1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2023 Google Corporation 4 */ 5 6 #include <linux/devcoredump.h> 7 8 #include <asm/unaligned.h> 9 #include <net/bluetooth/bluetooth.h> 10 #include <net/bluetooth/hci_core.h> 11 12 enum hci_devcoredump_pkt_type { 13 HCI_DEVCOREDUMP_PKT_INIT, 14 HCI_DEVCOREDUMP_PKT_SKB, 15 HCI_DEVCOREDUMP_PKT_PATTERN, 16 HCI_DEVCOREDUMP_PKT_COMPLETE, 17 HCI_DEVCOREDUMP_PKT_ABORT, 18 }; 19 20 struct hci_devcoredump_skb_cb { 21 u16 pkt_type; 22 }; 23 24 struct hci_devcoredump_skb_pattern { 25 u8 pattern; 26 u32 len; 27 } __packed; 28 29 #define hci_dmp_cb(skb) ((struct hci_devcoredump_skb_cb *)((skb)->cb)) 30 31 #define DBG_UNEXPECTED_STATE() \ 32 bt_dev_dbg(hdev, \ 33 "Unexpected packet (%d) for state (%d). ", \ 34 hci_dmp_cb(skb)->pkt_type, hdev->dump.state) 35 36 #define MAX_DEVCOREDUMP_HDR_SIZE 512 /* bytes */ 37 38 static int hci_devcd_update_hdr_state(char *buf, size_t size, int state) 39 { 40 int len = 0; 41 42 if (!buf) 43 return 0; 44 45 len = scnprintf(buf, size, "Bluetooth devcoredump\nState: %d\n", state); 46 47 return len + 1; /* scnprintf adds \0 at the end upon state rewrite */ 48 } 49 50 /* Call with hci_dev_lock only. */ 51 static int hci_devcd_update_state(struct hci_dev *hdev, int state) 52 { 53 bt_dev_dbg(hdev, "Updating devcoredump state from %d to %d.", 54 hdev->dump.state, state); 55 56 hdev->dump.state = state; 57 58 return hci_devcd_update_hdr_state(hdev->dump.head, 59 hdev->dump.alloc_size, state); 60 } 61 62 static int hci_devcd_mkheader(struct hci_dev *hdev, struct sk_buff *skb) 63 { 64 char dump_start[] = "--- Start dump ---\n"; 65 char hdr[80]; 66 int hdr_len; 67 68 hdr_len = hci_devcd_update_hdr_state(hdr, sizeof(hdr), 69 HCI_DEVCOREDUMP_IDLE); 70 skb_put_data(skb, hdr, hdr_len); 71 72 if (hdev->dump.dmp_hdr) 73 hdev->dump.dmp_hdr(hdev, skb); 74 75 skb_put_data(skb, dump_start, strlen(dump_start)); 76 77 return skb->len; 78 } 79 80 /* Do not call with hci_dev_lock since this calls driver code. */ 81 static void hci_devcd_notify(struct hci_dev *hdev, int state) 82 { 83 if (hdev->dump.notify_change) 84 hdev->dump.notify_change(hdev, state); 85 } 86 87 /* Call with hci_dev_lock only. */ 88 void hci_devcd_reset(struct hci_dev *hdev) 89 { 90 hdev->dump.head = NULL; 91 hdev->dump.tail = NULL; 92 hdev->dump.alloc_size = 0; 93 94 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_IDLE); 95 96 cancel_delayed_work(&hdev->dump.dump_timeout); 97 skb_queue_purge(&hdev->dump.dump_q); 98 } 99 100 /* Call with hci_dev_lock only. */ 101 static void hci_devcd_free(struct hci_dev *hdev) 102 { 103 if (hdev->dump.head) 104 vfree(hdev->dump.head); 105 106 hci_devcd_reset(hdev); 107 } 108 109 /* Call with hci_dev_lock only. */ 110 static int hci_devcd_alloc(struct hci_dev *hdev, u32 size) 111 { 112 hdev->dump.head = vmalloc(size); 113 if (!hdev->dump.head) 114 return -ENOMEM; 115 116 hdev->dump.alloc_size = size; 117 hdev->dump.tail = hdev->dump.head; 118 hdev->dump.end = hdev->dump.head + size; 119 120 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_IDLE); 121 122 return 0; 123 } 124 125 /* Call with hci_dev_lock only. */ 126 static bool hci_devcd_copy(struct hci_dev *hdev, char *buf, u32 size) 127 { 128 if (hdev->dump.tail + size > hdev->dump.end) 129 return false; 130 131 memcpy(hdev->dump.tail, buf, size); 132 hdev->dump.tail += size; 133 134 return true; 135 } 136 137 /* Call with hci_dev_lock only. */ 138 static bool hci_devcd_memset(struct hci_dev *hdev, u8 pattern, u32 len) 139 { 140 if (hdev->dump.tail + len > hdev->dump.end) 141 return false; 142 143 memset(hdev->dump.tail, pattern, len); 144 hdev->dump.tail += len; 145 146 return true; 147 } 148 149 /* Call with hci_dev_lock only. */ 150 static int hci_devcd_prepare(struct hci_dev *hdev, u32 dump_size) 151 { 152 struct sk_buff *skb; 153 int dump_hdr_size; 154 int err = 0; 155 156 skb = alloc_skb(MAX_DEVCOREDUMP_HDR_SIZE, GFP_ATOMIC); 157 if (!skb) 158 return -ENOMEM; 159 160 dump_hdr_size = hci_devcd_mkheader(hdev, skb); 161 162 if (hci_devcd_alloc(hdev, dump_hdr_size + dump_size)) { 163 err = -ENOMEM; 164 goto hdr_free; 165 } 166 167 /* Insert the device header */ 168 if (!hci_devcd_copy(hdev, skb->data, skb->len)) { 169 bt_dev_err(hdev, "Failed to insert header"); 170 hci_devcd_free(hdev); 171 172 err = -ENOMEM; 173 goto hdr_free; 174 } 175 176 hdr_free: 177 kfree_skb(skb); 178 179 return err; 180 } 181 182 static void hci_devcd_handle_pkt_init(struct hci_dev *hdev, struct sk_buff *skb) 183 { 184 u32 dump_size; 185 186 if (hdev->dump.state != HCI_DEVCOREDUMP_IDLE) { 187 DBG_UNEXPECTED_STATE(); 188 return; 189 } 190 191 if (skb->len != sizeof(dump_size)) { 192 bt_dev_dbg(hdev, "Invalid dump init pkt"); 193 return; 194 } 195 196 dump_size = get_unaligned_le32(skb_pull_data(skb, 4)); 197 if (!dump_size) { 198 bt_dev_err(hdev, "Zero size dump init pkt"); 199 return; 200 } 201 202 if (hci_devcd_prepare(hdev, dump_size)) { 203 bt_dev_err(hdev, "Failed to prepare for dump"); 204 return; 205 } 206 207 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_ACTIVE); 208 queue_delayed_work(hdev->workqueue, &hdev->dump.dump_timeout, 209 hdev->dump.timeout); 210 } 211 212 static void hci_devcd_handle_pkt_skb(struct hci_dev *hdev, struct sk_buff *skb) 213 { 214 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { 215 DBG_UNEXPECTED_STATE(); 216 return; 217 } 218 219 if (!hci_devcd_copy(hdev, skb->data, skb->len)) 220 bt_dev_dbg(hdev, "Failed to insert skb"); 221 } 222 223 static void hci_devcd_handle_pkt_pattern(struct hci_dev *hdev, 224 struct sk_buff *skb) 225 { 226 struct hci_devcoredump_skb_pattern *pattern; 227 228 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { 229 DBG_UNEXPECTED_STATE(); 230 return; 231 } 232 233 if (skb->len != sizeof(*pattern)) { 234 bt_dev_dbg(hdev, "Invalid pattern skb"); 235 return; 236 } 237 238 pattern = skb_pull_data(skb, sizeof(*pattern)); 239 240 if (!hci_devcd_memset(hdev, pattern->pattern, pattern->len)) 241 bt_dev_dbg(hdev, "Failed to set pattern"); 242 } 243 244 static void hci_devcd_handle_pkt_complete(struct hci_dev *hdev, 245 struct sk_buff *skb) 246 { 247 u32 dump_size; 248 249 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { 250 DBG_UNEXPECTED_STATE(); 251 return; 252 } 253 254 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_DONE); 255 dump_size = hdev->dump.tail - hdev->dump.head; 256 257 bt_dev_dbg(hdev, "complete with size %u (expect %zu)", dump_size, 258 hdev->dump.alloc_size); 259 260 dev_coredumpv(&hdev->dev, hdev->dump.head, dump_size, GFP_KERNEL); 261 } 262 263 static void hci_devcd_handle_pkt_abort(struct hci_dev *hdev, 264 struct sk_buff *skb) 265 { 266 u32 dump_size; 267 268 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { 269 DBG_UNEXPECTED_STATE(); 270 return; 271 } 272 273 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_ABORT); 274 dump_size = hdev->dump.tail - hdev->dump.head; 275 276 bt_dev_dbg(hdev, "aborted with size %u (expect %zu)", dump_size, 277 hdev->dump.alloc_size); 278 279 /* Emit a devcoredump with the available data */ 280 dev_coredumpv(&hdev->dev, hdev->dump.head, dump_size, GFP_KERNEL); 281 } 282 283 /* Bluetooth devcoredump state machine. 284 * 285 * Devcoredump states: 286 * 287 * HCI_DEVCOREDUMP_IDLE: The default state. 288 * 289 * HCI_DEVCOREDUMP_ACTIVE: A devcoredump will be in this state once it has 290 * been initialized using hci_devcd_init(). Once active, the driver 291 * can append data using hci_devcd_append() or insert a pattern 292 * using hci_devcd_append_pattern(). 293 * 294 * HCI_DEVCOREDUMP_DONE: Once the dump collection is complete, the drive 295 * can signal the completion using hci_devcd_complete(). A 296 * devcoredump is generated indicating the completion event and 297 * then the state machine is reset to the default state. 298 * 299 * HCI_DEVCOREDUMP_ABORT: The driver can cancel ongoing dump collection in 300 * case of any error using hci_devcd_abort(). A devcoredump is 301 * still generated with the available data indicating the abort 302 * event and then the state machine is reset to the default state. 303 * 304 * HCI_DEVCOREDUMP_TIMEOUT: A timeout timer for HCI_DEVCOREDUMP_TIMEOUT sec 305 * is started during devcoredump initialization. Once the timeout 306 * occurs, the driver is notified, a devcoredump is generated with 307 * the available data indicating the timeout event and then the 308 * state machine is reset to the default state. 309 * 310 * The driver must register using hci_devcd_register() before using the hci 311 * devcoredump APIs. 312 */ 313 void hci_devcd_rx(struct work_struct *work) 314 { 315 struct hci_dev *hdev = container_of(work, struct hci_dev, dump.dump_rx); 316 struct sk_buff *skb; 317 int start_state; 318 319 while ((skb = skb_dequeue(&hdev->dump.dump_q))) { 320 /* Return if timeout occurs. The timeout handler function 321 * hci_devcd_timeout() will report the available dump data. 322 */ 323 if (hdev->dump.state == HCI_DEVCOREDUMP_TIMEOUT) { 324 kfree_skb(skb); 325 return; 326 } 327 328 hci_dev_lock(hdev); 329 start_state = hdev->dump.state; 330 331 switch (hci_dmp_cb(skb)->pkt_type) { 332 case HCI_DEVCOREDUMP_PKT_INIT: 333 hci_devcd_handle_pkt_init(hdev, skb); 334 break; 335 336 case HCI_DEVCOREDUMP_PKT_SKB: 337 hci_devcd_handle_pkt_skb(hdev, skb); 338 break; 339 340 case HCI_DEVCOREDUMP_PKT_PATTERN: 341 hci_devcd_handle_pkt_pattern(hdev, skb); 342 break; 343 344 case HCI_DEVCOREDUMP_PKT_COMPLETE: 345 hci_devcd_handle_pkt_complete(hdev, skb); 346 break; 347 348 case HCI_DEVCOREDUMP_PKT_ABORT: 349 hci_devcd_handle_pkt_abort(hdev, skb); 350 break; 351 352 default: 353 bt_dev_dbg(hdev, "Unknown packet (%d) for state (%d). ", 354 hci_dmp_cb(skb)->pkt_type, hdev->dump.state); 355 break; 356 } 357 358 hci_dev_unlock(hdev); 359 kfree_skb(skb); 360 361 /* Notify the driver about any state changes before resetting 362 * the state machine 363 */ 364 if (start_state != hdev->dump.state) 365 hci_devcd_notify(hdev, hdev->dump.state); 366 367 /* Reset the state machine if the devcoredump is complete */ 368 hci_dev_lock(hdev); 369 if (hdev->dump.state == HCI_DEVCOREDUMP_DONE || 370 hdev->dump.state == HCI_DEVCOREDUMP_ABORT) 371 hci_devcd_reset(hdev); 372 hci_dev_unlock(hdev); 373 } 374 } 375 EXPORT_SYMBOL(hci_devcd_rx); 376 377 void hci_devcd_timeout(struct work_struct *work) 378 { 379 struct hci_dev *hdev = container_of(work, struct hci_dev, 380 dump.dump_timeout.work); 381 u32 dump_size; 382 383 hci_devcd_notify(hdev, HCI_DEVCOREDUMP_TIMEOUT); 384 385 hci_dev_lock(hdev); 386 387 cancel_work(&hdev->dump.dump_rx); 388 389 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_TIMEOUT); 390 391 dump_size = hdev->dump.tail - hdev->dump.head; 392 bt_dev_dbg(hdev, "timeout with size %u (expect %zu)", dump_size, 393 hdev->dump.alloc_size); 394 395 /* Emit a devcoredump with the available data */ 396 dev_coredumpv(&hdev->dev, hdev->dump.head, dump_size, GFP_KERNEL); 397 398 hci_devcd_reset(hdev); 399 400 hci_dev_unlock(hdev); 401 } 402 EXPORT_SYMBOL(hci_devcd_timeout); 403 404 int hci_devcd_register(struct hci_dev *hdev, coredump_t coredump, 405 dmp_hdr_t dmp_hdr, notify_change_t notify_change) 406 { 407 /* Driver must implement coredump() and dmp_hdr() functions for 408 * bluetooth devcoredump. The coredump() should trigger a coredump 409 * event on the controller when the device's coredump sysfs entry is 410 * written to. The dmp_hdr() should create a dump header to identify 411 * the controller/fw/driver info. 412 */ 413 if (!coredump || !dmp_hdr) 414 return -EINVAL; 415 416 hci_dev_lock(hdev); 417 hdev->dump.coredump = coredump; 418 hdev->dump.dmp_hdr = dmp_hdr; 419 hdev->dump.notify_change = notify_change; 420 hdev->dump.supported = true; 421 hdev->dump.timeout = DEVCOREDUMP_TIMEOUT; 422 hci_dev_unlock(hdev); 423 424 return 0; 425 } 426 EXPORT_SYMBOL(hci_devcd_register); 427 428 static inline bool hci_devcd_enabled(struct hci_dev *hdev) 429 { 430 return hdev->dump.supported; 431 } 432 433 int hci_devcd_init(struct hci_dev *hdev, u32 dump_size) 434 { 435 struct sk_buff *skb; 436 437 if (!hci_devcd_enabled(hdev)) 438 return -EOPNOTSUPP; 439 440 skb = alloc_skb(sizeof(dump_size), GFP_ATOMIC); 441 if (!skb) 442 return -ENOMEM; 443 444 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_INIT; 445 put_unaligned_le32(dump_size, skb_put(skb, 4)); 446 447 skb_queue_tail(&hdev->dump.dump_q, skb); 448 queue_work(hdev->workqueue, &hdev->dump.dump_rx); 449 450 return 0; 451 } 452 EXPORT_SYMBOL(hci_devcd_init); 453 454 int hci_devcd_append(struct hci_dev *hdev, struct sk_buff *skb) 455 { 456 if (!skb) 457 return -ENOMEM; 458 459 if (!hci_devcd_enabled(hdev)) { 460 kfree_skb(skb); 461 return -EOPNOTSUPP; 462 } 463 464 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_SKB; 465 466 skb_queue_tail(&hdev->dump.dump_q, skb); 467 queue_work(hdev->workqueue, &hdev->dump.dump_rx); 468 469 return 0; 470 } 471 EXPORT_SYMBOL(hci_devcd_append); 472 473 int hci_devcd_append_pattern(struct hci_dev *hdev, u8 pattern, u32 len) 474 { 475 struct hci_devcoredump_skb_pattern p; 476 struct sk_buff *skb; 477 478 if (!hci_devcd_enabled(hdev)) 479 return -EOPNOTSUPP; 480 481 skb = alloc_skb(sizeof(p), GFP_ATOMIC); 482 if (!skb) 483 return -ENOMEM; 484 485 p.pattern = pattern; 486 p.len = len; 487 488 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_PATTERN; 489 skb_put_data(skb, &p, sizeof(p)); 490 491 skb_queue_tail(&hdev->dump.dump_q, skb); 492 queue_work(hdev->workqueue, &hdev->dump.dump_rx); 493 494 return 0; 495 } 496 EXPORT_SYMBOL(hci_devcd_append_pattern); 497 498 int hci_devcd_complete(struct hci_dev *hdev) 499 { 500 struct sk_buff *skb; 501 502 if (!hci_devcd_enabled(hdev)) 503 return -EOPNOTSUPP; 504 505 skb = alloc_skb(0, GFP_ATOMIC); 506 if (!skb) 507 return -ENOMEM; 508 509 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_COMPLETE; 510 511 skb_queue_tail(&hdev->dump.dump_q, skb); 512 queue_work(hdev->workqueue, &hdev->dump.dump_rx); 513 514 return 0; 515 } 516 EXPORT_SYMBOL(hci_devcd_complete); 517 518 int hci_devcd_abort(struct hci_dev *hdev) 519 { 520 struct sk_buff *skb; 521 522 if (!hci_devcd_enabled(hdev)) 523 return -EOPNOTSUPP; 524 525 skb = alloc_skb(0, GFP_ATOMIC); 526 if (!skb) 527 return -ENOMEM; 528 529 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_ABORT; 530 531 skb_queue_tail(&hdev->dump.dump_q, skb); 532 queue_work(hdev->workqueue, &hdev->dump.dump_rx); 533 534 return 0; 535 } 536 EXPORT_SYMBOL(hci_devcd_abort); 537