1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 *
4 *  Bluetooth virtual HCI driver
5 *
6 *  Copyright (C) 2000-2001  Qualcomm Incorporated
7 *  Copyright (C) 2002-2003  Maxim Krasnyansky <maxk@qualcomm.com>
8 *  Copyright (C) 2004-2006  Marcel Holtmann <marcel@holtmann.org>
9 */
10
11#include <linux/module.h>
12#include <asm/unaligned.h>
13
14#include <linux/kernel.h>
15#include <linux/init.h>
16#include <linux/slab.h>
17#include <linux/types.h>
18#include <linux/errno.h>
19#include <linux/sched.h>
20#include <linux/poll.h>
21
22#include <linux/skbuff.h>
23#include <linux/miscdevice.h>
24
25#include <net/bluetooth/bluetooth.h>
26#include <net/bluetooth/hci_core.h>
27
28#define VERSION "1.5"
29
30static bool amp;
31
32struct vhci_data {
33	struct hci_dev *hdev;
34
35	wait_queue_head_t read_wait;
36	struct sk_buff_head readq;
37
38	struct mutex open_mutex;
39	struct delayed_work open_timeout;
40};
41
42static int vhci_open_dev(struct hci_dev *hdev)
43{
44	return 0;
45}
46
47static int vhci_close_dev(struct hci_dev *hdev)
48{
49	struct vhci_data *data = hci_get_drvdata(hdev);
50
51	skb_queue_purge(&data->readq);
52
53	return 0;
54}
55
56static int vhci_flush(struct hci_dev *hdev)
57{
58	struct vhci_data *data = hci_get_drvdata(hdev);
59
60	skb_queue_purge(&data->readq);
61
62	return 0;
63}
64
65static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
66{
67	struct vhci_data *data = hci_get_drvdata(hdev);
68
69	memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
70
71	mutex_lock(&data->open_mutex);
72	skb_queue_tail(&data->readq, skb);
73	mutex_unlock(&data->open_mutex);
74
75	wake_up_interruptible(&data->read_wait);
76	return 0;
77}
78
79static int __vhci_create_device(struct vhci_data *data, __u8 opcode)
80{
81	struct hci_dev *hdev;
82	struct sk_buff *skb;
83	__u8 dev_type;
84
85	if (data->hdev)
86		return -EBADFD;
87
88	/* bits 0-1 are dev_type (Primary or AMP) */
89	dev_type = opcode & 0x03;
90
91	if (dev_type != HCI_PRIMARY && dev_type != HCI_AMP)
92		return -EINVAL;
93
94	/* bits 2-5 are reserved (must be zero) */
95	if (opcode & 0x3c)
96		return -EINVAL;
97
98	skb = bt_skb_alloc(4, GFP_KERNEL);
99	if (!skb)
100		return -ENOMEM;
101
102	hdev = hci_alloc_dev();
103	if (!hdev) {
104		kfree_skb(skb);
105		return -ENOMEM;
106	}
107
108	data->hdev = hdev;
109
110	hdev->bus = HCI_VIRTUAL;
111	hdev->dev_type = dev_type;
112	hci_set_drvdata(hdev, data);
113
114	hdev->open  = vhci_open_dev;
115	hdev->close = vhci_close_dev;
116	hdev->flush = vhci_flush;
117	hdev->send  = vhci_send_frame;
118
119	/* bit 6 is for external configuration */
120	if (opcode & 0x40)
121		set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks);
122
123	/* bit 7 is for raw device */
124	if (opcode & 0x80)
125		set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
126
127	set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
128
129	if (hci_register_dev(hdev) < 0) {
130		BT_ERR("Can't register HCI device");
131		hci_free_dev(hdev);
132		data->hdev = NULL;
133		kfree_skb(skb);
134		return -EBUSY;
135	}
136
137	hci_skb_pkt_type(skb) = HCI_VENDOR_PKT;
138
139	skb_put_u8(skb, 0xff);
140	skb_put_u8(skb, opcode);
141	put_unaligned_le16(hdev->id, skb_put(skb, 2));
142	skb_queue_tail(&data->readq, skb);
143
144	wake_up_interruptible(&data->read_wait);
145	return 0;
146}
147
148static int vhci_create_device(struct vhci_data *data, __u8 opcode)
149{
150	int err;
151
152	mutex_lock(&data->open_mutex);
153	err = __vhci_create_device(data, opcode);
154	mutex_unlock(&data->open_mutex);
155
156	return err;
157}
158
159static inline ssize_t vhci_get_user(struct vhci_data *data,
160				    struct iov_iter *from)
161{
162	size_t len = iov_iter_count(from);
163	struct sk_buff *skb;
164	__u8 pkt_type, opcode;
165	int ret;
166
167	if (len < 2 || len > HCI_MAX_FRAME_SIZE)
168		return -EINVAL;
169
170	skb = bt_skb_alloc(len, GFP_KERNEL);
171	if (!skb)
172		return -ENOMEM;
173
174	if (!copy_from_iter_full(skb_put(skb, len), len, from)) {
175		kfree_skb(skb);
176		return -EFAULT;
177	}
178
179	pkt_type = *((__u8 *) skb->data);
180	skb_pull(skb, 1);
181
182	switch (pkt_type) {
183	case HCI_EVENT_PKT:
184	case HCI_ACLDATA_PKT:
185	case HCI_SCODATA_PKT:
186	case HCI_ISODATA_PKT:
187		if (!data->hdev) {
188			kfree_skb(skb);
189			return -ENODEV;
190		}
191
192		hci_skb_pkt_type(skb) = pkt_type;
193
194		ret = hci_recv_frame(data->hdev, skb);
195		break;
196
197	case HCI_VENDOR_PKT:
198		cancel_delayed_work_sync(&data->open_timeout);
199
200		opcode = *((__u8 *) skb->data);
201		skb_pull(skb, 1);
202
203		if (skb->len > 0) {
204			kfree_skb(skb);
205			return -EINVAL;
206		}
207
208		kfree_skb(skb);
209
210		ret = vhci_create_device(data, opcode);
211		break;
212
213	default:
214		kfree_skb(skb);
215		return -EINVAL;
216	}
217
218	return (ret < 0) ? ret : len;
219}
220
221static inline ssize_t vhci_put_user(struct vhci_data *data,
222				    struct sk_buff *skb,
223				    char __user *buf, int count)
224{
225	char __user *ptr = buf;
226	int len;
227
228	len = min_t(unsigned int, skb->len, count);
229
230	if (copy_to_user(ptr, skb->data, len))
231		return -EFAULT;
232
233	if (!data->hdev)
234		return len;
235
236	data->hdev->stat.byte_tx += len;
237
238	switch (hci_skb_pkt_type(skb)) {
239	case HCI_COMMAND_PKT:
240		data->hdev->stat.cmd_tx++;
241		break;
242	case HCI_ACLDATA_PKT:
243		data->hdev->stat.acl_tx++;
244		break;
245	case HCI_SCODATA_PKT:
246		data->hdev->stat.sco_tx++;
247		break;
248	}
249
250	return len;
251}
252
253static ssize_t vhci_read(struct file *file,
254			 char __user *buf, size_t count, loff_t *pos)
255{
256	struct vhci_data *data = file->private_data;
257	struct sk_buff *skb;
258	ssize_t ret = 0;
259
260	while (count) {
261		skb = skb_dequeue(&data->readq);
262		if (skb) {
263			ret = vhci_put_user(data, skb, buf, count);
264			if (ret < 0)
265				skb_queue_head(&data->readq, skb);
266			else
267				kfree_skb(skb);
268			break;
269		}
270
271		if (file->f_flags & O_NONBLOCK) {
272			ret = -EAGAIN;
273			break;
274		}
275
276		ret = wait_event_interruptible(data->read_wait,
277					       !skb_queue_empty(&data->readq));
278		if (ret < 0)
279			break;
280	}
281
282	return ret;
283}
284
285static ssize_t vhci_write(struct kiocb *iocb, struct iov_iter *from)
286{
287	struct file *file = iocb->ki_filp;
288	struct vhci_data *data = file->private_data;
289
290	return vhci_get_user(data, from);
291}
292
293static __poll_t vhci_poll(struct file *file, poll_table *wait)
294{
295	struct vhci_data *data = file->private_data;
296
297	poll_wait(file, &data->read_wait, wait);
298
299	if (!skb_queue_empty(&data->readq))
300		return EPOLLIN | EPOLLRDNORM;
301
302	return EPOLLOUT | EPOLLWRNORM;
303}
304
305static void vhci_open_timeout(struct work_struct *work)
306{
307	struct vhci_data *data = container_of(work, struct vhci_data,
308					      open_timeout.work);
309
310	vhci_create_device(data, amp ? HCI_AMP : HCI_PRIMARY);
311}
312
313static int vhci_open(struct inode *inode, struct file *file)
314{
315	struct vhci_data *data;
316
317	data = kzalloc(sizeof(struct vhci_data), GFP_KERNEL);
318	if (!data)
319		return -ENOMEM;
320
321	skb_queue_head_init(&data->readq);
322	init_waitqueue_head(&data->read_wait);
323
324	mutex_init(&data->open_mutex);
325	INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout);
326
327	file->private_data = data;
328	nonseekable_open(inode, file);
329
330	schedule_delayed_work(&data->open_timeout, msecs_to_jiffies(1000));
331
332	return 0;
333}
334
335static int vhci_release(struct inode *inode, struct file *file)
336{
337	struct vhci_data *data = file->private_data;
338	struct hci_dev *hdev;
339
340	cancel_delayed_work_sync(&data->open_timeout);
341
342	hdev = data->hdev;
343
344	if (hdev) {
345		hci_unregister_dev(hdev);
346		hci_free_dev(hdev);
347	}
348
349	skb_queue_purge(&data->readq);
350	file->private_data = NULL;
351	kfree(data);
352
353	return 0;
354}
355
356static const struct file_operations vhci_fops = {
357	.owner		= THIS_MODULE,
358	.read		= vhci_read,
359	.write_iter	= vhci_write,
360	.poll		= vhci_poll,
361	.open		= vhci_open,
362	.release	= vhci_release,
363	.llseek		= no_llseek,
364};
365
366static struct miscdevice vhci_miscdev = {
367	.name	= "vhci",
368	.fops	= &vhci_fops,
369	.minor	= VHCI_MINOR,
370};
371module_misc_device(vhci_miscdev);
372
373module_param(amp, bool, 0644);
374MODULE_PARM_DESC(amp, "Create AMP controller device");
375
376MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
377MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION);
378MODULE_VERSION(VERSION);
379MODULE_LICENSE("GPL");
380MODULE_ALIAS("devname:vhci");
381MODULE_ALIAS_MISCDEV(VHCI_MINOR);
382