skb_pull(skb, 1);
 498
 499         switch (pkt_type) {
 500         case HCI_EVENT_PKT:
 501         case HCI_ACLDATA_PKT:
 502         case HCI_SCODATA_PKT:
 503         case HCI_ISODATA_PKT:
 504                 if (!data->hdev) {
 505                         kfree_skb(skb);
 506                         return -ENODEV;
 507                 }
 508
 509                 hci_skb_pkt_type(skb) = pkt_type;
 510
 511                 ret = hci_recv_frame(data->hdev, skb);
 512                 break;
 513
 514         case HCI_VENDOR_PKT:
 515                 cancel_delayed_work_sync(&data->open_timeout);
 516
 517                 opcode = *((__u8 *) skb->data);
 518                 skb_pull(skb, 1);
 519
 520                 if (skb->len > 0) {
 521                         kfree_skb(skb);
 522                         return -EINVAL;
 523                 }
 524
 525                 kfree_skb(skb);
 526
 527                 ret = vhci_create_device(data, opcode);
 528                 break;
 529
 530         default:
 531                 kfree_skb(skb);
 532                 return -EINVAL;
 533         }
 534
 535         return (ret < 0) ? ret : len;
 536 }
 537
 538 static inline ssize_t vhci_put_user(struct vhci_data *data,
 539                                     struct sk_buff *skb,
 540                                     char __user *buf, int count)
 541 {
 542         char __user *ptr = buf;
 543         int len;
 544
 545         len = min_t(unsigned int, skb->len, count);
 546
 547         if (copy_to_user(ptr, skb->data, len))
 548                 return -EFAULT;
 549
 550         if (!data->hdev)
 551                 return len;
 552
 553         data->hdev->stat.byte_tx += len;
 554
 555         switch (hci_skb_pkt_type(skb)) {
 556         case HCI_COMMAND_PKT:
 557                 data->hdev->stat.cmd_tx++;
 558                 break;
 559         case HCI_ACLDATA_PKT:
 560                 data->hdev->stat.acl_tx++;
 561                 break;
 562         case HCI_SCODATA_PKT:
 563                 data->hdev->stat.sco_tx++;
 564                 break;
 565         }
 566
 567         return len;
 568 }
 569
 570 static ssize_t vhci_read(struct file *file,
 571                          char __user *buf, size_t count, loff_t *pos)
 572 {
 573         struct vhci_data *data = file->private_data;
 574         struct sk_buff *skb;
 575         ssize_t ret = 0;
 576
 577         while (count) {
 578                 skb = skb_dequeue(&data->readq);
 579                 if (skb) {
 580                         ret = vhci_put_user(data, skb, buf, count);
 581                         if (ret < 0)
 582                                 skb_queue_head(&data->readq, skb);
 583                         else
 584                                 kfree_skb(skb);
 585                         break;
 586                 }
 587
 588                 if (file->f_flags & O_NONBLOCK) {
 589                         ret = -EAGAIN;
 590                         break;
 591                 }
 592
 593                 ret = wait_event_interruptible(data->read_wait,
 594                                                !skb_queue_empty(&data->readq));
 595                 if (ret < 0)
 596                         break;
 597         }
 598
 599         return ret;
 600 }
 601
 602 static ssize_t vhci_write(struct kiocb *iocb, struct iov_iter *from)
 603 {
 604         struct file *file = iocb->ki_filp;
 605         struct vhci_data *data = file->private_data;
 606
 607         return vhci_get_user(data, from);
 608 }
 609
 610 static __poll_t vhci_poll(struct file *file, poll_table *wait)
 611 {
 612         struct vhci_data *data = file->private_data;
 613
 614         poll_wait(file, &data->read_wait, wait);
 615
 616         if (!skb_queue_empty(&data->readq))
 617                 return EPOLLIN | EPOLLRDNORM;
 618
 619         return EPOLLOUT | EPOLLWRNORM;
 620 }
 621
 622 static void vhci_open_timeout(struct work_struct *work)
 623 {
 624         struct vhci_data *data = container_of(work, struct vhci_data,
 625                                               open_timeout.work);
 626
 627         vhci_create_device(data, 0x00);
 628 }
 629
 630 static int vhci_open(struct inode *inode, struct file *file)
 631 {
 632         struct vhci_data *data;
 633
 634         data = kzalloc(sizeof(*data), GFP_KERNEL);
 635         if (!data)
 636                 return -ENOMEM;
 637
 638         skb_queue_head_init(&data->readq);
 639         init_waitqueue_head(&data->read_wait);
 640
 641         mutex_init(&data->open_mutex);
 642         INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout);
 643         INIT_WORK(&data->suspend_work, vhci_suspend_work);
 644
 645         file->private_data = data;
 646         nonseekable_open(inode, file);
 647
 648         schedule_delayed_work(&data->open_timeout, msecs_to_jiffies(1000));
 649
 650         return 0;
 651 }
 652
 653 static int vhci_release(struct inode *inode, struct file *file)
 654 {
 655         struct vhci_data *data = file->private_data;
 656         struct hci_dev *hdev;
 657
 658         cancel_delayed_work_sync(&data->open_timeout);
 659         flush_work(&data->suspend_work);
 660
 661         hdev = data->hdev;
 662
 663         if (hdev) {
 664                 hci_unregister_dev(hdev);
 665                 hci_free_dev(hdev);
 666         }
 667
 668         skb_queue_purge(&data->readq);
 669         file->private_data = NULL;
 670         kfree(data);
 671
 672         return 0;
 673 }
 674
 675 static const struct file_operations vhci_fops = {
 676         .owner          = THIS_MODULE,
 677         .read           = vhci_read,
 678         .write_iter     = vhci_write,
 679         .poll           = vhci_poll,
 680         .open           = vhci_open,
 681         .release        = vhci_release,
 682 };
 683
 684 static struct miscdevice vhci_miscdev = {
 685         .name   = "vhci",
 686         .fops   = &vhci_fops,
 687         .minor  = VHCI_MINOR,
 688 };
 689 module_misc_device(vhci_miscdev);
 690
 691 module_param(amp, bool, 0644);
 692 MODULE_PARM_DESC(amp, "Create AMP controller device");
 693
 694 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 695 MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION);
 696 MODULE_VERSION(VERSION);
 697 MODULE_LICENSE("GPL");
 698 MODULE_ALIAS("devname:vhci");
 699 MODULE_ALIAS_MISCDEV(VHCI_MINOR);