drivers/bluetooth/hci_vhci.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Bluetooth virtual HCI driver
   5  *
   6  *  Copyright (C) 2000-2001  Qualcomm Incorporated
   7  *  Copyright (C) 2002-2003  Maxim Krasnyansky <maxk@qualcomm.com>
   8  *  Copyright (C) 2004-2006  Marcel Holtmann <marcel@holtmann.org>
   9  */
  10
  11 #include <linux/module.h>
  12 #include <asm/unaligned.h>
  13
  14 #include <linux/atomic.h>
  15 #include <linux/kernel.h>
  16 #include <linux/init.h>
  17 #include <linux/slab.h>
  18 #include <linux/types.h>
  19 #include <linux/errno.h>
  20 #include <linux/sched.h>
  21 #include <linux/poll.h>
  22
  23 #include <linux/skbuff.h>
  24 #include <linux/miscdevice.h>
  25 #include <linux/debugfs.h>
  26
  27 #include <net/bluetooth/bluetooth.h>
  28 #include <net/bluetooth/hci_core.h>
  29
  30 #define VERSION "1.5"
  31
  32 static bool amp;
  33
  34 struct vhci_data {
  35         struct hci_dev *hdev;
  36
  37         wait_queue_head_t read_wait;
  38         struct sk_buff_head readq;
  39
  40         struct mutex open_mutex;
  41         struct delayed_work open_timeout;
  42         struct work_struct suspend_work;
  43
  44         bool suspended;
  45         bool wakeup;
  46         __u16 msft_opcode;
  47         bool aosp_capable;
  48         atomic_t initialized;
  49 };
  50
  51 static int vhci_open_dev(struct hci_dev *hdev)
  52 {
  53         return 0;
  54 }
  55
  56 static int vhci_close_dev(struct hci_dev *hdev)
  57 {
  58         struct vhci_data *data = hci_get_drvdata(hdev);
  59
  60         skb_queue_purge(&data->readq);
  61
  62         return 0;
  63 }
  64
  65 static int vhci_flush(struct hci_dev *hdev)
  66 {
  67         struct vhci_data *data = hci_get_drvdata(hdev);
  68
  69         skb_queue_purge(&data->readq);
  70
  71         return 0;
  72 }
  73
  74 static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
  75 {
  76         struct vhci_data *data = hci_get_drvdata(hdev);
  77
  78         memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
  79
  80         skb_queue_tail(&data->readq, skb);
  81
  82         if (atomic_read(&data->initialized))
  83                 wake_up_interruptible(&data->read_wait);
  84         return 0;
  85 }
  86
  87 static int vhci_get_data_path_id(struct hci_dev *hdev, u8 *data_path_id)
  88 {
  89         *data_path_id = 0;
  90         return 0;
  91 }
  92
  93 static int vhci_get_codec_config_data(struct hci_dev *hdev, __u8 type,
  94                                       struct bt_codec *codec, __u8 *vnd_len,
  95                                       __u8 **vnd_data)
  96 {
  97         if (type != ESCO_LINK)
  98                 return -EINVAL;
  99
 100         *vnd_len = 0;
 101         *vnd_data = NULL;
 102         return 0;
 103 }
 104
 105 static bool vhci_wakeup(struct hci_dev *hdev)
 106 {
 107         struct vhci_data *data = hci_get_drvdata(hdev);
 108
 109         return data->wakeup;
 110 }
 111
 112 static ssize_t force_suspend_read(struct file *file, char __user *user_buf,
 113                                   size_t count, loff_t *ppos)
 114 {
 115         struct vhci_data *data = file->private_data;
 116         char buf[3];
 117
 118         buf[0] = data->suspended ? 'Y' : 'N';
 119         buf[1] = '\n';
 120         buf[2] = '\0';
 121         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 122 }
 123
 124 static void vhci_suspend_work(struct work_struct *work)
 125 {
 126         struct vhci_data *data = container_of(work, struct vhci_data,
 127                                               suspend_work);
 128
 129         if (data->suspended)
 130                 hci_suspend_dev(data->hdev);
 131         else
 132                 hci_resume_dev(data->hdev);
 133 }
 134
 135 static ssize_t force_suspend_write(struct file *file,
 136                                    const char __user *user_buf,
 137                                    size_t count, loff_t *ppos)
 138 {
 139         struct vhci_data *data = file->private_data;
 140         bool enable;
 141         int err;
 142
 143         err = kstrtobool_from_user(user_buf, count, &enable);
 144         if (err)
 145                 return err;
 146
 147         if (data->suspended == enable)
 148                 return -EALREADY;
 149
 150         data->suspended = enable;
 151
 152         schedule_work(&data->suspend_work);
 153
 154         return count;
 155 }
 156
 157 static const struct file_operations force_suspend_fops = {
 158         .open           = simple_open,
 159         .read           = force_suspend_read,
 160         .write          = force_suspend_write,
 161         .llseek         = default_llseek,
 162 };
 163
 164 static ssize_t force_wakeup_read(struct file *file, char __user *user_buf,
 165                                  size_t count, loff_t *ppos)
 166 {
 167         struct vhci_data *data = file->private_data;
 168         char buf[3];
 169
 170         buf[0] = data->wakeup ? 'Y' : 'N';
 171         buf[1] = '\n';
 172         buf[2] = '\0';
 173         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 174 }
 175
 176 static ssize_t force_wakeup_write(struct file *file,
 177                                   const char __user *user_buf, size_t count,
 178                                   loff_t *ppos)
 179 {
 180         struct vhci_data *data = file->private_data;
 181         bool enable;
 182         int err;
 183
 184         err = kstrtobool_from_user(user_buf, count, &enable);
 185         if (err)
 186                 return err;
 187
 188         if (data->wakeup == enable)
 189                 return -EALREADY;
 190
 191         data->wakeup = enable;
 192
 193         return count;
 194 }
 195
 196 static const struct file_operations force_wakeup_fops = {
 197         .open           = simple_open,
 198         .read           = force_wakeup_read,
 199         .write          = force_wakeup_write,
 200         .llseek         = default_llseek,
 201 };
 202
 203 static int msft_opcode_set(void *data, u64 val)
 204 {
 205         struct vhci_data *vhci = data;
 206
 207         if (val > 0xffff || hci_opcode_ogf(val) != 0x3f)
 208                 return -EINVAL;
 209
 210         if (vhci->msft_opcode)
 211                 return -EALREADY;
 212
 213         vhci->msft_opcode = val;
 214
 215         return 0;
 216 }
 217
 218 static int msft_opcode_get(void *data, u64 *val)
 219 {
 220         struct vhci_data *vhci = data;
 221
 222         *val = vhci->msft_opcode;
 223
 224         return 0;
 225 }
 226
 227 DEFINE_DEBUGFS_ATTRIBUTE(msft_opcode_fops, msft_opcode_get, msft_opcode_set,
 228                          "%llu\n");
 229
 230 static ssize_t aosp_capable_read(struct file *file, char __user *user_buf,
 231                                  size_t count, loff_t *ppos)
 232 {
 233         struct vhci_data *vhci = file->private_data;
 234         char buf[3];
 235
 236         buf[0] = vhci->aosp_capable ? 'Y' : 'N';
 237         buf[1] = '\n';
 238         buf[2] = '\0';
 239         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 240 }
 241
 242 static ssize_t aosp_capable_write(struct file *file,
 243                                   const char __user *user_buf, size_t count,
 244                                   loff_t *ppos)
 245 {
 246         struct vhci_data *vhci = file->private_data;
 247         bool enable;
 248         int err;
 249
 250         err = kstrtobool_from_user(user_buf, count, &enable);
 251         if (err)
 252                 return err;
 253
 254         if (!enable)
 255                 return -EINVAL;
 256
 257         if (vhci->aosp_capable)
 258                 return -EALREADY;
 259
 260         vhci->aosp_capable = enable;
 261
 262         return count;
 263 }
 264
 265 static const struct file_operations aosp_capable_fops = {
 266         .open           = simple_open,
 267         .read           = aosp_capable_read,
 268         .write          = aosp_capable_write,
 269         .llseek         = default_llseek,
 270 };
 271
 272 static int vhci_setup(struct hci_dev *hdev)
 273 {
 274         struct vhci_data *vhci = hci_get_drvdata(hdev);
 275
 276         if (vhci->msft_opcode)
 277                 hci_set_msft_opcode(hdev, vhci->msft_opcode);
 278
 279         if (vhci->aosp_capable)
 280                 hci_set_aosp_capable(hdev);
 281
 282         return 0;
 283 }
 284
 285 static void vhci_coredump(struct hci_dev *hdev)
 286 {
 287         /* No need to do anything */
 288 }
 289
 290 static void vhci_coredump_hdr(struct hci_dev *hdev, struct sk_buff *skb)
 291 {
 292         char buf[80];
 293
 294         snprintf(buf, sizeof(buf), "Controller Name: vhci_ctrl\n");
 295         skb_put_data(skb, buf, strlen(buf));
 296
 297         snprintf(buf, sizeof(buf), "Firmware Version: vhci_fw\n");
 298         skb_put_data(skb, buf, strlen(buf));
 299
 300         snprintf(buf, sizeof(buf), "Driver: vhci_drv\n");
 301         skb_put_data(skb, buf, strlen(buf));
 302
 303         snprintf(buf, sizeof(buf), "Vendor: vhci\n");
 304         skb_put_data(skb, buf, strlen(buf));
 305 }
 306
 307 #define MAX_COREDUMP_LINE_LEN   40
 308
 309 struct devcoredump_test_data {
 310         enum devcoredump_state state;
 311         unsigned int timeout;
 312         char data[MAX_COREDUMP_LINE_LEN];
 313 };
 314
 315 static inline void force_devcd_timeout(struct hci_dev *hdev,
 316                                        unsigned int timeout)
 317 {
 318 #ifdef CONFIG_DEV_COREDUMP
 319         hdev->dump.timeout = msecs_to_jiffies(timeout * 1000);
 320 #endif
 321 }
 322
 323 static ssize_t force_devcd_write(struct file *file, const char __user *user_buf,
 324                                  size_t count, loff_t *ppos)
 325 {
 326         struct vhci_data *data = file->private_data;
 327         struct hci_dev *hdev = data->hdev;
 328         struct sk_buff *skb = NULL;
 329         struct devcoredump_test_data dump_data;
 330         size_t data_size;
 331         int ret;
 332
 333         if (count < offsetof(struct devcoredump_test_data, data) ||
 334             count > sizeof(dump_data))
 335                 return -EINVAL;
 336
 337         if (copy_from_user(&dump_data, user_buf, count))
 338                 return -EFAULT;
 339
 340         data_size = count - offsetof(struct devcoredump_test_data, data);
 341         skb = alloc_skb(data_size, GFP_ATOMIC);
 342         if (!skb)
 343                 return -ENOMEM;
 344         skb_put_data(skb, &dump_data.data, data_size);
 345
 346         hci_devcd_register(hdev, vhci_coredump, vhci_coredump_hdr, NULL);
 347
 348         /* Force the devcoredump timeout */
 349         if (dump_data.timeout)
 350                 force_devcd_timeout(hdev, dump_data.timeout);
 351
 352         ret = hci_devcd_init(hdev, skb->len);
 353         if (ret) {
 354                 BT_ERR("Failed to generate devcoredump");
 355                 kfree_skb(skb);
 356                 return ret;
 357         }
 358
 359         hci_devcd_append(hdev, skb);
 360
 361         switch (dump_data.state) {
 362         case HCI_DEVCOREDUMP_DONE:
 363                 hci_devcd_complete(hdev);
 364                 break;
 365         case HCI_DEVCOREDUMP_ABORT:
 366                 hci_devcd_abort(hdev);
 367                 break;
 368         case HCI_DEVCOREDUMP_TIMEOUT:
 369                 /* Do nothing */
 370                 break;
 371         default:
 372                 return -EINVAL;
 373         }
 374
 375         return count;
 376 }
 377
 378 static const struct file_operations force_devcoredump_fops = {
 379         .open           = simple_open,
 380         .write          = force_devcd_write,
 381 };
 382
 383 static int __vhci_create_device(struct vhci_data *data, __u8 opcode)
 384 {
 385         struct hci_dev *hdev;
 386         struct sk_buff *skb;
 387         __u8 dev_type;
 388
 389         if (data->hdev)
 390                 return -EBADFD;
 391
 392         /* bits 0-1 are dev_type (Primary or AMP) */
 393         dev_type = opcode & 0x03;
 394
 395         if (dev_type != HCI_PRIMARY && dev_type != HCI_AMP)
 396                 return -EINVAL;
 397
 398         /* bits 2-5 are reserved (must be zero) */
 399         if (opcode & 0x3c)
 400                 return -EINVAL;
 401
 402         skb = bt_skb_alloc(4, GFP_KERNEL);
 403         if (!skb)
 404                 return -ENOMEM;
 405
 406         hdev = hci_alloc_dev();
 407         if (!hdev) {
 408                 kfree_skb(skb);
 409                 return -ENOMEM;
 410         }
 411
 412         data->hdev = hdev;
 413
 414         hdev->bus = HCI_VIRTUAL;
 415         hdev->dev_type = dev_type;
 416         hci_set_drvdata(hdev, data);
 417
 418         hdev->open  = vhci_open_dev;
 419         hdev->close = vhci_close_dev;
 420         hdev->flush = vhci_flush;
 421         hdev->send  = vhci_send_frame;
 422         hdev->get_data_path_id = vhci_get_data_path_id;
 423         hdev->get_codec_config_data = vhci_get_codec_config_data;
 424         hdev->wakeup = vhci_wakeup;
 425         hdev->setup = vhci_setup;
 426         set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
 427
 428         /* bit 6 is for external configuration */
 429         if (opcode & 0x40)
 430                 set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks);
 431
 432         /* bit 7 is for raw device */
 433         if (opcode & 0x80)
 434                 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
 435
 436         set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
 437
 438         if (hci_register_dev(hdev) < 0) {
 439                 BT_ERR("Can't register HCI device");
 440                 hci_free_dev(hdev);
 441                 data->hdev = NULL;
 442                 kfree_skb(skb);
 443                 return -EBUSY;
 444         }
 445
 446         debugfs_create_file("force_suspend", 0644, hdev->debugfs, data,
 447                             &force_suspend_fops);
 448
 449         debugfs_create_file("force_wakeup", 0644, hdev->debugfs, data,
 450                             &force_wakeup_fops);
 451
 452         if (IS_ENABLED(CONFIG_BT_MSFTEXT))
 453                 debugfs_create_file("msft_opcode", 0644, hdev->debugfs, data,
 454                                     &msft_opcode_fops);
 455
 456         if (IS_ENABLED(CONFIG_BT_AOSPEXT))
 457                 debugfs_create_file("aosp_capable", 0644, hdev->debugfs, data,
 458                                     &aosp_capable_fops);
 459
 460         debugfs_create_file("force_devcoredump", 0644, hdev->debugfs, data,
 461                             &force_devcoredump_fops);
 462
 463         hci_skb_pkt_type(skb) = HCI_VENDOR_PKT;
 464
 465         skb_put_u8(skb, 0xff);
 466         skb_put_u8(skb, opcode);
 467         put_unaligned_le16(hdev->id, skb_put(skb, 2));
 468         skb_queue_head(&data->readq, skb);
 469         atomic_inc(&data->initialized);
 470
 471         wake_up_interruptible(&data->read_wait);
 472         return 0;
 473 }
 474
 475 static int vhci_create_device(struct vhci_data *data, __u8 opcode)
 476 {
 477         int err;
 478
 479         mutex_lock(&data->open_mutex);
 480         err = __vhci_create_device(data, opcode);
 481         mutex_unlock(&data->open_mutex);
 482
 483         return err;
 484 }
 485
 486 static inline ssize_t vhci_get_user(struct vhci_data *data,
 487                                     struct iov_iter *from)
 488 {
 489         size_t len = iov_iter_count(from);
 490         struct sk_buff *skb;
 491         __u8 pkt_type, opcode;
 492         int ret;
 493
 494         if (len < 2 || len > HCI_MAX_FRAME_SIZE)
 495                 return -EINVAL;
 496
 497         skb = bt_skb_alloc(len, GFP_KERNEL);
 498         if (!skb)
 499                 return -ENOMEM;
 500
 501         if (!copy_from_iter_full(skb_put(skb, len), len, from)) {
 502                 kfree_skb(skb);
 503                 return -EFAULT;
 504         }
 505
 506         pkt_type = *((__u8 *) skb->data);
 507         skb_pull(skb, 1);
 508
 509         switch (pkt_type) {
 510         case HCI_EVENT_PKT:
 511         case HCI_ACLDATA_PKT:
 512         case HCI_SCODATA_PKT:
 513         case HCI_ISODATA_PKT:
 514                 if (!data->hdev) {
 515                         kfree_skb(skb);
 516                         return -ENODEV;
 517                 }
 518
 519                 hci_skb_pkt_type(skb) = pkt_type;
 520
 521                 ret = hci_recv_frame(data->hdev, skb);
 522                 break;
 523
 524         case HCI_VENDOR_PKT:
 525                 cancel_delayed_work_sync(&data->open_timeout);
 526
 527                 opcode = *((__u8 *) skb->data);
 528                 skb_pull(skb, 1);
 529
 530                 if (skb->len > 0) {
 531                         kfree_skb(skb);
 532                         return -EINVAL;
 533                 }
 534
 535                 kfree_skb(skb);
 536
 537                 ret = vhci_create_device(data, opcode);
 538                 break;
 539
 540         default:
 541                 kfree_skb(skb);
 542                 return -EINVAL;
 543         }
 544
 545         return (ret < 0) ? ret : len;
 546 }
 547
 548 static inline ssize_t vhci_put_user(struct vhci_data *data,
 549                                     struct sk_buff *skb,
 550                                     char __user *buf, int count)
 551 {
 552         char __user *ptr = buf;
 553         int len;
 554
 555         len = min_t(unsigned int, skb->len, count);
 556
 557         if (copy_to_user(ptr, skb->data, len))
 558                 return -EFAULT;
 559
 560         if (!data->hdev)
 561                 return len;
 562
 563         data->hdev->stat.byte_tx += len;
 564
 565         switch (hci_skb_pkt_type(skb)) {
 566         case HCI_COMMAND_PKT:
 567                 data->hdev->stat.cmd_tx++;
 568                 break;
 569         case HCI_ACLDATA_PKT:
 570                 data->hdev->stat.acl_tx++;
 571                 break;
 572         case HCI_SCODATA_PKT:
 573                 data->hdev->stat.sco_tx++;
 574                 break;
 575         }
 576
 577         return len;
 578 }
 579
 580 static ssize_t vhci_read(struct file *file,
 581                          char __user *buf, size_t count, loff_t *pos)
 582 {
 583         struct vhci_data *data = file->private_data;
 584         struct sk_buff *skb;
 585         ssize_t ret = 0;
 586
 587         while (count) {
 588                 skb = skb_dequeue(&data->readq);
 589                 if (skb) {
 590                         ret = vhci_put_user(data, skb, buf, count);
 591                         if (ret < 0)
 592                                 skb_queue_head(&data->readq, skb);
 593                         else
 594                                 kfree_skb(skb);
 595                         break;
 596                 }
 597
 598                 if (file->f_flags & O_NONBLOCK) {
 599                         ret = -EAGAIN;
 600                         break;
 601                 }
 602
 603                 ret = wait_event_interruptible(data->read_wait,
 604                                                !skb_queue_empty(&data->readq));
 605                 if (ret < 0)
 606                         break;
 607         }
 608
 609         return ret;
 610 }
 611
 612 static ssize_t vhci_write(struct kiocb *iocb, struct iov_iter *from)
 613 {
 614         struct file *file = iocb->ki_filp;
 615         struct vhci_data *data = file->private_data;
 616
 617         return vhci_get_user(data, from);
 618 }
 619
 620 static __poll_t vhci_poll(struct file *file, poll_table *wait)
 621 {
 622         struct vhci_data *data = file->private_data;
 623
 624         poll_wait(file, &data->read_wait, wait);
 625
 626         if (!skb_queue_empty(&data->readq))
 627                 return EPOLLIN | EPOLLRDNORM;
 628
 629         return EPOLLOUT | EPOLLWRNORM;
 630 }
 631
 632 static void vhci_open_timeout(struct work_struct *work)
 633 {
 634         struct vhci_data *data = container_of(work, struct vhci_data,
 635                                               open_timeout.work);
 636
 637         vhci_create_device(data, amp ? HCI_AMP : HCI_PRIMARY);
 638 }
 639
 640 static int vhci_open(struct inode *inode, struct file *file)
 641 {
 642         struct vhci_data *data;
 643
 644         data = kzalloc(sizeof(struct vhci_data), GFP_KERNEL);
 645         if (!data)
 646                 return -ENOMEM;
 647
 648         skb_queue_head_init(&data->readq);
 649         init_waitqueue_head(&data->read_wait);
 650
 651         mutex_init(&data->open_mutex);
 652         INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout);
 653         INIT_WORK(&data->suspend_work, vhci_suspend_work);
 654
 655         file->private_data = data;
 656         nonseekable_open(inode, file);
 657
 658         schedule_delayed_work(&data->open_timeout, msecs_to_jiffies(1000));
 659
 660         return 0;
 661 }
 662
 663 static int vhci_release(struct inode *inode, struct file *file)
 664 {
 665         struct vhci_data *data = file->private_data;
 666         struct hci_dev *hdev;
 667
 668         cancel_delayed_work_sync(&data->open_timeout);
 669         flush_work(&data->suspend_work);
 670
 671         hdev = data->hdev;
 672
 673         if (hdev) {
 674                 hci_unregister_dev(hdev);
 675                 hci_free_dev(hdev);
 676         }
 677
 678         skb_queue_purge(&data->readq);
 679         file->private_data = NULL;
 680         kfree(data);
 681
 682         return 0;
 683 }
 684
 685 static const struct file_operations vhci_fops = {
 686         .owner          = THIS_MODULE,
 687         .read           = vhci_read,
 688         .write_iter     = vhci_write,
 689         .poll           = vhci_poll,
 690         .open           = vhci_open,
 691         .release        = vhci_release,
 692         .llseek         = no_llseek,
 693 };
 694
 695 static struct miscdevice vhci_miscdev = {
 696         .name   = "vhci",
 697         .fops   = &vhci_fops,
 698         .minor  = VHCI_MINOR,
 699 };
 700 module_misc_device(vhci_miscdev);
 701
 702 module_param(amp, bool, 0644);
 703 MODULE_PARM_DESC(amp, "Create AMP controller device");
 704
 705 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 706 MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION);
 707 MODULE_VERSION(VERSION);
 708 MODULE_LICENSE("GPL");
 709 MODULE_ALIAS("devname:vhci");
 710 MODULE_ALIAS_MISCDEV(VHCI_MINOR);